xref: /freebsd/sys/net/if_enc.c (revision 7c1b51d6dc2e165ae7333373513b080f17cf79bd)
1 /*-
2  * Copyright (c) 2006 The FreeBSD Project.
3  * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  *
28  * $FreeBSD$
29  */
30 
31 #include "opt_inet.h"
32 #include "opt_inet6.h"
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/hhook.h>
37 #include <sys/kernel.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/module.h>
41 #include <machine/bus.h>
42 #include <sys/rman.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/sysctl.h>
46 
47 #include <net/if.h>
48 #include <net/if_enc.h>
49 #include <net/if_var.h>
50 #include <net/if_clone.h>
51 #include <net/if_types.h>
52 #include <net/pfil.h>
53 #include <net/route.h>
54 #include <net/netisr.h>
55 #include <net/bpf.h>
56 #include <net/vnet.h>
57 
58 #include <netinet/in.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/ip.h>
61 #include <netinet/ip_var.h>
62 #include <netinet/in_var.h>
63 
64 #ifdef INET6
65 #include <netinet/ip6.h>
66 #include <netinet6/ip6_var.h>
67 #endif
68 
69 #include <netipsec/ipsec.h>
70 #include <netipsec/xform.h>
71 
72 #define ENCMTU		(1024+512)
73 
74 /* XXX this define must have the same value as in OpenBSD */
75 #define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
76 #define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
77 #define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
78 
79 struct enchdr {
80 	u_int32_t af;
81 	u_int32_t spi;
82 	u_int32_t flags;
83 };
84 struct enc_softc {
85 	struct	ifnet *sc_ifp;
86 };
87 static VNET_DEFINE(struct enc_softc *, enc_sc);
88 #define	V_enc_sc	VNET(enc_sc)
89 static VNET_DEFINE(struct if_clone *, enc_cloner);
90 #define	V_enc_cloner	VNET(enc_cloner)
91 
92 static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
93 static int	enc_output(struct ifnet *, struct mbuf *,
94     const struct sockaddr *, struct route *);
95 static int	enc_clone_create(struct if_clone *, int, caddr_t);
96 static void	enc_clone_destroy(struct ifnet *);
97 static int	enc_add_hhooks(struct enc_softc *);
98 static void	enc_remove_hhooks(struct enc_softc *);
99 
100 static const char encname[] = "enc";
101 
102 #define	IPSEC_ENC_AFTER_PFIL	0x04
103 /*
104  * Before and after are relative to when we are stripping the
105  * outer IP header.
106  *
107  * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
108  * after PFIL hook execution. It might be useful when PFIL hook does
109  * some changes to the packet, e.g. address translation. If PFIL hook
110  * consumes mbuf, nothing will be captured.
111  */
112 static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
113 static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
114 static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
115 static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
116 #define	V_filter_mask_in	VNET(filter_mask_in)
117 #define	V_bpf_mask_in		VNET(bpf_mask_in)
118 #define	V_filter_mask_out	VNET(filter_mask_out)
119 #define	V_bpf_mask_out		VNET(bpf_mask_out)
120 
121 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
122 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
123 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
124 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
125     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
126     "IPsec input firewall filter mask");
127 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
128     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
129     "IPsec input bpf mask");
130 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
131     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
132     "IPsec output firewall filter mask");
133 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
134     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
135     "IPsec output bpf mask");
136 
137 static void
138 enc_clone_destroy(struct ifnet *ifp)
139 {
140 	struct enc_softc *sc;
141 
142 	sc = ifp->if_softc;
143 	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
144 
145 	bpfdetach(ifp);
146 	if_detach(ifp);
147 	if_free(ifp);
148 	free(sc, M_DEVBUF);
149 	V_enc_sc = NULL;
150 }
151 
152 static int
153 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
154 {
155 	struct ifnet *ifp;
156 	struct enc_softc *sc;
157 
158 	sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
159 	    M_WAITOK | M_ZERO);
160 	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
161 	if (ifp == NULL) {
162 		free(sc, M_DEVBUF);
163 		return (ENOSPC);
164 	}
165 	if (V_enc_sc != NULL) {
166 		if_free(ifp);
167 		free(sc, M_DEVBUF);
168 		return (EEXIST);
169 	}
170 	V_enc_sc = sc;
171 	if_initname(ifp, encname, unit);
172 	ifp->if_mtu = ENCMTU;
173 	ifp->if_ioctl = enc_ioctl;
174 	ifp->if_output = enc_output;
175 	ifp->if_softc = sc;
176 	if_attach(ifp);
177 	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
178 	return (0);
179 }
180 
181 static int
182 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
183     struct route *ro)
184 {
185 
186 	m_freem(m);
187 	return (0);
188 }
189 
190 static int
191 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
192 {
193 
194 	if (cmd != SIOCSIFFLAGS)
195 		return (EINVAL);
196 	if (ifp->if_flags & IFF_UP)
197 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
198 	else
199 		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
200 	return (0);
201 }
202 
203 static void
204 enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
205     int32_t hhook_type, uint8_t enc, uint8_t af)
206 {
207 	struct enchdr hdr;
208 
209 	if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
210 	    (enc & V_bpf_mask_in) == 0)
211 		return;
212 	else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
213 	    (enc & V_bpf_mask_out) == 0)
214 		return;
215 	if (bpf_peers_present(ifp->if_bpf) == 0)
216 		return;
217 	hdr.af = af;
218 	hdr.spi = sav->spi;
219 	hdr.flags = 0;
220 	if (sav->alg_enc != SADB_EALG_NONE)
221 		hdr.flags |= M_CONF;
222 	if (sav->alg_auth != SADB_AALG_NONE)
223 		hdr.flags |= M_AUTH;
224 	bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
225 }
226 
227 /*
228  * One helper hook function is used by any hook points.
229  * + from hhook_type we can determine the packet direction:
230  *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
231  * + from hhook_id we can determine address family: AF_INET or AF_INET6;
232  * + udata contains pointer to enc_softc;
233  * + ctx_data contains pointer to struct ipsec_ctx_data.
234  */
235 static int
236 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
237     void *hdata, struct osd *hosd)
238 {
239 	struct ipsec_ctx_data *ctx;
240 	struct enc_softc *sc;
241 	struct ifnet *ifp, *rcvif;
242 	struct pfil_head *ph;
243 	int pdir;
244 
245 	sc = (struct enc_softc *)udata;
246 	ifp = sc->sc_ifp;
247 	if ((ifp->if_flags & IFF_UP) == 0)
248 		return (0);
249 
250 	ctx = (struct ipsec_ctx_data *)ctx_data;
251 	/* XXX: wrong hook point was used by caller? */
252 	if (ctx->af != hhook_id)
253 		return (EPFNOSUPPORT);
254 
255 	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
256 	switch (hhook_type) {
257 	case HHOOK_TYPE_IPSEC_IN:
258 		if (ctx->enc == IPSEC_ENC_BEFORE) {
259 			/* Do accounting only once */
260 			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
261 			if_inc_counter(ifp, IFCOUNTER_IBYTES,
262 			    (*ctx->mp)->m_pkthdr.len);
263 		}
264 		if ((ctx->enc & V_filter_mask_in) == 0)
265 			return (0); /* skip pfil processing */
266 		pdir = PFIL_IN;
267 		break;
268 	case HHOOK_TYPE_IPSEC_OUT:
269 		if (ctx->enc == IPSEC_ENC_BEFORE) {
270 			/* Do accounting only once */
271 			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
272 			if_inc_counter(ifp, IFCOUNTER_OBYTES,
273 			    (*ctx->mp)->m_pkthdr.len);
274 		}
275 		if ((ctx->enc & V_filter_mask_out) == 0)
276 			return (0); /* skip pfil processing */
277 		pdir = PFIL_OUT;
278 		break;
279 	default:
280 		return (EINVAL);
281 	}
282 
283 	switch (hhook_id) {
284 #ifdef INET
285 	case AF_INET:
286 		ph = &V_inet_pfil_hook;
287 		break;
288 #endif
289 #ifdef INET6
290 	case AF_INET6:
291 		ph = &V_inet6_pfil_hook;
292 		break;
293 #endif
294 	default:
295 		ph = NULL;
296 	}
297 	if (ph == NULL || !PFIL_HOOKED(ph))
298 		return (0);
299 	/* Make a packet looks like it was received on enc(4) */
300 	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
301 	(*ctx->mp)->m_pkthdr.rcvif = ifp;
302 	if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, ctx->inp) != 0 ||
303 	    *ctx->mp == NULL) {
304 		*ctx->mp = NULL; /* consumed by filter */
305 		return (EACCES);
306 	}
307 	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
308 	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
309 	    IPSEC_ENC_AFTER_PFIL, ctx->af);
310 	return (0);
311 }
312 
313 static int
314 enc_add_hhooks(struct enc_softc *sc)
315 {
316 	struct hookinfo hki;
317 	int error;
318 
319 	error = EPFNOSUPPORT;
320 	hki.hook_func = enc_hhook;
321 	hki.hook_helper = NULL;
322 	hki.hook_udata = sc;
323 #ifdef INET
324 	hki.hook_id = AF_INET;
325 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
326 	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
327 	    &hki, HHOOK_WAITOK);
328 	if (error != 0)
329 		return (error);
330 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
331 	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
332 	    &hki, HHOOK_WAITOK);
333 	if (error != 0)
334 		return (error);
335 #endif
336 #ifdef INET6
337 	hki.hook_id = AF_INET6;
338 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
339 	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
340 	    &hki, HHOOK_WAITOK);
341 	if (error != 0)
342 		return (error);
343 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
344 	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
345 	    &hki, HHOOK_WAITOK);
346 	if (error != 0)
347 		return (error);
348 #endif
349 	return (error);
350 }
351 
352 static void
353 enc_remove_hhooks(struct enc_softc *sc)
354 {
355 	struct hookinfo hki;
356 
357 	hki.hook_func = enc_hhook;
358 	hki.hook_helper = NULL;
359 	hki.hook_udata = sc;
360 #ifdef INET
361 	hki.hook_id = AF_INET;
362 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
363 	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
364 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
365 	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
366 #endif
367 #ifdef INET6
368 	hki.hook_id = AF_INET6;
369 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
370 	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
371 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
372 	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
373 #endif
374 }
375 
376 static void
377 vnet_enc_init(const void *unused __unused)
378 {
379 
380 	V_enc_sc = NULL;
381 	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
382 	    enc_clone_destroy, 1);
383 }
384 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
385     vnet_enc_init, NULL);
386 
387 static void
388 vnet_enc_init_proto(void *unused __unused)
389 {
390 	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
391 
392 	if (enc_add_hhooks(V_enc_sc) != 0)
393 		enc_clone_destroy(V_enc_sc->sc_ifp);
394 }
395 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
396     vnet_enc_init_proto, NULL);
397 
398 static void
399 vnet_enc_uninit(const void *unused __unused)
400 {
401 	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
402 
403 	if_clone_detach(V_enc_cloner);
404 }
405 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
406     vnet_enc_uninit, NULL);
407 
408 /*
409  * The hhook consumer needs to go before ip[6]_destroy are called on
410  * SI_ORDER_THIRD.
411  */
412 static void
413 vnet_enc_uninit_hhook(const void *unused __unused)
414 {
415 	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
416 
417 	enc_remove_hhooks(V_enc_sc);
418 }
419 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
420     vnet_enc_uninit_hhook, NULL);
421 
422 static int
423 enc_modevent(module_t mod, int type, void *data)
424 {
425 
426 	switch (type) {
427 	case MOD_LOAD:
428 	case MOD_UNLOAD:
429 		break;
430 	default:
431 		return (EOPNOTSUPP);
432 	}
433 	return (0);
434 }
435 
436 static moduledata_t enc_mod = {
437 	"if_enc",
438 	enc_modevent,
439 	0
440 };
441 
442 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
443 MODULE_VERSION(if_enc, 1);
444