1 /* $FreeBSD$ */ 2 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IPsec input processing. 41 */ 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_ipsec.h" 46 #include "opt_enc.h" 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/malloc.h> 51 #include <sys/mbuf.h> 52 #include <sys/domain.h> 53 #include <sys/protosw.h> 54 #include <sys/socket.h> 55 #include <sys/errno.h> 56 #include <sys/syslog.h> 57 58 #include <net/if.h> 59 #include <net/pfil.h> 60 #include <net/route.h> 61 #include <net/netisr.h> 62 #include <net/vnet.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/ip_var.h> 68 #include <netinet/in_var.h> 69 70 #include <netinet/ip6.h> 71 #ifdef INET6 72 #include <netinet6/ip6_var.h> 73 #endif 74 #include <netinet/in_pcb.h> 75 #ifdef INET6 76 #include <netinet/icmp6.h> 77 #endif 78 79 #include <netipsec/ipsec.h> 80 #ifdef INET6 81 #include <netipsec/ipsec6.h> 82 #endif 83 #include <netipsec/ah_var.h> 84 #include <netipsec/esp.h> 85 #include <netipsec/esp_var.h> 86 #include <netipsec/ipcomp_var.h> 87 88 #include <netipsec/key.h> 89 #include <netipsec/keydb.h> 90 91 #include <netipsec/xform.h> 92 #include <netinet6/ip6protosw.h> 93 94 #include <machine/in_cksum.h> 95 #include <machine/stdarg.h> 96 97 #ifdef DEV_ENC 98 #include <net/if_enc.h> 99 #endif 100 101 102 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \ 103 (p) == IPPROTO_AH ? (y)++ : (z)++) 104 105 #ifdef INET 106 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int); 107 #endif 108 109 /* 110 * ipsec_common_input gets called when an IPsec-protected packet 111 * is received by IPv4 or IPv6. Its job is to find the right SA 112 * and call the appropriate transform. The transform callback 113 * takes care of further processing (like ingress filtering). 114 */ 115 static int 116 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 117 { 118 union sockaddr_union dst_address; 119 struct secasvar *sav; 120 u_int32_t spi; 121 int error; 122 #ifdef INET 123 #ifdef IPSEC_NAT_T 124 struct m_tag *tag; 125 #endif 126 #endif 127 128 IPSEC_ISTAT(sproto, V_espstat.esps_input, V_ahstat.ahs_input, 129 V_ipcompstat.ipcomps_input); 130 131 IPSEC_ASSERT(m != NULL, ("null packet")); 132 133 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 134 sproto == IPPROTO_IPCOMP, 135 ("unexpected security protocol %u", sproto)); 136 137 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 138 (sproto == IPPROTO_AH && !V_ah_enable) || 139 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 140 m_freem(m); 141 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, V_ahstat.ahs_pdrops, 142 V_ipcompstat.ipcomps_pdrops); 143 return EOPNOTSUPP; 144 } 145 146 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 147 m_freem(m); 148 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 149 V_ipcompstat.ipcomps_hdrops); 150 DPRINTF(("%s: packet too small\n", __func__)); 151 return EINVAL; 152 } 153 154 /* Retrieve the SPI from the relevant IPsec header */ 155 if (sproto == IPPROTO_ESP) 156 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 157 else if (sproto == IPPROTO_AH) 158 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 159 (caddr_t) &spi); 160 else if (sproto == IPPROTO_IPCOMP) { 161 u_int16_t cpi; 162 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 163 (caddr_t) &cpi); 164 spi = ntohl(htons(cpi)); 165 } 166 167 /* 168 * Find the SA and (indirectly) call the appropriate 169 * kernel crypto routine. The resulting mbuf chain is a valid 170 * IP packet ready to go through input processing. 171 */ 172 bzero(&dst_address, sizeof (dst_address)); 173 dst_address.sa.sa_family = af; 174 switch (af) { 175 #ifdef INET 176 case AF_INET: 177 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 178 m_copydata(m, offsetof(struct ip, ip_dst), 179 sizeof(struct in_addr), 180 (caddr_t) &dst_address.sin.sin_addr); 181 #ifdef IPSEC_NAT_T 182 /* Find the source port for NAT-T; see udp*_espdecap. */ 183 tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL); 184 if (tag != NULL) 185 dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1]; 186 #endif /* IPSEC_NAT_T */ 187 break; 188 #endif /* INET */ 189 #ifdef INET6 190 case AF_INET6: 191 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 192 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 193 sizeof(struct in6_addr), 194 (caddr_t) &dst_address.sin6.sin6_addr); 195 break; 196 #endif /* INET6 */ 197 default: 198 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 199 m_freem(m); 200 IPSEC_ISTAT(sproto, V_espstat.esps_nopf, V_ahstat.ahs_nopf, 201 V_ipcompstat.ipcomps_nopf); 202 return EPFNOSUPPORT; 203 } 204 205 /* NB: only pass dst since key_allocsa follows RFC2401 */ 206 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 207 if (sav == NULL) { 208 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 209 __func__, ipsec_address(&dst_address), 210 (u_long) ntohl(spi), sproto)); 211 IPSEC_ISTAT(sproto, V_espstat.esps_notdb, V_ahstat.ahs_notdb, 212 V_ipcompstat.ipcomps_notdb); 213 m_freem(m); 214 return ENOENT; 215 } 216 217 if (sav->tdb_xform == NULL) { 218 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 219 __func__, ipsec_address(&dst_address), 220 (u_long) ntohl(spi), sproto)); 221 IPSEC_ISTAT(sproto, V_espstat.esps_noxform, V_ahstat.ahs_noxform, 222 V_ipcompstat.ipcomps_noxform); 223 KEY_FREESAV(&sav); 224 m_freem(m); 225 return ENXIO; 226 } 227 228 /* 229 * Call appropriate transform and return -- callback takes care of 230 * everything else. 231 */ 232 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 233 KEY_FREESAV(&sav); 234 return error; 235 } 236 237 #ifdef INET 238 /* 239 * Common input handler for IPv4 AH, ESP, and IPCOMP. 240 */ 241 int 242 ipsec4_common_input(struct mbuf *m, ...) 243 { 244 va_list ap; 245 int off, nxt; 246 247 va_start(ap, m); 248 off = va_arg(ap, int); 249 nxt = va_arg(ap, int); 250 va_end(ap); 251 252 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 253 AF_INET, nxt); 254 } 255 256 void 257 ah4_input(struct mbuf *m, int off) 258 { 259 ipsec4_common_input(m, off, IPPROTO_AH); 260 } 261 void 262 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v) 263 { 264 if (sa->sa_family == AF_INET && 265 sa->sa_len == sizeof(struct sockaddr_in)) 266 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH); 267 } 268 269 void 270 esp4_input(struct mbuf *m, int off) 271 { 272 ipsec4_common_input(m, off, IPPROTO_ESP); 273 } 274 void 275 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v) 276 { 277 if (sa->sa_family == AF_INET && 278 sa->sa_len == sizeof(struct sockaddr_in)) 279 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP); 280 } 281 282 void 283 ipcomp4_input(struct mbuf *m, int off) 284 { 285 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 286 } 287 288 /* 289 * IPsec input callback for INET protocols. 290 * This routine is called as the transform callback. 291 * Takes care of filtering and other sanity checks on 292 * the processed packet. 293 */ 294 int 295 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 296 int skip, int protoff, struct m_tag *mt) 297 { 298 int prot, af, sproto; 299 struct ip *ip; 300 struct m_tag *mtag; 301 struct tdb_ident *tdbi; 302 struct secasindex *saidx; 303 int error; 304 #ifdef INET6 305 #ifdef notyet 306 char ip6buf[INET6_ADDRSTRLEN]; 307 #endif 308 #endif 309 310 IPSEC_ASSERT(m != NULL, ("null mbuf")); 311 IPSEC_ASSERT(sav != NULL, ("null SA")); 312 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 313 saidx = &sav->sah->saidx; 314 af = saidx->dst.sa.sa_family; 315 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 316 sproto = saidx->proto; 317 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 318 sproto == IPPROTO_IPCOMP, 319 ("unexpected security protocol %u", sproto)); 320 321 /* Sanity check */ 322 if (m == NULL) { 323 DPRINTF(("%s: null mbuf", __func__)); 324 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr, 325 V_ipcompstat.ipcomps_badkcr); 326 KEY_FREESAV(&sav); 327 return EINVAL; 328 } 329 330 if (skip != 0) { 331 /* Fix IPv4 header */ 332 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 333 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 334 __func__, ipsec_address(&sav->sah->saidx.dst), 335 (u_long) ntohl(sav->spi))); 336 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 337 V_ipcompstat.ipcomps_hdrops); 338 error = ENOBUFS; 339 goto bad; 340 } 341 342 ip = mtod(m, struct ip *); 343 ip->ip_len = htons(m->m_pkthdr.len); 344 ip->ip_off = htons(ip->ip_off); 345 ip->ip_sum = 0; 346 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 347 } else { 348 ip = mtod(m, struct ip *); 349 } 350 prot = ip->ip_p; 351 352 #ifdef notyet 353 /* IP-in-IP encapsulation */ 354 if (prot == IPPROTO_IPIP) { 355 struct ip ipn; 356 357 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 358 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 359 V_ahstat.ahs_hdrops, 360 V_ipcompstat.ipcomps_hdrops); 361 error = EINVAL; 362 goto bad; 363 } 364 /* ipn will now contain the inner IPv4 header */ 365 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 366 (caddr_t) &ipn); 367 368 /* XXX PROXY address isn't recorded in SAH */ 369 /* 370 * Check that the inner source address is the same as 371 * the proxy address, if available. 372 */ 373 if ((saidx->proxy.sa.sa_family == AF_INET && 374 saidx->proxy.sin.sin_addr.s_addr != 375 INADDR_ANY && 376 ipn.ip_src.s_addr != 377 saidx->proxy.sin.sin_addr.s_addr) || 378 (saidx->proxy.sa.sa_family != AF_INET && 379 saidx->proxy.sa.sa_family != 0)) { 380 381 DPRINTF(("%s: inner source address %s doesn't " 382 "correspond to expected proxy source %s, " 383 "SA %s/%08lx\n", __func__, 384 inet_ntoa4(ipn.ip_src), 385 ipsp_address(saidx->proxy), 386 ipsp_address(saidx->dst), 387 (u_long) ntohl(sav->spi))); 388 389 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 390 V_ahstat.ahs_pdrops, 391 V_ipcompstat.ipcomps_pdrops); 392 error = EACCES; 393 goto bad; 394 } 395 } 396 #ifdef INET6 397 /* IPv6-in-IP encapsulation. */ 398 if (prot == IPPROTO_IPV6) { 399 struct ip6_hdr ip6n; 400 401 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 402 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 403 V_ahstat.ahs_hdrops, 404 V_ipcompstat.ipcomps_hdrops); 405 error = EINVAL; 406 goto bad; 407 } 408 /* ip6n will now contain the inner IPv6 header. */ 409 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 410 (caddr_t) &ip6n); 411 412 /* 413 * Check that the inner source address is the same as 414 * the proxy address, if available. 415 */ 416 if ((saidx->proxy.sa.sa_family == AF_INET6 && 417 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 418 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 419 &saidx->proxy.sin6.sin6_addr)) || 420 (saidx->proxy.sa.sa_family != AF_INET6 && 421 saidx->proxy.sa.sa_family != 0)) { 422 423 DPRINTF(("%s: inner source address %s doesn't " 424 "correspond to expected proxy source %s, " 425 "SA %s/%08lx\n", __func__, 426 ip6_sprintf(ip6buf, &ip6n.ip6_src), 427 ipsec_address(&saidx->proxy), 428 ipsec_address(&saidx->dst), 429 (u_long) ntohl(sav->spi))); 430 431 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 432 V_ahstat.ahs_pdrops, 433 V_ipcompstat.ipcomps_pdrops); 434 error = EACCES; 435 goto bad; 436 } 437 } 438 #endif /* INET6 */ 439 #endif /*XXX*/ 440 441 /* 442 * Record what we've done to the packet (under what SA it was 443 * processed). If we've been passed an mtag, it means the packet 444 * was already processed by an ethernet/crypto combo card and 445 * thus has a tag attached with all the right information, but 446 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 447 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 448 */ 449 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 450 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 451 sizeof(struct tdb_ident), M_NOWAIT); 452 if (mtag == NULL) { 453 DPRINTF(("%s: failed to get tag\n", __func__)); 454 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 455 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops); 456 error = ENOMEM; 457 goto bad; 458 } 459 460 tdbi = (struct tdb_ident *)(mtag + 1); 461 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 462 tdbi->proto = sproto; 463 tdbi->spi = sav->spi; 464 /* Cache those two for enc(4) in xform_ipip. */ 465 tdbi->alg_auth = sav->alg_auth; 466 tdbi->alg_enc = sav->alg_enc; 467 468 m_tag_prepend(m, mtag); 469 } else if (mt != NULL) { 470 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 471 /* XXX do we need to mark m_flags??? */ 472 } 473 474 key_sa_recordxfer(sav, m); /* record data transfer */ 475 476 m_addr_changed(m); 477 478 #ifdef DEV_ENC 479 encif->if_ipackets++; 480 encif->if_ibytes += m->m_pkthdr.len; 481 482 /* 483 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 484 * packet later after it has been decapsulated. 485 */ 486 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE); 487 488 if (prot != IPPROTO_IPIP) 489 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 490 return (error); 491 #endif 492 493 /* 494 * Re-dispatch via software interrupt. 495 */ 496 if ((error = netisr_queue_src(NETISR_IP, (uintptr_t)sav->spi, m))) { 497 IPSEC_ISTAT(sproto, V_espstat.esps_qfull, V_ahstat.ahs_qfull, 498 V_ipcompstat.ipcomps_qfull); 499 500 DPRINTF(("%s: queue full; proto %u packet dropped\n", 501 __func__, sproto)); 502 return error; 503 } 504 return 0; 505 bad: 506 m_freem(m); 507 return error; 508 } 509 510 void 511 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 512 { 513 /* XXX nothing just yet */ 514 } 515 #endif /* INET */ 516 517 #ifdef INET6 518 /* IPv6 AH wrapper. */ 519 int 520 ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 521 { 522 int l = 0; 523 int protoff; 524 struct ip6_ext ip6e; 525 526 if (*offp < sizeof(struct ip6_hdr)) { 527 DPRINTF(("%s: bad offset %u\n", __func__, *offp)); 528 return IPPROTO_DONE; 529 } else if (*offp == sizeof(struct ip6_hdr)) { 530 protoff = offsetof(struct ip6_hdr, ip6_nxt); 531 } else { 532 /* Chase down the header chain... */ 533 protoff = sizeof(struct ip6_hdr); 534 535 do { 536 protoff += l; 537 m_copydata(*mp, protoff, sizeof(ip6e), 538 (caddr_t) &ip6e); 539 540 if (ip6e.ip6e_nxt == IPPROTO_AH) 541 l = (ip6e.ip6e_len + 2) << 2; 542 else 543 l = (ip6e.ip6e_len + 1) << 3; 544 IPSEC_ASSERT(l > 0, ("l went zero or negative")); 545 } while (protoff + l < *offp); 546 547 /* Malformed packet check */ 548 if (protoff + l != *offp) { 549 DPRINTF(("%s: bad packet header chain, protoff %u, " 550 "l %u, off %u\n", __func__, protoff, l, *offp)); 551 IPSEC_ISTAT(proto, V_espstat.esps_hdrops, 552 V_ahstat.ahs_hdrops, 553 V_ipcompstat.ipcomps_hdrops); 554 m_freem(*mp); 555 *mp = NULL; 556 return IPPROTO_DONE; 557 } 558 protoff += offsetof(struct ip6_ext, ip6e_nxt); 559 } 560 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 561 return IPPROTO_DONE; 562 } 563 564 /* 565 * IPsec input callback, called by the transform callback. Takes care of 566 * filtering and other sanity checks on the processed packet. 567 */ 568 int 569 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 570 struct m_tag *mt) 571 { 572 int prot, af, sproto; 573 struct ip6_hdr *ip6; 574 struct m_tag *mtag; 575 struct tdb_ident *tdbi; 576 struct secasindex *saidx; 577 int nxt; 578 u_int8_t nxt8; 579 int error, nest; 580 #ifdef notyet 581 char ip6buf[INET6_ADDRSTRLEN]; 582 #endif 583 584 IPSEC_ASSERT(m != NULL, ("null mbuf")); 585 IPSEC_ASSERT(sav != NULL, ("null SA")); 586 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 587 saidx = &sav->sah->saidx; 588 af = saidx->dst.sa.sa_family; 589 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 590 sproto = saidx->proto; 591 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 592 sproto == IPPROTO_IPCOMP, 593 ("unexpected security protocol %u", sproto)); 594 595 /* Sanity check */ 596 if (m == NULL) { 597 DPRINTF(("%s: null mbuf", __func__)); 598 IPSEC_ISTAT(sproto, V_espstat.esps_badkcr, V_ahstat.ahs_badkcr, 599 V_ipcompstat.ipcomps_badkcr); 600 error = EINVAL; 601 goto bad; 602 } 603 604 /* Fix IPv6 header */ 605 if (m->m_len < sizeof(struct ip6_hdr) && 606 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 607 608 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 609 __func__, ipsec_address(&sav->sah->saidx.dst), 610 (u_long) ntohl(sav->spi))); 611 612 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, V_ahstat.ahs_hdrops, 613 V_ipcompstat.ipcomps_hdrops); 614 error = EACCES; 615 goto bad; 616 } 617 618 ip6 = mtod(m, struct ip6_hdr *); 619 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 620 621 /* Save protocol */ 622 m_copydata(m, protoff, 1, (unsigned char *) &prot); 623 624 #ifdef notyet 625 #ifdef INET 626 /* IP-in-IP encapsulation */ 627 if (prot == IPPROTO_IPIP) { 628 struct ip ipn; 629 630 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 631 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 632 V_ahstat.ahs_hdrops, 633 V_ipcompstat.ipcomps_hdrops); 634 error = EINVAL; 635 goto bad; 636 } 637 /* ipn will now contain the inner IPv4 header */ 638 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 639 640 /* 641 * Check that the inner source address is the same as 642 * the proxy address, if available. 643 */ 644 if ((saidx->proxy.sa.sa_family == AF_INET && 645 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 646 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 647 (saidx->proxy.sa.sa_family != AF_INET && 648 saidx->proxy.sa.sa_family != 0)) { 649 650 DPRINTF(("%s: inner source address %s doesn't " 651 "correspond to expected proxy source %s, " 652 "SA %s/%08lx\n", __func__, 653 inet_ntoa4(ipn.ip_src), 654 ipsec_address(&saidx->proxy), 655 ipsec_address(&saidx->dst), 656 (u_long) ntohl(sav->spi))); 657 658 IPSEC_ISTATsproto, (V_espstat.esps_pdrops, 659 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops); 660 error = EACCES; 661 goto bad; 662 } 663 } 664 #endif /* INET */ 665 666 /* IPv6-in-IP encapsulation */ 667 if (prot == IPPROTO_IPV6) { 668 struct ip6_hdr ip6n; 669 670 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 671 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 672 V_ahstat.ahs_hdrops, 673 V_ipcompstat.ipcomps_hdrops); 674 error = EINVAL; 675 goto bad; 676 } 677 /* ip6n will now contain the inner IPv6 header. */ 678 m_copydata(m, skip, sizeof(struct ip6_hdr), 679 (caddr_t) &ip6n); 680 681 /* 682 * Check that the inner source address is the same as 683 * the proxy address, if available. 684 */ 685 if ((saidx->proxy.sa.sa_family == AF_INET6 && 686 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 687 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 688 &saidx->proxy.sin6.sin6_addr)) || 689 (saidx->proxy.sa.sa_family != AF_INET6 && 690 saidx->proxy.sa.sa_family != 0)) { 691 692 DPRINTF(("%s: inner source address %s doesn't " 693 "correspond to expected proxy source %s, " 694 "SA %s/%08lx\n", __func__, 695 ip6_sprintf(ip6buf, &ip6n.ip6_src), 696 ipsec_address(&saidx->proxy), 697 ipsec_address(&saidx->dst), 698 (u_long) ntohl(sav->spi))); 699 700 IPSEC_ISTAT(sproto, V_espstat.esps_pdrops, 701 V_ahstat.ahs_pdrops, V_ipcompstat.ipcomps_pdrops); 702 error = EACCES; 703 goto bad; 704 } 705 } 706 #endif /*XXX*/ 707 708 /* 709 * Record what we've done to the packet (under what SA it was 710 * processed). If we've been passed an mtag, it means the packet 711 * was already processed by an ethernet/crypto combo card and 712 * thus has a tag attached with all the right information, but 713 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 714 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 715 */ 716 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 717 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 718 sizeof(struct tdb_ident), M_NOWAIT); 719 if (mtag == NULL) { 720 DPRINTF(("%s: failed to get tag\n", __func__)); 721 IPSEC_ISTAT(sproto, V_espstat.esps_hdrops, 722 V_ahstat.ahs_hdrops, V_ipcompstat.ipcomps_hdrops); 723 error = ENOMEM; 724 goto bad; 725 } 726 727 tdbi = (struct tdb_ident *)(mtag + 1); 728 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 729 tdbi->proto = sproto; 730 tdbi->spi = sav->spi; 731 /* Cache those two for enc(4) in xform_ipip. */ 732 tdbi->alg_auth = sav->alg_auth; 733 tdbi->alg_enc = sav->alg_enc; 734 735 m_tag_prepend(m, mtag); 736 } else { 737 if (mt != NULL) 738 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 739 /* XXX do we need to mark m_flags??? */ 740 } 741 742 key_sa_recordxfer(sav, m); 743 744 #ifdef DEV_ENC 745 encif->if_ipackets++; 746 encif->if_ibytes += m->m_pkthdr.len; 747 748 /* 749 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 750 * packet later after it has been decapsulated. 751 */ 752 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE); 753 754 /* XXX-BZ does not make sense. */ 755 if (prot != IPPROTO_IPIP) 756 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 757 return (error); 758 #endif 759 760 /* Retrieve new protocol */ 761 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 762 763 /* 764 * See the end of ip6_input for this logic. 765 * IPPROTO_IPV[46] case will be processed just like other ones 766 */ 767 nest = 0; 768 nxt = nxt8; 769 while (nxt != IPPROTO_DONE) { 770 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 771 V_ip6stat.ip6s_toomanyhdr++; 772 error = EINVAL; 773 goto bad; 774 } 775 776 /* 777 * Protection against faulty packet - there should be 778 * more sanity checks in header chain processing. 779 */ 780 if (m->m_pkthdr.len < skip) { 781 V_ip6stat.ip6s_tooshort++; 782 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 783 error = EINVAL; 784 goto bad; 785 } 786 /* 787 * Enforce IPsec policy checking if we are seeing last header. 788 * note that we do not visit this with protocols with pcb layer 789 * code - like udp/tcp/raw ip. 790 */ 791 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 792 ipsec6_in_reject(m, NULL)) { 793 error = EINVAL; 794 goto bad; 795 } 796 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 797 } 798 return 0; 799 bad: 800 if (m) 801 m_freem(m); 802 return error; 803 } 804 805 void 806 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 807 { 808 struct ip6ctlparam *ip6cp = NULL; 809 struct mbuf *m = NULL; 810 struct ip6_hdr *ip6; 811 int off; 812 813 if (sa->sa_family != AF_INET6 || 814 sa->sa_len != sizeof(struct sockaddr_in6)) 815 return; 816 if ((unsigned)cmd >= PRC_NCMDS) 817 return; 818 819 /* if the parameter is from icmp6, decode it. */ 820 if (d != NULL) { 821 ip6cp = (struct ip6ctlparam *)d; 822 m = ip6cp->ip6c_m; 823 ip6 = ip6cp->ip6c_ip6; 824 off = ip6cp->ip6c_off; 825 } else { 826 m = NULL; 827 ip6 = NULL; 828 off = 0; /* calm gcc */ 829 } 830 831 if (ip6 != NULL) { 832 833 struct ip6ctlparam ip6cp1; 834 835 /* 836 * Notify the error to all possible sockets via pfctlinput2. 837 * Since the upper layer information (such as protocol type, 838 * source and destination ports) is embedded in the encrypted 839 * data and might have been cut, we can't directly call 840 * an upper layer ctlinput function. However, the pcbnotify 841 * function will consider source and destination addresses 842 * as well as the flow info value, and may be able to find 843 * some PCB that should be notified. 844 * Although pfctlinput2 will call esp6_ctlinput(), there is 845 * no possibility of an infinite loop of function calls, 846 * because we don't pass the inner IPv6 header. 847 */ 848 bzero(&ip6cp1, sizeof(ip6cp1)); 849 ip6cp1.ip6c_src = ip6cp->ip6c_src; 850 pfctlinput2(cmd, sa, (void *)&ip6cp1); 851 852 /* 853 * Then go to special cases that need ESP header information. 854 * XXX: We assume that when ip6 is non NULL, 855 * M and OFF are valid. 856 */ 857 858 if (cmd == PRC_MSGSIZE) { 859 struct secasvar *sav; 860 u_int32_t spi; 861 int valid; 862 863 /* check header length before using m_copydata */ 864 if (m->m_pkthdr.len < off + sizeof (struct esp)) 865 return; 866 m_copydata(m, off + offsetof(struct esp, esp_spi), 867 sizeof(u_int32_t), (caddr_t) &spi); 868 /* 869 * Check to see if we have a valid SA corresponding to 870 * the address in the ICMP message payload. 871 */ 872 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 873 IPPROTO_ESP, spi); 874 valid = (sav != NULL); 875 if (sav) 876 KEY_FREESAV(&sav); 877 878 /* XXX Further validation? */ 879 880 /* 881 * Depending on whether the SA is "valid" and 882 * routing table size (mtudisc_{hi,lo}wat), we will: 883 * - recalcurate the new MTU and create the 884 * corresponding routing entry, or 885 * - ignore the MTU change notification. 886 */ 887 icmp6_mtudisc_update(ip6cp, valid); 888 } 889 } else { 890 /* we normally notify any pcb here */ 891 } 892 } 893 #endif /* INET6 */ 894