188768458SSam Leffler /* $FreeBSD$ */ 288768458SSam Leffler /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */ 388768458SSam Leffler 4c398230bSWarner Losh /*- 588768458SSam Leffler * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 688768458SSam Leffler * All rights reserved. 788768458SSam Leffler * 888768458SSam Leffler * Redistribution and use in source and binary forms, with or without 988768458SSam Leffler * modification, are permitted provided that the following conditions 1088768458SSam Leffler * are met: 1188768458SSam Leffler * 1. Redistributions of source code must retain the above copyright 1288768458SSam Leffler * notice, this list of conditions and the following disclaimer. 1388768458SSam Leffler * 2. Redistributions in binary form must reproduce the above copyright 1488768458SSam Leffler * notice, this list of conditions and the following disclaimer in the 1588768458SSam Leffler * documentation and/or other materials provided with the distribution. 1688768458SSam Leffler * 3. Neither the name of the project nor the names of its contributors 1788768458SSam Leffler * may be used to endorse or promote products derived from this software 1888768458SSam Leffler * without specific prior written permission. 1988768458SSam Leffler * 2088768458SSam Leffler * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 2188768458SSam Leffler * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2288768458SSam Leffler * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2388768458SSam Leffler * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 2488768458SSam Leffler * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2588768458SSam Leffler * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2688768458SSam Leffler * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2788768458SSam Leffler * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2888768458SSam Leffler * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2988768458SSam Leffler * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3088768458SSam Leffler * SUCH DAMAGE. 3188768458SSam Leffler */ 3288768458SSam Leffler 3388768458SSam Leffler /* 3488768458SSam Leffler * IPsec controller part. 3588768458SSam Leffler */ 3688768458SSam Leffler 3788768458SSam Leffler #include "opt_inet.h" 3888768458SSam Leffler #include "opt_inet6.h" 3988768458SSam Leffler #include "opt_ipsec.h" 4088768458SSam Leffler 4188768458SSam Leffler #include <sys/param.h> 4288768458SSam Leffler #include <sys/systm.h> 4388768458SSam Leffler #include <sys/malloc.h> 4488768458SSam Leffler #include <sys/mbuf.h> 4588768458SSam Leffler #include <sys/domain.h> 4646ee43b2SRobert Watson #include <sys/priv.h> 4788768458SSam Leffler #include <sys/protosw.h> 4888768458SSam Leffler #include <sys/socket.h> 4988768458SSam Leffler #include <sys/socketvar.h> 5088768458SSam Leffler #include <sys/errno.h> 5188768458SSam Leffler #include <sys/time.h> 5288768458SSam Leffler #include <sys/kernel.h> 5388768458SSam Leffler #include <sys/syslog.h> 5488768458SSam Leffler #include <sys/sysctl.h> 5588768458SSam Leffler #include <sys/proc.h> 5688768458SSam Leffler 5788768458SSam Leffler #include <net/if.h> 5888768458SSam Leffler #include <net/route.h> 5988768458SSam Leffler 6088768458SSam Leffler #include <netinet/in.h> 6188768458SSam Leffler #include <netinet/in_systm.h> 6288768458SSam Leffler #include <netinet/ip.h> 6388768458SSam Leffler #include <netinet/ip_var.h> 6488768458SSam Leffler #include <netinet/in_var.h> 6588768458SSam Leffler #include <netinet/udp.h> 6688768458SSam Leffler #include <netinet/udp_var.h> 6788768458SSam Leffler #include <netinet/tcp.h> 6888768458SSam Leffler #include <netinet/udp.h> 6988768458SSam Leffler 7088768458SSam Leffler #include <netinet/ip6.h> 7188768458SSam Leffler #ifdef INET6 7288768458SSam Leffler #include <netinet6/ip6_var.h> 7388768458SSam Leffler #endif 7488768458SSam Leffler #include <netinet/in_pcb.h> 7588768458SSam Leffler #ifdef INET6 7688768458SSam Leffler #include <netinet/icmp6.h> 7788768458SSam Leffler #endif 7888768458SSam Leffler 7988768458SSam Leffler #include <netipsec/ipsec.h> 8088768458SSam Leffler #ifdef INET6 8188768458SSam Leffler #include <netipsec/ipsec6.h> 8288768458SSam Leffler #endif 8388768458SSam Leffler #include <netipsec/ah_var.h> 8488768458SSam Leffler #include <netipsec/esp_var.h> 8588768458SSam Leffler #include <netipsec/ipcomp.h> /*XXX*/ 8688768458SSam Leffler #include <netipsec/ipcomp_var.h> 8788768458SSam Leffler 8888768458SSam Leffler #include <netipsec/key.h> 8988768458SSam Leffler #include <netipsec/keydb.h> 9088768458SSam Leffler #include <netipsec/key_debug.h> 9188768458SSam Leffler 9288768458SSam Leffler #include <netipsec/xform.h> 9388768458SSam Leffler 9488768458SSam Leffler #include <machine/in_cksum.h> 9588768458SSam Leffler 9688768458SSam Leffler #ifdef IPSEC_DEBUG 9788768458SSam Leffler int ipsec_debug = 1; 9888768458SSam Leffler #else 9988768458SSam Leffler int ipsec_debug = 0; 10088768458SSam Leffler #endif 10188768458SSam Leffler 10288768458SSam Leffler /* NB: name changed so netstat doesn't use it */ 10388768458SSam Leffler struct newipsecstat newipsecstat; 10488768458SSam Leffler int ip4_ah_offsetmask = 0; /* maybe IP_DF? */ 10588768458SSam Leffler int ip4_ipsec_dfbit = 0; /* DF bit on encap. 0: clear 1: set 2: copy */ 10688768458SSam Leffler int ip4_esp_trans_deflev = IPSEC_LEVEL_USE; 10788768458SSam Leffler int ip4_esp_net_deflev = IPSEC_LEVEL_USE; 10888768458SSam Leffler int ip4_ah_trans_deflev = IPSEC_LEVEL_USE; 10988768458SSam Leffler int ip4_ah_net_deflev = IPSEC_LEVEL_USE; 11088768458SSam Leffler struct secpolicy ip4_def_policy; 11188768458SSam Leffler int ip4_ipsec_ecn = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 11288768458SSam Leffler int ip4_esp_randpad = -1; 11388768458SSam Leffler /* 11488768458SSam Leffler * Crypto support requirements: 11588768458SSam Leffler * 11688768458SSam Leffler * 1 require hardware support 11788768458SSam Leffler * -1 require software support 11888768458SSam Leffler * 0 take anything 11988768458SSam Leffler */ 12088768458SSam Leffler int crypto_support = 0; 12188768458SSam Leffler 12288768458SSam Leffler SYSCTL_DECL(_net_inet_ipsec); 12388768458SSam Leffler 12488768458SSam Leffler /* net.inet.ipsec */ 12588768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_POLICY, 12688768458SSam Leffler def_policy, CTLFLAG_RW, &ip4_def_policy.policy, 0, ""); 12788768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev, 12888768458SSam Leffler CTLFLAG_RW, &ip4_esp_trans_deflev, 0, ""); 12988768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev, 13088768458SSam Leffler CTLFLAG_RW, &ip4_esp_net_deflev, 0, ""); 13188768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev, 13288768458SSam Leffler CTLFLAG_RW, &ip4_ah_trans_deflev, 0, ""); 13388768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev, 13488768458SSam Leffler CTLFLAG_RW, &ip4_ah_net_deflev, 0, ""); 13588768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, 13688768458SSam Leffler ah_cleartos, CTLFLAG_RW, &ah_cleartos, 0, ""); 13788768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK, 13888768458SSam Leffler ah_offsetmask, CTLFLAG_RW, &ip4_ah_offsetmask, 0, ""); 13988768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, 14088768458SSam Leffler dfbit, CTLFLAG_RW, &ip4_ipsec_dfbit, 0, ""); 14188768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, 14288768458SSam Leffler ecn, CTLFLAG_RW, &ip4_ipsec_ecn, 0, ""); 14388768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, 14488768458SSam Leffler debug, CTLFLAG_RW, &ipsec_debug, 0, ""); 14588768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD, 14688768458SSam Leffler esp_randpad, CTLFLAG_RW, &ip4_esp_randpad, 0, ""); 14788768458SSam Leffler SYSCTL_INT(_net_inet_ipsec, OID_AUTO, 14888768458SSam Leffler crypto_support, CTLFLAG_RW, &crypto_support,0, ""); 14988768458SSam Leffler SYSCTL_STRUCT(_net_inet_ipsec, OID_AUTO, 15088768458SSam Leffler ipsecstats, CTLFLAG_RD, &newipsecstat, newipsecstat, ""); 15188768458SSam Leffler 1526131838bSPawel Jakub Dawidek #ifdef REGRESSION 153dfa9422bSPawel Jakub Dawidek /* 154dfa9422bSPawel Jakub Dawidek * When set to 1, IPsec will send packets with the same sequence number. 155dfa9422bSPawel Jakub Dawidek * This allows to verify if the other side has proper replay attacks detection. 156dfa9422bSPawel Jakub Dawidek */ 157dfa9422bSPawel Jakub Dawidek int ipsec_replay = 0; 158dfa9422bSPawel Jakub Dawidek SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay, CTLFLAG_RW, &ipsec_replay, 0, 159dfa9422bSPawel Jakub Dawidek "Emulate replay attack"); 160dfa9422bSPawel Jakub Dawidek /* 161dfa9422bSPawel Jakub Dawidek * When set 1, IPsec will send packets with corrupted HMAC. 162dfa9422bSPawel Jakub Dawidek * This allows to verify if the other side properly detects modified packets. 163dfa9422bSPawel Jakub Dawidek */ 164dfa9422bSPawel Jakub Dawidek int ipsec_integrity = 0; 165dfa9422bSPawel Jakub Dawidek SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity, CTLFLAG_RW, 166dfa9422bSPawel Jakub Dawidek &ipsec_integrity, 0, "Emulate man-in-the-middle attack"); 1676131838bSPawel Jakub Dawidek #endif 168dfa9422bSPawel Jakub Dawidek 16988768458SSam Leffler #ifdef INET6 17088768458SSam Leffler int ip6_esp_trans_deflev = IPSEC_LEVEL_USE; 17188768458SSam Leffler int ip6_esp_net_deflev = IPSEC_LEVEL_USE; 17288768458SSam Leffler int ip6_ah_trans_deflev = IPSEC_LEVEL_USE; 17388768458SSam Leffler int ip6_ah_net_deflev = IPSEC_LEVEL_USE; 17488768458SSam Leffler int ip6_ipsec_ecn = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */ 17588768458SSam Leffler int ip6_esp_randpad = -1; 17688768458SSam Leffler 17788768458SSam Leffler SYSCTL_DECL(_net_inet6_ipsec6); 17888768458SSam Leffler 17988768458SSam Leffler /* net.inet6.ipsec6 */ 18088768458SSam Leffler #ifdef COMPAT_KAME 18188768458SSam Leffler SYSCTL_OID(_net_inet6_ipsec6, IPSECCTL_STATS, stats, CTLFLAG_RD, 18288768458SSam Leffler 0,0, compat_ipsecstats_sysctl, "S", ""); 18388768458SSam Leffler #endif /* COMPAT_KAME */ 18488768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, 18588768458SSam Leffler def_policy, CTLFLAG_RW, &ip4_def_policy.policy, 0, ""); 18688768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev, 18788768458SSam Leffler CTLFLAG_RW, &ip6_esp_trans_deflev, 0, ""); 18888768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev, 18988768458SSam Leffler CTLFLAG_RW, &ip6_esp_net_deflev, 0, ""); 19088768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev, 19188768458SSam Leffler CTLFLAG_RW, &ip6_ah_trans_deflev, 0, ""); 19288768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev, 19388768458SSam Leffler CTLFLAG_RW, &ip6_ah_net_deflev, 0, ""); 19488768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, 19588768458SSam Leffler ecn, CTLFLAG_RW, &ip6_ipsec_ecn, 0, ""); 19688768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, 19788768458SSam Leffler debug, CTLFLAG_RW, &ipsec_debug, 0, ""); 19888768458SSam Leffler SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD, 19988768458SSam Leffler esp_randpad, CTLFLAG_RW, &ip6_esp_randpad, 0, ""); 20088768458SSam Leffler #endif /* INET6 */ 20188768458SSam Leffler 20288768458SSam Leffler static int ipsec4_setspidx_inpcb __P((struct mbuf *, struct inpcb *pcb)); 20388768458SSam Leffler #ifdef INET6 20488768458SSam Leffler static int ipsec6_setspidx_in6pcb __P((struct mbuf *, struct in6pcb *pcb)); 20588768458SSam Leffler #endif 20688768458SSam Leffler static int ipsec_setspidx __P((struct mbuf *, struct secpolicyindex *, int)); 20788768458SSam Leffler static void ipsec4_get_ulp __P((struct mbuf *m, struct secpolicyindex *, int)); 20888768458SSam Leffler static int ipsec4_setspidx_ipaddr __P((struct mbuf *, struct secpolicyindex *)); 20988768458SSam Leffler #ifdef INET6 21088768458SSam Leffler static void ipsec6_get_ulp __P((struct mbuf *m, struct secpolicyindex *, int)); 21188768458SSam Leffler static int ipsec6_setspidx_ipaddr __P((struct mbuf *, struct secpolicyindex *)); 21288768458SSam Leffler #endif 21388768458SSam Leffler static void ipsec_delpcbpolicy __P((struct inpcbpolicy *)); 21488768458SSam Leffler static struct secpolicy *ipsec_deepcopy_policy __P((struct secpolicy *src)); 21588768458SSam Leffler static int ipsec_set_policy __P((struct secpolicy **pcb_sp, 21688768458SSam Leffler int optname, caddr_t request, size_t len, int priv)); 21788768458SSam Leffler static int ipsec_get_policy __P((struct secpolicy *pcb_sp, struct mbuf **mp)); 21888768458SSam Leffler static void vshiftl __P((unsigned char *, int, int)); 21988768458SSam Leffler static size_t ipsec_hdrsiz __P((struct secpolicy *)); 22088768458SSam Leffler 2216464079fSSam Leffler MALLOC_DEFINE(M_IPSEC_INPCB, "inpcbpolicy", "inpcb-resident ipsec policy"); 2226464079fSSam Leffler 22388768458SSam Leffler /* 22488768458SSam Leffler * Return a held reference to the default SP. 22588768458SSam Leffler */ 22688768458SSam Leffler static struct secpolicy * 22788768458SSam Leffler key_allocsp_default(const char* where, int tag) 22888768458SSam Leffler { 22988768458SSam Leffler struct secpolicy *sp; 23088768458SSam Leffler 23188768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 23288768458SSam Leffler printf("DP key_allocsp_default from %s:%u\n", where, tag)); 23388768458SSam Leffler 23488768458SSam Leffler sp = &ip4_def_policy; 23588768458SSam Leffler if (sp->policy != IPSEC_POLICY_DISCARD && 23688768458SSam Leffler sp->policy != IPSEC_POLICY_NONE) { 23788768458SSam Leffler ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n", 23888768458SSam Leffler sp->policy, IPSEC_POLICY_NONE)); 23988768458SSam Leffler sp->policy = IPSEC_POLICY_NONE; 24088768458SSam Leffler } 241422e4f5bSSam Leffler key_addref(sp); 24288768458SSam Leffler 24388768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 24488768458SSam Leffler printf("DP key_allocsp_default returns SP:%p (%u)\n", 24588768458SSam Leffler sp, sp->refcnt)); 24688768458SSam Leffler return sp; 24788768458SSam Leffler } 24888768458SSam Leffler #define KEY_ALLOCSP_DEFAULT() \ 24988768458SSam Leffler key_allocsp_default(__FILE__, __LINE__) 25088768458SSam Leffler 25188768458SSam Leffler /* 25288768458SSam Leffler * For OUTBOUND packet having a socket. Searching SPD for packet, 25388768458SSam Leffler * and return a pointer to SP. 25488768458SSam Leffler * OUT: NULL: no apropreate SP found, the following value is set to error. 25588768458SSam Leffler * 0 : bypass 25688768458SSam Leffler * EACCES : discard packet. 25788768458SSam Leffler * ENOENT : ipsec_acquire() in progress, maybe. 25888768458SSam Leffler * others : error occured. 25988768458SSam Leffler * others: a pointer to SP 26088768458SSam Leffler * 26188768458SSam Leffler * NOTE: IPv6 mapped adddress concern is implemented here. 26288768458SSam Leffler */ 26388768458SSam Leffler struct secpolicy * 26488768458SSam Leffler ipsec_getpolicy(struct tdb_ident *tdbi, u_int dir) 26588768458SSam Leffler { 26688768458SSam Leffler struct secpolicy *sp; 26788768458SSam Leffler 2689ffa9677SSam Leffler IPSEC_ASSERT(tdbi != NULL, ("null tdbi")); 2699ffa9677SSam Leffler IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 2709ffa9677SSam Leffler ("invalid direction %u", dir)); 27188768458SSam Leffler 27288768458SSam Leffler sp = KEY_ALLOCSP2(tdbi->spi, &tdbi->dst, tdbi->proto, dir); 27388768458SSam Leffler if (sp == NULL) /*XXX????*/ 27488768458SSam Leffler sp = KEY_ALLOCSP_DEFAULT(); 2759ffa9677SSam Leffler IPSEC_ASSERT(sp != NULL, ("null SP")); 27688768458SSam Leffler return sp; 27788768458SSam Leffler } 27888768458SSam Leffler 27988768458SSam Leffler /* 28088768458SSam Leffler * For OUTBOUND packet having a socket. Searching SPD for packet, 28188768458SSam Leffler * and return a pointer to SP. 28288768458SSam Leffler * OUT: NULL: no apropreate SP found, the following value is set to error. 28388768458SSam Leffler * 0 : bypass 28488768458SSam Leffler * EACCES : discard packet. 28588768458SSam Leffler * ENOENT : ipsec_acquire() in progress, maybe. 28688768458SSam Leffler * others : error occured. 28788768458SSam Leffler * others: a pointer to SP 28888768458SSam Leffler * 28988768458SSam Leffler * NOTE: IPv6 mapped adddress concern is implemented here. 29088768458SSam Leffler */ 29188768458SSam Leffler struct secpolicy * 29288768458SSam Leffler ipsec_getpolicybysock(m, dir, inp, error) 29388768458SSam Leffler struct mbuf *m; 29488768458SSam Leffler u_int dir; 29588768458SSam Leffler struct inpcb *inp; 29688768458SSam Leffler int *error; 29788768458SSam Leffler { 29888768458SSam Leffler struct inpcbpolicy *pcbsp = NULL; 29988768458SSam Leffler struct secpolicy *currsp = NULL; /* policy on socket */ 30088768458SSam Leffler struct secpolicy *sp; 30188768458SSam Leffler 3029ffa9677SSam Leffler IPSEC_ASSERT(m != NULL, ("null mbuf")); 3039ffa9677SSam Leffler IPSEC_ASSERT(inp != NULL, ("null inpcb")); 3049ffa9677SSam Leffler IPSEC_ASSERT(error != NULL, ("null error")); 3059ffa9677SSam Leffler IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 3069ffa9677SSam Leffler ("invalid direction %u", dir)); 30788768458SSam Leffler 30888768458SSam Leffler /* set spidx in pcb */ 3099c3309d1SJonathan Lemon if (inp->inp_vflag & INP_IPV6PROTO) { 310595064e8SSam Leffler #ifdef INET6 31188768458SSam Leffler *error = ipsec6_setspidx_in6pcb(m, inp); 31288768458SSam Leffler pcbsp = inp->in6p_sp; 313595064e8SSam Leffler #else 314595064e8SSam Leffler *error = EINVAL; /* should not happen */ 315595064e8SSam Leffler #endif 3169c3309d1SJonathan Lemon } else { 3179c3309d1SJonathan Lemon *error = ipsec4_setspidx_inpcb(m, inp); 3189c3309d1SJonathan Lemon pcbsp = inp->inp_sp; 31988768458SSam Leffler } 32088768458SSam Leffler if (*error) 32188768458SSam Leffler return NULL; 32288768458SSam Leffler 3239ffa9677SSam Leffler IPSEC_ASSERT(pcbsp != NULL, ("null pcbsp")); 32488768458SSam Leffler switch (dir) { 32588768458SSam Leffler case IPSEC_DIR_INBOUND: 32688768458SSam Leffler currsp = pcbsp->sp_in; 32788768458SSam Leffler break; 32888768458SSam Leffler case IPSEC_DIR_OUTBOUND: 32988768458SSam Leffler currsp = pcbsp->sp_out; 33088768458SSam Leffler break; 33188768458SSam Leffler } 3329ffa9677SSam Leffler IPSEC_ASSERT(currsp != NULL, ("null currsp")); 33388768458SSam Leffler 33488768458SSam Leffler if (pcbsp->priv) { /* when privilieged socket */ 33588768458SSam Leffler switch (currsp->policy) { 33688768458SSam Leffler case IPSEC_POLICY_BYPASS: 33788768458SSam Leffler case IPSEC_POLICY_IPSEC: 338422e4f5bSSam Leffler key_addref(currsp); 33988768458SSam Leffler sp = currsp; 34088768458SSam Leffler break; 34188768458SSam Leffler 34288768458SSam Leffler case IPSEC_POLICY_ENTRUST: 34388768458SSam Leffler /* look for a policy in SPD */ 34488768458SSam Leffler sp = KEY_ALLOCSP(&currsp->spidx, dir); 34588768458SSam Leffler if (sp == NULL) /* no SP found */ 34688768458SSam Leffler sp = KEY_ALLOCSP_DEFAULT(); 34788768458SSam Leffler break; 34888768458SSam Leffler 34988768458SSam Leffler default: 3509ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: Invalid policy for PCB %d\n", 3519ffa9677SSam Leffler __func__, currsp->policy)); 35288768458SSam Leffler *error = EINVAL; 35388768458SSam Leffler return NULL; 35488768458SSam Leffler } 35588768458SSam Leffler } else { /* unpriv, SPD has policy */ 35688768458SSam Leffler sp = KEY_ALLOCSP(&currsp->spidx, dir); 35788768458SSam Leffler if (sp == NULL) { /* no SP found */ 35888768458SSam Leffler switch (currsp->policy) { 35988768458SSam Leffler case IPSEC_POLICY_BYPASS: 3609ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: Illegal policy for " 3619ffa9677SSam Leffler "non-priviliged defined %d\n", 3629ffa9677SSam Leffler __func__, currsp->policy)); 36388768458SSam Leffler *error = EINVAL; 36488768458SSam Leffler return NULL; 36588768458SSam Leffler 36688768458SSam Leffler case IPSEC_POLICY_ENTRUST: 36788768458SSam Leffler sp = KEY_ALLOCSP_DEFAULT(); 36888768458SSam Leffler break; 36988768458SSam Leffler 37088768458SSam Leffler case IPSEC_POLICY_IPSEC: 371422e4f5bSSam Leffler key_addref(currsp); 37288768458SSam Leffler sp = currsp; 37388768458SSam Leffler break; 37488768458SSam Leffler 37588768458SSam Leffler default: 3769ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: Invalid policy for " 3779ffa9677SSam Leffler "PCB %d\n", __func__, currsp->policy)); 37888768458SSam Leffler *error = EINVAL; 37988768458SSam Leffler return NULL; 38088768458SSam Leffler } 38188768458SSam Leffler } 38288768458SSam Leffler } 3839ffa9677SSam Leffler IPSEC_ASSERT(sp != NULL, 3849ffa9677SSam Leffler ("null SP (priv %u policy %u", pcbsp->priv, currsp->policy)); 38588768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_STAMP, 3869ffa9677SSam Leffler printf("DP %s (priv %u policy %u) allocate SP:%p (refcnt %u)\n", 3879ffa9677SSam Leffler __func__, pcbsp->priv, currsp->policy, sp, sp->refcnt)); 38888768458SSam Leffler return sp; 38988768458SSam Leffler } 39088768458SSam Leffler 39188768458SSam Leffler /* 39288768458SSam Leffler * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet, 39388768458SSam Leffler * and return a pointer to SP. 39488768458SSam Leffler * OUT: positive: a pointer to the entry for security policy leaf matched. 39588768458SSam Leffler * NULL: no apropreate SP found, the following value is set to error. 39688768458SSam Leffler * 0 : bypass 39788768458SSam Leffler * EACCES : discard packet. 39888768458SSam Leffler * ENOENT : ipsec_acquire() in progress, maybe. 39988768458SSam Leffler * others : error occured. 40088768458SSam Leffler */ 40188768458SSam Leffler struct secpolicy * 40288768458SSam Leffler ipsec_getpolicybyaddr(m, dir, flag, error) 40388768458SSam Leffler struct mbuf *m; 40488768458SSam Leffler u_int dir; 40588768458SSam Leffler int flag; 40688768458SSam Leffler int *error; 40788768458SSam Leffler { 40888768458SSam Leffler struct secpolicyindex spidx; 40988768458SSam Leffler struct secpolicy *sp; 41088768458SSam Leffler 4119ffa9677SSam Leffler IPSEC_ASSERT(m != NULL, ("null mbuf")); 4129ffa9677SSam Leffler IPSEC_ASSERT(error != NULL, ("null error")); 4139ffa9677SSam Leffler IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND, 4149ffa9677SSam Leffler ("invalid direction %u", dir)); 41588768458SSam Leffler 41688768458SSam Leffler sp = NULL; 41788768458SSam Leffler if (key_havesp(dir)) { 4189d5abbddSJens Schweikhardt /* Make an index to look for a policy. */ 41988768458SSam Leffler *error = ipsec_setspidx(m, &spidx, 42088768458SSam Leffler (flag & IP_FORWARDING) ? 0 : 1); 42188768458SSam Leffler if (*error != 0) { 4229ffa9677SSam Leffler DPRINTF(("%s: setpidx failed, dir %u flag %u\n", 4239ffa9677SSam Leffler __func__, dir, flag)); 42488768458SSam Leffler return NULL; 42588768458SSam Leffler } 42688768458SSam Leffler spidx.dir = dir; 42788768458SSam Leffler 42888768458SSam Leffler sp = KEY_ALLOCSP(&spidx, dir); 42988768458SSam Leffler } 43088768458SSam Leffler if (sp == NULL) /* no SP found, use system default */ 43188768458SSam Leffler sp = KEY_ALLOCSP_DEFAULT(); 4329ffa9677SSam Leffler IPSEC_ASSERT(sp != NULL, ("null SP")); 43388768458SSam Leffler return sp; 43488768458SSam Leffler } 43588768458SSam Leffler 43688768458SSam Leffler struct secpolicy * 43788768458SSam Leffler ipsec4_checkpolicy(m, dir, flag, error, inp) 43888768458SSam Leffler struct mbuf *m; 43988768458SSam Leffler u_int dir, flag; 44088768458SSam Leffler int *error; 44188768458SSam Leffler struct inpcb *inp; 44288768458SSam Leffler { 44388768458SSam Leffler struct secpolicy *sp; 44488768458SSam Leffler 44588768458SSam Leffler *error = 0; 44688768458SSam Leffler if (inp == NULL) 44788768458SSam Leffler sp = ipsec_getpolicybyaddr(m, dir, flag, error); 44888768458SSam Leffler else 44988768458SSam Leffler sp = ipsec_getpolicybysock(m, dir, inp, error); 45088768458SSam Leffler if (sp == NULL) { 4519ffa9677SSam Leffler IPSEC_ASSERT(*error != 0, ("getpolicy failed w/o error")); 45288768458SSam Leffler newipsecstat.ips_out_inval++; 45388768458SSam Leffler return NULL; 45488768458SSam Leffler } 4559ffa9677SSam Leffler IPSEC_ASSERT(*error == 0, ("sp w/ error set to %u", *error)); 45688768458SSam Leffler switch (sp->policy) { 45788768458SSam Leffler case IPSEC_POLICY_ENTRUST: 45888768458SSam Leffler default: 4599ffa9677SSam Leffler printf("%s: invalid policy %u\n", __func__, sp->policy); 46088768458SSam Leffler /* fall thru... */ 46188768458SSam Leffler case IPSEC_POLICY_DISCARD: 46288768458SSam Leffler newipsecstat.ips_out_polvio++; 46388768458SSam Leffler *error = -EINVAL; /* packet is discarded by caller */ 46488768458SSam Leffler break; 46588768458SSam Leffler case IPSEC_POLICY_BYPASS: 46688768458SSam Leffler case IPSEC_POLICY_NONE: 46788768458SSam Leffler KEY_FREESP(&sp); 46888768458SSam Leffler sp = NULL; /* NB: force NULL result */ 46988768458SSam Leffler break; 47088768458SSam Leffler case IPSEC_POLICY_IPSEC: 47188768458SSam Leffler if (sp->req == NULL) /* acquire an SA */ 47288768458SSam Leffler *error = key_spdacquire(sp); 47388768458SSam Leffler break; 47488768458SSam Leffler } 47588768458SSam Leffler if (*error != 0) { 47688768458SSam Leffler KEY_FREESP(&sp); 47788768458SSam Leffler sp = NULL; 47888768458SSam Leffler } 47988768458SSam Leffler return sp; 48088768458SSam Leffler } 48188768458SSam Leffler 48288768458SSam Leffler static int 48388768458SSam Leffler ipsec4_setspidx_inpcb(m, pcb) 48488768458SSam Leffler struct mbuf *m; 48588768458SSam Leffler struct inpcb *pcb; 48688768458SSam Leffler { 48788768458SSam Leffler int error; 48888768458SSam Leffler 4899ffa9677SSam Leffler IPSEC_ASSERT(pcb != NULL, ("null pcb")); 4909ffa9677SSam Leffler IPSEC_ASSERT(pcb->inp_sp != NULL, ("null inp_sp")); 4919ffa9677SSam Leffler IPSEC_ASSERT(pcb->inp_sp->sp_out != NULL && pcb->inp_sp->sp_in != NULL, 4929ffa9677SSam Leffler ("null sp_in || sp_out")); 49388768458SSam Leffler 49488768458SSam Leffler error = ipsec_setspidx(m, &pcb->inp_sp->sp_in->spidx, 1); 49588768458SSam Leffler if (error == 0) { 49688768458SSam Leffler pcb->inp_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND; 49788768458SSam Leffler pcb->inp_sp->sp_out->spidx = pcb->inp_sp->sp_in->spidx; 49888768458SSam Leffler pcb->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND; 49988768458SSam Leffler } else { 50088768458SSam Leffler bzero(&pcb->inp_sp->sp_in->spidx, 50188768458SSam Leffler sizeof (pcb->inp_sp->sp_in->spidx)); 50288768458SSam Leffler bzero(&pcb->inp_sp->sp_out->spidx, 50388768458SSam Leffler sizeof (pcb->inp_sp->sp_in->spidx)); 50488768458SSam Leffler } 50588768458SSam Leffler return error; 50688768458SSam Leffler } 50788768458SSam Leffler 50888768458SSam Leffler #ifdef INET6 50988768458SSam Leffler static int 51088768458SSam Leffler ipsec6_setspidx_in6pcb(m, pcb) 51188768458SSam Leffler struct mbuf *m; 51288768458SSam Leffler struct in6pcb *pcb; 51388768458SSam Leffler { 51488768458SSam Leffler struct secpolicyindex *spidx; 51588768458SSam Leffler int error; 51688768458SSam Leffler 5179ffa9677SSam Leffler IPSEC_ASSERT(pcb != NULL, ("null pcb")); 5189ffa9677SSam Leffler IPSEC_ASSERT(pcb->in6p_sp != NULL, ("null inp_sp")); 5199ffa9677SSam Leffler IPSEC_ASSERT(pcb->in6p_sp->sp_out != NULL && pcb->in6p_sp->sp_in != NULL, 5209ffa9677SSam Leffler ("null sp_in || sp_out")); 52188768458SSam Leffler 52288768458SSam Leffler bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx)); 52388768458SSam Leffler bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx)); 52488768458SSam Leffler 52588768458SSam Leffler spidx = &pcb->in6p_sp->sp_in->spidx; 52688768458SSam Leffler error = ipsec_setspidx(m, spidx, 1); 52788768458SSam Leffler if (error) 52888768458SSam Leffler goto bad; 52988768458SSam Leffler spidx->dir = IPSEC_DIR_INBOUND; 53088768458SSam Leffler 53188768458SSam Leffler spidx = &pcb->in6p_sp->sp_out->spidx; 53288768458SSam Leffler error = ipsec_setspidx(m, spidx, 1); 53388768458SSam Leffler if (error) 53488768458SSam Leffler goto bad; 53588768458SSam Leffler spidx->dir = IPSEC_DIR_OUTBOUND; 53688768458SSam Leffler 53788768458SSam Leffler return 0; 53888768458SSam Leffler 53988768458SSam Leffler bad: 54088768458SSam Leffler bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx)); 54188768458SSam Leffler bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx)); 54288768458SSam Leffler return error; 54388768458SSam Leffler } 54488768458SSam Leffler #endif 54588768458SSam Leffler 54688768458SSam Leffler /* 54788768458SSam Leffler * configure security policy index (src/dst/proto/sport/dport) 54888768458SSam Leffler * by looking at the content of mbuf. 54988768458SSam Leffler * the caller is responsible for error recovery (like clearing up spidx). 55088768458SSam Leffler */ 55188768458SSam Leffler static int 55288768458SSam Leffler ipsec_setspidx(m, spidx, needport) 55388768458SSam Leffler struct mbuf *m; 55488768458SSam Leffler struct secpolicyindex *spidx; 55588768458SSam Leffler int needport; 55688768458SSam Leffler { 55788768458SSam Leffler struct ip *ip = NULL; 55888768458SSam Leffler struct ip ipbuf; 55988768458SSam Leffler u_int v; 56088768458SSam Leffler struct mbuf *n; 56188768458SSam Leffler int len; 56288768458SSam Leffler int error; 56388768458SSam Leffler 5649ffa9677SSam Leffler IPSEC_ASSERT(m != NULL, ("null mbuf")); 56588768458SSam Leffler 56688768458SSam Leffler /* 56788768458SSam Leffler * validate m->m_pkthdr.len. we see incorrect length if we 56888768458SSam Leffler * mistakenly call this function with inconsistent mbuf chain 56988768458SSam Leffler * (like 4.4BSD tcp/udp processing). XXX should we panic here? 57088768458SSam Leffler */ 57188768458SSam Leffler len = 0; 57288768458SSam Leffler for (n = m; n; n = n->m_next) 57388768458SSam Leffler len += n->m_len; 57488768458SSam Leffler if (m->m_pkthdr.len != len) { 57588768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 5769ffa9677SSam Leffler printf("%s: pkthdr len(%d) mismatch (%d), ignored.\n", 5779ffa9677SSam Leffler __func__, len, m->m_pkthdr.len)); 57888768458SSam Leffler return EINVAL; 57988768458SSam Leffler } 58088768458SSam Leffler 58188768458SSam Leffler if (m->m_pkthdr.len < sizeof(struct ip)) { 58288768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 5839ffa9677SSam Leffler printf("%s: pkthdr len(%d) too small (v4), ignored.\n", 5849ffa9677SSam Leffler __func__, m->m_pkthdr.len)); 58588768458SSam Leffler return EINVAL; 58688768458SSam Leffler } 58788768458SSam Leffler 58888768458SSam Leffler if (m->m_len >= sizeof(*ip)) 58988768458SSam Leffler ip = mtod(m, struct ip *); 59088768458SSam Leffler else { 59188768458SSam Leffler m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf); 59288768458SSam Leffler ip = &ipbuf; 59388768458SSam Leffler } 59488768458SSam Leffler #ifdef _IP_VHL 59588768458SSam Leffler v = _IP_VHL_V(ip->ip_vhl); 59688768458SSam Leffler #else 59788768458SSam Leffler v = ip->ip_v; 59888768458SSam Leffler #endif 59988768458SSam Leffler switch (v) { 60088768458SSam Leffler case 4: 60188768458SSam Leffler error = ipsec4_setspidx_ipaddr(m, spidx); 60288768458SSam Leffler if (error) 60388768458SSam Leffler return error; 60488768458SSam Leffler ipsec4_get_ulp(m, spidx, needport); 60588768458SSam Leffler return 0; 60688768458SSam Leffler #ifdef INET6 60788768458SSam Leffler case 6: 60888768458SSam Leffler if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) { 60988768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 6109ffa9677SSam Leffler printf("%s: pkthdr len(%d) too small (v6), " 6119ffa9677SSam Leffler "ignored\n", __func__, m->m_pkthdr.len)); 61288768458SSam Leffler return EINVAL; 61388768458SSam Leffler } 61488768458SSam Leffler error = ipsec6_setspidx_ipaddr(m, spidx); 61588768458SSam Leffler if (error) 61688768458SSam Leffler return error; 61788768458SSam Leffler ipsec6_get_ulp(m, spidx, needport); 61888768458SSam Leffler return 0; 61988768458SSam Leffler #endif 62088768458SSam Leffler default: 62188768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 6229ffa9677SSam Leffler printf("%s: " "unknown IP version %u, ignored.\n", 6239ffa9677SSam Leffler __func__, v)); 62488768458SSam Leffler return EINVAL; 62588768458SSam Leffler } 62688768458SSam Leffler } 62788768458SSam Leffler 62888768458SSam Leffler static void 62988768458SSam Leffler ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport) 63088768458SSam Leffler { 63188768458SSam Leffler u_int8_t nxt; 63288768458SSam Leffler int off; 63388768458SSam Leffler 63488768458SSam Leffler /* sanity check */ 6359ffa9677SSam Leffler IPSEC_ASSERT(m != NULL, ("null mbuf")); 6369ffa9677SSam Leffler IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip),("packet too short")); 63788768458SSam Leffler 63888768458SSam Leffler /* NB: ip_input() flips it into host endian XXX need more checking */ 63988768458SSam Leffler if (m->m_len < sizeof (struct ip)) { 64088768458SSam Leffler struct ip *ip = mtod(m, struct ip *); 64188768458SSam Leffler if (ip->ip_off & (IP_MF | IP_OFFMASK)) 64288768458SSam Leffler goto done; 64388768458SSam Leffler #ifdef _IP_VHL 64488768458SSam Leffler off = _IP_VHL_HL(ip->ip_vhl) << 2; 64588768458SSam Leffler #else 64688768458SSam Leffler off = ip->ip_hl << 2; 64788768458SSam Leffler #endif 64888768458SSam Leffler nxt = ip->ip_p; 64988768458SSam Leffler } else { 65088768458SSam Leffler struct ip ih; 65188768458SSam Leffler 65288768458SSam Leffler m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih); 65388768458SSam Leffler if (ih.ip_off & (IP_MF | IP_OFFMASK)) 65488768458SSam Leffler goto done; 65588768458SSam Leffler #ifdef _IP_VHL 65688768458SSam Leffler off = _IP_VHL_HL(ih.ip_vhl) << 2; 65788768458SSam Leffler #else 65888768458SSam Leffler off = ih.ip_hl << 2; 65988768458SSam Leffler #endif 66088768458SSam Leffler nxt = ih.ip_p; 66188768458SSam Leffler } 66288768458SSam Leffler 66388768458SSam Leffler while (off < m->m_pkthdr.len) { 66488768458SSam Leffler struct ip6_ext ip6e; 66588768458SSam Leffler struct tcphdr th; 66688768458SSam Leffler struct udphdr uh; 66788768458SSam Leffler 66888768458SSam Leffler switch (nxt) { 66988768458SSam Leffler case IPPROTO_TCP: 67088768458SSam Leffler spidx->ul_proto = nxt; 67188768458SSam Leffler if (!needport) 67288768458SSam Leffler goto done_proto; 67388768458SSam Leffler if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 67488768458SSam Leffler goto done; 67588768458SSam Leffler m_copydata(m, off, sizeof (th), (caddr_t) &th); 67688768458SSam Leffler spidx->src.sin.sin_port = th.th_sport; 67788768458SSam Leffler spidx->dst.sin.sin_port = th.th_dport; 67888768458SSam Leffler return; 67988768458SSam Leffler case IPPROTO_UDP: 68088768458SSam Leffler spidx->ul_proto = nxt; 68188768458SSam Leffler if (!needport) 68288768458SSam Leffler goto done_proto; 68388768458SSam Leffler if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 68488768458SSam Leffler goto done; 68588768458SSam Leffler m_copydata(m, off, sizeof (uh), (caddr_t) &uh); 68688768458SSam Leffler spidx->src.sin.sin_port = uh.uh_sport; 68788768458SSam Leffler spidx->dst.sin.sin_port = uh.uh_dport; 68888768458SSam Leffler return; 68988768458SSam Leffler case IPPROTO_AH: 690afa3570dSSam Leffler if (off + sizeof(ip6e) > m->m_pkthdr.len) 69188768458SSam Leffler goto done; 69288768458SSam Leffler /* XXX sigh, this works but is totally bogus */ 69388768458SSam Leffler m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e); 69488768458SSam Leffler off += (ip6e.ip6e_len + 2) << 2; 69588768458SSam Leffler nxt = ip6e.ip6e_nxt; 69688768458SSam Leffler break; 69788768458SSam Leffler case IPPROTO_ICMP: 69888768458SSam Leffler default: 69988768458SSam Leffler /* XXX intermediate headers??? */ 70088768458SSam Leffler spidx->ul_proto = nxt; 70188768458SSam Leffler goto done_proto; 70288768458SSam Leffler } 70388768458SSam Leffler } 70488768458SSam Leffler done: 70588768458SSam Leffler spidx->ul_proto = IPSEC_ULPROTO_ANY; 70688768458SSam Leffler done_proto: 70788768458SSam Leffler spidx->src.sin.sin_port = IPSEC_PORT_ANY; 70888768458SSam Leffler spidx->dst.sin.sin_port = IPSEC_PORT_ANY; 70988768458SSam Leffler } 71088768458SSam Leffler 71188768458SSam Leffler /* assumes that m is sane */ 71288768458SSam Leffler static int 71388768458SSam Leffler ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx) 71488768458SSam Leffler { 71588768458SSam Leffler static const struct sockaddr_in template = { 71688768458SSam Leffler sizeof (struct sockaddr_in), 71788768458SSam Leffler AF_INET, 71888768458SSam Leffler 0, { 0 }, { 0, 0, 0, 0, 0, 0, 0, 0 } 71988768458SSam Leffler }; 72088768458SSam Leffler 72188768458SSam Leffler spidx->src.sin = template; 72288768458SSam Leffler spidx->dst.sin = template; 72388768458SSam Leffler 72488768458SSam Leffler if (m->m_len < sizeof (struct ip)) { 72588768458SSam Leffler m_copydata(m, offsetof(struct ip, ip_src), 72688768458SSam Leffler sizeof (struct in_addr), 72788768458SSam Leffler (caddr_t) &spidx->src.sin.sin_addr); 72888768458SSam Leffler m_copydata(m, offsetof(struct ip, ip_dst), 72988768458SSam Leffler sizeof (struct in_addr), 73088768458SSam Leffler (caddr_t) &spidx->dst.sin.sin_addr); 73188768458SSam Leffler } else { 73288768458SSam Leffler struct ip *ip = mtod(m, struct ip *); 73388768458SSam Leffler spidx->src.sin.sin_addr = ip->ip_src; 73488768458SSam Leffler spidx->dst.sin.sin_addr = ip->ip_dst; 73588768458SSam Leffler } 73688768458SSam Leffler 73788768458SSam Leffler spidx->prefs = sizeof(struct in_addr) << 3; 73888768458SSam Leffler spidx->prefd = sizeof(struct in_addr) << 3; 73988768458SSam Leffler 74088768458SSam Leffler return 0; 74188768458SSam Leffler } 74288768458SSam Leffler 74388768458SSam Leffler #ifdef INET6 74488768458SSam Leffler static void 74588768458SSam Leffler ipsec6_get_ulp(m, spidx, needport) 74688768458SSam Leffler struct mbuf *m; 74788768458SSam Leffler struct secpolicyindex *spidx; 74888768458SSam Leffler int needport; 74988768458SSam Leffler { 75088768458SSam Leffler int off, nxt; 75188768458SSam Leffler struct tcphdr th; 75288768458SSam Leffler struct udphdr uh; 75388768458SSam Leffler 75488768458SSam Leffler /* sanity check */ 75588768458SSam Leffler if (m == NULL) 7569ffa9677SSam Leffler panic("%s: NULL pointer was passed.\n", __func__); 75788768458SSam Leffler 75888768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 7599ffa9677SSam Leffler printf("%s:\n", __func__); kdebug_mbuf(m)); 76088768458SSam Leffler 76188768458SSam Leffler /* set default */ 76288768458SSam Leffler spidx->ul_proto = IPSEC_ULPROTO_ANY; 76388768458SSam Leffler ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY; 76488768458SSam Leffler ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY; 76588768458SSam Leffler 76688768458SSam Leffler nxt = -1; 76788768458SSam Leffler off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt); 76888768458SSam Leffler if (off < 0 || m->m_pkthdr.len < off) 76988768458SSam Leffler return; 77088768458SSam Leffler 77188768458SSam Leffler switch (nxt) { 77288768458SSam Leffler case IPPROTO_TCP: 77388768458SSam Leffler spidx->ul_proto = nxt; 77488768458SSam Leffler if (!needport) 77588768458SSam Leffler break; 77688768458SSam Leffler if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) 77788768458SSam Leffler break; 77888768458SSam Leffler m_copydata(m, off, sizeof(th), (caddr_t)&th); 77988768458SSam Leffler ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport; 78088768458SSam Leffler ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport; 78188768458SSam Leffler break; 78288768458SSam Leffler case IPPROTO_UDP: 78388768458SSam Leffler spidx->ul_proto = nxt; 78488768458SSam Leffler if (!needport) 78588768458SSam Leffler break; 78688768458SSam Leffler if (off + sizeof(struct udphdr) > m->m_pkthdr.len) 78788768458SSam Leffler break; 78888768458SSam Leffler m_copydata(m, off, sizeof(uh), (caddr_t)&uh); 78988768458SSam Leffler ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport; 79088768458SSam Leffler ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport; 79188768458SSam Leffler break; 79288768458SSam Leffler case IPPROTO_ICMPV6: 79388768458SSam Leffler default: 79488768458SSam Leffler /* XXX intermediate headers??? */ 79588768458SSam Leffler spidx->ul_proto = nxt; 79688768458SSam Leffler break; 79788768458SSam Leffler } 79888768458SSam Leffler } 79988768458SSam Leffler 80088768458SSam Leffler /* assumes that m is sane */ 80188768458SSam Leffler static int 80288768458SSam Leffler ipsec6_setspidx_ipaddr(m, spidx) 80388768458SSam Leffler struct mbuf *m; 80488768458SSam Leffler struct secpolicyindex *spidx; 80588768458SSam Leffler { 80688768458SSam Leffler struct ip6_hdr *ip6 = NULL; 80788768458SSam Leffler struct ip6_hdr ip6buf; 80888768458SSam Leffler struct sockaddr_in6 *sin6; 80988768458SSam Leffler 81088768458SSam Leffler if (m->m_len >= sizeof(*ip6)) 81188768458SSam Leffler ip6 = mtod(m, struct ip6_hdr *); 81288768458SSam Leffler else { 81388768458SSam Leffler m_copydata(m, 0, sizeof(ip6buf), (caddr_t)&ip6buf); 81488768458SSam Leffler ip6 = &ip6buf; 81588768458SSam Leffler } 81688768458SSam Leffler 81788768458SSam Leffler sin6 = (struct sockaddr_in6 *)&spidx->src; 81888768458SSam Leffler bzero(sin6, sizeof(*sin6)); 81988768458SSam Leffler sin6->sin6_family = AF_INET6; 82088768458SSam Leffler sin6->sin6_len = sizeof(struct sockaddr_in6); 82188768458SSam Leffler bcopy(&ip6->ip6_src, &sin6->sin6_addr, sizeof(ip6->ip6_src)); 82288768458SSam Leffler if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) { 82388768458SSam Leffler sin6->sin6_addr.s6_addr16[1] = 0; 82488768458SSam Leffler sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]); 82588768458SSam Leffler } 82688768458SSam Leffler spidx->prefs = sizeof(struct in6_addr) << 3; 82788768458SSam Leffler 82888768458SSam Leffler sin6 = (struct sockaddr_in6 *)&spidx->dst; 82988768458SSam Leffler bzero(sin6, sizeof(*sin6)); 83088768458SSam Leffler sin6->sin6_family = AF_INET6; 83188768458SSam Leffler sin6->sin6_len = sizeof(struct sockaddr_in6); 83288768458SSam Leffler bcopy(&ip6->ip6_dst, &sin6->sin6_addr, sizeof(ip6->ip6_dst)); 83388768458SSam Leffler if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) { 83488768458SSam Leffler sin6->sin6_addr.s6_addr16[1] = 0; 83588768458SSam Leffler sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]); 83688768458SSam Leffler } 83788768458SSam Leffler spidx->prefd = sizeof(struct in6_addr) << 3; 83888768458SSam Leffler 83988768458SSam Leffler return 0; 84088768458SSam Leffler } 84188768458SSam Leffler #endif 84288768458SSam Leffler 84388768458SSam Leffler static void 84488768458SSam Leffler ipsec_delpcbpolicy(p) 84588768458SSam Leffler struct inpcbpolicy *p; 84688768458SSam Leffler { 8476464079fSSam Leffler free(p, M_IPSEC_INPCB); 84888768458SSam Leffler } 84988768458SSam Leffler 85088768458SSam Leffler /* initialize policy in PCB */ 85188768458SSam Leffler int 85288768458SSam Leffler ipsec_init_policy(so, pcb_sp) 85388768458SSam Leffler struct socket *so; 85488768458SSam Leffler struct inpcbpolicy **pcb_sp; 85588768458SSam Leffler { 85688768458SSam Leffler struct inpcbpolicy *new; 85788768458SSam Leffler 85888768458SSam Leffler /* sanity check. */ 85988768458SSam Leffler if (so == NULL || pcb_sp == NULL) 8609ffa9677SSam Leffler panic("%s: NULL pointer was passed.\n", __func__); 86188768458SSam Leffler 86288768458SSam Leffler new = (struct inpcbpolicy *) malloc(sizeof(struct inpcbpolicy), 8636464079fSSam Leffler M_IPSEC_INPCB, M_NOWAIT|M_ZERO); 86488768458SSam Leffler if (new == NULL) { 8659ffa9677SSam Leffler ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 86688768458SSam Leffler return ENOBUFS; 86788768458SSam Leffler } 86888768458SSam Leffler 8699ffa9677SSam Leffler new->priv = IPSEC_IS_PRIVILEGED_SO(so); 87088768458SSam Leffler 87188768458SSam Leffler if ((new->sp_in = KEY_NEWSP()) == NULL) { 87288768458SSam Leffler ipsec_delpcbpolicy(new); 87388768458SSam Leffler return ENOBUFS; 87488768458SSam Leffler } 87588768458SSam Leffler new->sp_in->state = IPSEC_SPSTATE_ALIVE; 87688768458SSam Leffler new->sp_in->policy = IPSEC_POLICY_ENTRUST; 87788768458SSam Leffler 87888768458SSam Leffler if ((new->sp_out = KEY_NEWSP()) == NULL) { 87988768458SSam Leffler KEY_FREESP(&new->sp_in); 88088768458SSam Leffler ipsec_delpcbpolicy(new); 88188768458SSam Leffler return ENOBUFS; 88288768458SSam Leffler } 88388768458SSam Leffler new->sp_out->state = IPSEC_SPSTATE_ALIVE; 88488768458SSam Leffler new->sp_out->policy = IPSEC_POLICY_ENTRUST; 88588768458SSam Leffler 88688768458SSam Leffler *pcb_sp = new; 88788768458SSam Leffler 88888768458SSam Leffler return 0; 88988768458SSam Leffler } 89088768458SSam Leffler 89188768458SSam Leffler /* copy old ipsec policy into new */ 89288768458SSam Leffler int 89388768458SSam Leffler ipsec_copy_policy(old, new) 89488768458SSam Leffler struct inpcbpolicy *old, *new; 89588768458SSam Leffler { 89688768458SSam Leffler struct secpolicy *sp; 89788768458SSam Leffler 89888768458SSam Leffler sp = ipsec_deepcopy_policy(old->sp_in); 89988768458SSam Leffler if (sp) { 90088768458SSam Leffler KEY_FREESP(&new->sp_in); 90188768458SSam Leffler new->sp_in = sp; 90288768458SSam Leffler } else 90388768458SSam Leffler return ENOBUFS; 90488768458SSam Leffler 90588768458SSam Leffler sp = ipsec_deepcopy_policy(old->sp_out); 90688768458SSam Leffler if (sp) { 90788768458SSam Leffler KEY_FREESP(&new->sp_out); 90888768458SSam Leffler new->sp_out = sp; 90988768458SSam Leffler } else 91088768458SSam Leffler return ENOBUFS; 91188768458SSam Leffler 91288768458SSam Leffler new->priv = old->priv; 91388768458SSam Leffler 91488768458SSam Leffler return 0; 91588768458SSam Leffler } 91688768458SSam Leffler 9176464079fSSam Leffler struct ipsecrequest * 9186464079fSSam Leffler ipsec_newisr(void) 9196464079fSSam Leffler { 9206464079fSSam Leffler struct ipsecrequest *p; 9216464079fSSam Leffler 9226464079fSSam Leffler p = malloc(sizeof(struct ipsecrequest), M_IPSEC_SR, M_NOWAIT|M_ZERO); 9236464079fSSam Leffler if (p != NULL) 9249ffa9677SSam Leffler IPSECREQUEST_LOCK_INIT(p); 9256464079fSSam Leffler return p; 9266464079fSSam Leffler } 9276464079fSSam Leffler 9286464079fSSam Leffler void 9296464079fSSam Leffler ipsec_delisr(struct ipsecrequest *p) 9306464079fSSam Leffler { 9319ffa9677SSam Leffler IPSECREQUEST_LOCK_DESTROY(p); 9326464079fSSam Leffler free(p, M_IPSEC_SR); 9336464079fSSam Leffler } 9346464079fSSam Leffler 93588768458SSam Leffler /* deep-copy a policy in PCB */ 93688768458SSam Leffler static struct secpolicy * 93788768458SSam Leffler ipsec_deepcopy_policy(src) 93888768458SSam Leffler struct secpolicy *src; 93988768458SSam Leffler { 94088768458SSam Leffler struct ipsecrequest *newchain = NULL; 94188768458SSam Leffler struct ipsecrequest *p; 94288768458SSam Leffler struct ipsecrequest **q; 94388768458SSam Leffler struct ipsecrequest *r; 94488768458SSam Leffler struct secpolicy *dst; 94588768458SSam Leffler 94688768458SSam Leffler if (src == NULL) 94788768458SSam Leffler return NULL; 94888768458SSam Leffler dst = KEY_NEWSP(); 94988768458SSam Leffler if (dst == NULL) 95088768458SSam Leffler return NULL; 95188768458SSam Leffler 95288768458SSam Leffler /* 95388768458SSam Leffler * deep-copy IPsec request chain. This is required since struct 95488768458SSam Leffler * ipsecrequest is not reference counted. 95588768458SSam Leffler */ 95688768458SSam Leffler q = &newchain; 95788768458SSam Leffler for (p = src->req; p; p = p->next) { 9586464079fSSam Leffler *q = ipsec_newisr(); 95988768458SSam Leffler if (*q == NULL) 96088768458SSam Leffler goto fail; 96188768458SSam Leffler (*q)->saidx.proto = p->saidx.proto; 96288768458SSam Leffler (*q)->saidx.mode = p->saidx.mode; 96388768458SSam Leffler (*q)->level = p->level; 96488768458SSam Leffler (*q)->saidx.reqid = p->saidx.reqid; 96588768458SSam Leffler 96688768458SSam Leffler bcopy(&p->saidx.src, &(*q)->saidx.src, sizeof((*q)->saidx.src)); 96788768458SSam Leffler bcopy(&p->saidx.dst, &(*q)->saidx.dst, sizeof((*q)->saidx.dst)); 96888768458SSam Leffler 96988768458SSam Leffler (*q)->sp = dst; 97088768458SSam Leffler 97188768458SSam Leffler q = &((*q)->next); 97288768458SSam Leffler } 97388768458SSam Leffler 97488768458SSam Leffler dst->req = newchain; 97588768458SSam Leffler dst->state = src->state; 97688768458SSam Leffler dst->policy = src->policy; 97788768458SSam Leffler /* do not touch the refcnt fields */ 97888768458SSam Leffler 97988768458SSam Leffler return dst; 98088768458SSam Leffler 98188768458SSam Leffler fail: 98288768458SSam Leffler for (p = newchain; p; p = r) { 98388768458SSam Leffler r = p->next; 9846464079fSSam Leffler ipsec_delisr(p); 98588768458SSam Leffler p = NULL; 98688768458SSam Leffler } 98788768458SSam Leffler return NULL; 98888768458SSam Leffler } 98988768458SSam Leffler 99088768458SSam Leffler /* set policy and ipsec request if present. */ 99188768458SSam Leffler static int 99288768458SSam Leffler ipsec_set_policy(pcb_sp, optname, request, len, priv) 99388768458SSam Leffler struct secpolicy **pcb_sp; 99488768458SSam Leffler int optname; 99588768458SSam Leffler caddr_t request; 99688768458SSam Leffler size_t len; 99788768458SSam Leffler int priv; 99888768458SSam Leffler { 99988768458SSam Leffler struct sadb_x_policy *xpl; 100088768458SSam Leffler struct secpolicy *newsp = NULL; 100188768458SSam Leffler int error; 100288768458SSam Leffler 100388768458SSam Leffler /* sanity check. */ 100488768458SSam Leffler if (pcb_sp == NULL || *pcb_sp == NULL || request == NULL) 100588768458SSam Leffler return EINVAL; 100688768458SSam Leffler if (len < sizeof(*xpl)) 100788768458SSam Leffler return EINVAL; 100888768458SSam Leffler xpl = (struct sadb_x_policy *)request; 100988768458SSam Leffler 101088768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 10119ffa9677SSam Leffler printf("%s: passed policy\n", __func__); 101288768458SSam Leffler kdebug_sadb_x_policy((struct sadb_ext *)xpl)); 101388768458SSam Leffler 101488768458SSam Leffler /* check policy type */ 101588768458SSam Leffler /* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */ 101688768458SSam Leffler if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD 101788768458SSam Leffler || xpl->sadb_x_policy_type == IPSEC_POLICY_NONE) 101888768458SSam Leffler return EINVAL; 101988768458SSam Leffler 102088768458SSam Leffler /* check privileged socket */ 102188768458SSam Leffler if (priv == 0 && xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS) 102288768458SSam Leffler return EACCES; 102388768458SSam Leffler 102488768458SSam Leffler /* allocation new SP entry */ 102588768458SSam Leffler if ((newsp = key_msg2sp(xpl, len, &error)) == NULL) 102688768458SSam Leffler return error; 102788768458SSam Leffler 102888768458SSam Leffler newsp->state = IPSEC_SPSTATE_ALIVE; 102988768458SSam Leffler 103088768458SSam Leffler /* clear old SP and set new SP */ 103188768458SSam Leffler KEY_FREESP(pcb_sp); 103288768458SSam Leffler *pcb_sp = newsp; 103388768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 10349ffa9677SSam Leffler printf("%s: new policy\n", __func__); 103588768458SSam Leffler kdebug_secpolicy(newsp)); 103688768458SSam Leffler 103788768458SSam Leffler return 0; 103888768458SSam Leffler } 103988768458SSam Leffler 104088768458SSam Leffler static int 104188768458SSam Leffler ipsec_get_policy(pcb_sp, mp) 104288768458SSam Leffler struct secpolicy *pcb_sp; 104388768458SSam Leffler struct mbuf **mp; 104488768458SSam Leffler { 104588768458SSam Leffler 104688768458SSam Leffler /* sanity check. */ 104788768458SSam Leffler if (pcb_sp == NULL || mp == NULL) 104888768458SSam Leffler return EINVAL; 104988768458SSam Leffler 105088768458SSam Leffler *mp = key_sp2msg(pcb_sp); 105188768458SSam Leffler if (!*mp) { 10529ffa9677SSam Leffler ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__)); 105388768458SSam Leffler return ENOBUFS; 105488768458SSam Leffler } 105588768458SSam Leffler 105688768458SSam Leffler (*mp)->m_type = MT_DATA; 105788768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 10589ffa9677SSam Leffler printf("%s:\n", __func__); kdebug_mbuf(*mp)); 105988768458SSam Leffler 106088768458SSam Leffler return 0; 106188768458SSam Leffler } 106288768458SSam Leffler 106388768458SSam Leffler int 106488768458SSam Leffler ipsec4_set_policy(inp, optname, request, len, priv) 106588768458SSam Leffler struct inpcb *inp; 106688768458SSam Leffler int optname; 106788768458SSam Leffler caddr_t request; 106888768458SSam Leffler size_t len; 106988768458SSam Leffler int priv; 107088768458SSam Leffler { 107188768458SSam Leffler struct sadb_x_policy *xpl; 107288768458SSam Leffler struct secpolicy **pcb_sp; 107388768458SSam Leffler 107488768458SSam Leffler /* sanity check. */ 107588768458SSam Leffler if (inp == NULL || request == NULL) 107688768458SSam Leffler return EINVAL; 107788768458SSam Leffler if (len < sizeof(*xpl)) 107888768458SSam Leffler return EINVAL; 107988768458SSam Leffler xpl = (struct sadb_x_policy *)request; 108088768458SSam Leffler 108188768458SSam Leffler /* select direction */ 108288768458SSam Leffler switch (xpl->sadb_x_policy_dir) { 108388768458SSam Leffler case IPSEC_DIR_INBOUND: 108488768458SSam Leffler pcb_sp = &inp->inp_sp->sp_in; 108588768458SSam Leffler break; 108688768458SSam Leffler case IPSEC_DIR_OUTBOUND: 108788768458SSam Leffler pcb_sp = &inp->inp_sp->sp_out; 108888768458SSam Leffler break; 108988768458SSam Leffler default: 10909ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 109188768458SSam Leffler xpl->sadb_x_policy_dir)); 109288768458SSam Leffler return EINVAL; 109388768458SSam Leffler } 109488768458SSam Leffler 109588768458SSam Leffler return ipsec_set_policy(pcb_sp, optname, request, len, priv); 109688768458SSam Leffler } 109788768458SSam Leffler 109888768458SSam Leffler int 109988768458SSam Leffler ipsec4_get_policy(inp, request, len, mp) 110088768458SSam Leffler struct inpcb *inp; 110188768458SSam Leffler caddr_t request; 110288768458SSam Leffler size_t len; 110388768458SSam Leffler struct mbuf **mp; 110488768458SSam Leffler { 110588768458SSam Leffler struct sadb_x_policy *xpl; 110688768458SSam Leffler struct secpolicy *pcb_sp; 110788768458SSam Leffler 110888768458SSam Leffler /* sanity check. */ 110988768458SSam Leffler if (inp == NULL || request == NULL || mp == NULL) 111088768458SSam Leffler return EINVAL; 11119ffa9677SSam Leffler IPSEC_ASSERT(inp->inp_sp != NULL, ("null inp_sp")); 111288768458SSam Leffler if (len < sizeof(*xpl)) 111388768458SSam Leffler return EINVAL; 111488768458SSam Leffler xpl = (struct sadb_x_policy *)request; 111588768458SSam Leffler 111688768458SSam Leffler /* select direction */ 111788768458SSam Leffler switch (xpl->sadb_x_policy_dir) { 111888768458SSam Leffler case IPSEC_DIR_INBOUND: 111988768458SSam Leffler pcb_sp = inp->inp_sp->sp_in; 112088768458SSam Leffler break; 112188768458SSam Leffler case IPSEC_DIR_OUTBOUND: 112288768458SSam Leffler pcb_sp = inp->inp_sp->sp_out; 112388768458SSam Leffler break; 112488768458SSam Leffler default: 11259ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 112688768458SSam Leffler xpl->sadb_x_policy_dir)); 112788768458SSam Leffler return EINVAL; 112888768458SSam Leffler } 112988768458SSam Leffler 113088768458SSam Leffler return ipsec_get_policy(pcb_sp, mp); 113188768458SSam Leffler } 113288768458SSam Leffler 113388768458SSam Leffler /* delete policy in PCB */ 113488768458SSam Leffler int 113588768458SSam Leffler ipsec4_delete_pcbpolicy(inp) 113688768458SSam Leffler struct inpcb *inp; 113788768458SSam Leffler { 11389ffa9677SSam Leffler IPSEC_ASSERT(inp != NULL, ("null inp")); 113988768458SSam Leffler 114088768458SSam Leffler if (inp->inp_sp == NULL) 114188768458SSam Leffler return 0; 114288768458SSam Leffler 114388768458SSam Leffler if (inp->inp_sp->sp_in != NULL) 114488768458SSam Leffler KEY_FREESP(&inp->inp_sp->sp_in); 114588768458SSam Leffler 114688768458SSam Leffler if (inp->inp_sp->sp_out != NULL) 114788768458SSam Leffler KEY_FREESP(&inp->inp_sp->sp_out); 114888768458SSam Leffler 114988768458SSam Leffler ipsec_delpcbpolicy(inp->inp_sp); 115088768458SSam Leffler inp->inp_sp = NULL; 115188768458SSam Leffler 115288768458SSam Leffler return 0; 115388768458SSam Leffler } 115488768458SSam Leffler 115588768458SSam Leffler #ifdef INET6 115688768458SSam Leffler int 115788768458SSam Leffler ipsec6_set_policy(in6p, optname, request, len, priv) 115888768458SSam Leffler struct in6pcb *in6p; 115988768458SSam Leffler int optname; 116088768458SSam Leffler caddr_t request; 116188768458SSam Leffler size_t len; 116288768458SSam Leffler int priv; 116388768458SSam Leffler { 116488768458SSam Leffler struct sadb_x_policy *xpl; 116588768458SSam Leffler struct secpolicy **pcb_sp; 116688768458SSam Leffler 116788768458SSam Leffler /* sanity check. */ 116888768458SSam Leffler if (in6p == NULL || request == NULL) 116988768458SSam Leffler return EINVAL; 117088768458SSam Leffler if (len < sizeof(*xpl)) 117188768458SSam Leffler return EINVAL; 117288768458SSam Leffler xpl = (struct sadb_x_policy *)request; 117388768458SSam Leffler 117488768458SSam Leffler /* select direction */ 117588768458SSam Leffler switch (xpl->sadb_x_policy_dir) { 117688768458SSam Leffler case IPSEC_DIR_INBOUND: 117788768458SSam Leffler pcb_sp = &in6p->in6p_sp->sp_in; 117888768458SSam Leffler break; 117988768458SSam Leffler case IPSEC_DIR_OUTBOUND: 118088768458SSam Leffler pcb_sp = &in6p->in6p_sp->sp_out; 118188768458SSam Leffler break; 118288768458SSam Leffler default: 11839ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 118488768458SSam Leffler xpl->sadb_x_policy_dir)); 118588768458SSam Leffler return EINVAL; 118688768458SSam Leffler } 118788768458SSam Leffler 118888768458SSam Leffler return ipsec_set_policy(pcb_sp, optname, request, len, priv); 118988768458SSam Leffler } 119088768458SSam Leffler 119188768458SSam Leffler int 119288768458SSam Leffler ipsec6_get_policy(in6p, request, len, mp) 119388768458SSam Leffler struct in6pcb *in6p; 119488768458SSam Leffler caddr_t request; 119588768458SSam Leffler size_t len; 119688768458SSam Leffler struct mbuf **mp; 119788768458SSam Leffler { 119888768458SSam Leffler struct sadb_x_policy *xpl; 119988768458SSam Leffler struct secpolicy *pcb_sp; 120088768458SSam Leffler 120188768458SSam Leffler /* sanity check. */ 120288768458SSam Leffler if (in6p == NULL || request == NULL || mp == NULL) 120388768458SSam Leffler return EINVAL; 12049ffa9677SSam Leffler IPSEC_ASSERT(in6p->in6p_sp != NULL, ("null in6p_sp")); 120588768458SSam Leffler if (len < sizeof(*xpl)) 120688768458SSam Leffler return EINVAL; 120788768458SSam Leffler xpl = (struct sadb_x_policy *)request; 120888768458SSam Leffler 120988768458SSam Leffler /* select direction */ 121088768458SSam Leffler switch (xpl->sadb_x_policy_dir) { 121188768458SSam Leffler case IPSEC_DIR_INBOUND: 121288768458SSam Leffler pcb_sp = in6p->in6p_sp->sp_in; 121388768458SSam Leffler break; 121488768458SSam Leffler case IPSEC_DIR_OUTBOUND: 121588768458SSam Leffler pcb_sp = in6p->in6p_sp->sp_out; 121688768458SSam Leffler break; 121788768458SSam Leffler default: 12189ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__, 121988768458SSam Leffler xpl->sadb_x_policy_dir)); 122088768458SSam Leffler return EINVAL; 122188768458SSam Leffler } 122288768458SSam Leffler 122388768458SSam Leffler return ipsec_get_policy(pcb_sp, mp); 122488768458SSam Leffler } 122588768458SSam Leffler 122688768458SSam Leffler int 122788768458SSam Leffler ipsec6_delete_pcbpolicy(in6p) 122888768458SSam Leffler struct in6pcb *in6p; 122988768458SSam Leffler { 12309ffa9677SSam Leffler IPSEC_ASSERT(in6p != NULL, ("null in6p")); 123188768458SSam Leffler 123288768458SSam Leffler if (in6p->in6p_sp == NULL) 123388768458SSam Leffler return 0; 123488768458SSam Leffler 123588768458SSam Leffler if (in6p->in6p_sp->sp_in != NULL) 123688768458SSam Leffler KEY_FREESP(&in6p->in6p_sp->sp_in); 123788768458SSam Leffler 123888768458SSam Leffler if (in6p->in6p_sp->sp_out != NULL) 123988768458SSam Leffler KEY_FREESP(&in6p->in6p_sp->sp_out); 124088768458SSam Leffler 124188768458SSam Leffler ipsec_delpcbpolicy(in6p->in6p_sp); 124288768458SSam Leffler in6p->in6p_sp = NULL; 124388768458SSam Leffler 124488768458SSam Leffler return 0; 124588768458SSam Leffler } 124688768458SSam Leffler #endif 124788768458SSam Leffler 124888768458SSam Leffler /* 124988768458SSam Leffler * return current level. 125088768458SSam Leffler * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned. 125188768458SSam Leffler */ 125288768458SSam Leffler u_int 125388768458SSam Leffler ipsec_get_reqlevel(isr) 125488768458SSam Leffler struct ipsecrequest *isr; 125588768458SSam Leffler { 125688768458SSam Leffler u_int level = 0; 125788768458SSam Leffler u_int esp_trans_deflev, esp_net_deflev; 125888768458SSam Leffler u_int ah_trans_deflev, ah_net_deflev; 125988768458SSam Leffler 12609ffa9677SSam Leffler IPSEC_ASSERT(isr != NULL && isr->sp != NULL, ("null argument")); 12619ffa9677SSam Leffler IPSEC_ASSERT(isr->sp->spidx.src.sa.sa_family == isr->sp->spidx.dst.sa.sa_family, 12629ffa9677SSam Leffler ("af family mismatch, src %u, dst %u", 126388768458SSam Leffler isr->sp->spidx.src.sa.sa_family, 126488768458SSam Leffler isr->sp->spidx.dst.sa.sa_family)); 126588768458SSam Leffler 126688768458SSam Leffler /* XXX note that we have ipseclog() expanded here - code sync issue */ 126788768458SSam Leffler #define IPSEC_CHECK_DEFAULT(lev) \ 126888768458SSam Leffler (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE \ 126988768458SSam Leffler && (lev) != IPSEC_LEVEL_UNIQUE) \ 127088768458SSam Leffler ? (ipsec_debug \ 127188768458SSam Leffler ? log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\ 127288768458SSam Leffler (lev), IPSEC_LEVEL_REQUIRE) \ 127388768458SSam Leffler : 0), \ 127488768458SSam Leffler (lev) = IPSEC_LEVEL_REQUIRE, \ 127588768458SSam Leffler (lev) \ 127688768458SSam Leffler : (lev)) 127788768458SSam Leffler 127888768458SSam Leffler /* set default level */ 127988768458SSam Leffler switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) { 128088768458SSam Leffler #ifdef INET 128188768458SSam Leffler case AF_INET: 128288768458SSam Leffler esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev); 128388768458SSam Leffler esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev); 128488768458SSam Leffler ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev); 128588768458SSam Leffler ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev); 128688768458SSam Leffler break; 128788768458SSam Leffler #endif 128888768458SSam Leffler #ifdef INET6 128988768458SSam Leffler case AF_INET6: 129088768458SSam Leffler esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev); 129188768458SSam Leffler esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev); 129288768458SSam Leffler ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev); 129388768458SSam Leffler ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev); 129488768458SSam Leffler break; 129588768458SSam Leffler #endif /* INET6 */ 129688768458SSam Leffler default: 12979ffa9677SSam Leffler panic("%s: unknown af %u", 12989ffa9677SSam Leffler __func__, isr->sp->spidx.src.sa.sa_family); 129988768458SSam Leffler } 130088768458SSam Leffler 130188768458SSam Leffler #undef IPSEC_CHECK_DEFAULT 130288768458SSam Leffler 130388768458SSam Leffler /* set level */ 130488768458SSam Leffler switch (isr->level) { 130588768458SSam Leffler case IPSEC_LEVEL_DEFAULT: 130688768458SSam Leffler switch (isr->saidx.proto) { 130788768458SSam Leffler case IPPROTO_ESP: 130888768458SSam Leffler if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 130988768458SSam Leffler level = esp_net_deflev; 131088768458SSam Leffler else 131188768458SSam Leffler level = esp_trans_deflev; 131288768458SSam Leffler break; 131388768458SSam Leffler case IPPROTO_AH: 131488768458SSam Leffler if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 131588768458SSam Leffler level = ah_net_deflev; 131688768458SSam Leffler else 131788768458SSam Leffler level = ah_trans_deflev; 13188381996eSSam Leffler break; 131988768458SSam Leffler case IPPROTO_IPCOMP: 132088768458SSam Leffler /* 132188768458SSam Leffler * we don't really care, as IPcomp document says that 132288768458SSam Leffler * we shouldn't compress small packets 132388768458SSam Leffler */ 132488768458SSam Leffler level = IPSEC_LEVEL_USE; 132588768458SSam Leffler break; 132688768458SSam Leffler default: 13279ffa9677SSam Leffler panic("%s: Illegal protocol defined %u\n", __func__, 132888768458SSam Leffler isr->saidx.proto); 132988768458SSam Leffler } 133088768458SSam Leffler break; 133188768458SSam Leffler 133288768458SSam Leffler case IPSEC_LEVEL_USE: 133388768458SSam Leffler case IPSEC_LEVEL_REQUIRE: 133488768458SSam Leffler level = isr->level; 133588768458SSam Leffler break; 133688768458SSam Leffler case IPSEC_LEVEL_UNIQUE: 133788768458SSam Leffler level = IPSEC_LEVEL_REQUIRE; 133888768458SSam Leffler break; 133988768458SSam Leffler 134088768458SSam Leffler default: 13419ffa9677SSam Leffler panic("%s: Illegal IPsec level %u\n", __func__, isr->level); 134288768458SSam Leffler } 134388768458SSam Leffler 134488768458SSam Leffler return level; 134588768458SSam Leffler } 134688768458SSam Leffler 134788768458SSam Leffler /* 134888768458SSam Leffler * Check security policy requirements against the actual 134988768458SSam Leffler * packet contents. Return one if the packet should be 135088768458SSam Leffler * reject as "invalid"; otherwiser return zero to have the 135188768458SSam Leffler * packet treated as "valid". 135288768458SSam Leffler * 135388768458SSam Leffler * OUT: 135488768458SSam Leffler * 0: valid 135588768458SSam Leffler * 1: invalid 135688768458SSam Leffler */ 135788768458SSam Leffler int 135888768458SSam Leffler ipsec_in_reject(struct secpolicy *sp, struct mbuf *m) 135988768458SSam Leffler { 136088768458SSam Leffler struct ipsecrequest *isr; 136188768458SSam Leffler int need_auth; 136288768458SSam Leffler 136388768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DATA, 13649ffa9677SSam Leffler printf("%s: using SP\n", __func__); kdebug_secpolicy(sp)); 136588768458SSam Leffler 136688768458SSam Leffler /* check policy */ 136788768458SSam Leffler switch (sp->policy) { 136888768458SSam Leffler case IPSEC_POLICY_DISCARD: 136988768458SSam Leffler return 1; 137088768458SSam Leffler case IPSEC_POLICY_BYPASS: 137188768458SSam Leffler case IPSEC_POLICY_NONE: 137288768458SSam Leffler return 0; 137388768458SSam Leffler } 137488768458SSam Leffler 13759ffa9677SSam Leffler IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 13769ffa9677SSam Leffler ("invalid policy %u", sp->policy)); 137788768458SSam Leffler 137888768458SSam Leffler /* XXX should compare policy against ipsec header history */ 137988768458SSam Leffler 138088768458SSam Leffler need_auth = 0; 138188768458SSam Leffler for (isr = sp->req; isr != NULL; isr = isr->next) { 138288768458SSam Leffler if (ipsec_get_reqlevel(isr) != IPSEC_LEVEL_REQUIRE) 138388768458SSam Leffler continue; 138488768458SSam Leffler switch (isr->saidx.proto) { 138588768458SSam Leffler case IPPROTO_ESP: 138688768458SSam Leffler if ((m->m_flags & M_DECRYPTED) == 0) { 138788768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 13889ffa9677SSam Leffler printf("%s: ESP m_flags:%x\n", __func__, 138988768458SSam Leffler m->m_flags)); 139088768458SSam Leffler return 1; 139188768458SSam Leffler } 139288768458SSam Leffler 139388768458SSam Leffler if (!need_auth && 139488768458SSam Leffler isr->sav != NULL && 139588768458SSam Leffler isr->sav->tdb_authalgxform != NULL && 139688768458SSam Leffler (m->m_flags & M_AUTHIPDGM) == 0) { 139788768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 13989ffa9677SSam Leffler printf("%s: ESP/AH m_flags:%x\n", __func__, 139988768458SSam Leffler m->m_flags)); 140088768458SSam Leffler return 1; 140188768458SSam Leffler } 140288768458SSam Leffler break; 140388768458SSam Leffler case IPPROTO_AH: 140488768458SSam Leffler need_auth = 1; 140588768458SSam Leffler if ((m->m_flags & M_AUTHIPHDR) == 0) { 140688768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DUMP, 14079ffa9677SSam Leffler printf("%s: AH m_flags:%x\n", __func__, 140888768458SSam Leffler m->m_flags)); 140988768458SSam Leffler return 1; 141088768458SSam Leffler } 141188768458SSam Leffler break; 141288768458SSam Leffler case IPPROTO_IPCOMP: 141388768458SSam Leffler /* 141488768458SSam Leffler * we don't really care, as IPcomp document 141588768458SSam Leffler * says that we shouldn't compress small 141688768458SSam Leffler * packets, IPComp policy should always be 141788768458SSam Leffler * treated as being in "use" level. 141888768458SSam Leffler */ 141988768458SSam Leffler break; 142088768458SSam Leffler } 142188768458SSam Leffler } 142288768458SSam Leffler return 0; /* valid */ 142388768458SSam Leffler } 142488768458SSam Leffler 142588768458SSam Leffler /* 142688768458SSam Leffler * Check AH/ESP integrity. 142788768458SSam Leffler * This function is called from tcp_input(), udp_input(), 142888768458SSam Leffler * and {ah,esp}4_input for tunnel mode 142988768458SSam Leffler */ 143088768458SSam Leffler int 143188768458SSam Leffler ipsec4_in_reject(m, inp) 143288768458SSam Leffler struct mbuf *m; 143388768458SSam Leffler struct inpcb *inp; 143488768458SSam Leffler { 143588768458SSam Leffler struct secpolicy *sp; 143688768458SSam Leffler int error; 143788768458SSam Leffler int result; 143888768458SSam Leffler 14399ffa9677SSam Leffler IPSEC_ASSERT(m != NULL, ("null mbuf")); 144088768458SSam Leffler 144188768458SSam Leffler /* get SP for this packet. 144288768458SSam Leffler * When we are called from ip_forward(), we call 144388768458SSam Leffler * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 144488768458SSam Leffler */ 144588768458SSam Leffler if (inp == NULL) 144688768458SSam Leffler sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error); 144788768458SSam Leffler else 144888768458SSam Leffler sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, inp, &error); 144988768458SSam Leffler 145088768458SSam Leffler if (sp != NULL) { 145188768458SSam Leffler result = ipsec_in_reject(sp, m); 145288768458SSam Leffler if (result) 145388768458SSam Leffler newipsecstat.ips_in_polvio++; 145488768458SSam Leffler KEY_FREESP(&sp); 145588768458SSam Leffler } else { 145688768458SSam Leffler result = 0; /* XXX should be panic ? 145788768458SSam Leffler * -> No, there may be error. */ 145888768458SSam Leffler } 145988768458SSam Leffler return result; 146088768458SSam Leffler } 146188768458SSam Leffler 146288768458SSam Leffler #ifdef INET6 146388768458SSam Leffler /* 146488768458SSam Leffler * Check AH/ESP integrity. 146588768458SSam Leffler * This function is called from tcp6_input(), udp6_input(), 146688768458SSam Leffler * and {ah,esp}6_input for tunnel mode 146788768458SSam Leffler */ 146888768458SSam Leffler int 146988768458SSam Leffler ipsec6_in_reject(m, inp) 147088768458SSam Leffler struct mbuf *m; 147188768458SSam Leffler struct inpcb *inp; 147288768458SSam Leffler { 147388768458SSam Leffler struct secpolicy *sp = NULL; 147488768458SSam Leffler int error; 147588768458SSam Leffler int result; 147688768458SSam Leffler 147788768458SSam Leffler /* sanity check */ 147888768458SSam Leffler if (m == NULL) 147988768458SSam Leffler return 0; /* XXX should be panic ? */ 148088768458SSam Leffler 148188768458SSam Leffler /* get SP for this packet. 148288768458SSam Leffler * When we are called from ip_forward(), we call 148388768458SSam Leffler * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 148488768458SSam Leffler */ 148588768458SSam Leffler if (inp == NULL) 148688768458SSam Leffler sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error); 148788768458SSam Leffler else 148888768458SSam Leffler sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, inp, &error); 148988768458SSam Leffler 149088768458SSam Leffler if (sp != NULL) { 149188768458SSam Leffler result = ipsec_in_reject(sp, m); 149288768458SSam Leffler if (result) 149388768458SSam Leffler newipsecstat.ips_in_polvio++; 149488768458SSam Leffler KEY_FREESP(&sp); 149588768458SSam Leffler } else { 149688768458SSam Leffler result = 0; 149788768458SSam Leffler } 149888768458SSam Leffler return result; 149988768458SSam Leffler } 150088768458SSam Leffler #endif 150188768458SSam Leffler 150288768458SSam Leffler /* 150388768458SSam Leffler * compute the byte size to be occupied by IPsec header. 150488768458SSam Leffler * in case it is tunneled, it includes the size of outer IP header. 150588768458SSam Leffler * NOTE: SP passed is free in this function. 150688768458SSam Leffler */ 150788768458SSam Leffler static size_t 150888768458SSam Leffler ipsec_hdrsiz(struct secpolicy *sp) 150988768458SSam Leffler { 151088768458SSam Leffler struct ipsecrequest *isr; 151188768458SSam Leffler size_t siz; 151288768458SSam Leffler 151388768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DATA, 15149ffa9677SSam Leffler printf("%s: using SP\n", __func__); kdebug_secpolicy(sp)); 151588768458SSam Leffler 151688768458SSam Leffler switch (sp->policy) { 151788768458SSam Leffler case IPSEC_POLICY_DISCARD: 151888768458SSam Leffler case IPSEC_POLICY_BYPASS: 151988768458SSam Leffler case IPSEC_POLICY_NONE: 152088768458SSam Leffler return 0; 152188768458SSam Leffler } 152288768458SSam Leffler 15239ffa9677SSam Leffler IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, 15249ffa9677SSam Leffler ("invalid policy %u", sp->policy)); 152588768458SSam Leffler 152688768458SSam Leffler siz = 0; 152788768458SSam Leffler for (isr = sp->req; isr != NULL; isr = isr->next) { 152888768458SSam Leffler size_t clen = 0; 152988768458SSam Leffler 153088768458SSam Leffler switch (isr->saidx.proto) { 153188768458SSam Leffler case IPPROTO_ESP: 153288768458SSam Leffler clen = esp_hdrsiz(isr->sav); 153388768458SSam Leffler break; 153488768458SSam Leffler case IPPROTO_AH: 153588768458SSam Leffler clen = ah_hdrsiz(isr->sav); 153688768458SSam Leffler break; 153788768458SSam Leffler case IPPROTO_IPCOMP: 153888768458SSam Leffler clen = sizeof(struct ipcomp); 153988768458SSam Leffler break; 154088768458SSam Leffler } 154188768458SSam Leffler 154288768458SSam Leffler if (isr->saidx.mode == IPSEC_MODE_TUNNEL) { 154388768458SSam Leffler switch (isr->saidx.dst.sa.sa_family) { 154488768458SSam Leffler case AF_INET: 154588768458SSam Leffler clen += sizeof(struct ip); 154688768458SSam Leffler break; 154788768458SSam Leffler #ifdef INET6 154888768458SSam Leffler case AF_INET6: 154988768458SSam Leffler clen += sizeof(struct ip6_hdr); 155088768458SSam Leffler break; 155188768458SSam Leffler #endif 155288768458SSam Leffler default: 15539ffa9677SSam Leffler ipseclog((LOG_ERR, "%s: unknown AF %d in " 15549ffa9677SSam Leffler "IPsec tunnel SA\n", __func__, 155588768458SSam Leffler ((struct sockaddr *)&isr->saidx.dst)->sa_family)); 155688768458SSam Leffler break; 155788768458SSam Leffler } 155888768458SSam Leffler } 155988768458SSam Leffler siz += clen; 156088768458SSam Leffler } 156188768458SSam Leffler 156288768458SSam Leffler return siz; 156388768458SSam Leffler } 156488768458SSam Leffler 156588768458SSam Leffler /* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */ 156688768458SSam Leffler size_t 156788768458SSam Leffler ipsec4_hdrsiz(m, dir, inp) 156888768458SSam Leffler struct mbuf *m; 156988768458SSam Leffler u_int dir; 157088768458SSam Leffler struct inpcb *inp; 157188768458SSam Leffler { 157288768458SSam Leffler struct secpolicy *sp; 157388768458SSam Leffler int error; 157488768458SSam Leffler size_t size; 157588768458SSam Leffler 15769ffa9677SSam Leffler IPSEC_ASSERT(m != NULL, ("null mbuf")); 157788768458SSam Leffler 157888768458SSam Leffler /* get SP for this packet. 157988768458SSam Leffler * When we are called from ip_forward(), we call 158088768458SSam Leffler * ipsec_getpolicybyaddr() with IP_FORWARDING flag. 158188768458SSam Leffler */ 158288768458SSam Leffler if (inp == NULL) 158388768458SSam Leffler sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error); 158488768458SSam Leffler else 158588768458SSam Leffler sp = ipsec_getpolicybysock(m, dir, inp, &error); 158688768458SSam Leffler 158788768458SSam Leffler if (sp != NULL) { 158888768458SSam Leffler size = ipsec_hdrsiz(sp); 158988768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DATA, 15909ffa9677SSam Leffler printf("%s: size:%lu.\n", __func__, 159188768458SSam Leffler (unsigned long)size)); 159288768458SSam Leffler 159388768458SSam Leffler KEY_FREESP(&sp); 159488768458SSam Leffler } else { 159588768458SSam Leffler size = 0; /* XXX should be panic ? */ 159688768458SSam Leffler } 159788768458SSam Leffler return size; 159888768458SSam Leffler } 159988768458SSam Leffler 160088768458SSam Leffler #ifdef INET6 160188768458SSam Leffler /* This function is called from ipsec6_hdrsize_tcp(), 160288768458SSam Leffler * and maybe from ip6_forward.() 160388768458SSam Leffler */ 160488768458SSam Leffler size_t 160588768458SSam Leffler ipsec6_hdrsiz(m, dir, in6p) 160688768458SSam Leffler struct mbuf *m; 160788768458SSam Leffler u_int dir; 160888768458SSam Leffler struct in6pcb *in6p; 160988768458SSam Leffler { 161088768458SSam Leffler struct secpolicy *sp; 161188768458SSam Leffler int error; 161288768458SSam Leffler size_t size; 161388768458SSam Leffler 16149ffa9677SSam Leffler IPSEC_ASSERT(m != NULL, ("null mbuf")); 16159ffa9677SSam Leffler IPSEC_ASSERT(in6p == NULL || in6p->in6p_socket != NULL, 16169ffa9677SSam Leffler ("socket w/o inpcb")); 161788768458SSam Leffler 161888768458SSam Leffler /* get SP for this packet */ 161988768458SSam Leffler /* XXX Is it right to call with IP_FORWARDING. */ 162088768458SSam Leffler if (in6p == NULL) 162188768458SSam Leffler sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error); 162288768458SSam Leffler else 162388768458SSam Leffler sp = ipsec_getpolicybysock(m, dir, in6p, &error); 162488768458SSam Leffler 162588768458SSam Leffler if (sp == NULL) 162688768458SSam Leffler return 0; 162788768458SSam Leffler size = ipsec_hdrsiz(sp); 162888768458SSam Leffler KEYDEBUG(KEYDEBUG_IPSEC_DATA, 16299ffa9677SSam Leffler printf("%s: size:%lu.\n", __func__, (unsigned long)size)); 163088768458SSam Leffler KEY_FREESP(&sp); 163188768458SSam Leffler 163288768458SSam Leffler return size; 163388768458SSam Leffler } 163488768458SSam Leffler #endif /*INET6*/ 163588768458SSam Leffler 163688768458SSam Leffler /* 163788768458SSam Leffler * Check the variable replay window. 163888768458SSam Leffler * ipsec_chkreplay() performs replay check before ICV verification. 163988768458SSam Leffler * ipsec_updatereplay() updates replay bitmap. This must be called after 164088768458SSam Leffler * ICV verification (it also performs replay check, which is usually done 164188768458SSam Leffler * beforehand). 164288768458SSam Leffler * 0 (zero) is returned if packet disallowed, 1 if packet permitted. 164388768458SSam Leffler * 164488768458SSam Leffler * based on RFC 2401. 164588768458SSam Leffler */ 164688768458SSam Leffler int 164788768458SSam Leffler ipsec_chkreplay(seq, sav) 164888768458SSam Leffler u_int32_t seq; 164988768458SSam Leffler struct secasvar *sav; 165088768458SSam Leffler { 165188768458SSam Leffler const struct secreplay *replay; 165288768458SSam Leffler u_int32_t diff; 165388768458SSam Leffler int fr; 165488768458SSam Leffler u_int32_t wsizeb; /* constant: bits of window size */ 165588768458SSam Leffler int frlast; /* constant: last frame */ 165688768458SSam Leffler 16579ffa9677SSam Leffler IPSEC_SPLASSERT_SOFTNET(__func__); 165888768458SSam Leffler 16599ffa9677SSam Leffler IPSEC_ASSERT(sav != NULL, ("Null SA")); 16609ffa9677SSam Leffler IPSEC_ASSERT(sav->replay != NULL, ("Null replay state")); 166188768458SSam Leffler 166288768458SSam Leffler replay = sav->replay; 166388768458SSam Leffler 166488768458SSam Leffler if (replay->wsize == 0) 166588768458SSam Leffler return 1; /* no need to check replay. */ 166688768458SSam Leffler 166788768458SSam Leffler /* constant */ 166888768458SSam Leffler frlast = replay->wsize - 1; 166988768458SSam Leffler wsizeb = replay->wsize << 3; 167088768458SSam Leffler 167188768458SSam Leffler /* sequence number of 0 is invalid */ 167288768458SSam Leffler if (seq == 0) 167388768458SSam Leffler return 0; 167488768458SSam Leffler 167588768458SSam Leffler /* first time is always okay */ 167688768458SSam Leffler if (replay->count == 0) 167788768458SSam Leffler return 1; 167888768458SSam Leffler 167988768458SSam Leffler if (seq > replay->lastseq) { 168088768458SSam Leffler /* larger sequences are okay */ 168188768458SSam Leffler return 1; 168288768458SSam Leffler } else { 168388768458SSam Leffler /* seq is equal or less than lastseq. */ 168488768458SSam Leffler diff = replay->lastseq - seq; 168588768458SSam Leffler 168688768458SSam Leffler /* over range to check, i.e. too old or wrapped */ 168788768458SSam Leffler if (diff >= wsizeb) 168888768458SSam Leffler return 0; 168988768458SSam Leffler 169088768458SSam Leffler fr = frlast - diff / 8; 169188768458SSam Leffler 169288768458SSam Leffler /* this packet already seen ? */ 169388768458SSam Leffler if ((replay->bitmap)[fr] & (1 << (diff % 8))) 169488768458SSam Leffler return 0; 169588768458SSam Leffler 169688768458SSam Leffler /* out of order but good */ 169788768458SSam Leffler return 1; 169888768458SSam Leffler } 169988768458SSam Leffler } 170088768458SSam Leffler 170188768458SSam Leffler /* 170288768458SSam Leffler * check replay counter whether to update or not. 170388768458SSam Leffler * OUT: 0: OK 170488768458SSam Leffler * 1: NG 170588768458SSam Leffler */ 170688768458SSam Leffler int 170788768458SSam Leffler ipsec_updatereplay(seq, sav) 170888768458SSam Leffler u_int32_t seq; 170988768458SSam Leffler struct secasvar *sav; 171088768458SSam Leffler { 171188768458SSam Leffler struct secreplay *replay; 171288768458SSam Leffler u_int32_t diff; 171388768458SSam Leffler int fr; 171488768458SSam Leffler u_int32_t wsizeb; /* constant: bits of window size */ 171588768458SSam Leffler int frlast; /* constant: last frame */ 171688768458SSam Leffler 17179ffa9677SSam Leffler IPSEC_SPLASSERT_SOFTNET(__func__); 171888768458SSam Leffler 17199ffa9677SSam Leffler IPSEC_ASSERT(sav != NULL, ("Null SA")); 17209ffa9677SSam Leffler IPSEC_ASSERT(sav->replay != NULL, ("Null replay state")); 172188768458SSam Leffler 172288768458SSam Leffler replay = sav->replay; 172388768458SSam Leffler 172488768458SSam Leffler if (replay->wsize == 0) 172588768458SSam Leffler goto ok; /* no need to check replay. */ 172688768458SSam Leffler 172788768458SSam Leffler /* constant */ 172888768458SSam Leffler frlast = replay->wsize - 1; 172988768458SSam Leffler wsizeb = replay->wsize << 3; 173088768458SSam Leffler 173188768458SSam Leffler /* sequence number of 0 is invalid */ 173288768458SSam Leffler if (seq == 0) 173388768458SSam Leffler return 1; 173488768458SSam Leffler 173588768458SSam Leffler /* first time */ 173688768458SSam Leffler if (replay->count == 0) { 173788768458SSam Leffler replay->lastseq = seq; 173888768458SSam Leffler bzero(replay->bitmap, replay->wsize); 173988768458SSam Leffler (replay->bitmap)[frlast] = 1; 174088768458SSam Leffler goto ok; 174188768458SSam Leffler } 174288768458SSam Leffler 174388768458SSam Leffler if (seq > replay->lastseq) { 174488768458SSam Leffler /* seq is larger than lastseq. */ 174588768458SSam Leffler diff = seq - replay->lastseq; 174688768458SSam Leffler 174788768458SSam Leffler /* new larger sequence number */ 174888768458SSam Leffler if (diff < wsizeb) { 174988768458SSam Leffler /* In window */ 175088768458SSam Leffler /* set bit for this packet */ 175188768458SSam Leffler vshiftl(replay->bitmap, diff, replay->wsize); 175288768458SSam Leffler (replay->bitmap)[frlast] |= 1; 175388768458SSam Leffler } else { 175488768458SSam Leffler /* this packet has a "way larger" */ 175588768458SSam Leffler bzero(replay->bitmap, replay->wsize); 175688768458SSam Leffler (replay->bitmap)[frlast] = 1; 175788768458SSam Leffler } 175888768458SSam Leffler replay->lastseq = seq; 175988768458SSam Leffler 176088768458SSam Leffler /* larger is good */ 176188768458SSam Leffler } else { 176288768458SSam Leffler /* seq is equal or less than lastseq. */ 176388768458SSam Leffler diff = replay->lastseq - seq; 176488768458SSam Leffler 176588768458SSam Leffler /* over range to check, i.e. too old or wrapped */ 176688768458SSam Leffler if (diff >= wsizeb) 176788768458SSam Leffler return 1; 176888768458SSam Leffler 176988768458SSam Leffler fr = frlast - diff / 8; 177088768458SSam Leffler 177188768458SSam Leffler /* this packet already seen ? */ 177288768458SSam Leffler if ((replay->bitmap)[fr] & (1 << (diff % 8))) 177388768458SSam Leffler return 1; 177488768458SSam Leffler 177588768458SSam Leffler /* mark as seen */ 177688768458SSam Leffler (replay->bitmap)[fr] |= (1 << (diff % 8)); 177788768458SSam Leffler 177888768458SSam Leffler /* out of order but good */ 177988768458SSam Leffler } 178088768458SSam Leffler 178188768458SSam Leffler ok: 178288768458SSam Leffler if (replay->count == ~0) { 178388768458SSam Leffler 178488768458SSam Leffler /* set overflow flag */ 178588768458SSam Leffler replay->overflow++; 178688768458SSam Leffler 178788768458SSam Leffler /* don't increment, no more packets accepted */ 178888768458SSam Leffler if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) 178988768458SSam Leffler return 1; 179088768458SSam Leffler 17919ffa9677SSam Leffler ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n", 17929ffa9677SSam Leffler __func__, replay->overflow, ipsec_logsastr(sav))); 179388768458SSam Leffler } 179488768458SSam Leffler 179588768458SSam Leffler replay->count++; 179688768458SSam Leffler 179788768458SSam Leffler return 0; 179888768458SSam Leffler } 179988768458SSam Leffler 180088768458SSam Leffler /* 1801d24ff94bSHiten Pandya * shift variable length buffer to left. 180288768458SSam Leffler * IN: bitmap: pointer to the buffer 180388768458SSam Leffler * nbit: the number of to shift. 180488768458SSam Leffler * wsize: buffer size (bytes). 180588768458SSam Leffler */ 180688768458SSam Leffler static void 180788768458SSam Leffler vshiftl(bitmap, nbit, wsize) 180888768458SSam Leffler unsigned char *bitmap; 180988768458SSam Leffler int nbit, wsize; 181088768458SSam Leffler { 181188768458SSam Leffler int s, j, i; 181288768458SSam Leffler unsigned char over; 181388768458SSam Leffler 181488768458SSam Leffler for (j = 0; j < nbit; j += 8) { 181588768458SSam Leffler s = (nbit - j < 8) ? (nbit - j): 8; 181688768458SSam Leffler bitmap[0] <<= s; 181788768458SSam Leffler for (i = 1; i < wsize; i++) { 181888768458SSam Leffler over = (bitmap[i] >> (8 - s)); 181988768458SSam Leffler bitmap[i] <<= s; 182088768458SSam Leffler bitmap[i-1] |= over; 182188768458SSam Leffler } 182288768458SSam Leffler } 182388768458SSam Leffler 182488768458SSam Leffler return; 182588768458SSam Leffler } 182688768458SSam Leffler 182788768458SSam Leffler /* Return a printable string for the IPv4 address. */ 182888768458SSam Leffler static char * 182988768458SSam Leffler inet_ntoa4(struct in_addr ina) 183088768458SSam Leffler { 183188768458SSam Leffler static char buf[4][4 * sizeof "123" + 4]; 183288768458SSam Leffler unsigned char *ucp = (unsigned char *) &ina; 183388768458SSam Leffler static int i = 3; 183488768458SSam Leffler 183588768458SSam Leffler i = (i + 1) % 4; 183688768458SSam Leffler sprintf(buf[i], "%d.%d.%d.%d", ucp[0] & 0xff, ucp[1] & 0xff, 183788768458SSam Leffler ucp[2] & 0xff, ucp[3] & 0xff); 183888768458SSam Leffler return (buf[i]); 183988768458SSam Leffler } 184088768458SSam Leffler 184188768458SSam Leffler /* Return a printable string for the address. */ 184288768458SSam Leffler char * 184388768458SSam Leffler ipsec_address(union sockaddr_union* sa) 184488768458SSam Leffler { 184588768458SSam Leffler switch (sa->sa.sa_family) { 184649ddabdfSPawel Jakub Dawidek #ifdef INET 184788768458SSam Leffler case AF_INET: 184888768458SSam Leffler return inet_ntoa4(sa->sin.sin_addr); 184988768458SSam Leffler #endif /* INET */ 185088768458SSam Leffler 185149ddabdfSPawel Jakub Dawidek #ifdef INET6 185288768458SSam Leffler case AF_INET6: 185388768458SSam Leffler return ip6_sprintf(&sa->sin6.sin6_addr); 185488768458SSam Leffler #endif /* INET6 */ 185588768458SSam Leffler 185688768458SSam Leffler default: 185788768458SSam Leffler return "(unknown address family)"; 185888768458SSam Leffler } 185988768458SSam Leffler } 186088768458SSam Leffler 186188768458SSam Leffler const char * 186288768458SSam Leffler ipsec_logsastr(sav) 186388768458SSam Leffler struct secasvar *sav; 186488768458SSam Leffler { 186588768458SSam Leffler static char buf[256]; 186688768458SSam Leffler char *p; 186788768458SSam Leffler struct secasindex *saidx = &sav->sah->saidx; 186888768458SSam Leffler 18699ffa9677SSam Leffler IPSEC_ASSERT(saidx->src.sa.sa_family == saidx->dst.sa.sa_family, 18709ffa9677SSam Leffler ("address family mismatch")); 187188768458SSam Leffler 187288768458SSam Leffler p = buf; 187388768458SSam Leffler snprintf(buf, sizeof(buf), "SA(SPI=%u ", (u_int32_t)ntohl(sav->spi)); 187488768458SSam Leffler while (p && *p) 187588768458SSam Leffler p++; 187688768458SSam Leffler /* NB: only use ipsec_address on one address at a time */ 187788768458SSam Leffler snprintf(p, sizeof (buf) - (p - buf), "src=%s ", 187888768458SSam Leffler ipsec_address(&saidx->src)); 187988768458SSam Leffler while (p && *p) 188088768458SSam Leffler p++; 188188768458SSam Leffler snprintf(p, sizeof (buf) - (p - buf), "dst=%s)", 188288768458SSam Leffler ipsec_address(&saidx->dst)); 188388768458SSam Leffler 188488768458SSam Leffler return buf; 188588768458SSam Leffler } 188688768458SSam Leffler 188788768458SSam Leffler void 188888768458SSam Leffler ipsec_dumpmbuf(m) 188988768458SSam Leffler struct mbuf *m; 189088768458SSam Leffler { 189188768458SSam Leffler int totlen; 189288768458SSam Leffler int i; 189388768458SSam Leffler u_char *p; 189488768458SSam Leffler 189588768458SSam Leffler totlen = 0; 189688768458SSam Leffler printf("---\n"); 189788768458SSam Leffler while (m) { 189888768458SSam Leffler p = mtod(m, u_char *); 189988768458SSam Leffler for (i = 0; i < m->m_len; i++) { 190088768458SSam Leffler printf("%02x ", p[i]); 190188768458SSam Leffler totlen++; 190288768458SSam Leffler if (totlen % 16 == 0) 190388768458SSam Leffler printf("\n"); 190488768458SSam Leffler } 190588768458SSam Leffler m = m->m_next; 190688768458SSam Leffler } 190788768458SSam Leffler if (totlen % 16 != 0) 190888768458SSam Leffler printf("\n"); 190988768458SSam Leffler printf("---\n"); 191088768458SSam Leffler } 191188768458SSam Leffler 19128381996eSSam Leffler static void 19138381996eSSam Leffler ipsec_attach(void) 19148381996eSSam Leffler { 19158381996eSSam Leffler SECPOLICY_LOCK_INIT(&ip4_def_policy); 19168381996eSSam Leffler ip4_def_policy.refcnt = 1; /* NB: disallow free */ 19178381996eSSam Leffler } 19188381996eSSam Leffler SYSINIT(ipsec, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, ipsec_attach, NULL) 19198381996eSSam Leffler 19208381996eSSam Leffler 192188768458SSam Leffler /* XXX this stuff doesn't belong here... */ 192288768458SSam Leffler 192388768458SSam Leffler static struct xformsw* xforms = NULL; 192488768458SSam Leffler 192588768458SSam Leffler /* 192688768458SSam Leffler * Register a transform; typically at system startup. 192788768458SSam Leffler */ 192888768458SSam Leffler void 192988768458SSam Leffler xform_register(struct xformsw* xsp) 193088768458SSam Leffler { 193188768458SSam Leffler xsp->xf_next = xforms; 193288768458SSam Leffler xforms = xsp; 193388768458SSam Leffler } 193488768458SSam Leffler 193588768458SSam Leffler /* 193688768458SSam Leffler * Initialize transform support in an sav. 193788768458SSam Leffler */ 193888768458SSam Leffler int 193988768458SSam Leffler xform_init(struct secasvar *sav, int xftype) 194088768458SSam Leffler { 194188768458SSam Leffler struct xformsw *xsp; 194288768458SSam Leffler 194382a6d6acSSam Leffler if (sav->tdb_xform != NULL) /* previously initialized */ 194482a6d6acSSam Leffler return 0; 194588768458SSam Leffler for (xsp = xforms; xsp; xsp = xsp->xf_next) 194688768458SSam Leffler if (xsp->xf_type == xftype) 194788768458SSam Leffler return (*xsp->xf_init)(sav, xsp); 194888768458SSam Leffler return EINVAL; 194988768458SSam Leffler } 1950