1 /* $FreeBSD$ */ 2 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IPsec input processing. 41 */ 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_ipsec.h" 46 #include "opt_enc.h" 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/malloc.h> 51 #include <sys/mbuf.h> 52 #include <sys/domain.h> 53 #include <sys/protosw.h> 54 #include <sys/socket.h> 55 #include <sys/errno.h> 56 #include <sys/syslog.h> 57 58 #include <net/if.h> 59 #include <net/if_var.h> 60 #include <net/pfil.h> 61 #include <net/route.h> 62 #include <net/netisr.h> 63 #include <net/vnet.h> 64 65 #include <netinet/in.h> 66 #include <netinet/in_systm.h> 67 #include <netinet/ip.h> 68 #include <netinet/ip_var.h> 69 #include <netinet/in_var.h> 70 71 #include <netinet/ip6.h> 72 #ifdef INET6 73 #include <netinet6/ip6_var.h> 74 #endif 75 #include <netinet/in_pcb.h> 76 #ifdef INET6 77 #include <netinet/icmp6.h> 78 #endif 79 80 #include <netipsec/ipsec.h> 81 #ifdef INET6 82 #include <netipsec/ipsec6.h> 83 #endif 84 #include <netipsec/ah_var.h> 85 #include <netipsec/esp.h> 86 #include <netipsec/esp_var.h> 87 #include <netipsec/ipcomp_var.h> 88 89 #include <netipsec/key.h> 90 #include <netipsec/keydb.h> 91 92 #include <netipsec/xform.h> 93 #include <netinet6/ip6protosw.h> 94 95 #include <machine/in_cksum.h> 96 #include <machine/stdarg.h> 97 98 #ifdef DEV_ENC 99 #include <net/if_enc.h> 100 #endif 101 102 103 #define IPSEC_ISTAT(proto, name) do { \ 104 if ((proto) == IPPROTO_ESP) \ 105 ESPSTAT_INC(esps_##name); \ 106 else if ((proto) == IPPROTO_AH) \ 107 AHSTAT_INC(ahs_##name); \ 108 else \ 109 IPCOMPSTAT_INC(ipcomps_##name); \ 110 } while (0) 111 112 #ifdef INET 113 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int); 114 #endif 115 116 /* 117 * ipsec_common_input gets called when an IPsec-protected packet 118 * is received by IPv4 or IPv6. Its job is to find the right SA 119 * and call the appropriate transform. The transform callback 120 * takes care of further processing (like ingress filtering). 121 */ 122 static int 123 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 124 { 125 union sockaddr_union dst_address; 126 struct secasvar *sav; 127 u_int32_t spi; 128 int error; 129 #ifdef INET 130 #ifdef IPSEC_NAT_T 131 struct m_tag *tag; 132 #endif 133 #endif 134 135 IPSEC_ISTAT(sproto, input); 136 137 IPSEC_ASSERT(m != NULL, ("null packet")); 138 139 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 140 sproto == IPPROTO_IPCOMP, 141 ("unexpected security protocol %u", sproto)); 142 143 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 144 (sproto == IPPROTO_AH && !V_ah_enable) || 145 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 146 m_freem(m); 147 IPSEC_ISTAT(sproto, pdrops); 148 return EOPNOTSUPP; 149 } 150 151 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 152 m_freem(m); 153 IPSEC_ISTAT(sproto, hdrops); 154 DPRINTF(("%s: packet too small\n", __func__)); 155 return EINVAL; 156 } 157 158 /* Retrieve the SPI from the relevant IPsec header */ 159 if (sproto == IPPROTO_ESP) 160 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 161 else if (sproto == IPPROTO_AH) 162 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 163 (caddr_t) &spi); 164 else if (sproto == IPPROTO_IPCOMP) { 165 u_int16_t cpi; 166 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 167 (caddr_t) &cpi); 168 spi = ntohl(htons(cpi)); 169 } 170 171 /* 172 * Find the SA and (indirectly) call the appropriate 173 * kernel crypto routine. The resulting mbuf chain is a valid 174 * IP packet ready to go through input processing. 175 */ 176 bzero(&dst_address, sizeof (dst_address)); 177 dst_address.sa.sa_family = af; 178 switch (af) { 179 #ifdef INET 180 case AF_INET: 181 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 182 m_copydata(m, offsetof(struct ip, ip_dst), 183 sizeof(struct in_addr), 184 (caddr_t) &dst_address.sin.sin_addr); 185 #ifdef IPSEC_NAT_T 186 /* Find the source port for NAT-T; see udp*_espdecap. */ 187 tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL); 188 if (tag != NULL) 189 dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1]; 190 #endif /* IPSEC_NAT_T */ 191 break; 192 #endif /* INET */ 193 #ifdef INET6 194 case AF_INET6: 195 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 196 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 197 sizeof(struct in6_addr), 198 (caddr_t) &dst_address.sin6.sin6_addr); 199 break; 200 #endif /* INET6 */ 201 default: 202 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 203 m_freem(m); 204 IPSEC_ISTAT(sproto, nopf); 205 return EPFNOSUPPORT; 206 } 207 208 /* NB: only pass dst since key_allocsa follows RFC2401 */ 209 sav = KEY_ALLOCSA(&dst_address, sproto, spi); 210 if (sav == NULL) { 211 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 212 __func__, ipsec_address(&dst_address), 213 (u_long) ntohl(spi), sproto)); 214 IPSEC_ISTAT(sproto, notdb); 215 m_freem(m); 216 return ENOENT; 217 } 218 219 if (sav->tdb_xform == NULL) { 220 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 221 __func__, ipsec_address(&dst_address), 222 (u_long) ntohl(spi), sproto)); 223 IPSEC_ISTAT(sproto, noxform); 224 KEY_FREESAV(&sav); 225 m_freem(m); 226 return ENXIO; 227 } 228 229 /* 230 * Call appropriate transform and return -- callback takes care of 231 * everything else. 232 */ 233 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 234 KEY_FREESAV(&sav); 235 return error; 236 } 237 238 #ifdef INET 239 /* 240 * Common input handler for IPv4 AH, ESP, and IPCOMP. 241 */ 242 int 243 ipsec4_common_input(struct mbuf *m, ...) 244 { 245 va_list ap; 246 int off, nxt; 247 248 va_start(ap, m); 249 off = va_arg(ap, int); 250 nxt = va_arg(ap, int); 251 va_end(ap); 252 253 return ipsec_common_input(m, off, offsetof(struct ip, ip_p), 254 AF_INET, nxt); 255 } 256 257 void 258 ah4_input(struct mbuf *m, int off) 259 { 260 ipsec4_common_input(m, off, IPPROTO_AH); 261 } 262 void 263 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v) 264 { 265 if (sa->sa_family == AF_INET && 266 sa->sa_len == sizeof(struct sockaddr_in)) 267 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH); 268 } 269 270 void 271 esp4_input(struct mbuf *m, int off) 272 { 273 ipsec4_common_input(m, off, IPPROTO_ESP); 274 } 275 void 276 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v) 277 { 278 if (sa->sa_family == AF_INET && 279 sa->sa_len == sizeof(struct sockaddr_in)) 280 ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP); 281 } 282 283 void 284 ipcomp4_input(struct mbuf *m, int off) 285 { 286 ipsec4_common_input(m, off, IPPROTO_IPCOMP); 287 } 288 289 /* 290 * IPsec input callback for INET protocols. 291 * This routine is called as the transform callback. 292 * Takes care of filtering and other sanity checks on 293 * the processed packet. 294 */ 295 int 296 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, 297 int skip, int protoff, struct m_tag *mt) 298 { 299 int prot, af, sproto; 300 struct ip *ip; 301 struct m_tag *mtag; 302 struct tdb_ident *tdbi; 303 struct secasindex *saidx; 304 int error; 305 #ifdef INET6 306 #ifdef notyet 307 char ip6buf[INET6_ADDRSTRLEN]; 308 #endif 309 #endif 310 311 IPSEC_ASSERT(m != NULL, ("null mbuf")); 312 IPSEC_ASSERT(sav != NULL, ("null SA")); 313 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 314 saidx = &sav->sah->saidx; 315 af = saidx->dst.sa.sa_family; 316 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 317 sproto = saidx->proto; 318 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 319 sproto == IPPROTO_IPCOMP, 320 ("unexpected security protocol %u", sproto)); 321 322 /* Sanity check */ 323 if (m == NULL) { 324 DPRINTF(("%s: null mbuf", __func__)); 325 IPSEC_ISTAT(sproto, badkcr); 326 KEY_FREESAV(&sav); 327 return EINVAL; 328 } 329 330 if (skip != 0) { 331 /* 332 * Fix IPv4 header 333 * XXXGL: do we need this entire block? 334 */ 335 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 336 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 337 __func__, ipsec_address(&sav->sah->saidx.dst), 338 (u_long) ntohl(sav->spi))); 339 IPSEC_ISTAT(sproto, hdrops); 340 error = ENOBUFS; 341 goto bad; 342 } 343 344 ip = mtod(m, struct ip *); 345 ip->ip_len = htons(m->m_pkthdr.len); 346 ip->ip_sum = 0; 347 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 348 } else { 349 ip = mtod(m, struct ip *); 350 } 351 prot = ip->ip_p; 352 353 #ifdef notyet 354 /* IP-in-IP encapsulation */ 355 if (prot == IPPROTO_IPIP) { 356 struct ip ipn; 357 358 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 359 IPSEC_ISTAT(sproto, hdrops); 360 error = EINVAL; 361 goto bad; 362 } 363 /* ipn will now contain the inner IPv4 header */ 364 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), 365 (caddr_t) &ipn); 366 367 /* XXX PROXY address isn't recorded in SAH */ 368 /* 369 * Check that the inner source address is the same as 370 * the proxy address, if available. 371 */ 372 if ((saidx->proxy.sa.sa_family == AF_INET && 373 saidx->proxy.sin.sin_addr.s_addr != 374 INADDR_ANY && 375 ipn.ip_src.s_addr != 376 saidx->proxy.sin.sin_addr.s_addr) || 377 (saidx->proxy.sa.sa_family != AF_INET && 378 saidx->proxy.sa.sa_family != 0)) { 379 380 DPRINTF(("%s: inner source address %s doesn't " 381 "correspond to expected proxy source %s, " 382 "SA %s/%08lx\n", __func__, 383 inet_ntoa4(ipn.ip_src), 384 ipsp_address(saidx->proxy), 385 ipsp_address(saidx->dst), 386 (u_long) ntohl(sav->spi))); 387 388 IPSEC_ISTAT(sproto, pdrops); 389 error = EACCES; 390 goto bad; 391 } 392 } 393 #ifdef INET6 394 /* IPv6-in-IP encapsulation. */ 395 if (prot == IPPROTO_IPV6) { 396 struct ip6_hdr ip6n; 397 398 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 399 IPSEC_ISTAT(sproto, hdrops); 400 error = EINVAL; 401 goto bad; 402 } 403 /* ip6n will now contain the inner IPv6 header. */ 404 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), 405 (caddr_t) &ip6n); 406 407 /* 408 * Check that the inner source address is the same as 409 * the proxy address, if available. 410 */ 411 if ((saidx->proxy.sa.sa_family == AF_INET6 && 412 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 413 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 414 &saidx->proxy.sin6.sin6_addr)) || 415 (saidx->proxy.sa.sa_family != AF_INET6 && 416 saidx->proxy.sa.sa_family != 0)) { 417 418 DPRINTF(("%s: inner source address %s doesn't " 419 "correspond to expected proxy source %s, " 420 "SA %s/%08lx\n", __func__, 421 ip6_sprintf(ip6buf, &ip6n.ip6_src), 422 ipsec_address(&saidx->proxy), 423 ipsec_address(&saidx->dst), 424 (u_long) ntohl(sav->spi))); 425 426 IPSEC_ISTAT(sproto, pdrops); 427 error = EACCES; 428 goto bad; 429 } 430 } 431 #endif /* INET6 */ 432 #endif /*XXX*/ 433 434 /* 435 * Record what we've done to the packet (under what SA it was 436 * processed). If we've been passed an mtag, it means the packet 437 * was already processed by an ethernet/crypto combo card and 438 * thus has a tag attached with all the right information, but 439 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 440 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 441 */ 442 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 443 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 444 sizeof(struct tdb_ident), M_NOWAIT); 445 if (mtag == NULL) { 446 DPRINTF(("%s: failed to get tag\n", __func__)); 447 IPSEC_ISTAT(sproto, hdrops); 448 error = ENOMEM; 449 goto bad; 450 } 451 452 tdbi = (struct tdb_ident *)(mtag + 1); 453 bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len); 454 tdbi->proto = sproto; 455 tdbi->spi = sav->spi; 456 /* Cache those two for enc(4) in xform_ipip. */ 457 tdbi->alg_auth = sav->alg_auth; 458 tdbi->alg_enc = sav->alg_enc; 459 460 m_tag_prepend(m, mtag); 461 } else if (mt != NULL) { 462 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 463 /* XXX do we need to mark m_flags??? */ 464 } 465 466 key_sa_recordxfer(sav, m); /* record data transfer */ 467 468 #ifdef DEV_ENC 469 encif->if_ipackets++; 470 encif->if_ibytes += m->m_pkthdr.len; 471 472 /* 473 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 474 * packet later after it has been decapsulated. 475 */ 476 ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE); 477 478 if (prot != IPPROTO_IPIP) 479 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 480 return (error); 481 #endif 482 483 /* 484 * Re-dispatch via software interrupt. 485 */ 486 if ((error = netisr_queue_src(NETISR_IP, (uintptr_t)sav->spi, m))) { 487 IPSEC_ISTAT(sproto, qfull); 488 DPRINTF(("%s: queue full; proto %u packet dropped\n", 489 __func__, sproto)); 490 return error; 491 } 492 return 0; 493 bad: 494 m_freem(m); 495 return error; 496 } 497 498 void 499 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto) 500 { 501 /* XXX nothing just yet */ 502 } 503 #endif /* INET */ 504 505 #ifdef INET6 506 /* IPv6 AH wrapper. */ 507 int 508 ipsec6_common_input(struct mbuf **mp, int *offp, int proto) 509 { 510 int l = 0; 511 int protoff; 512 struct ip6_ext ip6e; 513 514 if (*offp < sizeof(struct ip6_hdr)) { 515 DPRINTF(("%s: bad offset %u\n", __func__, *offp)); 516 return IPPROTO_DONE; 517 } else if (*offp == sizeof(struct ip6_hdr)) { 518 protoff = offsetof(struct ip6_hdr, ip6_nxt); 519 } else { 520 /* Chase down the header chain... */ 521 protoff = sizeof(struct ip6_hdr); 522 523 do { 524 protoff += l; 525 m_copydata(*mp, protoff, sizeof(ip6e), 526 (caddr_t) &ip6e); 527 528 if (ip6e.ip6e_nxt == IPPROTO_AH) 529 l = (ip6e.ip6e_len + 2) << 2; 530 else 531 l = (ip6e.ip6e_len + 1) << 3; 532 IPSEC_ASSERT(l > 0, ("l went zero or negative")); 533 } while (protoff + l < *offp); 534 535 /* Malformed packet check */ 536 if (protoff + l != *offp) { 537 DPRINTF(("%s: bad packet header chain, protoff %u, " 538 "l %u, off %u\n", __func__, protoff, l, *offp)); 539 IPSEC_ISTAT(proto, hdrops); 540 m_freem(*mp); 541 *mp = NULL; 542 return IPPROTO_DONE; 543 } 544 protoff += offsetof(struct ip6_ext, ip6e_nxt); 545 } 546 (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); 547 return IPPROTO_DONE; 548 } 549 550 /* 551 * IPsec input callback, called by the transform callback. Takes care of 552 * filtering and other sanity checks on the processed packet. 553 */ 554 int 555 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff, 556 struct m_tag *mt) 557 { 558 int prot, af, sproto; 559 struct ip6_hdr *ip6; 560 struct m_tag *mtag; 561 struct tdb_ident *tdbi; 562 struct secasindex *saidx; 563 int nxt; 564 u_int8_t nxt8; 565 int error, nest; 566 #ifdef notyet 567 char ip6buf[INET6_ADDRSTRLEN]; 568 #endif 569 570 IPSEC_ASSERT(m != NULL, ("null mbuf")); 571 IPSEC_ASSERT(sav != NULL, ("null SA")); 572 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 573 saidx = &sav->sah->saidx; 574 af = saidx->dst.sa.sa_family; 575 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 576 sproto = saidx->proto; 577 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 578 sproto == IPPROTO_IPCOMP, 579 ("unexpected security protocol %u", sproto)); 580 581 /* Sanity check */ 582 if (m == NULL) { 583 DPRINTF(("%s: null mbuf", __func__)); 584 IPSEC_ISTAT(sproto, badkcr); 585 error = EINVAL; 586 goto bad; 587 } 588 589 /* Fix IPv6 header */ 590 if (m->m_len < sizeof(struct ip6_hdr) && 591 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 592 593 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 594 __func__, ipsec_address(&sav->sah->saidx.dst), 595 (u_long) ntohl(sav->spi))); 596 597 IPSEC_ISTAT(sproto, hdrops); 598 error = EACCES; 599 goto bad; 600 } 601 602 ip6 = mtod(m, struct ip6_hdr *); 603 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 604 605 /* Save protocol */ 606 m_copydata(m, protoff, 1, (unsigned char *) &prot); 607 608 #ifdef notyet 609 #ifdef INET 610 /* IP-in-IP encapsulation */ 611 if (prot == IPPROTO_IPIP) { 612 struct ip ipn; 613 614 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 615 IPSEC_ISTAT(sproto, hdrops); 616 error = EINVAL; 617 goto bad; 618 } 619 /* ipn will now contain the inner IPv4 header */ 620 m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn); 621 622 /* 623 * Check that the inner source address is the same as 624 * the proxy address, if available. 625 */ 626 if ((saidx->proxy.sa.sa_family == AF_INET && 627 saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY && 628 ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) || 629 (saidx->proxy.sa.sa_family != AF_INET && 630 saidx->proxy.sa.sa_family != 0)) { 631 632 DPRINTF(("%s: inner source address %s doesn't " 633 "correspond to expected proxy source %s, " 634 "SA %s/%08lx\n", __func__, 635 inet_ntoa4(ipn.ip_src), 636 ipsec_address(&saidx->proxy), 637 ipsec_address(&saidx->dst), 638 (u_long) ntohl(sav->spi))); 639 640 IPSEC_ISTAT(sproto, pdrops); 641 error = EACCES; 642 goto bad; 643 } 644 } 645 #endif /* INET */ 646 647 /* IPv6-in-IP encapsulation */ 648 if (prot == IPPROTO_IPV6) { 649 struct ip6_hdr ip6n; 650 651 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 652 IPSEC_ISTAT(sproto, hdrops); 653 error = EINVAL; 654 goto bad; 655 } 656 /* ip6n will now contain the inner IPv6 header. */ 657 m_copydata(m, skip, sizeof(struct ip6_hdr), 658 (caddr_t) &ip6n); 659 660 /* 661 * Check that the inner source address is the same as 662 * the proxy address, if available. 663 */ 664 if ((saidx->proxy.sa.sa_family == AF_INET6 && 665 !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) && 666 !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src, 667 &saidx->proxy.sin6.sin6_addr)) || 668 (saidx->proxy.sa.sa_family != AF_INET6 && 669 saidx->proxy.sa.sa_family != 0)) { 670 671 DPRINTF(("%s: inner source address %s doesn't " 672 "correspond to expected proxy source %s, " 673 "SA %s/%08lx\n", __func__, 674 ip6_sprintf(ip6buf, &ip6n.ip6_src), 675 ipsec_address(&saidx->proxy), 676 ipsec_address(&saidx->dst), 677 (u_long) ntohl(sav->spi))); 678 679 IPSEC_ISTAT(sproto, pdrops); 680 error = EACCES; 681 goto bad; 682 } 683 } 684 #endif /*XXX*/ 685 686 /* 687 * Record what we've done to the packet (under what SA it was 688 * processed). If we've been passed an mtag, it means the packet 689 * was already processed by an ethernet/crypto combo card and 690 * thus has a tag attached with all the right information, but 691 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to 692 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type. 693 */ 694 if (mt == NULL && sproto != IPPROTO_IPCOMP) { 695 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 696 sizeof(struct tdb_ident), M_NOWAIT); 697 if (mtag == NULL) { 698 DPRINTF(("%s: failed to get tag\n", __func__)); 699 IPSEC_ISTAT(sproto, hdrops); 700 error = ENOMEM; 701 goto bad; 702 } 703 704 tdbi = (struct tdb_ident *)(mtag + 1); 705 bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union)); 706 tdbi->proto = sproto; 707 tdbi->spi = sav->spi; 708 /* Cache those two for enc(4) in xform_ipip. */ 709 tdbi->alg_auth = sav->alg_auth; 710 tdbi->alg_enc = sav->alg_enc; 711 712 m_tag_prepend(m, mtag); 713 } else { 714 if (mt != NULL) 715 mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE; 716 /* XXX do we need to mark m_flags??? */ 717 } 718 719 key_sa_recordxfer(sav, m); 720 721 #ifdef DEV_ENC 722 encif->if_ipackets++; 723 encif->if_ibytes += m->m_pkthdr.len; 724 725 /* 726 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP 727 * packet later after it has been decapsulated. 728 */ 729 ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE); 730 731 /* XXX-BZ does not make sense. */ 732 if (prot != IPPROTO_IPIP) 733 if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0) 734 return (error); 735 #endif 736 737 /* Retrieve new protocol */ 738 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8); 739 740 /* 741 * See the end of ip6_input for this logic. 742 * IPPROTO_IPV[46] case will be processed just like other ones 743 */ 744 nest = 0; 745 nxt = nxt8; 746 while (nxt != IPPROTO_DONE) { 747 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 748 IP6STAT_INC(ip6s_toomanyhdr); 749 error = EINVAL; 750 goto bad; 751 } 752 753 /* 754 * Protection against faulty packet - there should be 755 * more sanity checks in header chain processing. 756 */ 757 if (m->m_pkthdr.len < skip) { 758 IP6STAT_INC(ip6s_tooshort); 759 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 760 error = EINVAL; 761 goto bad; 762 } 763 /* 764 * Enforce IPsec policy checking if we are seeing last header. 765 * note that we do not visit this with protocols with pcb layer 766 * code - like udp/tcp/raw ip. 767 */ 768 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 769 ipsec6_in_reject(m, NULL)) { 770 error = EINVAL; 771 goto bad; 772 } 773 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 774 } 775 return 0; 776 bad: 777 if (m) 778 m_freem(m); 779 return error; 780 } 781 782 void 783 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 784 { 785 struct ip6ctlparam *ip6cp = NULL; 786 struct mbuf *m = NULL; 787 struct ip6_hdr *ip6; 788 int off; 789 790 if (sa->sa_family != AF_INET6 || 791 sa->sa_len != sizeof(struct sockaddr_in6)) 792 return; 793 if ((unsigned)cmd >= PRC_NCMDS) 794 return; 795 796 /* if the parameter is from icmp6, decode it. */ 797 if (d != NULL) { 798 ip6cp = (struct ip6ctlparam *)d; 799 m = ip6cp->ip6c_m; 800 ip6 = ip6cp->ip6c_ip6; 801 off = ip6cp->ip6c_off; 802 } else { 803 m = NULL; 804 ip6 = NULL; 805 off = 0; /* calm gcc */ 806 } 807 808 if (ip6 != NULL) { 809 810 struct ip6ctlparam ip6cp1; 811 812 /* 813 * Notify the error to all possible sockets via pfctlinput2. 814 * Since the upper layer information (such as protocol type, 815 * source and destination ports) is embedded in the encrypted 816 * data and might have been cut, we can't directly call 817 * an upper layer ctlinput function. However, the pcbnotify 818 * function will consider source and destination addresses 819 * as well as the flow info value, and may be able to find 820 * some PCB that should be notified. 821 * Although pfctlinput2 will call esp6_ctlinput(), there is 822 * no possibility of an infinite loop of function calls, 823 * because we don't pass the inner IPv6 header. 824 */ 825 bzero(&ip6cp1, sizeof(ip6cp1)); 826 ip6cp1.ip6c_src = ip6cp->ip6c_src; 827 pfctlinput2(cmd, sa, (void *)&ip6cp1); 828 829 /* 830 * Then go to special cases that need ESP header information. 831 * XXX: We assume that when ip6 is non NULL, 832 * M and OFF are valid. 833 */ 834 835 if (cmd == PRC_MSGSIZE) { 836 struct secasvar *sav; 837 u_int32_t spi; 838 int valid; 839 840 /* check header length before using m_copydata */ 841 if (m->m_pkthdr.len < off + sizeof (struct esp)) 842 return; 843 m_copydata(m, off + offsetof(struct esp, esp_spi), 844 sizeof(u_int32_t), (caddr_t) &spi); 845 /* 846 * Check to see if we have a valid SA corresponding to 847 * the address in the ICMP message payload. 848 */ 849 sav = KEY_ALLOCSA((union sockaddr_union *)sa, 850 IPPROTO_ESP, spi); 851 valid = (sav != NULL); 852 if (sav) 853 KEY_FREESAV(&sav); 854 855 /* XXX Further validation? */ 856 857 /* 858 * Depending on whether the SA is "valid" and 859 * routing table size (mtudisc_{hi,lo}wat), we will: 860 * - recalcurate the new MTU and create the 861 * corresponding routing entry, or 862 * - ignore the MTU change notification. 863 */ 864 icmp6_mtudisc_update(ip6cp, valid); 865 } 866 } else { 867 /* we normally notify any pcb here */ 868 } 869 } 870 #endif /* INET6 */ 871