xref: /freebsd/sys/net/if_enc.c (revision 5dd76dd0cc19450133aa379ce0ce4a68ae07fb39)
1 /*-
2  * Copyright (c) 2006 The FreeBSD Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  * $FreeBSD$
28  */
29 
30 #include "opt_inet.h"
31 #include "opt_inet6.h"
32 #include "opt_enc.h"
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/kernel.h>
37 #include <sys/malloc.h>
38 #include <sys/mbuf.h>
39 #include <sys/module.h>
40 #include <machine/bus.h>
41 #include <sys/rman.h>
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
44 #include <sys/sysctl.h>
45 
46 #include <net/if.h>
47 #include <net/if_var.h>
48 #include <net/if_clone.h>
49 #include <net/if_types.h>
50 #include <net/pfil.h>
51 #include <net/route.h>
52 #include <net/netisr.h>
53 #include <net/bpf.h>
54 #include <net/vnet.h>
55 
56 #include <netinet/in.h>
57 #include <netinet/in_systm.h>
58 #include <netinet/ip.h>
59 #include <netinet/ip_var.h>
60 #include <netinet/in_var.h>
61 
62 #ifdef INET6
63 #include <netinet/ip6.h>
64 #include <netinet6/ip6_var.h>
65 #endif
66 
67 #include <netipsec/ipsec.h>
68 #include <netipsec/xform.h>
69 
70 #define ENCMTU		(1024+512)
71 
72 /* XXX this define must have the same value as in OpenBSD */
73 #define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
74 #define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
75 #define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
76 
77 struct enchdr {
78 	u_int32_t af;
79 	u_int32_t spi;
80 	u_int32_t flags;
81 };
82 
83 struct ifnet	*encif;
84 static struct mtx	enc_mtx;
85 
86 struct enc_softc {
87 	struct	ifnet *sc_ifp;
88 };
89 
90 static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
91 static int	enc_output(struct ifnet *ifp, struct mbuf *m,
92 		    const struct sockaddr *dst, struct route *ro);
93 static int	enc_clone_create(struct if_clone *, int, caddr_t);
94 static void	enc_clone_destroy(struct ifnet *);
95 static struct if_clone *enc_cloner;
96 static const char encname[] = "enc";
97 
98 /*
99  * Sysctls.
100  */
101 
102 /*
103  * Before and after are relative to when we are stripping the
104  * outer IP header.
105  */
106 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
107 
108 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
109 static int ipsec_filter_mask_in = ENC_BEFORE;
110 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
111 	&ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
112 static int ipsec_bpf_mask_in = ENC_BEFORE;
113 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
114 	&ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
115 
116 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
117 static int ipsec_filter_mask_out = ENC_BEFORE;
118 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
119 	&ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
120 static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
121 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
122 	&ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
123 
124 static void
125 enc_clone_destroy(struct ifnet *ifp)
126 {
127 	KASSERT(ifp != encif, ("%s: destroying encif", __func__));
128 
129 	bpfdetach(ifp);
130 	if_detach(ifp);
131 	if_free(ifp);
132 }
133 
134 static int
135 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
136 {
137 	struct ifnet *ifp;
138 	struct enc_softc *sc;
139 
140 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
141 	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
142 	if (ifp == NULL) {
143 		free(sc, M_DEVBUF);
144 		return (ENOSPC);
145 	}
146 
147 	if_initname(ifp, encname, unit);
148 	ifp->if_mtu = ENCMTU;
149 	ifp->if_ioctl = enc_ioctl;
150 	ifp->if_output = enc_output;
151 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
152 	ifp->if_softc = sc;
153 	if_attach(ifp);
154 	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
155 
156 	mtx_lock(&enc_mtx);
157 	/* grab a pointer to enc0, ignore the rest */
158 	if (encif == NULL)
159 		encif = ifp;
160 	mtx_unlock(&enc_mtx);
161 
162 	return (0);
163 }
164 
165 static int
166 enc_modevent(module_t mod, int type, void *data)
167 {
168 	switch (type) {
169 	case MOD_LOAD:
170 		mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
171 		enc_cloner = if_clone_simple(encname, enc_clone_create,
172 		    enc_clone_destroy, 1);
173 		break;
174 	case MOD_UNLOAD:
175 		printf("enc module unload - not possible for this module\n");
176 		return (EINVAL);
177 	default:
178 		return (EOPNOTSUPP);
179 	}
180 	return (0);
181 }
182 
183 static moduledata_t enc_mod = {
184 	"if_enc",
185 	enc_modevent,
186 	0
187 };
188 
189 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
190 
191 static int
192 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
193     struct route *ro)
194 {
195 	m_freem(m);
196 	return (0);
197 }
198 
199 /*
200  * Process an ioctl request.
201  */
202 /* ARGSUSED */
203 static int
204 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
205 {
206 	int error = 0;
207 
208 	mtx_lock(&enc_mtx);
209 
210 	switch (cmd) {
211 
212 	case SIOCSIFFLAGS:
213 		if (ifp->if_flags & IFF_UP)
214 			ifp->if_drv_flags |= IFF_DRV_RUNNING;
215 		else
216 			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
217 
218 		break;
219 
220 	default:
221 		error = EINVAL;
222 	}
223 
224 	mtx_unlock(&enc_mtx);
225 	return (error);
226 }
227 
228 int
229 ipsec_filter(struct mbuf **mp, int dir, int flags)
230 {
231 	int error, i;
232 	struct ip *ip;
233 
234 	KASSERT(encif != NULL, ("%s: encif is null", __func__));
235 	KASSERT(flags & (ENC_IN|ENC_OUT),
236 		("%s: invalid flags: %04x", __func__, flags));
237 
238 	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
239 		return (0);
240 
241 	if (flags & ENC_IN) {
242 		if ((flags & ipsec_filter_mask_in) == 0)
243 			return (0);
244 	} else {
245 		if ((flags & ipsec_filter_mask_out) == 0)
246 			return (0);
247 	}
248 
249 	/* Skip pfil(9) if no filters are loaded */
250 	if (1
251 #ifdef INET
252 	    && !PFIL_HOOKED(&V_inet_pfil_hook)
253 #endif
254 #ifdef INET6
255 	    && !PFIL_HOOKED(&V_inet6_pfil_hook)
256 #endif
257 	    ) {
258 		return (0);
259 	}
260 
261 	i = min((*mp)->m_pkthdr.len, max_protohdr);
262 	if ((*mp)->m_len < i) {
263 		*mp = m_pullup(*mp, i);
264 		if (*mp == NULL) {
265 			printf("%s: m_pullup failed\n", __func__);
266 			return (-1);
267 		}
268 	}
269 
270 	error = 0;
271 	ip = mtod(*mp, struct ip *);
272 	switch (ip->ip_v) {
273 #ifdef INET
274 		case 4:
275 			error = pfil_run_hooks(&V_inet_pfil_hook, mp,
276 			    encif, dir, NULL);
277 			break;
278 #endif
279 #ifdef INET6
280 		case 6:
281 			error = pfil_run_hooks(&V_inet6_pfil_hook, mp,
282 			    encif, dir, NULL);
283 			break;
284 #endif
285 		default:
286 			printf("%s: unknown IP version\n", __func__);
287 	}
288 
289 	/*
290 	 * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
291 	 * then error will be zero but we still want to return an error to our
292 	 * caller so the null mbuf isn't forwarded further.
293 	 */
294 	if (*mp == NULL && error == 0)
295 		return (-1);	/* Consumed by the filter */
296 	if (*mp == NULL)
297 		return (error);
298 	if (error != 0)
299 		goto bad;
300 
301 	return (error);
302 
303 bad:
304 	m_freem(*mp);
305 	*mp = NULL;
306 	return (error);
307 }
308 
309 void
310 ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
311 {
312 	int mflags;
313 	struct enchdr hdr;
314 
315 	KASSERT(encif != NULL, ("%s: encif is null", __func__));
316 	KASSERT(flags & (ENC_IN|ENC_OUT),
317 		("%s: invalid flags: %04x", __func__, flags));
318 
319 	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
320 		return;
321 
322 	if (flags & ENC_IN) {
323 		if ((flags & ipsec_bpf_mask_in) == 0)
324 			return;
325 	} else {
326 		if ((flags & ipsec_bpf_mask_out) == 0)
327 			return;
328 	}
329 
330 	if (bpf_peers_present(encif->if_bpf)) {
331 		mflags = 0;
332 		hdr.spi = 0;
333 		if (!sav) {
334 			struct m_tag *mtag;
335 			mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
336 			if (mtag != NULL) {
337 				struct tdb_ident *tdbi;
338 				tdbi = (struct tdb_ident *) (mtag + 1);
339 				if (tdbi->alg_enc != SADB_EALG_NONE)
340 					mflags |= M_CONF;
341 				if (tdbi->alg_auth != SADB_AALG_NONE)
342 					mflags |= M_AUTH;
343 				hdr.spi = tdbi->spi;
344 			}
345 		} else {
346 			if (sav->alg_enc != SADB_EALG_NONE)
347 				mflags |= M_CONF;
348 			if (sav->alg_auth != SADB_AALG_NONE)
349 				mflags |= M_AUTH;
350 			hdr.spi = sav->spi;
351 		}
352 
353 		/*
354 		 * We need to prepend the address family as a four byte
355 		 * field.  Cons up a dummy header to pacify bpf.  This
356 		 * is safe because bpf will only read from the mbuf
357 		 * (i.e., it won't try to free it or keep a pointer a
358 		 * to it).
359 		 */
360 		hdr.af = af;
361 		/* hdr.spi already set above */
362 		hdr.flags = mflags;
363 
364 		bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
365 	}
366 }
367