1 /* $FreeBSD$ */ 2 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */ 3 4 /* 5 * IPsec input processing. 6 */ 7 8 #include "opt_inet.h" 9 #include "opt_inet6.h" 10 #include "opt_ipsec.h" 11 12 #include <sys/param.h> 13 #include <sys/systm.h> 14 #include <sys/malloc.h> 15 #include <sys/mbuf.h> 16 #include <sys/domain.h> 17 #include <sys/protosw.h> 18 #include <sys/socket.h> 19 #include <sys/errno.h> 20 #include <sys/syslog.h> 21 22 #include <net/if.h> 23 #include <net/route.h> 24 #include <net/netisr.h> 25 26 #include <netinet/in.h> 27 #include <netinet/in_systm.h> 28 #include <netinet/ip.h> 29 #include <netinet/ip_var.h> 30 #include <netinet/in_var.h> 31 32 #include <netinet/ip6.h> 33 #ifdef INET6 34 #include <netinet6/ip6_var.h> 35 #endif 36 #include <netinet/in_pcb.h> 37 #ifdef INET6 38 #include <netinet/icmp6.h> 39 #endif 40 41 #include <netipsec/ipsec.h> 42 #ifdef INET6 43 #include <netipsec/ipsec6.h> 44 #endif 45 #include <netipsec/ah_var.h> 46 #include <netipsec/esp.h> 47 #include <netipsec/esp_var.h> 48 #include <netipsec/ipcomp_var.h> 49 50 #include <netipsec/key.h> 51 #include <netipsec/keydb.h> 52 53 #include <netipsec/xform.h> 54 #include <netinet6/ip6protosw.h> 55 56 #include <machine/in_cksum.h> 57 #include <machine/stdarg.h> 58 59 #include <net/net_osdep.h> 60 61 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \ 62 (p) == IPPROTO_AH ? (y)++ : (z)++) 63 64 /* 65 * ipsec_common_input gets called when an IPsec-protected packet 66 * is received by IPv4 or IPv6. It's job is to find the right SA 67 # and call the appropriate transform. The transform callback 68 * takes care of further processing (like ingress filtering). 69 */ 70 static int 71 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 72 { 73 union sockaddr_union dst_address; 74 struct secasvar *sav; 75 u_int32_t spi; 76 int s, error; 77 78 IPSEC_ISTAT(sproto, espstat.esps_input, ahstat.ahs_input, 79 ipcompstat.ipcomps_input); 80 81 KASSERT(m != NULL, ("ipsec_common_input: null packet")); 82 83 if ((sproto == IPPROTO_ESP && !esp_enable) || 84 (sproto == IPPROTO_AH && !ah_enable) || 85 (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) { 86 m_freem(m); 87 IPSEC_ISTAT(sproto, espstat.esps_pdrops, ahstat.ahs_pdrops, 88 ipcompstat.ipcomps_pdrops); 89 return EOPNOTSUPP; 90 } 91 92 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 93 m_freem(m); 94 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 95 ipcompstat.ipcomps_hdrops); 96 DPRINTF(("ipsec_common_input: packet too small\n")); 97 return EINVAL; 98 } 99 100 /* Retrieve the SPI from the relevant IPsec header */ 101 if (sproto == IPPROTO_ESP) 102 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 103 else if (sproto == IPPROTO_AH) 104 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 105 (caddr_t) &spi); 106 else if (sproto == IPPROTO_IPCOMP) { 107 u_int16_t cpi; 108 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 109 (caddr_t) &cpi); 110 spi = ntohl(htons(cpi)); 111 } 112 113 /* 114 * Find the SA and (indirectly) call the appropriate 115 * kernel crypto routine. The resulting mbuf chain is a valid 116 * IP packet ready to go through input processing. 117 */ 118 bzero(&dst_address, sizeof (dst_address)); 119 dst_address.sa.sa_family = af; 120 switch (af) { 121 #ifdef INET 122 case AF_INET: 123 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 124 m_copydata(m, offsetof(struct ip, ip_dst), 125 sizeof(struct in_addr), 126 (caddr_t) &dst_address.sin.sin_addr); 127 break; 128 #endif /* INET */ 129 #ifdef INET6 130 case AF_INET6: 131 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 132 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 133 sizeof(struct in6_addr), 134 (caddr_t) &dst_address.sin6.sin6_addr); 135 break; 136 #endif /* INET6 */ 137 default: 138 DPRINTF(("ipsec_common_input: unsupported protocol " 139 "family %u\n", af)); 140 m_freem(m); 141 IPSEC_ISTAT(sproto, espstat.esps_nopf, ahstat.ahs_nopf, 142 ipcompstat.ipcomps_nopf); 143 return EPFNOSUPPORT; 144 } 145 146 s = splnet(); 147 148 /* NB: only pass dst since key_allocsa follows RFC2401 */ 149 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 150 if (sav == NULL) { 151 DPRINTF(("ipsec_common_input: no key association found for" 152 " SA %s/%08lx/%u\n", 153 ipsec_address(&dst_address), 154 (u_long) ntohl(spi), sproto)); 155 IPSEC_ISTAT(sproto, espstat.esps_notdb, ahstat.ahs_notdb, 156 ipcompstat.ipcomps_notdb); 157 splx(s); 158 m_freem(m); 159 return ENOENT; 160 } 161 162 if (sav->tdb_xform == NULL) { 163 DPRINTF(("ipsec_common_input: attempted to use uninitialized" 164 " SA %s/%08lx/%u\n", 165 ipsec_address(&dst_address), 166 (u_long) ntohl(spi), sproto)); 167 IPSEC_ISTAT(sproto, espstat.esps_noxform, ahstat.ahs_noxform, 168 ipcompstat.ipcomps_noxform); 169 KEY_FREESAV(&sav); 170 splx(s); 171 m_freem(m); 172 return ENXIO; 173 } 174 175 /* 176 * Call appropriate transform and return -- callback takes care of 177 * everything else. 178 */ 179 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 180 KEY_FREESAV(&sav); 181 splx(s); 182 return error; 183 } 184 185 #ifdef INET 186 /* 187 * Common input handler for IPv4 AH, ESP, and IPCOMP. 188 */ 189 int 190 ipsec4_common_input(struct mbuf *m, ...) 191 { 192 va_list ap; 193 int off, nxt; 194 195 va_start(ap, m); 196 off = va_arg(ap, int); 197 nxt = va_arg(ap, int); 198 va_end(ap); 199 200 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 201 AF_INET, nxt); 202 } 203 204 /* 205 * IPsec input callback for INET protocols. 206 * This routine is called as the transform callback. 207 * Takes care of filtering and other sanity checks on 208 * the processed packet. 209 */ 210 int 211 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 212 int skip, int protoff, struct m_tag *mt) 213 { 214 int prot, af, sproto; 215 struct ip *ip; 216 struct m_tag *mtag; 217 struct tdb_ident *tdbi; 218 struct secasindex *saidx; 219 int error; 220 221 #if 0 222 SPLASSERT(net, "ipsec4_common_input_cb"); 223 #endif 224 225 KASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf")); 226 KASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA")); 227 KASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH")); 228 saidx = &sav->sah->saidx; 229 af = saidx->dst.sa.sa_family; 230 KASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af)); 231 sproto = saidx->proto; 232 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 233 sproto == IPPROTO_IPCOMP, 234 ("ipsec4_common_input_cb: unexpected security protocol %u", 235 sproto)); 236 237 /* Sanity check */ 238 if (m == NULL) { 239 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 240 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 241 ipcompstat.ipcomps_badkcr); 242 KEY_FREESAV(&sav); 243 return EINVAL; 244 } 245 246 if (skip != 0) { 247 /* Fix IPv4 header */ 248 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 249 DPRINTF(("ipsec4_common_input_cb: processing failed " 250 "for SA %s/%08lx\n", 251 ipsec_address(&sav->sah->saidx.dst), 252 (u_long) ntohl(sav->spi))); 253 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 254 ipcompstat.ipcomps_hdrops); 255 error = ENOBUFS; 256 goto bad; 257 } 258 259 ip = mtod(m, struct ip *); 260 ip->ip_len = htons(m->m_pkthdr.len); 261 ip->ip_off = htons(ip->ip_off); 262 ip->ip_sum = 0; 263 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 264 } else { 265 ip = mtod(m, struct ip *); 266 } 267 prot = ip->ip_p; 268 269 /* IP-in-IP encapsulation */ 270 if (prot == IPPROTO_IPIP) { 271 struct ip ipn; 272 273 /* ipn will now contain the inner IPv4 header */ 274 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 275 (caddr_t) &ipn); 276 277 #ifdef notyet 278 /* XXX PROXY address isn't recorded in SAH */ 279 /* 280 * Check that the inner source address is the same as 281 * the proxy address, if available. 282 */ 283 if ((saidx->proxy.sa.sa_family == AF_INET && 284 saidx->proxy.sin.sin_addr.s_addr != 285 INADDR_ANY && 286 ipn.ip_src.s_addr != 287 saidx->proxy.sin.sin_addr.s_addr) || 288 (saidx->proxy.sa.sa_family != AF_INET && 289 saidx->proxy.sa.sa_family != 0)) { 290 291 DPRINTF(("ipsec4_common_input_cb: inner " 292 "source address %s doesn't correspond to " 293 "expected proxy source %s, SA %s/%08lx\n", 294 inet_ntoa4(ipn.ip_src), 295 ipsp_address(saidx->proxy), 296 ipsp_address(saidx->dst), 297 (u_long) ntohl(sav->spi))); 298 299 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 300 ahstat.ahs_pdrops, 301 ipcompstat.ipcomps_pdrops); 302 error = EACCES; 303 goto bad; 304 } 305 #endif /*XXX*/ 306 } 307 #if INET6 308 /* IPv6-in-IP encapsulation. */ 309 if (prot == IPPROTO_IPV6) { 310 struct ip6_hdr ip6n; 311 312 /* ip6n will now contain the inner IPv6 header. */ 313 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 314 (caddr_t) &ip6n); 315 316 #ifdef notyet 317 /* 318 * Check that the inner source address is the same as 319 * the proxy address, if available. 320 */ 321 if ((saidx->proxy.sa.sa_family == AF_INET6 && 322 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 323 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 324 &saidx->proxy.sin6.sin6_addr)) || 325 (saidx->proxy.sa.sa_family != AF_INET6 && 326 saidx->proxy.sa.sa_family != 0)) { 327 328 DPRINTF(("ipsec4_common_input_cb: inner " 329 "source address %s doesn't correspond to " 330 "expected proxy source %s, SA %s/%08lx\n", 331 ip6_sprintf(&ip6n.ip6_src), 332 ipsec_address(&saidx->proxy), 333 ipsec_address(&saidx->dst), 334 (u_long) ntohl(sav->spi))); 335 336 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 337 ahstat.ahs_pdrops, 338 ipcompstat.ipcomps_pdrops); 339 error = EACCES; 340 goto bad; 341 } 342 #endif /*XXX*/ 343 } 344 #endif /* INET6 */ 345 346 /* 347 * Record what we've done to the packet (under what SA it was 348 * processed). If we've been passed an mtag, it means the packet 349 * was already processed by an ethernet/crypto combo card and 350 * thus has a tag attached with all the right information, but 351 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 352 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 353 */ 354 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 355 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 356 sizeof(struct tdb_ident), M_NOWAIT); 357 if (mtag == NULL) { 358 DPRINTF(("ipsec4_common_input_cb: failed to get tag\n")); 359 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 360 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 361 error = ENOMEM; 362 goto bad; 363 } 364 365 tdbi = (struct tdb_ident *)(mtag + 1); 366 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 367 tdbi->proto = sproto; 368 tdbi->spi = sav->spi; 369 370 m_tag_prepend(m, mtag); 371 } else { 372 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 373 /* XXX do we need to mark m_flags??? */ 374 } 375 376 key_sa_recordxfer(sav, m); /* record data transfer */ 377 378 /* 379 * Re-dispatch via software interrupt. 380 */ 381 if (!IF_HANDOFF(&ipintrq, m, NULL)) { 382 IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull, 383 ipcompstat.ipcomps_qfull); 384 385 DPRINTF(("ipsec4_common_input_cb: queue full; " 386 "proto %u packet dropped\n", sproto)); 387 return ENOBUFS; 388 } 389 schednetisr(NETISR_IP); 390 return 0; 391 bad: 392 m_freem(m); 393 return error; 394 } 395 #endif /* INET */ 396 397 #ifdef INET6 398 /* IPv6 AH wrapper. */ 399 int 400 ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 401 { 402 int l = 0; 403 int protoff; 404 struct ip6_ext ip6e; 405 406 if (*offp < sizeof(struct ip6_hdr)) { 407 DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp)); 408 return IPPROTO_DONE; 409 } else if (*offp == sizeof(struct ip6_hdr)) { 410 protoff = offsetof(struct ip6_hdr, ip6_nxt); 411 } else { 412 /* Chase down the header chain... */ 413 protoff = sizeof(struct ip6_hdr); 414 415 do { 416 protoff += l; 417 m_copydata(*mp, protoff, sizeof(ip6e), 418 (caddr_t) &ip6e); 419 420 if (ip6e.ip6e_nxt == IPPROTO_AH) 421 l = (ip6e.ip6e_len + 2) << 2; 422 else 423 l = (ip6e.ip6e_len + 1) << 3; 424 KASSERT(l > 0, ("ah6_input: l went zero or negative")); 425 } while (protoff + l < *offp); 426 427 /* Malformed packet check */ 428 if (protoff + l != *offp) { 429 DPRINTF(("ipsec6_common_input: bad packet header chain, " 430 "protoff %u, l %u, off %u\n", protoff, l, *offp)); 431 IPSEC_ISTAT(proto, espstat.esps_hdrops, 432 ahstat.ahs_hdrops, 433 ipcompstat.ipcomps_hdrops); 434 m_freem(*mp); 435 *mp = NULL; 436 return IPPROTO_DONE; 437 } 438 protoff += offsetof(struct ip6_ext, ip6e_nxt); 439 } 440 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 441 return IPPROTO_DONE; 442 } 443 444 void 445 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 446 { 447 if (sa->sa_family != AF_INET6 || 448 sa->sa_len != sizeof(struct sockaddr_in6)) 449 return; 450 if ((unsigned)cmd >= PRC_NCMDS) 451 return; 452 453 /* if the parameter is from icmp6, decode it. */ 454 if (d != NULL) { 455 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d; 456 struct mbuf *m = ip6cp->ip6c_m; 457 int off = ip6cp->ip6c_off; 458 459 struct ip6ctlparam ip6cp1; 460 461 /* 462 * Notify the error to all possible sockets via pfctlinput2. 463 * Since the upper layer information (such as protocol type, 464 * source and destination ports) is embedded in the encrypted 465 * data and might have been cut, we can't directly call 466 * an upper layer ctlinput function. However, the pcbnotify 467 * function will consider source and destination addresses 468 * as well as the flow info value, and may be able to find 469 * some PCB that should be notified. 470 * Although pfctlinput2 will call esp6_ctlinput(), there is 471 * no possibility of an infinite loop of function calls, 472 * because we don't pass the inner IPv6 header. 473 */ 474 bzero(&ip6cp1, sizeof(ip6cp1)); 475 ip6cp1.ip6c_src = ip6cp->ip6c_src; 476 pfctlinput2(cmd, sa, (void *)&ip6cp1); 477 478 /* 479 * Then go to special cases that need ESP header information. 480 * XXX: We assume that when ip6 is non NULL, 481 * M and OFF are valid. 482 */ 483 484 if (cmd == PRC_MSGSIZE) { 485 struct secasvar *sav; 486 u_int32_t spi; 487 int valid; 488 489 /* check header length before using m_copydata */ 490 if (m->m_pkthdr.len < off + sizeof (struct esp)) 491 return; 492 m_copydata(m, off + offsetof(struct esp, esp_spi), 493 sizeof(u_int32_t), (caddr_t) &spi); 494 /* 495 * Check to see if we have a valid SA corresponding to 496 * the address in the ICMP message payload. 497 */ 498 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 499 IPPROTO_ESP, spi); 500 valid = (sav != NULL); 501 if (sav) 502 KEY_FREESAV(&sav); 503 504 /* XXX Further validation? */ 505 506 /* 507 * Depending on whether the SA is "valid" and 508 * routing table size (mtudisc_{hi,lo}wat), we will: 509 * - recalcurate the new MTU and create the 510 * corresponding routing entry, or 511 * - ignore the MTU change notification. 512 */ 513 icmp6_mtudisc_update(ip6cp, valid); 514 } 515 } else { 516 /* we normally notify any pcb here */ 517 } 518 } 519 520 /* 521 * IPsec input callback, called by the transform callback. Takes care of 522 * filtering and other sanity checks on the processed packet. 523 */ 524 int 525 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 526 struct m_tag *mt) 527 { 528 int prot, af, sproto; 529 struct ip6_hdr *ip6; 530 struct m_tag *mtag; 531 struct tdb_ident *tdbi; 532 struct secasindex *saidx; 533 int nxt; 534 u_int8_t nxt8; 535 int error, nest; 536 537 KASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf")); 538 KASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA")); 539 KASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH")); 540 saidx = &sav->sah->saidx; 541 af = saidx->dst.sa.sa_family; 542 KASSERT(af == AF_INET6, 543 ("ipsec6_common_input_cb: unexpected af %u", af)); 544 sproto = saidx->proto; 545 KASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 546 sproto == IPPROTO_IPCOMP, 547 ("ipsec6_common_input_cb: unexpected security protocol %u", 548 sproto)); 549 550 /* Sanity check */ 551 if (m == NULL) { 552 DPRINTF(("ipsec4_common_input_cb: null mbuf")); 553 IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr, 554 ipcompstat.ipcomps_badkcr); 555 error = EINVAL; 556 goto bad; 557 } 558 559 /* Fix IPv6 header */ 560 if (m->m_len < sizeof(struct ip6_hdr) && 561 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 562 563 DPRINTF(("ipsec_common_input_cb: processing failed " 564 "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst), 565 (u_long) ntohl(sav->spi))); 566 567 IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops, 568 ipcompstat.ipcomps_hdrops); 569 error = EACCES; 570 goto bad; 571 } 572 573 ip6 = mtod(m, struct ip6_hdr *); 574 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 575 576 /* Save protocol */ 577 m_copydata(m, protoff, 1, (unsigned char *) &prot); 578 579 #ifdef INET 580 /* IP-in-IP encapsulation */ 581 if (prot == IPPROTO_IPIP) { 582 struct ip ipn; 583 584 /* ipn will now contain the inner IPv4 header */ 585 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 586 587 #ifdef notyet 588 /* 589 * Check that the inner source address is the same as 590 * the proxy address, if available. 591 */ 592 if ((saidx->proxy.sa.sa_family == AF_INET && 593 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 594 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 595 (saidx->proxy.sa.sa_family != AF_INET && 596 saidx->proxy.sa.sa_family != 0)) { 597 598 DPRINTF(("ipsec_common_input_cb: inner " 599 "source address %s doesn't correspond to " 600 "expected proxy source %s, SA %s/%08lx\n", 601 inet_ntoa4(ipn.ip_src), 602 ipsec_address(&saidx->proxy), 603 ipsec_address(&saidx->dst), 604 (u_long) ntohl(sav->spi))); 605 606 IPSEC_ISTATsproto, (espstat.esps_pdrops, 607 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 608 error = EACCES; 609 goto bad; 610 } 611 #endif /*XXX*/ 612 } 613 #endif /* INET */ 614 615 /* IPv6-in-IP encapsulation */ 616 if (prot == IPPROTO_IPV6) { 617 struct ip6_hdr ip6n; 618 619 /* ip6n will now contain the inner IPv6 header. */ 620 m_copydata(m, skip, sizeof(struct ip6_hdr), 621 (caddr_t) &ip6n); 622 623 #ifdef notyet 624 /* 625 * Check that the inner source address is the same as 626 * the proxy address, if available. 627 */ 628 if ((saidx->proxy.sa.sa_family == AF_INET6 && 629 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 630 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 631 &saidx->proxy.sin6.sin6_addr)) || 632 (saidx->proxy.sa.sa_family != AF_INET6 && 633 saidx->proxy.sa.sa_family != 0)) { 634 635 DPRINTF(("ipsec_common_input_cb: inner " 636 "source address %s doesn't correspond to " 637 "expected proxy source %s, SA %s/%08lx\n", 638 ip6_sprintf(&ip6n.ip6_src), 639 ipsec_address(&saidx->proxy), 640 ipsec_address(&saidx->dst), 641 (u_long) ntohl(sav->spi))); 642 643 IPSEC_ISTAT(sproto, espstat.esps_pdrops, 644 ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops); 645 error = EACCES; 646 goto bad; 647 } 648 #endif /*XXX*/ 649 } 650 651 /* 652 * Record what we've done to the packet (under what SA it was 653 * processed). If we've been passed an mtag, it means the packet 654 * was already processed by an ethernet/crypto combo card and 655 * thus has a tag attached with all the right information, but 656 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 657 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 658 */ 659 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 660 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 661 sizeof(struct tdb_ident), M_NOWAIT); 662 if (mtag == NULL) { 663 DPRINTF(("ipsec_common_input_cb: failed to " 664 "get tag\n")); 665 IPSEC_ISTAT(sproto, espstat.esps_hdrops, 666 ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops); 667 error = ENOMEM; 668 goto bad; 669 } 670 671 tdbi = (struct tdb_ident *)(mtag + 1); 672 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 673 tdbi->proto = sproto; 674 tdbi->spi = sav->spi; 675 676 m_tag_prepend(m, mtag); 677 } else { 678 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 679 /* XXX do we need to mark m_flags??? */ 680 } 681 682 key_sa_recordxfer(sav, m); 683 684 /* Retrieve new protocol */ 685 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 686 687 /* 688 * See the end of ip6_input for this logic. 689 * IPPROTO_IPV[46] case will be processed just like other ones 690 */ 691 nest = 0; 692 nxt = nxt8; 693 while (nxt != IPPROTO_DONE) { 694 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 695 ip6stat.ip6s_toomanyhdr++; 696 error = EINVAL; 697 goto bad; 698 } 699 700 /* 701 * Protection against faulty packet - there should be 702 * more sanity checks in header chain processing. 703 */ 704 if (m->m_pkthdr.len < skip) { 705 ip6stat.ip6s_tooshort++; 706 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 707 error = EINVAL; 708 goto bad; 709 } 710 /* 711 * Enforce IPsec policy checking if we are seeing last header. 712 * note that we do not visit this with protocols with pcb layer 713 * code - like udp/tcp/raw ip. 714 */ 715 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 716 ipsec6_in_reject(m, NULL)) { 717 error = EINVAL; 718 goto bad; 719 } 720 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 721 } 722 return 0; 723 bad: 724 if (m) 725 m_freem(m); 726 return error; 727 } 728 #endif /* INET6 */ 729