xref: /freebsd/sys/net/if_enc.c (revision 195ebc7e9e4b129de810833791a19dfb4349d6a9)
1 /*-
2  * Copyright (c) 2006 The FreeBSD Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  * $FreeBSD$
28  */
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/malloc.h>
34 #include <sys/mbuf.h>
35 #include <sys/module.h>
36 #include <machine/bus.h>
37 #include <sys/rman.h>
38 #include <sys/socket.h>
39 #include <sys/sockio.h>
40 #include <sys/sysctl.h>
41 
42 #include <net/if.h>
43 #include <net/if_clone.h>
44 #include <net/if_types.h>
45 #include <net/pfil.h>
46 #include <net/route.h>
47 #include <net/netisr.h>
48 #include <net/bpf.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #include <netinet/in_var.h>
55 #include "opt_inet6.h"
56 
57 #ifdef INET6
58 #include <netinet/ip6.h>
59 #include <netinet6/ip6_var.h>
60 #endif
61 
62 #include "opt_enc.h"
63 #include <netipsec/ipsec.h>
64 #include <netipsec/xform.h>
65 
66 #define ENCMTU		(1024+512)
67 
68 /* XXX this define must have the same value as in OpenBSD */
69 #define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
70 #define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
71 #define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
72 
73 struct enchdr {
74 	u_int32_t af;
75 	u_int32_t spi;
76 	u_int32_t flags;
77 };
78 
79 struct ifnet	*encif;
80 static struct mtx	enc_mtx;
81 
82 struct enc_softc {
83 	struct	ifnet *sc_ifp;
84 };
85 
86 static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
87 static int	enc_output(struct ifnet *ifp, struct mbuf *m,
88 		    struct sockaddr *dst, struct route *ro);
89 static int	enc_clone_create(struct if_clone *, int, caddr_t);
90 static void	enc_clone_destroy(struct ifnet *);
91 
92 IFC_SIMPLE_DECLARE(enc, 1);
93 
94 /*
95  * Sysctls.
96  */
97 
98 /*
99  * Before and after are relative to when we are stripping the
100  * outer IP header.
101  */
102 SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
103 
104 SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
105 static int ipsec_filter_mask_in = ENC_BEFORE;
106 SYSCTL_XINT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
107 	&ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
108 static int ipsec_bpf_mask_in = ENC_BEFORE;
109 SYSCTL_XINT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
110 	&ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
111 
112 SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
113 static int ipsec_filter_mask_out = ENC_BEFORE;
114 SYSCTL_XINT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
115 	&ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
116 static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
117 SYSCTL_XINT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
118 	&ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
119 
120 static void
121 enc_clone_destroy(struct ifnet *ifp)
122 {
123 	KASSERT(ifp != encif, ("%s: destroying encif", __func__));
124 
125 	bpfdetach(ifp);
126 	if_detach(ifp);
127 	if_free(ifp);
128 }
129 
130 static int
131 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
132 {
133 	struct ifnet *ifp;
134 	struct enc_softc *sc;
135 
136 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
137 	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
138 	if (ifp == NULL) {
139 		free(sc, M_DEVBUF);
140 		return (ENOSPC);
141 	}
142 
143 	if_initname(ifp, ifc->ifc_name, unit);
144 	ifp->if_mtu = ENCMTU;
145 	ifp->if_ioctl = enc_ioctl;
146 	ifp->if_output = enc_output;
147 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
148 	ifp->if_softc = sc;
149 	if_attach(ifp);
150 	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
151 
152 	mtx_lock(&enc_mtx);
153 	/* grab a pointer to enc0, ignore the rest */
154 	if (encif == NULL)
155 		encif = ifp;
156 	mtx_unlock(&enc_mtx);
157 
158 	return (0);
159 }
160 
161 static int
162 enc_modevent(module_t mod, int type, void *data)
163 {
164 	switch (type) {
165 	case MOD_LOAD:
166 		mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
167 		if_clone_attach(&enc_cloner);
168 		break;
169 	case MOD_UNLOAD:
170 		printf("enc module unload - not possible for this module\n");
171 		return (EINVAL);
172 	default:
173 		return (EOPNOTSUPP);
174 	}
175 	return (0);
176 }
177 
178 static moduledata_t enc_mod = {
179 	"enc",
180 	enc_modevent,
181 	0
182 };
183 
184 DECLARE_MODULE(enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
185 
186 static int
187 enc_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
188     struct route *ro)
189 {
190 	m_freem(m);
191 	return (0);
192 }
193 
194 /*
195  * Process an ioctl request.
196  */
197 /* ARGSUSED */
198 static int
199 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
200 {
201 	int error = 0;
202 
203 	mtx_lock(&enc_mtx);
204 
205 	switch (cmd) {
206 
207 	case SIOCSIFFLAGS:
208 		if (ifp->if_flags & IFF_UP)
209 			ifp->if_drv_flags |= IFF_DRV_RUNNING;
210 		else
211 			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
212 
213 		break;
214 
215 	default:
216 		error = EINVAL;
217 	}
218 
219 	mtx_unlock(&enc_mtx);
220 	return (error);
221 }
222 
223 int
224 ipsec_filter(struct mbuf **mp, int dir, int flags)
225 {
226 	int error, i;
227 	struct ip *ip;
228 
229 	KASSERT(encif != NULL, ("%s: encif is null", __func__));
230 	KASSERT(flags & (ENC_IN|ENC_OUT),
231 		("%s: invalid flags: %04x", __func__, flags));
232 
233 	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
234 		return (0);
235 
236 	if (flags & ENC_IN) {
237 		if ((flags & ipsec_filter_mask_in) == 0)
238 			return (0);
239 	} else {
240 		if ((flags & ipsec_filter_mask_out) == 0)
241 			return (0);
242 	}
243 
244 	/* Skip pfil(9) if no filters are loaded */
245 	if (!(PFIL_HOOKED(&inet_pfil_hook)
246 #ifdef INET6
247 	    || PFIL_HOOKED(&inet6_pfil_hook)
248 #endif
249 	    )) {
250 		return (0);
251 	}
252 
253 	i = min((*mp)->m_pkthdr.len, max_protohdr);
254 	if ((*mp)->m_len < i) {
255 		*mp = m_pullup(*mp, i);
256 		if (*mp == NULL) {
257 			printf("%s: m_pullup failed\n", __func__);
258 			return (-1);
259 		}
260 	}
261 
262 	error = 0;
263 	ip = mtod(*mp, struct ip *);
264 	switch (ip->ip_v) {
265 		case 4:
266 			/*
267 			 * before calling the firewall, swap fields the same as
268 			 * IP does. here we assume the header is contiguous
269 			 */
270 			ip->ip_len = ntohs(ip->ip_len);
271 			ip->ip_off = ntohs(ip->ip_off);
272 
273 			error = pfil_run_hooks(&inet_pfil_hook, mp,
274 			    encif, dir, NULL);
275 
276 			if (*mp == NULL || error != 0)
277 				break;
278 
279 			/* restore byte ordering */
280 			ip = mtod(*mp, struct ip *);
281 			ip->ip_len = htons(ip->ip_len);
282 			ip->ip_off = htons(ip->ip_off);
283 			break;
284 
285 #ifdef INET6
286 		case 6:
287 			error = pfil_run_hooks(&inet6_pfil_hook, mp,
288 			    encif, dir, NULL);
289 			break;
290 #endif
291 		default:
292 			printf("%s: unknown IP version\n", __func__);
293 	}
294 
295 	/*
296 	 * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
297 	 * then error will be zero but we still want to return an error to our
298 	 * caller so the null mbuf isn't forwarded further.
299 	 */
300 	if (*mp == NULL && error == 0)
301 		return (-1);	/* Consumed by the filter */
302 	if (*mp == NULL)
303 		return (error);
304 	if (error != 0)
305 		goto bad;
306 
307 	return (error);
308 
309 bad:
310 	m_freem(*mp);
311 	*mp = NULL;
312 	return (error);
313 }
314 
315 void
316 ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
317 {
318 	int mflags;
319 	struct enchdr hdr;
320 
321 	KASSERT(encif != NULL, ("%s: encif is null", __func__));
322 	KASSERT(flags & (ENC_IN|ENC_OUT),
323 		("%s: invalid flags: %04x", __func__, flags));
324 
325 	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
326 		return;
327 
328 	if (flags & ENC_IN) {
329 		if ((flags & ipsec_bpf_mask_in) == 0)
330 			return;
331 	} else {
332 		if ((flags & ipsec_bpf_mask_out) == 0)
333 			return;
334 	}
335 
336 	if (bpf_peers_present(encif->if_bpf)) {
337 		mflags = 0;
338 		hdr.spi = 0;
339 		if (!sav) {
340 			struct m_tag *mtag;
341 			mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
342 			if (mtag != NULL) {
343 				struct tdb_ident *tdbi;
344 				tdbi = (struct tdb_ident *) (mtag + 1);
345 				if (tdbi->alg_enc != SADB_EALG_NONE)
346 					mflags |= M_CONF;
347 				if (tdbi->alg_auth != SADB_AALG_NONE)
348 					mflags |= M_AUTH;
349 				hdr.spi = tdbi->spi;
350 			}
351 		} else {
352 			if (sav->alg_enc != SADB_EALG_NONE)
353 				mflags |= M_CONF;
354 			if (sav->alg_auth != SADB_AALG_NONE)
355 				mflags |= M_AUTH;
356 			hdr.spi = sav->spi;
357 		}
358 
359 		/*
360 		 * We need to prepend the address family as a four byte
361 		 * field.  Cons up a dummy header to pacify bpf.  This
362 		 * is safe because bpf will only read from the mbuf
363 		 * (i.e., it won't try to free it or keep a pointer a
364 		 * to it).
365 		 */
366 		hdr.af = af;
367 		/* hdr.spi already set above */
368 		hdr.flags = mflags;
369 
370 		bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
371 	}
372 }
373