1 /*- 2 * Copyright (c) 2016-2018 Yandex LLC 3 * Copyright (c) 2016-2018 Andrey V. Elsukov <ae@FreeBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 #include "opt_inet.h" 32 #include "opt_inet6.h" 33 34 #include <sys/param.h> 35 #include <sys/systm.h> 36 #include <sys/kernel.h> 37 #include <sys/fnv_hash.h> 38 #include <sys/jail.h> 39 #include <sys/lock.h> 40 #include <sys/malloc.h> 41 #include <sys/mbuf.h> 42 #include <sys/module.h> 43 #include <sys/socket.h> 44 #include <sys/sockio.h> 45 #include <sys/sx.h> 46 #include <sys/errno.h> 47 #include <sys/sysctl.h> 48 #include <sys/priv.h> 49 #include <sys/proc.h> 50 #include <sys/conf.h> 51 52 #include <net/if.h> 53 #include <net/if_var.h> 54 #include <net/if_clone.h> 55 #include <net/if_types.h> 56 #include <net/bpf.h> 57 #include <net/route.h> 58 #include <net/vnet.h> 59 60 #include <netinet/in.h> 61 #include <netinet/in_var.h> 62 #include <netinet/ip.h> 63 #include <netinet/ip_encap.h> 64 65 #include <netinet/ip6.h> 66 #include <netinet6/in6_var.h> 67 #include <netinet6/scope6_var.h> 68 69 #include <netipsec/ipsec.h> 70 #ifdef INET6 71 #include <netipsec/ipsec6.h> 72 #endif 73 74 #include <net/if_ipsec.h> 75 #include <netipsec/key.h> 76 77 #include <security/mac/mac_framework.h> 78 79 static MALLOC_DEFINE(M_IPSEC, "ipsec", "IPsec Virtual Tunnel Interface"); 80 static const char ipsecname[] = "ipsec"; 81 82 #if defined(INET) && defined(INET6) 83 #define IPSEC_SPCOUNT 4 84 #else 85 #define IPSEC_SPCOUNT 2 86 #endif 87 88 struct ipsec_softc { 89 struct ifnet *ifp; 90 struct secpolicy *sp[IPSEC_SPCOUNT]; 91 uint32_t reqid; 92 u_int family; 93 u_int fibnum; 94 95 CK_LIST_ENTRY(ipsec_softc) idhash; 96 CK_LIST_ENTRY(ipsec_softc) srchash; 97 }; 98 99 #define IPSEC_RLOCK_TRACKER struct epoch_tracker ipsec_et 100 #define IPSEC_RLOCK() epoch_enter_preempt(net_epoch_preempt, &ipsec_et) 101 #define IPSEC_RUNLOCK() epoch_exit_preempt(net_epoch_preempt, &ipsec_et) 102 #define IPSEC_WAIT() epoch_wait_preempt(net_epoch_preempt) 103 104 #ifndef IPSEC_HASH_SIZE 105 #define IPSEC_HASH_SIZE (1 << 5) 106 #endif 107 108 CK_LIST_HEAD(ipsec_iflist, ipsec_softc); 109 VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec_idhtbl) = NULL; 110 #define V_ipsec_idhtbl VNET(ipsec_idhtbl) 111 112 #ifdef INET 113 VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec4_srchtbl) = NULL; 114 #define V_ipsec4_srchtbl VNET(ipsec4_srchtbl) 115 static const struct srcaddrtab *ipsec4_srctab = NULL; 116 #endif 117 118 #ifdef INET6 119 VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec6_srchtbl) = NULL; 120 #define V_ipsec6_srchtbl VNET(ipsec6_srchtbl) 121 static const struct srcaddrtab *ipsec6_srctab = NULL; 122 #endif 123 124 static struct ipsec_iflist * 125 ipsec_idhash(uint32_t id) 126 { 127 128 return (&V_ipsec_idhtbl[fnv_32_buf(&id, sizeof(id), 129 FNV1_32_INIT) & (IPSEC_HASH_SIZE - 1)]); 130 } 131 132 static struct ipsec_iflist * 133 ipsec_srchash(const struct sockaddr *sa) 134 { 135 uint32_t hval; 136 137 switch (sa->sa_family) { 138 #ifdef INET 139 case AF_INET: 140 hval = fnv_32_buf( 141 &((const struct sockaddr_in *)sa)->sin_addr.s_addr, 142 sizeof(in_addr_t), FNV1_32_INIT); 143 return (&V_ipsec4_srchtbl[hval & (IPSEC_HASH_SIZE - 1)]); 144 #endif 145 #ifdef INET6 146 case AF_INET6: 147 hval = fnv_32_buf( 148 &((const struct sockaddr_in6 *)sa)->sin6_addr, 149 sizeof(struct in6_addr), FNV1_32_INIT); 150 return (&V_ipsec6_srchtbl[hval & (IPSEC_HASH_SIZE - 1)]); 151 #endif 152 } 153 return (NULL); 154 } 155 156 /* 157 * ipsec_ioctl_sx protects from concurrent ioctls. 158 */ 159 static struct sx ipsec_ioctl_sx; 160 SX_SYSINIT(ipsec_ioctl_sx, &ipsec_ioctl_sx, "ipsec_ioctl"); 161 162 static int ipsec_init_reqid(struct ipsec_softc *); 163 static int ipsec_set_tunnel(struct ipsec_softc *, struct sockaddr *, 164 struct sockaddr *, uint32_t); 165 static void ipsec_delete_tunnel(struct ipsec_softc *); 166 167 static int ipsec_set_addresses(struct ifnet *, struct sockaddr *, 168 struct sockaddr *); 169 static int ipsec_set_reqid(struct ipsec_softc *, uint32_t); 170 static void ipsec_set_running(struct ipsec_softc *); 171 172 static void ipsec_srcaddr(void *, const struct sockaddr *, int); 173 static int ipsec_ioctl(struct ifnet *, u_long, caddr_t); 174 static int ipsec_transmit(struct ifnet *, struct mbuf *); 175 static int ipsec_output(struct ifnet *, struct mbuf *, 176 const struct sockaddr *, struct route *); 177 static void ipsec_qflush(struct ifnet *); 178 static int ipsec_clone_create(struct if_clone *, int, caddr_t); 179 static void ipsec_clone_destroy(struct ifnet *); 180 181 VNET_DEFINE_STATIC(struct if_clone *, ipsec_cloner); 182 #define V_ipsec_cloner VNET(ipsec_cloner) 183 184 static int 185 ipsec_clone_create(struct if_clone *ifc, int unit, caddr_t params) 186 { 187 struct ipsec_softc *sc; 188 struct ifnet *ifp; 189 190 sc = malloc(sizeof(*sc), M_IPSEC, M_WAITOK | M_ZERO); 191 sc->fibnum = curthread->td_proc->p_fibnum; 192 sc->ifp = ifp = if_alloc(IFT_TUNNEL); 193 ifp->if_softc = sc; 194 if_initname(ifp, ipsecname, unit); 195 196 ifp->if_addrlen = 0; 197 ifp->if_mtu = IPSEC_MTU; 198 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST; 199 ifp->if_ioctl = ipsec_ioctl; 200 ifp->if_transmit = ipsec_transmit; 201 ifp->if_qflush = ipsec_qflush; 202 ifp->if_output = ipsec_output; 203 if_attach(ifp); 204 bpfattach(ifp, DLT_NULL, sizeof(uint32_t)); 205 206 return (0); 207 } 208 209 static void 210 ipsec_clone_destroy(struct ifnet *ifp) 211 { 212 struct ipsec_softc *sc; 213 214 sx_xlock(&ipsec_ioctl_sx); 215 sc = ifp->if_softc; 216 ipsec_delete_tunnel(sc); 217 /* 218 * Delete softc from idhash on interface destroy, since 219 * ipsec_delete_tunnel() keeps reqid unchanged. 220 */ 221 if (sc->reqid != 0) 222 CK_LIST_REMOVE(sc, idhash); 223 bpfdetach(ifp); 224 if_detach(ifp); 225 ifp->if_softc = NULL; 226 sx_xunlock(&ipsec_ioctl_sx); 227 228 IPSEC_WAIT(); 229 if_free(ifp); 230 free(sc, M_IPSEC); 231 } 232 233 static struct ipsec_iflist * 234 ipsec_hashinit(void) 235 { 236 struct ipsec_iflist *hash; 237 int i; 238 239 hash = malloc(sizeof(struct ipsec_iflist) * IPSEC_HASH_SIZE, 240 M_IPSEC, M_WAITOK); 241 for (i = 0; i < IPSEC_HASH_SIZE; i++) 242 CK_LIST_INIT(&hash[i]); 243 244 return (hash); 245 } 246 247 static void 248 vnet_ipsec_init(const void *unused __unused) 249 { 250 251 V_ipsec_idhtbl = ipsec_hashinit(); 252 #ifdef INET 253 V_ipsec4_srchtbl = ipsec_hashinit(); 254 if (IS_DEFAULT_VNET(curvnet)) 255 ipsec4_srctab = ip_encap_register_srcaddr(ipsec_srcaddr, 256 NULL, M_WAITOK); 257 #endif 258 #ifdef INET6 259 V_ipsec6_srchtbl = ipsec_hashinit(); 260 if (IS_DEFAULT_VNET(curvnet)) 261 ipsec6_srctab = ip6_encap_register_srcaddr(ipsec_srcaddr, 262 NULL, M_WAITOK); 263 #endif 264 V_ipsec_cloner = if_clone_simple(ipsecname, ipsec_clone_create, 265 ipsec_clone_destroy, 0); 266 } 267 VNET_SYSINIT(vnet_ipsec_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY, 268 vnet_ipsec_init, NULL); 269 270 static void 271 vnet_ipsec_uninit(const void *unused __unused) 272 { 273 274 if_clone_detach(V_ipsec_cloner); 275 free(V_ipsec_idhtbl, M_IPSEC); 276 /* 277 * Use V_ipsec_idhtbl pointer as indicator that VNET is going to be 278 * destroyed, it is used by ipsec_srcaddr() callback. 279 */ 280 V_ipsec_idhtbl = NULL; 281 IPSEC_WAIT(); 282 283 #ifdef INET 284 if (IS_DEFAULT_VNET(curvnet)) 285 ip_encap_unregister_srcaddr(ipsec4_srctab); 286 free(V_ipsec4_srchtbl, M_IPSEC); 287 #endif 288 #ifdef INET6 289 if (IS_DEFAULT_VNET(curvnet)) 290 ip6_encap_unregister_srcaddr(ipsec6_srctab); 291 free(V_ipsec6_srchtbl, M_IPSEC); 292 #endif 293 } 294 VNET_SYSUNINIT(vnet_ipsec_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY, 295 vnet_ipsec_uninit, NULL); 296 297 static struct secpolicy * 298 ipsec_getpolicy(struct ipsec_softc *sc, int dir, sa_family_t af) 299 { 300 301 switch (af) { 302 #ifdef INET 303 case AF_INET: 304 return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1)]); 305 #endif 306 #ifdef INET6 307 case AF_INET6: 308 return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1) 309 #ifdef INET 310 + 2 311 #endif 312 ]); 313 #endif 314 } 315 return (NULL); 316 } 317 318 static struct secasindex * 319 ipsec_getsaidx(struct ipsec_softc *sc, int dir, sa_family_t af) 320 { 321 struct secpolicy *sp; 322 323 sp = ipsec_getpolicy(sc, dir, af); 324 if (sp == NULL) 325 return (NULL); 326 return (&sp->req[0]->saidx); 327 } 328 329 static int 330 ipsec_transmit(struct ifnet *ifp, struct mbuf *m) 331 { 332 IPSEC_RLOCK_TRACKER; 333 struct ipsec_softc *sc; 334 struct secpolicy *sp; 335 struct ip *ip; 336 uint32_t af; 337 int error; 338 339 IPSEC_RLOCK(); 340 #ifdef MAC 341 error = mac_ifnet_check_transmit(ifp, m); 342 if (error) { 343 m_freem(m); 344 goto err; 345 } 346 #endif 347 error = ENETDOWN; 348 sc = ifp->if_softc; 349 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || 350 (ifp->if_flags & IFF_MONITOR) != 0 || 351 (ifp->if_flags & IFF_UP) == 0 || sc->family == 0) { 352 m_freem(m); 353 goto err; 354 } 355 356 /* Determine address family to correctly handle packet in BPF */ 357 ip = mtod(m, struct ip *); 358 switch (ip->ip_v) { 359 #ifdef INET 360 case IPVERSION: 361 af = AF_INET; 362 break; 363 #endif 364 #ifdef INET6 365 case (IPV6_VERSION >> 4): 366 af = AF_INET6; 367 break; 368 #endif 369 default: 370 error = EAFNOSUPPORT; 371 m_freem(m); 372 goto err; 373 } 374 375 /* 376 * Loop prevention. 377 * XXX: for now just check presence of IPSEC_OUT_DONE mbuf tag. 378 * We can read full chain and compare destination address, 379 * proto and mode from xform_history with values from softc. 380 */ 381 if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL) { 382 m_freem(m); 383 goto err; 384 } 385 386 sp = ipsec_getpolicy(sc, IPSEC_DIR_OUTBOUND, af); 387 key_addref(sp); 388 M_SETFIB(m, sc->fibnum); 389 390 BPF_MTAP2(ifp, &af, sizeof(af), m); 391 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); 392 if_inc_counter(ifp, IFCOUNTER_OBYTES, m->m_pkthdr.len); 393 394 switch (af) { 395 #ifdef INET 396 case AF_INET: 397 error = ipsec4_process_packet(m, sp, NULL); 398 break; 399 #endif 400 #ifdef INET6 401 case AF_INET6: 402 error = ipsec6_process_packet(m, sp, NULL); 403 break; 404 #endif 405 default: 406 panic("%s: unknown address family\n", __func__); 407 } 408 err: 409 if (error != 0) 410 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 411 IPSEC_RUNLOCK(); 412 return (error); 413 } 414 415 static void 416 ipsec_qflush(struct ifnet *ifp __unused) 417 { 418 419 } 420 421 static int 422 ipsec_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 423 struct route *ro) 424 { 425 426 return (ifp->if_transmit(ifp, m)); 427 } 428 429 int 430 ipsec_if_input(struct mbuf *m, struct secasvar *sav, uint32_t af) 431 { 432 IPSEC_RLOCK_TRACKER; 433 struct secasindex *saidx; 434 struct ipsec_softc *sc; 435 struct ifnet *ifp; 436 437 if (sav->state != SADB_SASTATE_MATURE && 438 sav->state != SADB_SASTATE_DYING) { 439 m_freem(m); 440 return (ENETDOWN); 441 } 442 443 if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL || 444 sav->sah->saidx.proto != IPPROTO_ESP) 445 return (0); 446 447 IPSEC_RLOCK(); 448 CK_LIST_FOREACH(sc, ipsec_idhash(sav->sah->saidx.reqid), idhash) { 449 if (sc->family == 0) 450 continue; 451 saidx = ipsec_getsaidx(sc, IPSEC_DIR_INBOUND, 452 sav->sah->saidx.src.sa.sa_family); 453 /* SA's reqid should match reqid in SP */ 454 if (saidx == NULL || 455 sav->sah->saidx.reqid != saidx->reqid) 456 continue; 457 /* SAH's addresses should match tunnel endpoints. */ 458 if (key_sockaddrcmp(&sav->sah->saidx.dst.sa, 459 &saidx->dst.sa, 0) != 0) 460 continue; 461 if (key_sockaddrcmp(&sav->sah->saidx.src.sa, 462 &saidx->src.sa, 0) == 0) 463 break; 464 } 465 if (sc == NULL) { 466 IPSEC_RUNLOCK(); 467 /* Tunnel was not found. Nothing to do. */ 468 return (0); 469 } 470 ifp = sc->ifp; 471 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || 472 (ifp->if_flags & IFF_UP) == 0) { 473 IPSEC_RUNLOCK(); 474 m_freem(m); 475 return (ENETDOWN); 476 } 477 /* 478 * We found matching and working tunnel. 479 * Set its ifnet as receiving interface. 480 */ 481 m->m_pkthdr.rcvif = ifp; 482 483 m_clrprotoflags(m); 484 M_SETFIB(m, ifp->if_fib); 485 BPF_MTAP2(ifp, &af, sizeof(af), m); 486 if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1); 487 if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len); 488 if ((ifp->if_flags & IFF_MONITOR) != 0) { 489 IPSEC_RUNLOCK(); 490 m_freem(m); 491 return (ENETDOWN); 492 } 493 IPSEC_RUNLOCK(); 494 return (0); 495 } 496 497 static int 498 ipsec_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 499 { 500 struct ifreq *ifr = (struct ifreq*)data; 501 struct sockaddr *dst, *src; 502 struct ipsec_softc *sc; 503 struct secasindex *saidx; 504 #ifdef INET 505 struct sockaddr_in *sin = NULL; 506 #endif 507 #ifdef INET6 508 struct sockaddr_in6 *sin6 = NULL; 509 #endif 510 uint32_t reqid; 511 int error; 512 513 switch (cmd) { 514 case SIOCSIFADDR: 515 ifp->if_flags |= IFF_UP; 516 case SIOCADDMULTI: 517 case SIOCDELMULTI: 518 case SIOCGIFMTU: 519 case SIOCSIFFLAGS: 520 return (0); 521 case SIOCSIFMTU: 522 if (ifr->ifr_mtu < IPSEC_MTU_MIN || 523 ifr->ifr_mtu > IPSEC_MTU_MAX) 524 return (EINVAL); 525 else 526 ifp->if_mtu = ifr->ifr_mtu; 527 return (0); 528 } 529 sx_xlock(&ipsec_ioctl_sx); 530 sc = ifp->if_softc; 531 /* Check that softc is still here */ 532 if (sc == NULL) { 533 error = ENXIO; 534 goto bad; 535 } 536 error = 0; 537 switch (cmd) { 538 case SIOCSIFPHYADDR: 539 #ifdef INET6 540 case SIOCSIFPHYADDR_IN6: 541 #endif 542 error = EINVAL; 543 switch (cmd) { 544 #ifdef INET 545 case SIOCSIFPHYADDR: 546 src = (struct sockaddr *) 547 &(((struct in_aliasreq *)data)->ifra_addr); 548 dst = (struct sockaddr *) 549 &(((struct in_aliasreq *)data)->ifra_dstaddr); 550 break; 551 #endif 552 #ifdef INET6 553 case SIOCSIFPHYADDR_IN6: 554 src = (struct sockaddr *) 555 &(((struct in6_aliasreq *)data)->ifra_addr); 556 dst = (struct sockaddr *) 557 &(((struct in6_aliasreq *)data)->ifra_dstaddr); 558 break; 559 #endif 560 default: 561 goto bad; 562 } 563 /* sa_family must be equal */ 564 if (src->sa_family != dst->sa_family || 565 src->sa_len != dst->sa_len) 566 goto bad; 567 568 /* validate sa_len */ 569 switch (src->sa_family) { 570 #ifdef INET 571 case AF_INET: 572 if (src->sa_len != sizeof(struct sockaddr_in)) 573 goto bad; 574 break; 575 #endif 576 #ifdef INET6 577 case AF_INET6: 578 if (src->sa_len != sizeof(struct sockaddr_in6)) 579 goto bad; 580 break; 581 #endif 582 default: 583 error = EAFNOSUPPORT; 584 goto bad; 585 } 586 /* check sa_family looks sane for the cmd */ 587 error = EAFNOSUPPORT; 588 switch (cmd) { 589 #ifdef INET 590 case SIOCSIFPHYADDR: 591 if (src->sa_family == AF_INET) 592 break; 593 goto bad; 594 #endif 595 #ifdef INET6 596 case SIOCSIFPHYADDR_IN6: 597 if (src->sa_family == AF_INET6) 598 break; 599 goto bad; 600 #endif 601 } 602 error = EADDRNOTAVAIL; 603 switch (src->sa_family) { 604 #ifdef INET 605 case AF_INET: 606 if (satosin(src)->sin_addr.s_addr == INADDR_ANY || 607 satosin(dst)->sin_addr.s_addr == INADDR_ANY) 608 goto bad; 609 break; 610 #endif 611 #ifdef INET6 612 case AF_INET6: 613 if (IN6_IS_ADDR_UNSPECIFIED( 614 &satosin6(src)->sin6_addr) || 615 IN6_IS_ADDR_UNSPECIFIED( 616 &satosin6(dst)->sin6_addr)) 617 goto bad; 618 /* 619 * Check validity of the scope zone ID of the 620 * addresses, and convert it into the kernel 621 * internal form if necessary. 622 */ 623 error = sa6_embedscope(satosin6(src), 0); 624 if (error != 0) 625 goto bad; 626 error = sa6_embedscope(satosin6(dst), 0); 627 if (error != 0) 628 goto bad; 629 #endif 630 }; 631 error = ipsec_set_addresses(ifp, src, dst); 632 break; 633 case SIOCDIFPHYADDR: 634 ipsec_delete_tunnel(sc); 635 break; 636 case SIOCGIFPSRCADDR: 637 case SIOCGIFPDSTADDR: 638 #ifdef INET6 639 case SIOCGIFPSRCADDR_IN6: 640 case SIOCGIFPDSTADDR_IN6: 641 #endif 642 if (sc->family == 0) { 643 error = EADDRNOTAVAIL; 644 break; 645 } 646 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family); 647 switch (cmd) { 648 #ifdef INET 649 case SIOCGIFPSRCADDR: 650 case SIOCGIFPDSTADDR: 651 if (saidx->src.sa.sa_family != AF_INET) { 652 error = EADDRNOTAVAIL; 653 break; 654 } 655 sin = (struct sockaddr_in *)&ifr->ifr_addr; 656 memset(sin, 0, sizeof(*sin)); 657 sin->sin_family = AF_INET; 658 sin->sin_len = sizeof(*sin); 659 break; 660 #endif 661 #ifdef INET6 662 case SIOCGIFPSRCADDR_IN6: 663 case SIOCGIFPDSTADDR_IN6: 664 if (saidx->src.sa.sa_family != AF_INET6) { 665 error = EADDRNOTAVAIL; 666 break; 667 } 668 sin6 = (struct sockaddr_in6 *) 669 &(((struct in6_ifreq *)data)->ifr_addr); 670 memset(sin6, 0, sizeof(*sin6)); 671 sin6->sin6_family = AF_INET6; 672 sin6->sin6_len = sizeof(*sin6); 673 break; 674 #endif 675 default: 676 error = EAFNOSUPPORT; 677 } 678 if (error == 0) { 679 switch (cmd) { 680 #ifdef INET 681 case SIOCGIFPSRCADDR: 682 sin->sin_addr = saidx->src.sin.sin_addr; 683 break; 684 case SIOCGIFPDSTADDR: 685 sin->sin_addr = saidx->dst.sin.sin_addr; 686 break; 687 #endif 688 #ifdef INET6 689 case SIOCGIFPSRCADDR_IN6: 690 sin6->sin6_addr = saidx->src.sin6.sin6_addr; 691 break; 692 case SIOCGIFPDSTADDR_IN6: 693 sin6->sin6_addr = saidx->dst.sin6.sin6_addr; 694 break; 695 #endif 696 } 697 } 698 if (error != 0) 699 break; 700 switch (cmd) { 701 #ifdef INET 702 case SIOCGIFPSRCADDR: 703 case SIOCGIFPDSTADDR: 704 error = prison_if(curthread->td_ucred, 705 (struct sockaddr *)sin); 706 if (error != 0) 707 memset(sin, 0, sizeof(*sin)); 708 break; 709 #endif 710 #ifdef INET6 711 case SIOCGIFPSRCADDR_IN6: 712 case SIOCGIFPDSTADDR_IN6: 713 error = prison_if(curthread->td_ucred, 714 (struct sockaddr *)sin6); 715 if (error == 0) 716 error = sa6_recoverscope(sin6); 717 if (error != 0) 718 memset(sin6, 0, sizeof(*sin6)); 719 #endif 720 } 721 break; 722 case SIOCGTUNFIB: 723 ifr->ifr_fib = sc->fibnum; 724 break; 725 case SIOCSTUNFIB: 726 if ((error = priv_check(curthread, PRIV_NET_SETIFFIB)) != 0) 727 break; 728 if (ifr->ifr_fib >= rt_numfibs) 729 error = EINVAL; 730 else 731 sc->fibnum = ifr->ifr_fib; 732 break; 733 case IPSECGREQID: 734 reqid = sc->reqid; 735 error = copyout(&reqid, ifr_data_get_ptr(ifr), sizeof(reqid)); 736 break; 737 case IPSECSREQID: 738 if ((error = priv_check(curthread, PRIV_NET_SETIFCAP)) != 0) 739 break; 740 error = copyin(ifr_data_get_ptr(ifr), &reqid, sizeof(reqid)); 741 if (error != 0) 742 break; 743 error = ipsec_set_reqid(sc, reqid); 744 break; 745 default: 746 error = EINVAL; 747 break; 748 } 749 bad: 750 sx_xunlock(&ipsec_ioctl_sx); 751 return (error); 752 } 753 754 /* 755 * Check that ingress address belongs to local host. 756 */ 757 static void 758 ipsec_set_running(struct ipsec_softc *sc) 759 { 760 struct secasindex *saidx; 761 int localip; 762 763 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family); 764 localip = 0; 765 switch (sc->family) { 766 #ifdef INET 767 case AF_INET: 768 localip = in_localip(saidx->src.sin.sin_addr); 769 break; 770 #endif 771 #ifdef INET6 772 case AF_INET6: 773 localip = in6_localip(&saidx->src.sin6.sin6_addr); 774 break; 775 #endif 776 } 777 if (localip != 0) 778 sc->ifp->if_drv_flags |= IFF_DRV_RUNNING; 779 else 780 sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 781 } 782 783 /* 784 * ifaddr_event handler. 785 * Clear IFF_DRV_RUNNING flag when ingress address disappears to prevent 786 * source address spoofing. 787 */ 788 static void 789 ipsec_srcaddr(void *arg __unused, const struct sockaddr *sa, 790 int event __unused) 791 { 792 struct ipsec_softc *sc; 793 struct secasindex *saidx; 794 795 /* Check that VNET is ready */ 796 if (V_ipsec_idhtbl == NULL) 797 return; 798 799 MPASS(in_epoch(net_epoch_preempt)); 800 CK_LIST_FOREACH(sc, ipsec_srchash(sa), srchash) { 801 if (sc->family == 0) 802 continue; 803 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sa->sa_family); 804 if (saidx == NULL || 805 key_sockaddrcmp(&saidx->src.sa, sa, 0) != 0) 806 continue; 807 ipsec_set_running(sc); 808 } 809 } 810 811 /* 812 * Allocate new private security policies for tunneling interface. 813 * Each tunneling interface has following security policies for 814 * both AF: 815 * 0.0.0.0/0[any] 0.0.0.0/0[any] -P in \ 816 * ipsec esp/tunnel/RemoteIP-LocalIP/unique:reqid 817 * 0.0.0.0/0[any] 0.0.0.0/0[any] -P out \ 818 * ipsec esp/tunnel/LocalIP-RemoteIP/unique:reqid 819 */ 820 static int 821 ipsec_newpolicies(struct ipsec_softc *sc, struct secpolicy *sp[IPSEC_SPCOUNT], 822 const struct sockaddr *src, const struct sockaddr *dst, uint32_t reqid) 823 { 824 struct ipsecrequest *isr; 825 int i; 826 827 memset(sp, 0, sizeof(struct secpolicy *) * IPSEC_SPCOUNT); 828 for (i = 0; i < IPSEC_SPCOUNT; i++) { 829 if ((sp[i] = key_newsp()) == NULL) 830 goto fail; 831 if ((isr = ipsec_newisr()) == NULL) 832 goto fail; 833 834 sp[i]->policy = IPSEC_POLICY_IPSEC; 835 sp[i]->state = IPSEC_SPSTATE_DEAD; 836 sp[i]->req[sp[i]->tcount++] = isr; 837 sp[i]->created = time_second; 838 /* Use priority field to store if_index */ 839 sp[i]->priority = sc->ifp->if_index; 840 isr->level = IPSEC_LEVEL_UNIQUE; 841 isr->saidx.proto = IPPROTO_ESP; 842 isr->saidx.mode = IPSEC_MODE_TUNNEL; 843 isr->saidx.reqid = reqid; 844 if (i % 2 == 0) { 845 sp[i]->spidx.dir = IPSEC_DIR_INBOUND; 846 bcopy(src, &isr->saidx.dst, src->sa_len); 847 bcopy(dst, &isr->saidx.src, dst->sa_len); 848 } else { 849 sp[i]->spidx.dir = IPSEC_DIR_OUTBOUND; 850 bcopy(src, &isr->saidx.src, src->sa_len); 851 bcopy(dst, &isr->saidx.dst, dst->sa_len); 852 } 853 sp[i]->spidx.ul_proto = IPSEC_ULPROTO_ANY; 854 #ifdef INET 855 if (i < 2) { 856 sp[i]->spidx.src.sa.sa_family = 857 sp[i]->spidx.dst.sa.sa_family = AF_INET; 858 sp[i]->spidx.src.sa.sa_len = 859 sp[i]->spidx.dst.sa.sa_len = 860 sizeof(struct sockaddr_in); 861 continue; 862 } 863 #endif 864 #ifdef INET6 865 sp[i]->spidx.src.sa.sa_family = 866 sp[i]->spidx.dst.sa.sa_family = AF_INET6; 867 sp[i]->spidx.src.sa.sa_len = 868 sp[i]->spidx.dst.sa.sa_len = sizeof(struct sockaddr_in6); 869 #endif 870 } 871 return (0); 872 fail: 873 for (i = 0; i < IPSEC_SPCOUNT; i++) 874 key_freesp(&sp[i]); 875 return (ENOMEM); 876 } 877 878 static int 879 ipsec_check_reqid(uint32_t reqid) 880 { 881 struct ipsec_softc *sc; 882 883 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 884 CK_LIST_FOREACH(sc, ipsec_idhash(reqid), idhash) { 885 if (sc->reqid == reqid) 886 return (EEXIST); 887 } 888 return (0); 889 } 890 891 /* 892 * We use key_newreqid() to automatically obtain unique reqid. 893 * Then we check that given id is unique, i.e. it is not used by 894 * another if_ipsec(4) interface. This macro limits the number of 895 * tries to get unique id. 896 */ 897 #define IPSEC_REQID_TRYCNT 64 898 static int 899 ipsec_init_reqid(struct ipsec_softc *sc) 900 { 901 uint32_t reqid; 902 int trycount; 903 904 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 905 if (sc->reqid != 0) /* already initialized */ 906 return (0); 907 908 trycount = IPSEC_REQID_TRYCNT; 909 while (--trycount > 0) { 910 reqid = key_newreqid(); 911 if (ipsec_check_reqid(reqid) == 0) 912 break; 913 } 914 if (trycount == 0) 915 return (EEXIST); 916 sc->reqid = reqid; 917 CK_LIST_INSERT_HEAD(ipsec_idhash(reqid), sc, idhash); 918 return (0); 919 } 920 921 /* 922 * Set or update reqid for given tunneling interface. 923 * When specified reqid is zero, generate new one. 924 * We are protected by ioctl_sx lock from concurrent id generation. 925 * Also softc would not disappear while we hold ioctl_sx lock. 926 */ 927 static int 928 ipsec_set_reqid(struct ipsec_softc *sc, uint32_t reqid) 929 { 930 struct secasindex *saidx; 931 932 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 933 934 if (sc->reqid == reqid && reqid != 0) 935 return (0); 936 937 if (reqid != 0) { 938 /* Check that specified reqid doesn't exist */ 939 if (ipsec_check_reqid(reqid) != 0) 940 return (EEXIST); 941 if (sc->reqid != 0) { 942 CK_LIST_REMOVE(sc, idhash); 943 IPSEC_WAIT(); 944 } 945 sc->reqid = reqid; 946 CK_LIST_INSERT_HEAD(ipsec_idhash(reqid), sc, idhash); 947 } else { 948 /* Generate new reqid */ 949 if (ipsec_init_reqid(sc) != 0) 950 return (EEXIST); 951 } 952 953 /* Tunnel isn't fully configured, just return. */ 954 if (sc->family == 0) 955 return (0); 956 957 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family); 958 KASSERT(saidx != NULL, 959 ("saidx is NULL, but family is %d", sc->family)); 960 return (ipsec_set_tunnel(sc, &saidx->src.sa, &saidx->dst.sa, 961 sc->reqid)); 962 } 963 964 /* 965 * Set tunnel endpoints addresses. 966 */ 967 static int 968 ipsec_set_addresses(struct ifnet *ifp, struct sockaddr *src, 969 struct sockaddr *dst) 970 { 971 struct ipsec_softc *sc; 972 struct secasindex *saidx; 973 974 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 975 976 sc = ifp->if_softc; 977 if (sc->family != 0) { 978 saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, 979 src->sa_family); 980 if (saidx != NULL && saidx->reqid == sc->reqid && 981 key_sockaddrcmp(&saidx->src.sa, src, 0) == 0 && 982 key_sockaddrcmp(&saidx->dst.sa, dst, 0) == 0) 983 return (0); /* Nothing has been changed. */ 984 985 } 986 /* If reqid is not set, generate new one. */ 987 if (ipsec_init_reqid(sc) != 0) 988 return (EEXIST); 989 return (ipsec_set_tunnel(sc, src, dst, sc->reqid)); 990 } 991 992 static int 993 ipsec_set_tunnel(struct ipsec_softc *sc, struct sockaddr *src, 994 struct sockaddr *dst, uint32_t reqid) 995 { 996 struct secpolicy *sp[IPSEC_SPCOUNT]; 997 int i; 998 999 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 1000 1001 /* Allocate SP with new addresses. */ 1002 if (ipsec_newpolicies(sc, sp, src, dst, reqid) == 0) { 1003 /* Add new policies to SPDB */ 1004 if (key_register_ifnet(sp, IPSEC_SPCOUNT) != 0) { 1005 for (i = 0; i < IPSEC_SPCOUNT; i++) 1006 key_freesp(&sp[i]); 1007 return (EAGAIN); 1008 } 1009 if (sc->family != 0) 1010 ipsec_delete_tunnel(sc); 1011 for (i = 0; i < IPSEC_SPCOUNT; i++) 1012 sc->sp[i] = sp[i]; 1013 sc->family = src->sa_family; 1014 CK_LIST_INSERT_HEAD(ipsec_srchash(src), sc, srchash); 1015 } else { 1016 sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 1017 return (ENOMEM); 1018 } 1019 ipsec_set_running(sc); 1020 return (0); 1021 } 1022 1023 static void 1024 ipsec_delete_tunnel(struct ipsec_softc *sc) 1025 { 1026 int i; 1027 1028 sx_assert(&ipsec_ioctl_sx, SA_XLOCKED); 1029 1030 sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 1031 if (sc->family != 0) { 1032 CK_LIST_REMOVE(sc, srchash); 1033 sc->family = 0; 1034 /* 1035 * Make sure that ipsec_if_input() will not do access 1036 * to softc's policies. 1037 */ 1038 IPSEC_WAIT(); 1039 1040 key_unregister_ifnet(sc->sp, IPSEC_SPCOUNT); 1041 for (i = 0; i < IPSEC_SPCOUNT; i++) 1042 key_freesp(&sc->sp[i]); 1043 } 1044 } 1045