xref: /freebsd/sys/net/if_enc.c (revision d3d381b2b194b4d24853e92eecef55f262688d1a)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2006 The FreeBSD Project.
5  * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $FreeBSD$
31  */
32 
33 #include "opt_inet.h"
34 #include "opt_inet6.h"
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/hhook.h>
39 #include <sys/kernel.h>
40 #include <sys/malloc.h>
41 #include <sys/mbuf.h>
42 #include <sys/module.h>
43 #include <machine/bus.h>
44 #include <sys/rman.h>
45 #include <sys/socket.h>
46 #include <sys/sockio.h>
47 #include <sys/sysctl.h>
48 
49 #include <net/if.h>
50 #include <net/if_enc.h>
51 #include <net/if_var.h>
52 #include <net/if_clone.h>
53 #include <net/if_types.h>
54 #include <net/pfil.h>
55 #include <net/route.h>
56 #include <net/netisr.h>
57 #include <net/bpf.h>
58 #include <net/vnet.h>
59 
60 #include <netinet/in.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/ip.h>
63 #include <netinet/ip_var.h>
64 #include <netinet/in_var.h>
65 
66 #ifdef INET6
67 #include <netinet/ip6.h>
68 #include <netinet6/ip6_var.h>
69 #endif
70 
71 #include <netipsec/ipsec.h>
72 #include <netipsec/xform.h>
73 
74 #define ENCMTU		(1024+512)
75 
76 /* XXX this define must have the same value as in OpenBSD */
77 #define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
78 #define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
79 #define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
80 
81 struct enchdr {
82 	u_int32_t af;
83 	u_int32_t spi;
84 	u_int32_t flags;
85 };
86 struct enc_softc {
87 	struct	ifnet *sc_ifp;
88 };
89 VNET_DEFINE_STATIC(struct enc_softc *, enc_sc);
90 #define	V_enc_sc	VNET(enc_sc)
91 VNET_DEFINE_STATIC(struct if_clone *, enc_cloner);
92 #define	V_enc_cloner	VNET(enc_cloner)
93 
94 static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
95 static int	enc_output(struct ifnet *, struct mbuf *,
96     const struct sockaddr *, struct route *);
97 static int	enc_clone_create(struct if_clone *, int, caddr_t);
98 static void	enc_clone_destroy(struct ifnet *);
99 static int	enc_add_hhooks(struct enc_softc *);
100 static void	enc_remove_hhooks(struct enc_softc *);
101 
102 static const char encname[] = "enc";
103 
104 #define	IPSEC_ENC_AFTER_PFIL	0x04
105 /*
106  * Before and after are relative to when we are stripping the
107  * outer IP header.
108  *
109  * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
110  * after PFIL hook execution. It might be useful when PFIL hook does
111  * some changes to the packet, e.g. address translation. If PFIL hook
112  * consumes mbuf, nothing will be captured.
113  */
114 VNET_DEFINE_STATIC(int, filter_mask_in) = IPSEC_ENC_BEFORE;
115 VNET_DEFINE_STATIC(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
116 VNET_DEFINE_STATIC(int, filter_mask_out) = IPSEC_ENC_BEFORE;
117 VNET_DEFINE_STATIC(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
118 #define	V_filter_mask_in	VNET(filter_mask_in)
119 #define	V_bpf_mask_in		VNET(bpf_mask_in)
120 #define	V_filter_mask_out	VNET(filter_mask_out)
121 #define	V_bpf_mask_out		VNET(bpf_mask_out)
122 
123 static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
124 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
125 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
126 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
127     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
128     "IPsec input firewall filter mask");
129 SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
130     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
131     "IPsec input bpf mask");
132 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
133     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
134     "IPsec output firewall filter mask");
135 SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
136     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
137     "IPsec output bpf mask");
138 
139 static void
140 enc_clone_destroy(struct ifnet *ifp)
141 {
142 	struct enc_softc *sc;
143 
144 	sc = ifp->if_softc;
145 	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
146 
147 	bpfdetach(ifp);
148 	if_detach(ifp);
149 	if_free(ifp);
150 	free(sc, M_DEVBUF);
151 	V_enc_sc = NULL;
152 }
153 
154 static int
155 enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
156 {
157 	struct ifnet *ifp;
158 	struct enc_softc *sc;
159 
160 	sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
161 	    M_WAITOK | M_ZERO);
162 	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
163 	if (ifp == NULL) {
164 		free(sc, M_DEVBUF);
165 		return (ENOSPC);
166 	}
167 	if (V_enc_sc != NULL) {
168 		if_free(ifp);
169 		free(sc, M_DEVBUF);
170 		return (EEXIST);
171 	}
172 	V_enc_sc = sc;
173 	if_initname(ifp, encname, unit);
174 	ifp->if_mtu = ENCMTU;
175 	ifp->if_ioctl = enc_ioctl;
176 	ifp->if_output = enc_output;
177 	ifp->if_softc = sc;
178 	if_attach(ifp);
179 	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
180 	return (0);
181 }
182 
183 static int
184 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
185     struct route *ro)
186 {
187 
188 	m_freem(m);
189 	return (0);
190 }
191 
192 static int
193 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
194 {
195 
196 	if (cmd != SIOCSIFFLAGS)
197 		return (EINVAL);
198 	if (ifp->if_flags & IFF_UP)
199 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
200 	else
201 		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
202 	return (0);
203 }
204 
205 static void
206 enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
207     int32_t hhook_type, uint8_t enc, uint8_t af)
208 {
209 	struct enchdr hdr;
210 
211 	if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
212 	    (enc & V_bpf_mask_in) == 0)
213 		return;
214 	else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
215 	    (enc & V_bpf_mask_out) == 0)
216 		return;
217 	if (bpf_peers_present(ifp->if_bpf) == 0)
218 		return;
219 	hdr.af = af;
220 	hdr.spi = sav->spi;
221 	hdr.flags = 0;
222 	if (sav->alg_enc != SADB_EALG_NONE)
223 		hdr.flags |= M_CONF;
224 	if (sav->alg_auth != SADB_AALG_NONE)
225 		hdr.flags |= M_AUTH;
226 	bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
227 }
228 
229 /*
230  * One helper hook function is used by any hook points.
231  * + from hhook_type we can determine the packet direction:
232  *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
233  * + from hhook_id we can determine address family: AF_INET or AF_INET6;
234  * + udata contains pointer to enc_softc;
235  * + ctx_data contains pointer to struct ipsec_ctx_data.
236  */
237 static int
238 enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
239     void *hdata, struct osd *hosd)
240 {
241 	struct ipsec_ctx_data *ctx;
242 	struct enc_softc *sc;
243 	struct ifnet *ifp, *rcvif;
244 	struct pfil_head *ph;
245 	int pdir;
246 
247 	sc = (struct enc_softc *)udata;
248 	ifp = sc->sc_ifp;
249 	if ((ifp->if_flags & IFF_UP) == 0)
250 		return (0);
251 
252 	ctx = (struct ipsec_ctx_data *)ctx_data;
253 	/* XXX: wrong hook point was used by caller? */
254 	if (ctx->af != hhook_id)
255 		return (EPFNOSUPPORT);
256 
257 	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
258 	switch (hhook_type) {
259 	case HHOOK_TYPE_IPSEC_IN:
260 		if (ctx->enc == IPSEC_ENC_BEFORE) {
261 			/* Do accounting only once */
262 			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
263 			if_inc_counter(ifp, IFCOUNTER_IBYTES,
264 			    (*ctx->mp)->m_pkthdr.len);
265 		}
266 		if ((ctx->enc & V_filter_mask_in) == 0)
267 			return (0); /* skip pfil processing */
268 		pdir = PFIL_IN;
269 		break;
270 	case HHOOK_TYPE_IPSEC_OUT:
271 		if (ctx->enc == IPSEC_ENC_BEFORE) {
272 			/* Do accounting only once */
273 			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
274 			if_inc_counter(ifp, IFCOUNTER_OBYTES,
275 			    (*ctx->mp)->m_pkthdr.len);
276 		}
277 		if ((ctx->enc & V_filter_mask_out) == 0)
278 			return (0); /* skip pfil processing */
279 		pdir = PFIL_OUT;
280 		break;
281 	default:
282 		return (EINVAL);
283 	}
284 
285 	switch (hhook_id) {
286 #ifdef INET
287 	case AF_INET:
288 		ph = &V_inet_pfil_hook;
289 		break;
290 #endif
291 #ifdef INET6
292 	case AF_INET6:
293 		ph = &V_inet6_pfil_hook;
294 		break;
295 #endif
296 	default:
297 		ph = NULL;
298 	}
299 	if (ph == NULL || !PFIL_HOOKED(ph))
300 		return (0);
301 	/* Make a packet looks like it was received on enc(4) */
302 	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
303 	(*ctx->mp)->m_pkthdr.rcvif = ifp;
304 	if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, 0, ctx->inp) != 0 ||
305 	    *ctx->mp == NULL) {
306 		*ctx->mp = NULL; /* consumed by filter */
307 		return (EACCES);
308 	}
309 	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
310 	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
311 	    IPSEC_ENC_AFTER_PFIL, ctx->af);
312 	return (0);
313 }
314 
315 static int
316 enc_add_hhooks(struct enc_softc *sc)
317 {
318 	struct hookinfo hki;
319 	int error;
320 
321 	error = EPFNOSUPPORT;
322 	hki.hook_func = enc_hhook;
323 	hki.hook_helper = NULL;
324 	hki.hook_udata = sc;
325 #ifdef INET
326 	hki.hook_id = AF_INET;
327 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
328 	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
329 	    &hki, HHOOK_WAITOK);
330 	if (error != 0)
331 		return (error);
332 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
333 	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
334 	    &hki, HHOOK_WAITOK);
335 	if (error != 0)
336 		return (error);
337 #endif
338 #ifdef INET6
339 	hki.hook_id = AF_INET6;
340 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
341 	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
342 	    &hki, HHOOK_WAITOK);
343 	if (error != 0)
344 		return (error);
345 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
346 	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
347 	    &hki, HHOOK_WAITOK);
348 	if (error != 0)
349 		return (error);
350 #endif
351 	return (error);
352 }
353 
354 static void
355 enc_remove_hhooks(struct enc_softc *sc)
356 {
357 	struct hookinfo hki;
358 
359 	hki.hook_func = enc_hhook;
360 	hki.hook_helper = NULL;
361 	hki.hook_udata = sc;
362 #ifdef INET
363 	hki.hook_id = AF_INET;
364 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
365 	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
366 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
367 	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
368 #endif
369 #ifdef INET6
370 	hki.hook_id = AF_INET6;
371 	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
372 	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
373 	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
374 	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
375 #endif
376 }
377 
378 static void
379 vnet_enc_init(const void *unused __unused)
380 {
381 
382 	V_enc_sc = NULL;
383 	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
384 	    enc_clone_destroy, 1);
385 }
386 VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
387     vnet_enc_init, NULL);
388 
389 static void
390 vnet_enc_init_proto(void *unused __unused)
391 {
392 	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
393 
394 	if (enc_add_hhooks(V_enc_sc) != 0)
395 		enc_clone_destroy(V_enc_sc->sc_ifp);
396 }
397 VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
398     vnet_enc_init_proto, NULL);
399 
400 static void
401 vnet_enc_uninit(const void *unused __unused)
402 {
403 	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
404 
405 	if_clone_detach(V_enc_cloner);
406 }
407 VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
408     vnet_enc_uninit, NULL);
409 
410 /*
411  * The hhook consumer needs to go before ip[6]_destroy are called on
412  * SI_ORDER_THIRD.
413  */
414 static void
415 vnet_enc_uninit_hhook(const void *unused __unused)
416 {
417 	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
418 
419 	enc_remove_hhooks(V_enc_sc);
420 }
421 VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
422     vnet_enc_uninit_hhook, NULL);
423 
424 static int
425 enc_modevent(module_t mod, int type, void *data)
426 {
427 
428 	switch (type) {
429 	case MOD_LOAD:
430 	case MOD_UNLOAD:
431 		break;
432 	default:
433 		return (EOPNOTSUPP);
434 	}
435 	return (0);
436 }
437 
438 static moduledata_t enc_mod = {
439 	"if_enc",
440 	enc_modevent,
441 	0
442 };
443 
444 DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
445 MODULE_VERSION(if_enc, 1);
446