1 /* $FreeBSD$ */ 2 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IPsec input processing. 41 */ 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_ipsec.h" 46 #include "opt_enc.h" 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/malloc.h> 51 #include <sys/mbuf.h> 52 #include <sys/domain.h> 53 #include <sys/protosw.h> 54 #include <sys/socket.h> 55 #include <sys/errno.h> 56 #include <sys/syslog.h> 57 58 #include <net/if.h> 59 #include <net/if_var.h> 60 #include <net/pfil.h> 61 #include <net/netisr.h> 62 #include <net/vnet.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/ip_var.h> 68 #include <netinet/in_var.h> 69 70 #include <netinet/ip6.h> 71 #ifdef INET6 72 #include <netinet6/ip6_var.h> 73 #endif 74 #include <netinet/in_pcb.h> 75 #ifdef INET6 76 #include <netinet/icmp6.h> 77 #endif 78 79 #include <netipsec/ipsec.h> 80 #ifdef INET6 81 #include <netipsec/ipsec6.h> 82 #endif 83 #include <netipsec/ah_var.h> 84 #include <netipsec/esp.h> 85 #include <netipsec/esp_var.h> 86 #include <netipsec/ipcomp_var.h> 87 88 #include <netipsec/key.h> 89 #include <netipsec/keydb.h> 90 91 #include <netipsec/xform.h> 92 #include <netinet6/ip6protosw.h> 93 94 #include <machine/in_cksum.h> 95 #include <machine/stdarg.h> 96 97 #ifdef DEV_ENC 98 #include <net/if_enc.h> 99 #endif 100 101 102 #define IPSEC_ISTAT(proto, name) do { \ 103 if ((proto) == IPPROTO_ESP) \ 104 ESPSTAT_INC(esps_##name); \ 105 else if ((proto) == IPPROTO_AH) \ 106 AHSTAT_INC(ahs_##name); \ 107 else \ 108 IPCOMPSTAT_INC(ipcomps_##name); \ 109 } while (0) 110 111 #ifdef INET 112 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int); 113 #endif 114 115 /* 116 * ipsec_common_input gets called when an IPsec-protected packet 117 * is received by IPv4 or IPv6. Its job is to find the right SA 118 * and call the appropriate transform. The transform callback 119 * takes care of further processing (like ingress filtering). 120 */ 121 static int 122 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 123 { 124 char buf[INET6_ADDRSTRLEN]; 125 union sockaddr_union dst_address; 126 struct secasvar *sav; 127 u_int32_t spi; 128 int error; 129 #ifdef INET 130 #ifdef IPSEC_NAT_T 131 struct m_tag *tag; 132 #endif 133 #endif 134 135 IPSEC_ISTAT(sproto, input); 136 137 IPSEC_ASSERT(m != NULL, ("null packet")); 138 139 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 140 sproto == IPPROTO_IPCOMP, 141 ("unexpected security protocol %u", sproto)); 142 143 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 144 (sproto == IPPROTO_AH && !V_ah_enable) || 145 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 146 m_freem(m); 147 IPSEC_ISTAT(sproto, pdrops); 148 return EOPNOTSUPP; 149 } 150 151 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 152 m_freem(m); 153 IPSEC_ISTAT(sproto, hdrops); 154 DPRINTF(("%s: packet too small\n", __func__)); 155 return EINVAL; 156 } 157 158 /* Retrieve the SPI from the relevant IPsec header */ 159 if (sproto == IPPROTO_ESP) 160 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 161 else if (sproto == IPPROTO_AH) 162 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 163 (caddr_t) &spi); 164 else if (sproto == IPPROTO_IPCOMP) { 165 u_int16_t cpi; 166 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 167 (caddr_t) &cpi); 168 spi = ntohl(htons(cpi)); 169 } 170 171 /* 172 * Find the SA and (indirectly) call the appropriate 173 * kernel crypto routine. The resulting mbuf chain is a valid 174 * IP packet ready to go through input processing. 175 */ 176 bzero(&dst_address, sizeof (dst_address)); 177 dst_address.sa.sa_family = af; 178 switch (af) { 179 #ifdef INET 180 case AF_INET: 181 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 182 m_copydata(m, offsetof(struct ip, ip_dst), 183 sizeof(struct in_addr), 184 (caddr_t) &dst_address.sin.sin_addr); 185 #ifdef IPSEC_NAT_T 186 /* Find the source port for NAT-T; see udp*_espdecap. */ 187 tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL); 188 if (tag != NULL) 189 dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1]; 190 #endif /* IPSEC_NAT_T */ 191 break; 192 #endif /* INET */ 193 #ifdef INET6 194 case AF_INET6: 195 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 196 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 197 sizeof(struct in6_addr), 198 (caddr_t) &dst_address.sin6.sin6_addr); 199 /* We keep addresses in SADB without embedded scope id */ 200 if (IN6_IS_SCOPE_LINKLOCAL(&dst_address.sin6.sin6_addr)) { 201 /* XXX: sa6_recoverscope() */ 202 dst_address.sin6.sin6_scope_id = 203 ntohs(dst_address.sin6.sin6_addr.s6_addr16[1]); 204 dst_address.sin6.sin6_addr.s6_addr16[1] = 0; 205 } 206 break; 207 #endif /* INET6 */ 208 default: 209 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 210 m_freem(m); 211 IPSEC_ISTAT(sproto, nopf); 212 return EPFNOSUPPORT; 213 } 214 215 /* NB: only pass dst since key_allocsa follows RFC2401 */ 216 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 217 if (sav == NULL) { 218 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 219 __func__, ipsec_address(&dst_address, buf, sizeof(buf)), 220 (u_long) ntohl(spi), sproto)); 221 IPSEC_ISTAT(sproto, notdb); 222 m_freem(m); 223 return ENOENT; 224 } 225 226 if (sav->tdb_xform == NULL) { 227 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 228 __func__, ipsec_address(&dst_address, buf, sizeof(buf)), 229 (u_long) ntohl(spi), sproto)); 230 IPSEC_ISTAT(sproto, noxform); 231 KEY_FREESAV(&sav); 232 m_freem(m); 233 return ENXIO; 234 } 235 236 /* 237 * Call appropriate transform and return -- callback takes care of 238 * everything else. 239 */ 240 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 241 KEY_FREESAV(&sav); 242 return error; 243 } 244 245 #ifdef INET 246 /* 247 * Common input handler for IPv4 AH, ESP, and IPCOMP. 248 */ 249 int 250 ipsec4_common_input(struct mbuf *m, ...) 251 { 252 va_list ap; 253 int off, nxt; 254 255 va_start(ap, m); 256 off = va_arg(ap, int); 257 nxt = va_arg(ap, int); 258 va_end(ap); 259 260 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 261 AF_INET, nxt); 262 } 263 264 int 265 ah4_input(struct mbuf **mp, int *offp, int proto) 266 { 267 struct mbuf *m; 268 int off; 269 270 m = *mp; 271 off = *offp; 272 *mp = NULL; 273 274 ipsec4_common_input(m, off, IPPROTO_AH); 275 return (IPPROTO_DONE); 276 } 277 void 278 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v) 279 { 280 if (sa->sa_family == AF_INET && 281 sa->sa_len == sizeof(struct sockaddr_in)) 282 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH); 283 } 284 285 int 286 esp4_input(struct mbuf **mp, int *offp, int proto) 287 { 288 struct mbuf *m; 289 int off; 290 291 m = *mp; 292 off = *offp; 293 mp = NULL; 294 295 ipsec4_common_input(m, off, IPPROTO_ESP); 296 return (IPPROTO_DONE); 297 } 298 299 void 300 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v) 301 { 302 if (sa->sa_family == AF_INET && 303 sa->sa_len == sizeof(struct sockaddr_in)) 304 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP); 305 } 306 307 int 308 ipcomp4_input(struct mbuf **mp, int *offp, int proto) 309 { 310 struct mbuf *m; 311 int off; 312 313 m = *mp; 314 off = *offp; 315 mp = NULL; 316 317 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 318 return (IPPROTO_DONE); 319 } 320 321 /* 322 * IPsec input callback for INET protocols. 323 * This routine is called as the transform callback. 324 * Takes care of filtering and other sanity checks on 325 * the processed packet. 326 */ 327 int 328 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, 329 int protoff) 330 { 331 char buf[INET6_ADDRSTRLEN]; 332 int prot, af, sproto, isr_prot; 333 struct ip *ip; 334 struct m_tag *mtag; 335 struct tdb_ident *tdbi; 336 struct secasindex *saidx; 337 int error; 338 #ifdef INET6 339 #ifdef notyet 340 char ip6buf[INET6_ADDRSTRLEN]; 341 #endif 342 #endif 343 344 IPSEC_ASSERT(m != NULL, ("null mbuf")); 345 IPSEC_ASSERT(sav != NULL, ("null SA")); 346 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 347 saidx = &sav->sah->saidx; 348 af = saidx->dst.sa.sa_family; 349 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 350 sproto = saidx->proto; 351 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 352 sproto == IPPROTO_IPCOMP, 353 ("unexpected security protocol %u", sproto)); 354 355 /* Sanity check */ 356 if (m == NULL) { 357 DPRINTF(("%s: null mbuf", __func__)); 358 IPSEC_ISTAT(sproto, badkcr); 359 KEY_FREESAV(&sav); 360 return EINVAL; 361 } 362 363 if (skip != 0) { 364 /* 365 * Fix IPv4 header 366 * XXXGL: do we need this entire block? 367 */ 368 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 369 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 370 __func__, ipsec_address(&sav->sah->saidx.dst, 371 buf, sizeof(buf)), (u_long) ntohl(sav->spi))); 372 IPSEC_ISTAT(sproto, hdrops); 373 error = ENOBUFS; 374 goto bad; 375 } 376 377 ip = mtod(m, struct ip *); 378 ip->ip_len = htons(m->m_pkthdr.len); 379 ip->ip_sum = 0; 380 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 381 } else { 382 ip = mtod(m, struct ip *); 383 } 384 prot = ip->ip_p; 385 386 #ifdef DEV_ENC 387 if_inc_counter(encif, IFCOUNTER_IPACKETS, 1); 388 if_inc_counter(encif, IFCOUNTER_IBYTES, m->m_pkthdr.len); 389 390 /* Pass the mbuf to enc0 for bpf and pfil. */ 391 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE); 392 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 393 return (error); 394 ip = mtod(m, struct ip *); 395 #endif /* DEV_ENC */ 396 397 /* IP-in-IP encapsulation */ 398 if (prot == IPPROTO_IPIP && 399 saidx->mode != IPSEC_MODE_TRANSPORT) { 400 401 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 402 IPSEC_ISTAT(sproto, hdrops); 403 error = EINVAL; 404 goto bad; 405 } 406 /* enc0: strip outer IPv4 header */ 407 m_striphdr(m, 0, ip->ip_hl << 2); 408 409 #ifdef notyet 410 /* XXX PROXY address isn't recorded in SAH */ 411 /* 412 * Check that the inner source address is the same as 413 * the proxy address, if available. 414 */ 415 if ((saidx->proxy.sa.sa_family == AF_INET && 416 saidx->proxy.sin.sin_addr.s_addr != 417 INADDR_ANY && 418 ipn.ip_src.s_addr != 419 saidx->proxy.sin.sin_addr.s_addr) || 420 (saidx->proxy.sa.sa_family != AF_INET && 421 saidx->proxy.sa.sa_family != 0)) { 422 423 DPRINTF(("%s: inner source address %s doesn't " 424 "correspond to expected proxy source %s, " 425 "SA %s/%08lx\n", __func__, 426 inet_ntoa4(ipn.ip_src), 427 ipsp_address(saidx->proxy), 428 ipsp_address(saidx->dst), 429 (u_long) ntohl(sav->spi))); 430 431 IPSEC_ISTAT(sproto, pdrops); 432 error = EACCES; 433 goto bad; 434 } 435 #endif /* notyet */ 436 } 437 #ifdef INET6 438 /* IPv6-in-IP encapsulation. */ 439 else if (prot == IPPROTO_IPV6 && 440 saidx->mode != IPSEC_MODE_TRANSPORT) { 441 442 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 443 IPSEC_ISTAT(sproto, hdrops); 444 error = EINVAL; 445 goto bad; 446 } 447 /* enc0: strip IPv4 header, keep IPv6 header only */ 448 m_striphdr(m, 0, ip->ip_hl << 2); 449 #ifdef notyet 450 /* 451 * Check that the inner source address is the same as 452 * the proxy address, if available. 453 */ 454 if ((saidx->proxy.sa.sa_family == AF_INET6 && 455 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 456 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 457 &saidx->proxy.sin6.sin6_addr)) || 458 (saidx->proxy.sa.sa_family != AF_INET6 && 459 saidx->proxy.sa.sa_family != 0)) { 460 461 DPRINTF(("%s: inner source address %s doesn't " 462 "correspond to expected proxy source %s, " 463 "SA %s/%08lx\n", __func__, 464 ip6_sprintf(ip6buf, &ip6n.ip6_src), 465 ipsec_address(&saidx->proxy), 466 ipsec_address(&saidx->dst), 467 (u_long) ntohl(sav->spi))); 468 469 IPSEC_ISTAT(sproto, pdrops); 470 error = EACCES; 471 goto bad; 472 } 473 #endif /* notyet */ 474 } 475 #endif /* INET6 */ 476 else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) { 477 /* 478 * When mode is wildcard, inner protocol is IPv6 and 479 * we have no INET6 support - drop this packet a bit later. 480 * In other cases we assume transport mode and outer 481 * header was already stripped in xform_xxx_cb. 482 */ 483 prot = IPPROTO_IPIP; 484 } 485 486 /* 487 * Record what we've done to the packet (under what SA it was 488 * processed). 489 */ 490 if (sproto != IPPROTO_IPCOMP) { 491 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 492 sizeof(struct tdb_ident), M_NOWAIT); 493 if (mtag == NULL) { 494 DPRINTF(("%s: failed to get tag\n", __func__)); 495 IPSEC_ISTAT(sproto, hdrops); 496 error = ENOMEM; 497 goto bad; 498 } 499 500 tdbi = (struct tdb_ident *)(mtag + 1); 501 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 502 tdbi->proto = sproto; 503 tdbi->spi = sav->spi; 504 /* Cache those two for enc(4) in xform_ipip. */ 505 tdbi->alg_auth = sav->alg_auth; 506 tdbi->alg_enc = sav->alg_enc; 507 508 m_tag_prepend(m, mtag); 509 } 510 511 key_sa_recordxfer(sav, m); /* record data transfer */ 512 513 /* 514 * In transport mode requeue decrypted mbuf back to IPv4 protocol 515 * handler. This is necessary to correctly expose rcvif. 516 */ 517 if (saidx->mode == IPSEC_MODE_TRANSPORT) 518 prot = IPPROTO_IPIP; 519 #ifdef DEV_ENC 520 /* 521 * Pass the mbuf to enc0 for bpf and pfil. 522 */ 523 if (prot == IPPROTO_IPIP) 524 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER); 525 #ifdef INET6 526 if (prot == IPPROTO_IPV6) 527 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER); 528 #endif 529 530 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0) 531 return (error); 532 #endif /* DEV_ENC */ 533 534 /* 535 * Re-dispatch via software interrupt. 536 */ 537 538 switch (prot) { 539 case IPPROTO_IPIP: 540 isr_prot = NETISR_IP; 541 break; 542 #ifdef INET6 543 case IPPROTO_IPV6: 544 isr_prot = NETISR_IPV6; 545 break; 546 #endif 547 default: 548 DPRINTF(("%s: cannot handle inner ip proto %d\n", 549 __func__, prot)); 550 IPSEC_ISTAT(sproto, nopf); 551 error = EPFNOSUPPORT; 552 goto bad; 553 } 554 555 error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m); 556 if (error) { 557 IPSEC_ISTAT(sproto, qfull); 558 DPRINTF(("%s: queue full; proto %u packet dropped\n", 559 __func__, sproto)); 560 return error; 561 } 562 return 0; 563 bad: 564 m_freem(m); 565 return error; 566 } 567 568 void 569 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 570 { 571 /* XXX nothing just yet */ 572 } 573 #endif /* INET */ 574 575 #ifdef INET6 576 /* IPv6 AH wrapper. */ 577 int 578 ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 579 { 580 int l = 0; 581 int protoff; 582 struct ip6_ext ip6e; 583 584 if (*offp < sizeof(struct ip6_hdr)) { 585 DPRINTF(("%s: bad offset %u\n", __func__, *offp)); 586 return IPPROTO_DONE; 587 } else if (*offp == sizeof(struct ip6_hdr)) { 588 protoff = offsetof(struct ip6_hdr, ip6_nxt); 589 } else { 590 /* Chase down the header chain... */ 591 protoff = sizeof(struct ip6_hdr); 592 593 do { 594 protoff += l; 595 m_copydata(*mp, protoff, sizeof(ip6e), 596 (caddr_t) &ip6e); 597 598 if (ip6e.ip6e_nxt == IPPROTO_AH) 599 l = (ip6e.ip6e_len + 2) << 2; 600 else 601 l = (ip6e.ip6e_len + 1) << 3; 602 IPSEC_ASSERT(l > 0, ("l went zero or negative")); 603 } while (protoff + l < *offp); 604 605 /* Malformed packet check */ 606 if (protoff + l != *offp) { 607 DPRINTF(("%s: bad packet header chain, protoff %u, " 608 "l %u, off %u\n", __func__, protoff, l, *offp)); 609 IPSEC_ISTAT(proto, hdrops); 610 m_freem(*mp); 611 *mp = NULL; 612 return IPPROTO_DONE; 613 } 614 protoff += offsetof(struct ip6_ext, ip6e_nxt); 615 } 616 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 617 return IPPROTO_DONE; 618 } 619 620 /* 621 * IPsec input callback, called by the transform callback. Takes care of 622 * filtering and other sanity checks on the processed packet. 623 */ 624 int 625 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, 626 int protoff) 627 { 628 char buf[INET6_ADDRSTRLEN]; 629 int prot, af, sproto; 630 struct ip6_hdr *ip6; 631 struct m_tag *mtag; 632 struct tdb_ident *tdbi; 633 struct secasindex *saidx; 634 int nxt, isr_prot; 635 u_int8_t nxt8; 636 int error, nest; 637 #ifdef notyet 638 char ip6buf[INET6_ADDRSTRLEN]; 639 #endif 640 641 IPSEC_ASSERT(m != NULL, ("null mbuf")); 642 IPSEC_ASSERT(sav != NULL, ("null SA")); 643 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 644 saidx = &sav->sah->saidx; 645 af = saidx->dst.sa.sa_family; 646 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 647 sproto = saidx->proto; 648 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 649 sproto == IPPROTO_IPCOMP, 650 ("unexpected security protocol %u", sproto)); 651 652 /* Sanity check */ 653 if (m == NULL) { 654 DPRINTF(("%s: null mbuf", __func__)); 655 IPSEC_ISTAT(sproto, badkcr); 656 error = EINVAL; 657 goto bad; 658 } 659 660 /* Fix IPv6 header */ 661 if (m->m_len < sizeof(struct ip6_hdr) && 662 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 663 664 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 665 __func__, ipsec_address(&sav->sah->saidx.dst, buf, 666 sizeof(buf)), (u_long) ntohl(sav->spi))); 667 668 IPSEC_ISTAT(sproto, hdrops); 669 error = EACCES; 670 goto bad; 671 } 672 673 ip6 = mtod(m, struct ip6_hdr *); 674 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 675 676 /* Save protocol */ 677 m_copydata(m, protoff, 1, &nxt8); 678 prot = nxt8; 679 680 #ifdef DEV_ENC 681 if_inc_counter(encif, IFCOUNTER_IPACKETS, 1); 682 if_inc_counter(encif, IFCOUNTER_IBYTES, m->m_pkthdr.len); 683 684 /* Pass the mbuf to enc0 for bpf and pfil. */ 685 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE); 686 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 687 return (error); 688 #endif /* DEV_ENC */ 689 690 /* IPv6-in-IP encapsulation */ 691 if (prot == IPPROTO_IPV6 && 692 saidx->mode != IPSEC_MODE_TRANSPORT) { 693 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 694 IPSEC_ISTAT(sproto, hdrops); 695 error = EINVAL; 696 goto bad; 697 } 698 /* ip6n will now contain the inner IPv6 header. */ 699 m_striphdr(m, 0, skip); 700 skip = 0; 701 #ifdef notyet 702 /* 703 * Check that the inner source address is the same as 704 * the proxy address, if available. 705 */ 706 if ((saidx->proxy.sa.sa_family == AF_INET6 && 707 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 708 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 709 &saidx->proxy.sin6.sin6_addr)) || 710 (saidx->proxy.sa.sa_family != AF_INET6 && 711 saidx->proxy.sa.sa_family != 0)) { 712 713 DPRINTF(("%s: inner source address %s doesn't " 714 "correspond to expected proxy source %s, " 715 "SA %s/%08lx\n", __func__, 716 ip6_sprintf(ip6buf, &ip6n.ip6_src), 717 ipsec_address(&saidx->proxy), 718 ipsec_address(&saidx->dst), 719 (u_long) ntohl(sav->spi))); 720 721 IPSEC_ISTAT(sproto, pdrops); 722 error = EACCES; 723 goto bad; 724 } 725 #endif /* notyet */ 726 } 727 #ifdef INET 728 /* IP-in-IP encapsulation */ 729 else if (prot == IPPROTO_IPIP && 730 saidx->mode != IPSEC_MODE_TRANSPORT) { 731 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 732 IPSEC_ISTAT(sproto, hdrops); 733 error = EINVAL; 734 goto bad; 735 } 736 /* ipn will now contain the inner IPv4 header */ 737 m_striphdr(m, 0, skip); 738 skip = 0; 739 #ifdef notyet 740 /* 741 * Check that the inner source address is the same as 742 * the proxy address, if available. 743 */ 744 if ((saidx->proxy.sa.sa_family == AF_INET && 745 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 746 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 747 (saidx->proxy.sa.sa_family != AF_INET && 748 saidx->proxy.sa.sa_family != 0)) { 749 750 DPRINTF(("%s: inner source address %s doesn't " 751 "correspond to expected proxy source %s, " 752 "SA %s/%08lx\n", __func__, 753 inet_ntoa4(ipn.ip_src), 754 ipsec_address(&saidx->proxy), 755 ipsec_address(&saidx->dst), 756 (u_long) ntohl(sav->spi))); 757 758 IPSEC_ISTAT(sproto, pdrops); 759 error = EACCES; 760 goto bad; 761 } 762 #endif /* notyet */ 763 } 764 #endif /* INET */ 765 else { 766 prot = IPPROTO_IPV6; /* for correct BPF processing */ 767 } 768 769 /* 770 * Record what we've done to the packet (under what SA it was 771 * processed). 772 */ 773 if (sproto != IPPROTO_IPCOMP) { 774 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 775 sizeof(struct tdb_ident), M_NOWAIT); 776 if (mtag == NULL) { 777 DPRINTF(("%s: failed to get tag\n", __func__)); 778 IPSEC_ISTAT(sproto, hdrops); 779 error = ENOMEM; 780 goto bad; 781 } 782 783 tdbi = (struct tdb_ident *)(mtag + 1); 784 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 785 tdbi->proto = sproto; 786 tdbi->spi = sav->spi; 787 /* Cache those two for enc(4) in xform_ipip. */ 788 tdbi->alg_auth = sav->alg_auth; 789 tdbi->alg_enc = sav->alg_enc; 790 791 m_tag_prepend(m, mtag); 792 } 793 794 key_sa_recordxfer(sav, m); 795 796 #ifdef DEV_ENC 797 /* 798 * Pass the mbuf to enc0 for bpf and pfil. 799 */ 800 #ifdef INET 801 if (prot == IPPROTO_IPIP) 802 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER); 803 #endif 804 if (prot == IPPROTO_IPV6) 805 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER); 806 807 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0) 808 return (error); 809 #endif /* DEV_ENC */ 810 if (skip == 0) { 811 /* 812 * We stripped outer IPv6 header. 813 * Now we should requeue decrypted packet via netisr. 814 */ 815 switch (prot) { 816 #ifdef INET 817 case IPPROTO_IPIP: 818 isr_prot = NETISR_IP; 819 break; 820 #endif 821 case IPPROTO_IPV6: 822 isr_prot = NETISR_IPV6; 823 break; 824 default: 825 DPRINTF(("%s: cannot handle inner ip proto %d\n", 826 __func__, prot)); 827 IPSEC_ISTAT(sproto, nopf); 828 error = EPFNOSUPPORT; 829 goto bad; 830 } 831 error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m); 832 if (error) { 833 IPSEC_ISTAT(sproto, qfull); 834 DPRINTF(("%s: queue full; proto %u packet dropped\n", 835 __func__, sproto)); 836 } 837 return (error); 838 } 839 /* 840 * See the end of ip6_input for this logic. 841 * IPPROTO_IPV[46] case will be processed just like other ones 842 */ 843 nest = 0; 844 nxt = nxt8; 845 while (nxt != IPPROTO_DONE) { 846 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 847 IP6STAT_INC(ip6s_toomanyhdr); 848 error = EINVAL; 849 goto bad; 850 } 851 852 /* 853 * Protection against faulty packet - there should be 854 * more sanity checks in header chain processing. 855 */ 856 if (m->m_pkthdr.len < skip) { 857 IP6STAT_INC(ip6s_tooshort); 858 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 859 error = EINVAL; 860 goto bad; 861 } 862 /* 863 * Enforce IPsec policy checking if we are seeing last header. 864 * note that we do not visit this with protocols with pcb layer 865 * code - like udp/tcp/raw ip. 866 */ 867 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 868 ipsec6_in_reject(m, NULL)) { 869 error = EINVAL; 870 goto bad; 871 } 872 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 873 } 874 return 0; 875 bad: 876 if (m) 877 m_freem(m); 878 return error; 879 } 880 881 void 882 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 883 { 884 struct ip6ctlparam *ip6cp = NULL; 885 struct mbuf *m = NULL; 886 struct ip6_hdr *ip6; 887 int off; 888 889 if (sa->sa_family != AF_INET6 || 890 sa->sa_len != sizeof(struct sockaddr_in6)) 891 return; 892 if ((unsigned)cmd >= PRC_NCMDS) 893 return; 894 895 /* if the parameter is from icmp6, decode it. */ 896 if (d != NULL) { 897 ip6cp = (struct ip6ctlparam *)d; 898 m = ip6cp->ip6c_m; 899 ip6 = ip6cp->ip6c_ip6; 900 off = ip6cp->ip6c_off; 901 } else { 902 m = NULL; 903 ip6 = NULL; 904 off = 0; /* calm gcc */ 905 } 906 907 if (ip6 != NULL) { 908 909 struct ip6ctlparam ip6cp1; 910 911 /* 912 * Notify the error to all possible sockets via pfctlinput2. 913 * Since the upper layer information (such as protocol type, 914 * source and destination ports) is embedded in the encrypted 915 * data and might have been cut, we can't directly call 916 * an upper layer ctlinput function. However, the pcbnotify 917 * function will consider source and destination addresses 918 * as well as the flow info value, and may be able to find 919 * some PCB that should be notified. 920 * Although pfctlinput2 will call esp6_ctlinput(), there is 921 * no possibility of an infinite loop of function calls, 922 * because we don't pass the inner IPv6 header. 923 */ 924 bzero(&ip6cp1, sizeof(ip6cp1)); 925 ip6cp1.ip6c_src = ip6cp->ip6c_src; 926 pfctlinput2(cmd, sa, (void *)&ip6cp1); 927 928 /* 929 * Then go to special cases that need ESP header information. 930 * XXX: We assume that when ip6 is non NULL, 931 * M and OFF are valid. 932 */ 933 934 if (cmd == PRC_MSGSIZE) { 935 struct secasvar *sav; 936 u_int32_t spi; 937 int valid; 938 939 /* check header length before using m_copydata */ 940 if (m->m_pkthdr.len < off + sizeof (struct esp)) 941 return; 942 m_copydata(m, off + offsetof(struct esp, esp_spi), 943 sizeof(u_int32_t), (caddr_t) &spi); 944 /* 945 * Check to see if we have a valid SA corresponding to 946 * the address in the ICMP message payload. 947 */ 948 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 949 IPPROTO_ESP, spi); 950 valid = (sav != NULL); 951 if (sav) 952 KEY_FREESAV(&sav); 953 954 /* XXX Further validation? */ 955 956 /* 957 * Depending on whether the SA is "valid" and 958 * routing table size (mtudisc_{hi,lo}wat), we will: 959 * - recalcurate the new MTU and create the 960 * corresponding routing entry, or 961 * - ignore the MTU change notification. 962 */ 963 icmp6_mtudisc_update(ip6cp, valid); 964 } 965 } else { 966 /* we normally notify any pcb here */ 967 } 968 } 969 #endif /* INET6 */ 970