1 /*- 2 * Copyright (c) 2016-2018 Yandex LLC 3 * Copyright (c) 2016-2018 Andrey V. Elsukov <ae@FreeBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 #include "opt_inet.h" 32 #include "opt_inet6.h" 33 #include "opt_ipsec.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/kernel.h> 38 #include <sys/fnv_hash.h> 39 #include <sys/jail.h> 40 #include <sys/lock.h> 41 #include <sys/malloc.h> 42 #include <sys/mbuf.h> 43 #include <sys/module.h> 44 #include <sys/socket.h> 45 #include <sys/sockio.h> 46 #include <sys/sx.h> 47 #include <sys/errno.h> 48 #include <sys/sysctl.h> 49 #include <sys/priv.h> 50 #include <sys/proc.h> 51 #include <sys/conf.h> 52 53 #include <net/if.h> 54 #include <net/if_var.h> 55 #include <net/if_clone.h> 56 #include <net/if_types.h> 57 #include <net/bpf.h> 58 #include <net/route.h> 59 #include <net/vnet.h> 60 61 #include <netinet/in.h> 62 #include <netinet/in_var.h> 63 #include <netinet/ip.h> 64 #include <netinet/ip_encap.h> 65 66 #include <netinet/ip6.h> 67 #include <netinet6/in6_var.h> 68 #include <netinet6/scope6_var.h> 69 70 #include <netipsec/ipsec.h> 71 #ifdef INET6 72 #include <netipsec/ipsec6.h> 73 #endif 74 75 #include <net/if_ipsec.h> 76 #include <netipsec/key.h> 77 78 #include <security/mac/mac_framework.h> 79 80 static MALLOC_DEFINE(M_IPSEC, "ipsec", "IPsec Virtual Tunnel Interface"); 81 static const char ipsecname[] = "ipsec"; 82 83 #if defined(INET) && defined(INET6) 84 #define IPSEC_SPCOUNT 4 85 #else 86 #define IPSEC_SPCOUNT 2 87 #endif 88 89 struct ipsec_softc { 90 struct ifnet *ifp; 91 struct secpolicy *sp[IPSEC_SPCOUNT]; 92 uint32_t reqid; 93 u_int family; 94 u_int fibnum; 95 96 CK_LIST_ENTRY(ipsec_softc) idhash; 97 CK_LIST_ENTRY(ipsec_softc) srchash; 98 }; 99 100 #define IPSEC_RLOCK_TRACKER struct epoch_tracker ipsec_et 101 #define IPSEC_RLOCK() epoch_enter_preempt(net_epoch_preempt, &ipsec_et) 102 #define IPSEC_RUNLOCK() epoch_exit_preempt(net_epoch_preempt, &ipsec_et) 103 #define IPSEC_WAIT() epoch_wait_preempt(net_epoch_preempt) 104 105 #ifndef IPSEC_HASH_SIZE 106 #define IPSEC_HASH_SIZE (1 << 5) 107 #endif 108 109 CK_LIST_HEAD(ipsec_iflist, ipsec_softc); 110 VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec_idhtbl) = NULL; 111 #define V_ipsec_idhtbl VNET(ipsec_idhtbl) 112 113 #ifdef INET 114 VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec4_srchtbl) = NULL; 115 #define V_ipsec4_srchtbl VNET(ipsec4_srchtbl) 116 static const struct srcaddrtab *ipsec4_srctab = NULL; 117 #endif 118 119 #ifdef INET6 120 VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec6_srchtbl) = NULL; 121 #define V_ipsec6_srchtbl VNET(ipsec6_srchtbl) 122 static const struct srcaddrtab *ipsec6_srctab = NULL; 123 #endif 124 125 static struct ipsec_iflist * 126 ipsec_idhash(uint32_t id) 127 { 128 129 return (&V_ipsec_idhtbl[fnv_32_buf(&id, sizeof(id), 130 FNV1_32_INIT) & (IPSEC_HASH_SIZE - 1)]); 131 } 132 133 static struct ipsec_iflist * 134 ipsec_srchash(const struct sockaddr *sa) 135 { 136 uint32_t hval; 137 138 switch (sa->sa_family) { 139 #ifdef INET 140 case AF_INET: 141 hval = fnv_32_buf( 142 &((const struct sockaddr_in *)sa)->sin_addr.s_addr, 143 sizeof(in_addr_t), FNV1_32_INIT); 144 return (&V_ipsec4_srchtbl[hval & (IPSEC_HASH_SIZE - 1)]); 145 #endif 146 #ifdef INET6 147 case AF_INET6: 148 hval = fnv_32_buf( 149 &((const struct sockaddr_in6 *)sa)->sin6_addr, 150 sizeof(struct in6_addr), FNV1_32_INIT); 151 return (&V_ipsec6_srchtbl[hval & (IPSEC_HASH_SIZE - 1)]); 152 #endif 153 } 154 return (NULL); 155 } 156 157 /* 158 * ipsec_ioctl_sx protects from concurrent ioctls. 159 */ 160 static struct sx ipsec_ioctl_sx; 161 SX_SYSINIT(ipsec_ioctl_sx, &ipsec_ioctl_sx, "ipsec_ioctl"); 162 163 static int ipsec_init_reqid(struct ipsec_softc *); 164 static int ipsec_set_tunnel(struct ipsec_softc *, struct sockaddr *, 165 struct sockaddr *, uint32_t); 166 static void ipsec_delete_tunnel(struct ipsec_softc *); 167 168 static int ipsec_set_addresses(struct ifnet *, struct sockaddr *, 169 struct sockaddr *); 170 static int ipsec_set_reqid(struct ipsec_softc *, uint32_t); 171 static void ipsec_set_running(struct ipsec_softc *); 172 173 #ifdef VIMAGE 174 static void ipsec_reassign(struct ifnet *, struct vnet *, char *); 175 #endif 176 static void ipsec_srcaddr(void *, const struct sockaddr *, int); 177 static int ipsec_ioctl(struct ifnet *, u_long, caddr_t); 178 static int ipsec_transmit(struct ifnet *, struct mbuf *); 179 static int ipsec_output(struct ifnet *, struct mbuf *, 180 const struct sockaddr *, struct route *); 181 static void ipsec_qflush(struct ifnet *); 182 static int ipsec_clone_create(struct if_clone *, int, caddr_t); 183 static void ipsec_clone_destroy(struct ifnet *); 184 185 VNET_DEFINE_STATIC(struct if_clone *, ipsec_cloner); 186 #define V_ipsec_cloner VNET(ipsec_cloner) 187 188 static int 189 ipsec_clone_create(struct if_clone *ifc, int unit, caddr_t params) 190 { 191 struct ipsec_softc *sc; 192 struct ifnet *ifp; 193 194 sc = malloc(sizeof(*sc), M_IPSEC, M_WAITOK | M_ZERO); 195 sc->fibnum = curthread->td_proc->p_fibnum; 196 sc->ifp = ifp = if_alloc(IFT_TUNNEL); 197 ifp->if_softc = sc; 198 if_initname(ifp, ipsecname, unit); 199 200 ifp->if_addrlen = 0; 201 ifp->if_mtu = IPSEC_MTU; 202 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST; 203 ifp->if_ioctl = ipsec_ioctl; 204 ifp->if_transmit = ipsec_transmit; 205 ifp->if_qflush = ipsec_qflush; 206 ifp->if_output = ipsec_output; 207 #ifdef VIMAGE 208 ifp->if_reassign = ipsec_reassign; 209 #endif 210 if_attach(ifp); 211 bpfattach(ifp, DLT_NULL, sizeof(uint32_t)); 212 213 return (0); 214 } 215 216 #ifdef VIMAGE 217 static void 218 ipsec_reassign(struct ifnet *ifp, struct vnet *new_vnet __unused, 219 char *unused __unused) 220 { 221 struct ipsec_softc *sc; 222 223 sx_xlock(&ipsec_ioctl_sx); 224 sc = ifp->if_softc; 225 if (sc != NULL) 226 ipsec_delete_tunnel(sc); 227 sx_xunlock(&ipsec_ioctl_sx); 228 } 229 #endif /* VIMAGE */ 230 231 static void 232 ipsec_clone_destroy(struct ifnet *ifp) 233 { 234 struct ipsec_softc *sc; 235 236 sx_xlock(&ipsec_ioctl_sx); 237 sc = ifp->if_softc; 238 ipsec_delete_tunnel(sc); 239 /* 240 * Delete softc from idhash on interface destroy, since 241 * ipsec_delete_tunnel() keeps reqid unchanged. 242 */ 243 if (sc->reqid != 0) 244 CK_LIST_REMOVE(sc, idhash); 245 bpfdetach(ifp); 246 if_detach(ifp); 247 ifp->if_softc = NULL; 248 sx_xunlock(&ipsec_ioctl_sx); 249 250 IPSEC_WAIT(); 251 if_free(ifp); 252 free(sc, M_IPSEC); 253 } 254 255 static struct ipsec_iflist * 256 ipsec_hashinit(void) 257 { 258 struct ipsec_iflist *hash; 259 int i; 260 261 hash = malloc(sizeof(struct ipsec_iflist) * IPSEC_HASH_SIZE, 262 M_IPSEC, M_WAITOK); 263 for (i = 0; i < IPSEC_HASH_SIZE; i++) 264 CK_LIST_INIT(&hash[i]); 265 266 return (hash); 267 } 268 269 static void 270 vnet_ipsec_init(const void *unused __unused) 271 { 272 273 V_ipsec_idhtbl = ipsec_hashinit(); 274 #ifdef INET 275 V_ipsec4_srchtbl = ipsec_hashinit(); 276 if (IS_DEFAULT_VNET(curvnet)) 277 ipsec4_srctab = ip_encap_register_srcaddr(ipsec_srcaddr, 278 NULL, M_WAITOK); 279 #endif 280 #ifdef INET6 281 V_ipsec6_srchtbl = ipsec_hashinit(); 282 if (IS_DEFAULT_VNET(curvnet)) 283 ipsec6_srctab = ip6_encap_register_srcaddr(ipsec_srcaddr, 284 NULL, M_WAITOK); 285 #endif 286 V_ipsec_cloner = if_clone_simple(ipsecname, ipsec_clone_create, 287 ipsec_clone_destroy, 0); 288 } 289 VNET_SYSINIT(vnet_ipsec_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY, 290 vnet_ipsec_init, NULL); 291 292 static void 293 vnet_ipsec_uninit(const void *unused __unused) 294 { 295 296 if_clone_detach(V_ipsec_cloner); 297 free(V_ipsec_idhtbl, M_IPSEC); 298 /* 299 * Use V_ipsec_idhtbl pointer as indicator that VNET is going to be 300 * destroyed, it is used by ipsec_srcaddr() callback. 301 */ 302 V_ipsec_idhtbl = NULL; 303 IPSEC_WAIT(); 304 305 #ifdef INET 306 if (IS_DEFAULT_VNET(curvnet)) 307 ip_encap_unregister_srcaddr(ipsec4_srctab); 308 free(V_ipsec4_srchtbl, M_IPSEC); 309 #endif 310 #ifdef INET6 311 if (IS_DEFAULT_VNET(curvnet)) 312 ip6_encap_unregister_srcaddr(ipsec6_srctab); 313 free(V_ipsec6_srchtbl, M_IPSEC); 314 #endif 315 } 316 VNET_SYSUNINIT(vnet_ipsec_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY, 317 vnet_ipsec_uninit, NULL); 318 319 static struct secpolicy * 320 ipsec_getpolicy(struct ipsec_softc *sc, int dir, sa_family_t af) 321 { 322 323 switch (af) { 324 #ifdef INET 325 case AF_INET: 326 return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1)]); 327 #endif 328 #ifdef INET6 329 case AF_INET6: 330 return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1) 331 #ifdef INET 332 + 2 333 #endif 334 ]); 335 #endif 336 } 337 return (NULL); 338 } 339 340 static struct secasindex * 341 ipsec_getsaidx(struct ipsec_softc *sc, int dir, sa_family_t af) 342 { 343 struct secpolicy *sp; 344 345 sp = ipsec_getpolicy(sc, dir, af); 346 if (sp == NULL) 347 return (NULL); 348 return (&sp->req[0]->saidx); 349 } 350 351 static int 352 ipsec_transmit(struct ifnet *ifp, struct mbuf *m) 353 { 354 IPSEC_RLOCK_TRACKER; 355 struct ipsec_softc *sc; 356 struct secpolicy *sp; 357 struct ip *ip; 358 uint32_t af; 359 int error; 360 361 IPSEC_RLOCK(); 362 #ifdef MAC 363 error = mac_ifnet_check_transmit(ifp, m); 364 if (error) { 365 m_freem(m); 366 goto err; 367 } 368 #endif 369 error = ENETDOWN; 370 sc = ifp->if_softc; 371 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || 372 (ifp->if_flags & IFF_MONITOR) != 0 || 373 (ifp->if_flags & IFF_UP) == 0 || sc->family == 0) { 374 m_freem(m); 375 goto err; 376 } 377 378 /* Determine address family to correctly handle packet in BPF */ 379 ip = mtod(m, struct ip *); 380 switch (ip->ip_v) { 381 #ifdef INET 382 case IPVERSION: 383 af = AF_INET; 384 break; 385 #endif 386 #ifdef INET6 387 case (IPV6_VERSION >> 4): 388 af = AF_INET6; 389 break; 390 #endif 391 default: 392 error = EAFNOSUPPORT; 393 m_freem(m); 394 goto err; 395 } 396 397 /* 398 * Loop prevention. 399 * XXX: for now just check presence of IPSEC_OUT_DONE mbuf tag. 400 * We can read full chain and compare destination address, 401 * proto and mode from xform_history with values from softc. 402 */ 403 if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL) { 404 m_freem(m); 405 goto err; 406 } 407 408 sp = ipsec_getpolicy(sc, IPSEC_DIR_OUTBOUND, af); 409 key_addref(sp); 410 M_SETFIB(m, sc->fibnum); 411 412 BPF_MTAP2(ifp, &af, sizeof(af), m); 413 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); 414 if_inc_counter(ifp, IFCOUNTER_OBYTES, m->m_pkthdr.len); 415 416 switch (af) { 417 #ifdef INET 418 case AF_INET: 419 error = ipsec4_process_packet(m, sp, NULL); 420 break; 421 #endif 422 #ifdef INET6 423 case AF_INET6: 424 error = ipsec6_process_packet(m, sp, NULL); 425 break; 426 #endif 427 default: 428 panic("%s: unknown address family\n", __func__); 429 } 430 err: 431 if (error != 0) 432 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 433 IPSEC_RUNLOCK(); 434 return (error); 435 } 436 437 static void 438 ipsec_qflush(struct ifnet *ifp __unused) 439 { 440 441 } 442 443 static int 444 ipsec_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 445 struct route *ro) 446 { 447 448 return (ifp->if_transmit(ifp, m)); 449 } 450 451 int 452 ipsec_if_input(struct mbuf *m, struct secasvar *sav, uint32_t af) 453 { 454 IPSEC_RLOCK_TRACKER; 455 struct secasindex *saidx; 456 struct ipsec_softc *sc; 457 struct ifnet *ifp; 458 459 if (sav->state != SADB_SASTATE_MATURE && 460 sav->state != SADB_SASTATE_DYING) { 461 m_freem(m); 462 return (ENETDOWN); 463 } 464 465 if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL || 466 sav->sah->saidx.proto != IPPROTO_ESP) 467 return (0); 468 469 IPSEC_RLOCK(); 470 CK_LIST_FOREACH(sc, ipsec_idhash(sav->sah->saidx.reqid), idhash) { 471 if (sc->family == 0) 472 continue; 473 saidx = ipsec_getsaidx(sc, IPSEC_DIR_INBOUND, 474 sav->sah->saidx.src.sa.sa_family); 475 /* SA's reqid should match reqid in SP */ 476 if (saidx == NULL || 477 sav->sah->saidx.reqid != saidx->reqid) 478 continue; 479 /* SAH's addresses should match tunnel endpoints. */ 480 if (key_sockaddrcmp(&sav->sah->saidx.dst.sa, 481 &saidx->dst.sa, 0) != 0) 482 continue; 483 if (key_sockaddrcmp(&sav->sah->saidx.src.sa, 484 &saidx->src.sa, 0) == 0) 485 break; 486 } 487 if (sc == NULL) { 488 IPSEC_RUNLOCK(); 489 /* Tunnel was not found. Nothing to do. */ 490 return (0); 491 } 492 ifp = sc->ifp; 493 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || 494 (ifp->if_flags & IFF_UP) == 0) { 495 IPSEC_RUNLOCK(); 496 m_freem(m); 497 return (ENETDOWN); 498 } 499 /* 500 * We found matching and working tunnel. 501 * Set its ifnet as receiving interface. 502 */ 503 m->m_pkthdr.rcvif = ifp; 504 505 m_clrprotoflags(m); 506 M_SETFIB(m, ifp->if_fib); 507 BPF_MTAP2(ifp, &af, sizeof(af), m); 508 if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1); 509 if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len); 510 if ((ifp->if_flags & IFF_MONITOR) != 0) { 511 IPSEC_RUNLOCK(); 512 m_freem(m); 513 return (ENETDOWN); 514 } 515 IPSEC_RUNLOCK(); 516 return (0); 517 } 518 519 static int 520 ipsec_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 521 { 522 struct ifreq *ifr = (struct ifreq*)data; 523 struct sockaddr *dst, *src; 524 struct ipsec_softc *sc; 525 struct secasindex *saidx; 526 #ifdef INET 527 struct sockaddr_in *sin = NULL; 528 #endif 529 #ifdef INET6 530 struct sockaddr_in6 *sin6 = NULL; 531 #endif 532 uint32_t reqid; 533 int error; 534 535 switch (cmd) { 536 case SIOCSIFADDR: 537 ifp->if_flags |= IFF_UP; 538 case SIOCADDMULTI: 539 case SIOCDELMULTI: 540 case SIOCGIFMTU: 541 case SIOCSIFFLAGS: 542 return (0); 543 case SIOCSIFMTU: 544 if (ifr->ifr_mtu < IPSEC_MTU_MIN || 545 ifr->ifr_mtu > IPSEC_MTU_MAX) 546 return (EINVAL); 547 else 548 ifp->if_mtu = ifr->ifr_mtu; 549 return (0); 550 } 551 sx_xlock(&ipsec_ioctl_sx); 552 sc = ifp->if_softc; 553 /* Check that softc is still here */ 554 if (sc == NULL) { 555 error = ENXIO; 556 goto bad; 557 } 558 error = 0; 559 switch (cmd) { 560 case SIOCSIFPHYADDR: 561 #ifdef INET6 562 case SIOCSIFPHYADDR_IN6: 563 #endif 564 error = EINVAL; 565 switch (cmd) { 566 #ifdef INET 567 case SIOCSIFPHYADDR: 568 src = (struct sockaddr *) 569 &(((struct in_aliasreq *)data)->ifra_addr); 570 dst = (struct sockaddr *) 571 &(((struct in_aliasreq *)data)->ifra_dstaddr); 572 break; 573 #endif 574 #ifdef INET6 575 case SIOCSIFPHYADDR_IN6: 576 src = (struct sockaddr *) 577 &(((struct in6_aliasreq *)data)->ifra_addr); 578 dst = (struct sockaddr *) 579 &(((struct in6_aliasreq *)data)->ifra_dstaddr); 580 break; 581 #endif 582 default: 583 goto bad; 584 } 585 /* sa_family must be equal */ 586 if (src->sa_family != dst->sa_family || 587 src->sa_len != dst->sa_len) 588 goto bad; 589 590 /* validate sa_len */ 591 switch (src->sa_family) { 592 #ifdef INET 593 case AF_INET: 594 if (src->sa_len != sizeof(struct sockaddr_in)) 595 goto bad; 596 break; 597 #endif 598 #ifdef INET6 599 case AF_INET6: 600 if (src->sa_len != sizeof(struct sockaddr_in6)) 601 goto bad; 602 break; 603 #endif 604 default: 605 error = EAFNOSUPPORT; 606 goto bad; 607 } 608 /* check sa_family looks sane for the cmd */ 609 error = EAFNOSUPPORT; 610 switch (cmd) { 611 #ifdef INET 612 case SIOCSIFPHYADDR: 613 if (src->sa_family == AF_INET) 614 break; 615 goto bad; 616 #endif 617 #ifdef INET6 618 case SIOCSIFPHYADDR_IN6: 619 if (src->sa_family == AF_INET6) 620 break; 621 goto bad; 622 #endif 623 } 624 error = EADDRNOTAVAIL; 625 switch (src->sa_family) { 626 #ifdef INET 627 case AF_INET: 628 if (satosin(src)->sin_addr.s_addr == INADDR_ANY || 629 satosin(dst)->sin_addr.s_addr == INADDR_ANY) 630 goto bad; 631 break; 632 #endif 633 #ifdef INET6 634 case AF_INET6: 635 if (IN6_IS_ADDR_UNSPECIFIED( 636 &satosin6(src)->sin6_addr) || 637 IN6_IS_ADDR_UNSPECIFIED( 638 &satosin6(dst)->sin6_addr)) 639 goto bad; 640 /* 641 * Check validity of the scope zone ID of the 642 * addresses, and convert it into the kernel 643 * internal form if necessary. 644 */ 645 error = sa6_embedscope(satosin6(src), 0); 646 if (error != 0) 647 goto bad; 648 error = sa6_embedscope(satosin6(dst), 0); 649 if (error != 0) 650 goto bad; 651 #endif 652 }; 653 error = ipsec_set_addresses(ifp, src, dst); 654 break; 655 case SIOCDIFPHYADDR: 656 ipsec_delete_tunnel(sc); 657 break; 658 case SIOCGIFPSRCADDR: 659 case SIOCGIFPDSTADDR: 660 #ifdef INET6 661 case SIOCGIFPSRCADDR_IN6: 662 case SIOCGIFPDSTADDR_IN6: 663 #endif 664 if (sc->family == 0) { 665 error = EADDRNOTAVAIL; 666 break; 667 } 668 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family); 669 switch (cmd) { 670 #ifdef INET 671 case SIOCGIFPSRCADDR: 672 case SIOCGIFPDSTADDR: 673 if (saidx->src.sa.sa_family != AF_INET) { 674 error = EADDRNOTAVAIL; 675 break; 676 } 677 sin = (struct sockaddr_in *)&ifr->ifr_addr; 678 memset(sin, 0, sizeof(*sin)); 679 sin->sin_family = AF_INET; 680 sin->sin_len = sizeof(*sin); 681 break; 682 #endif 683 #ifdef INET6 684 case SIOCGIFPSRCADDR_IN6: 685 case SIOCGIFPDSTADDR_IN6: 686 if (saidx->src.sa.sa_family != AF_INET6) { 687 error = EADDRNOTAVAIL; 688 break; 689 } 690 sin6 = (struct sockaddr_in6 *) 691 &(((struct in6_ifreq *)data)->ifr_addr); 692 memset(sin6, 0, sizeof(*sin6)); 693 sin6->sin6_family = AF_INET6; 694 sin6->sin6_len = sizeof(*sin6); 695 break; 696 #endif 697 default: 698 error = EAFNOSUPPORT; 699 } 700 if (error == 0) { 701 switch (cmd) { 702 #ifdef INET 703 case SIOCGIFPSRCADDR: 704 sin->sin_addr = saidx->src.sin.sin_addr; 705 break; 706 case SIOCGIFPDSTADDR: 707 sin->sin_addr = saidx->dst.sin.sin_addr; 708 break; 709 #endif 710 #ifdef INET6 711 case SIOCGIFPSRCADDR_IN6: 712 sin6->sin6_addr = saidx->src.sin6.sin6_addr; 713 break; 714 case SIOCGIFPDSTADDR_IN6: 715 sin6->sin6_addr = saidx->dst.sin6.sin6_addr; 716 break; 717 #endif 718 } 719 } 720 if (error != 0) 721 break; 722 switch (cmd) { 723 #ifdef INET 724 case SIOCGIFPSRCADDR: 725 case SIOCGIFPDSTADDR: 726 error = prison_if(curthread->td_ucred, 727 (struct sockaddr *)sin); 728 if (error != 0) 729 memset(sin, 0, sizeof(*sin)); 730 break; 731 #endif 732 #ifdef INET6 733 case SIOCGIFPSRCADDR_IN6: 734 case SIOCGIFPDSTADDR_IN6: 735 error = prison_if(curthread->td_ucred, 736 (struct sockaddr *)sin6); 737 if (error == 0) 738 error = sa6_recoverscope(sin6); 739 if (error != 0) 740 memset(sin6, 0, sizeof(*sin6)); 741 #endif 742 } 743 break; 744 case SIOCGTUNFIB: 745 ifr->ifr_fib = sc->fibnum; 746 break; 747 case SIOCSTUNFIB: 748 if ((error = priv_check(curthread, PRIV_NET_SETIFFIB)) != 0) 749 break; 750 if (ifr->ifr_fib >= rt_numfibs) 751 error = EINVAL; 752 else 753 sc->fibnum = ifr->ifr_fib; 754 break; 755 case IPSECGREQID: 756 reqid = sc->reqid; 757 error = copyout(&reqid, ifr_data_get_ptr(ifr), sizeof(reqid)); 758 break; 759 case IPSECSREQID: 760 if ((error = priv_check(curthread, PRIV_NET_SETIFCAP)) != 0) 761 break; 762 error = copyin(ifr_data_get_ptr(ifr), &reqid, sizeof(reqid)); 763 if (error != 0) 764 break; 765 error = ipsec_set_reqid(sc, reqid); 766 break; 767 default: 768 error = EINVAL; 769 break; 770 } 771 bad: 772 sx_xunlock(&ipsec_ioctl_sx); 773 return (error); 774 } 775 776 /* 777 * Check that ingress address belongs to local host. 778 */ 779 static void 780 ipsec_set_running(struct ipsec_softc *sc) 781 { 782 struct secasindex *saidx; 783 int localip; 784 785 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family); 786 localip = 0; 787 switch (sc->family) { 788 #ifdef INET 789 case AF_INET: 790 localip = in_localip(saidx->src.sin.sin_addr); 791 break; 792 #endif 793 #ifdef INET6 794 case AF_INET6: 795 localip = in6_localip(&saidx->src.sin6.sin6_addr); 796 break; 797 #endif 798 } 799 if (localip != 0) 800 sc->ifp->if_drv_flags |= IFF_DRV_RUNNING; 801 else 802 sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 803 } 804 805 /* 806 * ifaddr_event handler. 807 * Clear IFF_DRV_RUNNING flag when ingress address disappears to prevent 808 * source address spoofing. 809 */ 810 static void 811 ipsec_srcaddr(void *arg __unused, const struct sockaddr *sa, 812 int event __unused) 813 { 814 struct ipsec_softc *sc; 815 struct secasindex *saidx; 816 817 /* Check that VNET is ready */ 818 if (V_ipsec_idhtbl == NULL) 819 return; 820 821 NET_EPOCH_ASSERT(); 822 CK_LIST_FOREACH(sc, ipsec_srchash(sa), srchash) { 823 if (sc->family == 0) 824 continue; 825 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sa->sa_family); 826 if (saidx == NULL || 827 key_sockaddrcmp(&saidx->src.sa, sa, 0) != 0) 828 continue; 829 ipsec_set_running(sc); 830 } 831 } 832 833 /* 834 * Allocate new private security policies for tunneling interface. 835 * Each tunneling interface has following security policies for 836 * both AF: 837 * 0.0.0.0/0[any] 0.0.0.0/0[any] -P in \ 838 * ipsec esp/tunnel/RemoteIP-LocalIP/unique:reqid 839 * 0.0.0.0/0[any] 0.0.0.0/0[any] -P out \ 840 * ipsec esp/tunnel/LocalIP-RemoteIP/unique:reqid 841 */ 842 static int 843 ipsec_newpolicies(struct ipsec_softc *sc, struct secpolicy *sp[IPSEC_SPCOUNT], 844 const struct sockaddr *src, const struct sockaddr *dst, uint32_t reqid) 845 { 846 struct ipsecrequest *isr; 847 int i; 848 849 memset(sp, 0, sizeof(struct secpolicy *) * IPSEC_SPCOUNT); 850 for (i = 0; i < IPSEC_SPCOUNT; i++) { 851 if ((sp[i] = key_newsp()) == NULL) 852 goto fail; 853 if ((isr = ipsec_newisr()) == NULL) 854 goto fail; 855 856 sp[i]->policy = IPSEC_POLICY_IPSEC; 857 sp[i]->state = IPSEC_SPSTATE_DEAD; 858 sp[i]->req[sp[i]->tcount++] = isr; 859 sp[i]->created = time_second; 860 /* Use priority field to store if_index */ 861 sp[i]->priority = sc->ifp->if_index; 862 isr->level = IPSEC_LEVEL_UNIQUE; 863 isr->saidx.proto = IPPROTO_ESP; 864 isr->saidx.mode = IPSEC_MODE_TUNNEL; 865 isr->saidx.reqid = reqid; 866 if (i % 2 == 0) { 867 sp[i]->spidx.dir = IPSEC_DIR_INBOUND; 868 bcopy(src, &isr->saidx.dst, src->sa_len); 869 bcopy(dst, &isr->saidx.src, dst->sa_len); 870 } else { 871 sp[i]->spidx.dir = IPSEC_DIR_OUTBOUND; 872 bcopy(src, &isr->saidx.src, src->sa_len); 873 bcopy(dst, &isr->saidx.dst, dst->sa_len); 874 } 875 sp[i]->spidx.ul_proto = IPSEC_ULPROTO_ANY; 876 #ifdef INET 877 if (i < 2) { 878 sp[i]->spidx.src.sa.sa_family = 879 sp[i]->spidx.dst.sa.sa_family = AF_INET; 880 sp[i]->spidx.src.sa.sa_len = 881 sp[i]->spidx.dst.sa.sa_len = 882 sizeof(struct sockaddr_in); 883 continue; 884 } 885 #endif 886 #ifdef INET6 887 sp[i]->spidx.src.sa.sa_family = 888 sp[i]->spidx.dst.sa.sa_family = AF_INET6; 889 sp[i]->spidx.src.sa.sa_len = 890 sp[i]->spidx.dst.sa.sa_len = sizeof(struct sockaddr_in6); 891 #endif 892 } 893 return (0); 894 fail: 895 for (i = 0; i < IPSEC_SPCOUNT; i++) 896 key_freesp(&sp[i]); 897 return (ENOMEM); 898 } 899 900 static int 901 ipsec_check_reqid(uint32_t reqid) 902 { 903 struct ipsec_softc *sc; 904 905 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 906 CK_LIST_FOREACH(sc, ipsec_idhash(reqid), idhash) { 907 if (sc->reqid == reqid) 908 return (EEXIST); 909 } 910 return (0); 911 } 912 913 /* 914 * We use key_newreqid() to automatically obtain unique reqid. 915 * Then we check that given id is unique, i.e. it is not used by 916 * another if_ipsec(4) interface. This macro limits the number of 917 * tries to get unique id. 918 */ 919 #define IPSEC_REQID_TRYCNT 64 920 static int 921 ipsec_init_reqid(struct ipsec_softc *sc) 922 { 923 uint32_t reqid; 924 int trycount; 925 926 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 927 if (sc->reqid != 0) /* already initialized */ 928 return (0); 929 930 trycount = IPSEC_REQID_TRYCNT; 931 while (--trycount > 0) { 932 reqid = key_newreqid(); 933 if (ipsec_check_reqid(reqid) == 0) 934 break; 935 } 936 if (trycount == 0) 937 return (EEXIST); 938 sc->reqid = reqid; 939 CK_LIST_INSERT_HEAD(ipsec_idhash(reqid), sc, idhash); 940 return (0); 941 } 942 943 /* 944 * Set or update reqid for given tunneling interface. 945 * When specified reqid is zero, generate new one. 946 * We are protected by ioctl_sx lock from concurrent id generation. 947 * Also softc would not disappear while we hold ioctl_sx lock. 948 */ 949 static int 950 ipsec_set_reqid(struct ipsec_softc *sc, uint32_t reqid) 951 { 952 struct secasindex *saidx; 953 954 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 955 956 if (sc->reqid == reqid && reqid != 0) 957 return (0); 958 959 if (reqid != 0) { 960 /* Check that specified reqid doesn't exist */ 961 if (ipsec_check_reqid(reqid) != 0) 962 return (EEXIST); 963 if (sc->reqid != 0) { 964 CK_LIST_REMOVE(sc, idhash); 965 IPSEC_WAIT(); 966 } 967 sc->reqid = reqid; 968 CK_LIST_INSERT_HEAD(ipsec_idhash(reqid), sc, idhash); 969 } else { 970 /* Generate new reqid */ 971 if (ipsec_init_reqid(sc) != 0) 972 return (EEXIST); 973 } 974 975 /* Tunnel isn't fully configured, just return. */ 976 if (sc->family == 0) 977 return (0); 978 979 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family); 980 KASSERT(saidx != NULL, 981 ("saidx is NULL, but family is %d", sc->family)); 982 return (ipsec_set_tunnel(sc, &saidx->src.sa, &saidx->dst.sa, 983 sc->reqid)); 984 } 985 986 /* 987 * Set tunnel endpoints addresses. 988 */ 989 static int 990 ipsec_set_addresses(struct ifnet *ifp, struct sockaddr *src, 991 struct sockaddr *dst) 992 { 993 struct ipsec_softc *sc; 994 struct secasindex *saidx; 995 996 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 997 998 sc = ifp->if_softc; 999 if (sc->family != 0) { 1000 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, 1001 src->sa_family); 1002 if (saidx != NULL && saidx->reqid == sc->reqid && 1003 key_sockaddrcmp(&saidx->src.sa, src, 0) == 0 && 1004 key_sockaddrcmp(&saidx->dst.sa, dst, 0) == 0) 1005 return (0); /* Nothing has been changed. */ 1006 } 1007 /* If reqid is not set, generate new one. */ 1008 if (ipsec_init_reqid(sc) != 0) 1009 return (EEXIST); 1010 return (ipsec_set_tunnel(sc, src, dst, sc->reqid)); 1011 } 1012 1013 static int 1014 ipsec_set_tunnel(struct ipsec_softc *sc, struct sockaddr *src, 1015 struct sockaddr *dst, uint32_t reqid) 1016 { 1017 struct epoch_tracker et; 1018 struct secpolicy *sp[IPSEC_SPCOUNT]; 1019 int i; 1020 1021 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 1022 1023 /* Allocate SP with new addresses. */ 1024 if (ipsec_newpolicies(sc, sp, src, dst, reqid) == 0) { 1025 /* Add new policies to SPDB */ 1026 if (key_register_ifnet(sp, IPSEC_SPCOUNT) != 0) { 1027 for (i = 0; i < IPSEC_SPCOUNT; i++) 1028 key_freesp(&sp[i]); 1029 return (EAGAIN); 1030 } 1031 if (sc->family != 0) 1032 ipsec_delete_tunnel(sc); 1033 for (i = 0; i < IPSEC_SPCOUNT; i++) 1034 sc->sp[i] = sp[i]; 1035 sc->family = src->sa_family; 1036 CK_LIST_INSERT_HEAD(ipsec_srchash(src), sc, srchash); 1037 } else { 1038 sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 1039 return (ENOMEM); 1040 } 1041 NET_EPOCH_ENTER(et); 1042 ipsec_set_running(sc); 1043 NET_EPOCH_EXIT(et); 1044 return (0); 1045 } 1046 1047 static void 1048 ipsec_delete_tunnel(struct ipsec_softc *sc) 1049 { 1050 int i; 1051 1052 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 1053 1054 sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 1055 if (sc->family != 0) { 1056 CK_LIST_REMOVE(sc, srchash); 1057 sc->family = 0; 1058 /* 1059 * Make sure that ipsec_if_input() will not do access 1060 * to softc's policies. 1061 */ 1062 IPSEC_WAIT(); 1063 1064 key_unregister_ifnet(sc->sp, IPSEC_SPCOUNT); 1065 for (i = 0; i < IPSEC_SPCOUNT; i++) 1066 key_freesp(&sc->sp[i]); 1067 } 1068 } 1069