1 /* $FreeBSD$ */ 2 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IPsec input processing. 41 */ 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_ipsec.h" 46 #include "opt_enc.h" 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/malloc.h> 51 #include <sys/mbuf.h> 52 #include <sys/domain.h> 53 #include <sys/protosw.h> 54 #include <sys/socket.h> 55 #include <sys/errno.h> 56 #include <sys/syslog.h> 57 58 #include <net/if.h> 59 #include <net/pfil.h> 60 #include <net/route.h> 61 #include <net/netisr.h> 62 #include <net/vnet.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/ip_var.h> 68 #include <netinet/in_var.h> 69 70 #include <netinet/ip6.h> 71 #ifdef INET6 72 #include <netinet6/ip6_var.h> 73 #endif 74 #include <netinet/in_pcb.h> 75 #ifdef INET6 76 #include <netinet/icmp6.h> 77 #endif 78 79 #include <netipsec/ipsec.h> 80 #ifdef INET6 81 #include <netipsec/ipsec6.h> 82 #endif 83 #include <netipsec/ah_var.h> 84 #include <netipsec/esp.h> 85 #include <netipsec/esp_var.h> 86 #include <netipsec/ipcomp_var.h> 87 88 #include <netipsec/key.h> 89 #include <netipsec/keydb.h> 90 91 #include <netipsec/xform.h> 92 #include <netinet6/ip6protosw.h> 93 94 #include <machine/in_cksum.h> 95 #include <machine/stdarg.h> 96 97 #ifdef DEV_ENC 98 #include <net/if_enc.h> 99 #endif 100 101 102 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \ 103 (p) == IPPROTO_AH ? (y)++ : (z)++) 104 105 #ifdef INET 106 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int); 107 #endif 108 109 /* 110 * ipsec_common_input gets called when an IPsec-protected packet 111 * is received by IPv4 or IPv6. Its job is to find the right SA 112 * and call the appropriate transform. The transform callback 113 * takes care of further processing (like ingress filtering). 114 */ 115 static int 116 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 117 { 118 union sockaddr_union dst_address; 119 struct secasvar *sav; 120 u_int32_t spi; 121 int error; 122 #ifdef INET 123 #ifdef IPSEC_NAT_T 124 struct m_tag *tag; 125 #endif 126 #endif 127 128 IPSEC_ISTAT(sproto, V_espstat.esps_input, V_ahstat.ahs_input, 129 V_ipcompstat.ipcomps_input); 130 131 IPSEC_ASSERT(m != NULL, ("null packet")); 132 133 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 134 sproto == IPPROTO_IPCOMP, 135 ("unexpected security protocol %u", sproto)); 136 137 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 138 (sproto == IPPROTO_AH && !V_ah_enable) || 139 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 140 m_freem(m); 141 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, V_ahstat.ahs_pdrops, 142 V_ipcompstat.ipcomps_pdrops); 143 return EOPNOTSUPP; 144 } 145 146 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 147 m_freem(m); 148 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 149 V_ipcompstat.ipcomps_hdrops); 150 DPRINTF(("%s: packet too small\n", __func__)); 151 return EINVAL; 152 } 153 154 /* Retrieve the SPI from the relevant IPsec header */ 155 if (sproto == IPPROTO_ESP) 156 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 157 else if (sproto == IPPROTO_AH) 158 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 159 (caddr_t) &spi); 160 else if (sproto == IPPROTO_IPCOMP) { 161 u_int16_t cpi; 162 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 163 (caddr_t) &cpi); 164 spi = ntohl(htons(cpi)); 165 } 166 167 /* 168 * Find the SA and (indirectly) call the appropriate 169 * kernel crypto routine. The resulting mbuf chain is a valid 170 * IP packet ready to go through input processing. 171 */ 172 bzero(&dst_address, sizeof (dst_address)); 173 dst_address.sa.sa_family = af; 174 switch (af) { 175 #ifdef INET 176 case AF_INET: 177 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 178 m_copydata(m, offsetof(struct ip, ip_dst), 179 sizeof(struct in_addr), 180 (caddr_t) &dst_address.sin.sin_addr); 181 #ifdef IPSEC_NAT_T 182 /* Find the source port for NAT-T; see udp*_espdecap. */ 183 tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL); 184 if (tag != NULL) 185 dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1]; 186 #endif /* IPSEC_NAT_T */ 187 break; 188 #endif /* INET */ 189 #ifdef INET6 190 case AF_INET6: 191 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 192 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 193 sizeof(struct in6_addr), 194 (caddr_t) &dst_address.sin6.sin6_addr); 195 break; 196 #endif /* INET6 */ 197 default: 198 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 199 m_freem(m); 200 IPSEC_ISTAT(sproto, V_espstat.esps_nopf, V_ahstat.ahs_nopf, 201 V_ipcompstat.ipcomps_nopf); 202 return EPFNOSUPPORT; 203 } 204 205 /* NB: only pass dst since key_allocsa follows RFC2401 */ 206 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 207 if (sav == NULL) { 208 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 209 __func__, ipsec_address(&dst_address), 210 (u_long) ntohl(spi), sproto)); 211 IPSEC_ISTAT(sproto, V_espstat.esps_notdb, V_ahstat.ahs_notdb, 212 V_ipcompstat.ipcomps_notdb); 213 m_freem(m); 214 return ENOENT; 215 } 216 217 if (sav->tdb_xform == NULL) { 218 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 219 __func__, ipsec_address(&dst_address), 220 (u_long) ntohl(spi), sproto)); 221 IPSEC_ISTAT(sproto, V_espstat.esps_noxform, V_ahstat.ahs_noxform, 222 V_ipcompstat.ipcomps_noxform); 223 KEY_FREESAV(&sav); 224 m_freem(m); 225 return ENXIO; 226 } 227 228 /* 229 * Call appropriate transform and return -- callback takes care of 230 * everything else. 231 */ 232 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 233 KEY_FREESAV(&sav); 234 return error; 235 } 236 237 #ifdef INET 238 /* 239 * Common input handler for IPv4 AH, ESP, and IPCOMP. 240 */ 241 int 242 ipsec4_common_input(struct mbuf *m, ...) 243 { 244 va_list ap; 245 int off, nxt; 246 247 va_start(ap, m); 248 off = va_arg(ap, int); 249 nxt = va_arg(ap, int); 250 va_end(ap); 251 252 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 253 AF_INET, nxt); 254 } 255 256 void 257 ah4_input(struct mbuf *m, int off) 258 { 259 ipsec4_common_input(m, off, IPPROTO_AH); 260 } 261 void 262 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v) 263 { 264 if (sa->sa_family == AF_INET && 265 sa->sa_len == sizeof(struct sockaddr_in)) 266 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH); 267 } 268 269 void 270 esp4_input(struct mbuf *m, int off) 271 { 272 ipsec4_common_input(m, off, IPPROTO_ESP); 273 } 274 void 275 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v) 276 { 277 if (sa->sa_family == AF_INET && 278 sa->sa_len == sizeof(struct sockaddr_in)) 279 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP); 280 } 281 282 void 283 ipcomp4_input(struct mbuf *m, int off) 284 { 285 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 286 } 287 288 /* 289 * IPsec input callback for INET protocols. 290 * This routine is called as the transform callback. 291 * Takes care of filtering and other sanity checks on 292 * the processed packet. 293 */ 294 int 295 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 296 int skip, int protoff, struct m_tag *mt) 297 { 298 int prot, af, sproto; 299 struct ip *ip; 300 struct m_tag *mtag; 301 struct tdb_ident *tdbi; 302 struct secasindex *saidx; 303 int error; 304 #ifdef INET6 305 #ifdef notyet 306 char ip6buf[INET6_ADDRSTRLEN]; 307 #endif 308 #endif 309 310 IPSEC_ASSERT(m != NULL, ("null mbuf")); 311 IPSEC_ASSERT(sav != NULL, ("null SA")); 312 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 313 saidx = &sav->sah->saidx; 314 af = saidx->dst.sa.sa_family; 315 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 316 sproto = saidx->proto; 317 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 318 sproto == IPPROTO_IPCOMP, 319 ("unexpected security protocol %u", sproto)); 320 321 /* Sanity check */ 322 if (m == NULL) { 323 DPRINTF(("%s: null mbuf", __func__)); 324 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr, 325 V_ipcompstat.ipcomps_badkcr); 326 KEY_FREESAV(&sav); 327 return EINVAL; 328 } 329 330 if (skip != 0) { 331 /* Fix IPv4 header */ 332 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 333 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 334 __func__, ipsec_address(&sav->sah->saidx.dst), 335 (u_long) ntohl(sav->spi))); 336 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 337 V_ipcompstat.ipcomps_hdrops); 338 error = ENOBUFS; 339 goto bad; 340 } 341 342 ip = mtod(m, struct ip *); 343 ip->ip_len = htons(m->m_pkthdr.len); 344 ip->ip_off = htons(ip->ip_off); 345 ip->ip_sum = 0; 346 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 347 } else { 348 ip = mtod(m, struct ip *); 349 } 350 prot = ip->ip_p; 351 352 #ifdef notyet 353 /* IP-in-IP encapsulation */ 354 if (prot == IPPROTO_IPIP) { 355 struct ip ipn; 356 357 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 358 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 359 V_ahstat.ahs_hdrops, 360 V_ipcompstat.ipcomps_hdrops); 361 error = EINVAL; 362 goto bad; 363 } 364 /* ipn will now contain the inner IPv4 header */ 365 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 366 (caddr_t) &ipn); 367 368 /* XXX PROXY address isn't recorded in SAH */ 369 /* 370 * Check that the inner source address is the same as 371 * the proxy address, if available. 372 */ 373 if ((saidx->proxy.sa.sa_family == AF_INET && 374 saidx->proxy.sin.sin_addr.s_addr != 375 INADDR_ANY && 376 ipn.ip_src.s_addr != 377 saidx->proxy.sin.sin_addr.s_addr) || 378 (saidx->proxy.sa.sa_family != AF_INET && 379 saidx->proxy.sa.sa_family != 0)) { 380 381 DPRINTF(("%s: inner source address %s doesn't " 382 "correspond to expected proxy source %s, " 383 "SA %s/%08lx\n", __func__, 384 inet_ntoa4(ipn.ip_src), 385 ipsp_address(saidx->proxy), 386 ipsp_address(saidx->dst), 387 (u_long) ntohl(sav->spi))); 388 389 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 390 V_ahstat.ahs_pdrops, 391 V_ipcompstat.ipcomps_pdrops); 392 error = EACCES; 393 goto bad; 394 } 395 } 396 #ifdef INET6 397 /* IPv6-in-IP encapsulation. */ 398 if (prot == IPPROTO_IPV6) { 399 struct ip6_hdr ip6n; 400 401 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 402 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 403 V_ahstat.ahs_hdrops, 404 V_ipcompstat.ipcomps_hdrops); 405 error = EINVAL; 406 goto bad; 407 } 408 /* ip6n will now contain the inner IPv6 header. */ 409 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 410 (caddr_t) &ip6n); 411 412 /* 413 * Check that the inner source address is the same as 414 * the proxy address, if available. 415 */ 416 if ((saidx->proxy.sa.sa_family == AF_INET6 && 417 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 418 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 419 &saidx->proxy.sin6.sin6_addr)) || 420 (saidx->proxy.sa.sa_family != AF_INET6 && 421 saidx->proxy.sa.sa_family != 0)) { 422 423 DPRINTF(("%s: inner source address %s doesn't " 424 "correspond to expected proxy source %s, " 425 "SA %s/%08lx\n", __func__, 426 ip6_sprintf(ip6buf, &ip6n.ip6_src), 427 ipsec_address(&saidx->proxy), 428 ipsec_address(&saidx->dst), 429 (u_long) ntohl(sav->spi))); 430 431 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 432 V_ahstat.ahs_pdrops, 433 V_ipcompstat.ipcomps_pdrops); 434 error = EACCES; 435 goto bad; 436 } 437 } 438 #endif /* INET6 */ 439 #endif /*XXX*/ 440 441 /* 442 * Record what we've done to the packet (under what SA it was 443 * processed). If we've been passed an mtag, it means the packet 444 * was already processed by an ethernet/crypto combo card and 445 * thus has a tag attached with all the right information, but 446 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 447 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 448 */ 449 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 450 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 451 sizeof(struct tdb_ident), M_NOWAIT); 452 if (mtag == NULL) { 453 DPRINTF(("%s: failed to get tag\n", __func__)); 454 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 455 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops); 456 error = ENOMEM; 457 goto bad; 458 } 459 460 tdbi = (struct tdb_ident *)(mtag + 1); 461 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 462 tdbi->proto = sproto; 463 tdbi->spi = sav->spi; 464 /* Cache those two for enc(4) in xform_ipip. */ 465 tdbi->alg_auth = sav->alg_auth; 466 tdbi->alg_enc = sav->alg_enc; 467 468 m_tag_prepend(m, mtag); 469 } else if (mt != NULL) { 470 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 471 /* XXX do we need to mark m_flags??? */ 472 } 473 474 key_sa_recordxfer(sav, m); /* record data transfer */ 475 476 #ifdef DEV_ENC 477 encif->if_ipackets++; 478 encif->if_ibytes += m->m_pkthdr.len; 479 480 /* 481 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 482 * packet later after it has been decapsulated. 483 */ 484 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE); 485 486 if (prot != IPPROTO_IPIP) 487 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 488 return (error); 489 #endif 490 491 /* 492 * Re-dispatch via software interrupt. 493 */ 494 if ((error = netisr_queue_src(NETISR_IP, (uintptr_t)sav->spi, m))) { 495 IPSEC_ISTAT(sproto, V_espstat.esps_qfull, V_ahstat.ahs_qfull, 496 V_ipcompstat.ipcomps_qfull); 497 498 DPRINTF(("%s: queue full; proto %u packet dropped\n", 499 __func__, sproto)); 500 return error; 501 } 502 return 0; 503 bad: 504 m_freem(m); 505 return error; 506 } 507 508 void 509 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 510 { 511 /* XXX nothing just yet */ 512 } 513 #endif /* INET */ 514 515 #ifdef INET6 516 /* IPv6 AH wrapper. */ 517 int 518 ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 519 { 520 int l = 0; 521 int protoff; 522 struct ip6_ext ip6e; 523 524 if (*offp < sizeof(struct ip6_hdr)) { 525 DPRINTF(("%s: bad offset %u\n", __func__, *offp)); 526 return IPPROTO_DONE; 527 } else if (*offp == sizeof(struct ip6_hdr)) { 528 protoff = offsetof(struct ip6_hdr, ip6_nxt); 529 } else { 530 /* Chase down the header chain... */ 531 protoff = sizeof(struct ip6_hdr); 532 533 do { 534 protoff += l; 535 m_copydata(*mp, protoff, sizeof(ip6e), 536 (caddr_t) &ip6e); 537 538 if (ip6e.ip6e_nxt == IPPROTO_AH) 539 l = (ip6e.ip6e_len + 2) << 2; 540 else 541 l = (ip6e.ip6e_len + 1) << 3; 542 IPSEC_ASSERT(l > 0, ("l went zero or negative")); 543 } while (protoff + l < *offp); 544 545 /* Malformed packet check */ 546 if (protoff + l != *offp) { 547 DPRINTF(("%s: bad packet header chain, protoff %u, " 548 "l %u, off %u\n", __func__, protoff, l, *offp)); 549 IPSEC_ISTAT(proto, V_espstat.esps_hdrops, 550 V_ahstat.ahs_hdrops, 551 V_ipcompstat.ipcomps_hdrops); 552 m_freem(*mp); 553 *mp = NULL; 554 return IPPROTO_DONE; 555 } 556 protoff += offsetof(struct ip6_ext, ip6e_nxt); 557 } 558 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 559 return IPPROTO_DONE; 560 } 561 562 /* 563 * IPsec input callback, called by the transform callback. Takes care of 564 * filtering and other sanity checks on the processed packet. 565 */ 566 int 567 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 568 struct m_tag *mt) 569 { 570 int prot, af, sproto; 571 struct ip6_hdr *ip6; 572 struct m_tag *mtag; 573 struct tdb_ident *tdbi; 574 struct secasindex *saidx; 575 int nxt; 576 u_int8_t nxt8; 577 int error, nest; 578 #ifdef notyet 579 char ip6buf[INET6_ADDRSTRLEN]; 580 #endif 581 582 IPSEC_ASSERT(m != NULL, ("null mbuf")); 583 IPSEC_ASSERT(sav != NULL, ("null SA")); 584 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 585 saidx = &sav->sah->saidx; 586 af = saidx->dst.sa.sa_family; 587 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 588 sproto = saidx->proto; 589 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 590 sproto == IPPROTO_IPCOMP, 591 ("unexpected security protocol %u", sproto)); 592 593 /* Sanity check */ 594 if (m == NULL) { 595 DPRINTF(("%s: null mbuf", __func__)); 596 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr, 597 V_ipcompstat.ipcomps_badkcr); 598 error = EINVAL; 599 goto bad; 600 } 601 602 /* Fix IPv6 header */ 603 if (m->m_len < sizeof(struct ip6_hdr) && 604 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 605 606 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 607 __func__, ipsec_address(&sav->sah->saidx.dst), 608 (u_long) ntohl(sav->spi))); 609 610 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 611 V_ipcompstat.ipcomps_hdrops); 612 error = EACCES; 613 goto bad; 614 } 615 616 ip6 = mtod(m, struct ip6_hdr *); 617 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 618 619 /* Save protocol */ 620 m_copydata(m, protoff, 1, (unsigned char *) &prot); 621 622 #ifdef notyet 623 #ifdef INET 624 /* IP-in-IP encapsulation */ 625 if (prot == IPPROTO_IPIP) { 626 struct ip ipn; 627 628 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 629 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 630 V_ahstat.ahs_hdrops, 631 V_ipcompstat.ipcomps_hdrops); 632 error = EINVAL; 633 goto bad; 634 } 635 /* ipn will now contain the inner IPv4 header */ 636 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 637 638 /* 639 * Check that the inner source address is the same as 640 * the proxy address, if available. 641 */ 642 if ((saidx->proxy.sa.sa_family == AF_INET && 643 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 644 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 645 (saidx->proxy.sa.sa_family != AF_INET && 646 saidx->proxy.sa.sa_family != 0)) { 647 648 DPRINTF(("%s: inner source address %s doesn't " 649 "correspond to expected proxy source %s, " 650 "SA %s/%08lx\n", __func__, 651 inet_ntoa4(ipn.ip_src), 652 ipsec_address(&saidx->proxy), 653 ipsec_address(&saidx->dst), 654 (u_long) ntohl(sav->spi))); 655 656 IPSEC_ISTATsproto, (V_espstat.esps_pdrops, 657 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops); 658 error = EACCES; 659 goto bad; 660 } 661 } 662 #endif /* INET */ 663 664 /* IPv6-in-IP encapsulation */ 665 if (prot == IPPROTO_IPV6) { 666 struct ip6_hdr ip6n; 667 668 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 669 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 670 V_ahstat.ahs_hdrops, 671 V_ipcompstat.ipcomps_hdrops); 672 error = EINVAL; 673 goto bad; 674 } 675 /* ip6n will now contain the inner IPv6 header. */ 676 m_copydata(m, skip, sizeof(struct ip6_hdr), 677 (caddr_t) &ip6n); 678 679 /* 680 * Check that the inner source address is the same as 681 * the proxy address, if available. 682 */ 683 if ((saidx->proxy.sa.sa_family == AF_INET6 && 684 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 685 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 686 &saidx->proxy.sin6.sin6_addr)) || 687 (saidx->proxy.sa.sa_family != AF_INET6 && 688 saidx->proxy.sa.sa_family != 0)) { 689 690 DPRINTF(("%s: inner source address %s doesn't " 691 "correspond to expected proxy source %s, " 692 "SA %s/%08lx\n", __func__, 693 ip6_sprintf(ip6buf, &ip6n.ip6_src), 694 ipsec_address(&saidx->proxy), 695 ipsec_address(&saidx->dst), 696 (u_long) ntohl(sav->spi))); 697 698 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 699 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops); 700 error = EACCES; 701 goto bad; 702 } 703 } 704 #endif /*XXX*/ 705 706 /* 707 * Record what we've done to the packet (under what SA it was 708 * processed). If we've been passed an mtag, it means the packet 709 * was already processed by an ethernet/crypto combo card and 710 * thus has a tag attached with all the right information, but 711 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 712 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 713 */ 714 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 715 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 716 sizeof(struct tdb_ident), M_NOWAIT); 717 if (mtag == NULL) { 718 DPRINTF(("%s: failed to get tag\n", __func__)); 719 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 720 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops); 721 error = ENOMEM; 722 goto bad; 723 } 724 725 tdbi = (struct tdb_ident *)(mtag + 1); 726 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 727 tdbi->proto = sproto; 728 tdbi->spi = sav->spi; 729 /* Cache those two for enc(4) in xform_ipip. */ 730 tdbi->alg_auth = sav->alg_auth; 731 tdbi->alg_enc = sav->alg_enc; 732 733 m_tag_prepend(m, mtag); 734 } else { 735 if (mt != NULL) 736 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 737 /* XXX do we need to mark m_flags??? */ 738 } 739 740 key_sa_recordxfer(sav, m); 741 742 #ifdef DEV_ENC 743 encif->if_ipackets++; 744 encif->if_ibytes += m->m_pkthdr.len; 745 746 /* 747 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 748 * packet later after it has been decapsulated. 749 */ 750 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE); 751 752 /* XXX-BZ does not make sense. */ 753 if (prot != IPPROTO_IPIP) 754 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 755 return (error); 756 #endif 757 758 /* Retrieve new protocol */ 759 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 760 761 /* 762 * See the end of ip6_input for this logic. 763 * IPPROTO_IPV[46] case will be processed just like other ones 764 */ 765 nest = 0; 766 nxt = nxt8; 767 while (nxt != IPPROTO_DONE) { 768 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 769 V_ip6stat.ip6s_toomanyhdr++; 770 error = EINVAL; 771 goto bad; 772 } 773 774 /* 775 * Protection against faulty packet - there should be 776 * more sanity checks in header chain processing. 777 */ 778 if (m->m_pkthdr.len < skip) { 779 V_ip6stat.ip6s_tooshort++; 780 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 781 error = EINVAL; 782 goto bad; 783 } 784 /* 785 * Enforce IPsec policy checking if we are seeing last header. 786 * note that we do not visit this with protocols with pcb layer 787 * code - like udp/tcp/raw ip. 788 */ 789 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 790 ipsec6_in_reject(m, NULL)) { 791 error = EINVAL; 792 goto bad; 793 } 794 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 795 } 796 return 0; 797 bad: 798 if (m) 799 m_freem(m); 800 return error; 801 } 802 803 void 804 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 805 { 806 struct ip6ctlparam *ip6cp = NULL; 807 struct mbuf *m = NULL; 808 struct ip6_hdr *ip6; 809 int off; 810 811 if (sa->sa_family != AF_INET6 || 812 sa->sa_len != sizeof(struct sockaddr_in6)) 813 return; 814 if ((unsigned)cmd >= PRC_NCMDS) 815 return; 816 817 /* if the parameter is from icmp6, decode it. */ 818 if (d != NULL) { 819 ip6cp = (struct ip6ctlparam *)d; 820 m = ip6cp->ip6c_m; 821 ip6 = ip6cp->ip6c_ip6; 822 off = ip6cp->ip6c_off; 823 } else { 824 m = NULL; 825 ip6 = NULL; 826 off = 0; /* calm gcc */ 827 } 828 829 if (ip6 != NULL) { 830 831 struct ip6ctlparam ip6cp1; 832 833 /* 834 * Notify the error to all possible sockets via pfctlinput2. 835 * Since the upper layer information (such as protocol type, 836 * source and destination ports) is embedded in the encrypted 837 * data and might have been cut, we can't directly call 838 * an upper layer ctlinput function. However, the pcbnotify 839 * function will consider source and destination addresses 840 * as well as the flow info value, and may be able to find 841 * some PCB that should be notified. 842 * Although pfctlinput2 will call esp6_ctlinput(), there is 843 * no possibility of an infinite loop of function calls, 844 * because we don't pass the inner IPv6 header. 845 */ 846 bzero(&ip6cp1, sizeof(ip6cp1)); 847 ip6cp1.ip6c_src = ip6cp->ip6c_src; 848 pfctlinput2(cmd, sa, (void *)&ip6cp1); 849 850 /* 851 * Then go to special cases that need ESP header information. 852 * XXX: We assume that when ip6 is non NULL, 853 * M and OFF are valid. 854 */ 855 856 if (cmd == PRC_MSGSIZE) { 857 struct secasvar *sav; 858 u_int32_t spi; 859 int valid; 860 861 /* check header length before using m_copydata */ 862 if (m->m_pkthdr.len < off + sizeof (struct esp)) 863 return; 864 m_copydata(m, off + offsetof(struct esp, esp_spi), 865 sizeof(u_int32_t), (caddr_t) &spi); 866 /* 867 * Check to see if we have a valid SA corresponding to 868 * the address in the ICMP message payload. 869 */ 870 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 871 IPPROTO_ESP, spi); 872 valid = (sav != NULL); 873 if (sav) 874 KEY_FREESAV(&sav); 875 876 /* XXX Further validation? */ 877 878 /* 879 * Depending on whether the SA is "valid" and 880 * routing table size (mtudisc_{hi,lo}wat), we will: 881 * - recalcurate the new MTU and create the 882 * corresponding routing entry, or 883 * - ignore the MTU change notification. 884 */ 885 icmp6_mtudisc_update(ip6cp, valid); 886 } 887 } else { 888 /* we normally notify any pcb here */ 889 } 890 } 891 #endif /* INET6 */ 892