1 /* $FreeBSD$ */ 2 /* $OpenBSD: ip_ah.c,v 1.63 2001/06/26 06:18:58 angelos Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * The original version of this code was written by John Ioannidis 9 * for BSD/OS in Athens, Greece, in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist. 18 * 19 * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 1999 Niklas Hallqvist. 22 * Copyright (c) 2001 Angelos D. Keromytis. 23 * 24 * Permission to use, copy, and modify this software with or without fee 25 * is hereby granted, provided that this entire notice is included in 26 * all copies of any software which is or includes a copy or 27 * modification of this software. 28 * You may use this code under the GNU public license if you so wish. Please 29 * contribute changes back to the authors under this freer than GPL license 30 * so that we may further the use of strong encryption without limitations to 31 * all. 32 * 33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 37 * PURPOSE. 38 */ 39 #include "opt_inet.h" 40 #include "opt_inet6.h" 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/mbuf.h> 45 #include <sys/socket.h> 46 #include <sys/syslog.h> 47 #include <sys/kernel.h> 48 #include <sys/lock.h> 49 #include <sys/rwlock.h> 50 #include <sys/sysctl.h> 51 52 #include <net/if.h> 53 #include <net/vnet.h> 54 55 #include <netinet/in.h> 56 #include <netinet/in_systm.h> 57 #include <netinet/ip.h> 58 #include <netinet/ip_ecn.h> 59 #include <netinet/ip6.h> 60 61 #include <netipsec/ipsec.h> 62 #include <netipsec/ah.h> 63 #include <netipsec/ah_var.h> 64 #include <netipsec/xform.h> 65 66 #ifdef INET6 67 #include <netinet6/ip6_var.h> 68 #include <netipsec/ipsec6.h> 69 #include <netinet6/ip6_ecn.h> 70 #endif 71 72 #include <netipsec/key.h> 73 #include <netipsec/key_debug.h> 74 75 #include <opencrypto/cryptodev.h> 76 77 /* 78 * Return header size in bytes. The old protocol did not support 79 * the replay counter; the new protocol always includes the counter. 80 */ 81 #define HDRSIZE(sav) \ 82 (((sav)->flags & SADB_X_EXT_OLD) ? \ 83 sizeof (struct ah) : sizeof (struct ah) + sizeof (u_int32_t)) 84 /* 85 * Return authenticator size in bytes. The old protocol is known 86 * to use a fixed 16-byte authenticator. The new algorithm use 12-byte 87 * authenticator. 88 */ 89 #define AUTHSIZE(sav) ah_authsize(sav) 90 91 VNET_DEFINE(int, ah_enable) = 1; /* control flow of packets with AH */ 92 VNET_DEFINE(int, ah_cleartos) = 1; /* clear ip_tos when doing AH calc */ 93 VNET_PCPUSTAT_DEFINE(struct ahstat, ahstat); 94 VNET_PCPUSTAT_SYSINIT(ahstat); 95 96 #ifdef VIMAGE 97 VNET_PCPUSTAT_SYSUNINIT(ahstat); 98 #endif /* VIMAGE */ 99 100 #ifdef INET 101 SYSCTL_DECL(_net_inet_ah); 102 SYSCTL_INT(_net_inet_ah, OID_AUTO, ah_enable, 103 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_enable), 0, ""); 104 SYSCTL_INT(_net_inet_ah, OID_AUTO, ah_cleartos, 105 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0, ""); 106 SYSCTL_VNET_PCPUSTAT(_net_inet_ah, IPSECCTL_STATS, stats, struct ahstat, 107 ahstat, "AH statistics (struct ahstat, netipsec/ah_var.h)"); 108 #endif 109 110 static unsigned char ipseczeroes[256]; /* larger than an ip6 extension hdr */ 111 112 static int ah_input_cb(struct cryptop*); 113 static int ah_output_cb(struct cryptop*); 114 115 static int 116 ah_authsize(struct secasvar *sav) 117 { 118 119 IPSEC_ASSERT(sav != NULL, ("%s: sav == NULL", __func__)); 120 121 if (sav->flags & SADB_X_EXT_OLD) 122 return 16; 123 124 switch (sav->alg_auth) { 125 case SADB_X_AALG_SHA2_256: 126 return 16; 127 case SADB_X_AALG_SHA2_384: 128 return 24; 129 case SADB_X_AALG_SHA2_512: 130 return 32; 131 default: 132 return AH_HMAC_HASHLEN; 133 } 134 /* NOTREACHED */ 135 } 136 /* 137 * NB: this is public for use by the PF_KEY support. 138 */ 139 struct auth_hash * 140 ah_algorithm_lookup(int alg) 141 { 142 if (alg > SADB_AALG_MAX) 143 return NULL; 144 switch (alg) { 145 case SADB_X_AALG_NULL: 146 return &auth_hash_null; 147 case SADB_AALG_MD5HMAC: 148 return &auth_hash_hmac_md5; 149 case SADB_AALG_SHA1HMAC: 150 return &auth_hash_hmac_sha1; 151 case SADB_X_AALG_RIPEMD160HMAC: 152 return &auth_hash_hmac_ripemd_160; 153 case SADB_X_AALG_MD5: 154 return &auth_hash_key_md5; 155 case SADB_X_AALG_SHA: 156 return &auth_hash_key_sha1; 157 case SADB_X_AALG_SHA2_256: 158 return &auth_hash_hmac_sha2_256; 159 case SADB_X_AALG_SHA2_384: 160 return &auth_hash_hmac_sha2_384; 161 case SADB_X_AALG_SHA2_512: 162 return &auth_hash_hmac_sha2_512; 163 } 164 return NULL; 165 } 166 167 size_t 168 ah_hdrsiz(struct secasvar *sav) 169 { 170 size_t size; 171 172 if (sav != NULL) { 173 int authsize; 174 IPSEC_ASSERT(sav->tdb_authalgxform != NULL, ("null xform")); 175 /*XXX not right for null algorithm--does it matter??*/ 176 authsize = AUTHSIZE(sav); 177 size = roundup(authsize, sizeof (u_int32_t)) + HDRSIZE(sav); 178 } else { 179 /* default guess */ 180 size = sizeof (struct ah) + sizeof (u_int32_t) + 16; 181 } 182 return size; 183 } 184 185 /* 186 * NB: public for use by esp_init. 187 */ 188 int 189 ah_init0(struct secasvar *sav, struct xformsw *xsp, struct cryptoini *cria) 190 { 191 struct auth_hash *thash; 192 int keylen; 193 194 thash = ah_algorithm_lookup(sav->alg_auth); 195 if (thash == NULL) { 196 DPRINTF(("%s: unsupported authentication algorithm %u\n", 197 __func__, sav->alg_auth)); 198 return EINVAL; 199 } 200 /* 201 * Verify the replay state block allocation is consistent with 202 * the protocol type. We check here so we can make assumptions 203 * later during protocol processing. 204 */ 205 /* NB: replay state is setup elsewhere (sigh) */ 206 if (((sav->flags&SADB_X_EXT_OLD) == 0) ^ (sav->replay != NULL)) { 207 DPRINTF(("%s: replay state block inconsistency, " 208 "%s algorithm %s replay state\n", __func__, 209 (sav->flags & SADB_X_EXT_OLD) ? "old" : "new", 210 sav->replay == NULL ? "without" : "with")); 211 return EINVAL; 212 } 213 if (sav->key_auth == NULL) { 214 DPRINTF(("%s: no authentication key for %s algorithm\n", 215 __func__, thash->name)); 216 return EINVAL; 217 } 218 keylen = _KEYLEN(sav->key_auth); 219 if (keylen != thash->keysize && thash->keysize != 0) { 220 DPRINTF(("%s: invalid keylength %d, algorithm %s requires " 221 "keysize %d\n", __func__, 222 keylen, thash->name, thash->keysize)); 223 return EINVAL; 224 } 225 226 sav->tdb_xform = xsp; 227 sav->tdb_authalgxform = thash; 228 229 /* Initialize crypto session. */ 230 bzero(cria, sizeof (*cria)); 231 cria->cri_alg = sav->tdb_authalgxform->type; 232 cria->cri_klen = _KEYBITS(sav->key_auth); 233 cria->cri_key = sav->key_auth->key_data; 234 cria->cri_mlen = AUTHSIZE(sav); 235 236 return 0; 237 } 238 239 /* 240 * ah_init() is called when an SPI is being set up. 241 */ 242 static int 243 ah_init(struct secasvar *sav, struct xformsw *xsp) 244 { 245 struct cryptoini cria; 246 int error; 247 248 error = ah_init0(sav, xsp, &cria); 249 return error ? error : 250 crypto_newsession(&sav->tdb_cryptoid, &cria, V_crypto_support); 251 } 252 253 /* 254 * Paranoia. 255 * 256 * NB: public for use by esp_zeroize (XXX). 257 */ 258 int 259 ah_zeroize(struct secasvar *sav) 260 { 261 int err; 262 263 if (sav->key_auth) 264 bzero(sav->key_auth->key_data, _KEYLEN(sav->key_auth)); 265 266 err = crypto_freesession(sav->tdb_cryptoid); 267 sav->tdb_cryptoid = 0; 268 sav->tdb_authalgxform = NULL; 269 sav->tdb_xform = NULL; 270 return err; 271 } 272 273 /* 274 * Massage IPv4/IPv6 headers for AH processing. 275 */ 276 static int 277 ah_massage_headers(struct mbuf **m0, int proto, int skip, int alg, int out) 278 { 279 struct mbuf *m = *m0; 280 unsigned char *ptr; 281 int off, count; 282 283 #ifdef INET 284 struct ip *ip; 285 #endif /* INET */ 286 287 #ifdef INET6 288 struct ip6_ext *ip6e; 289 struct ip6_hdr ip6; 290 int alloc, len, ad; 291 #endif /* INET6 */ 292 293 switch (proto) { 294 #ifdef INET 295 case AF_INET: 296 /* 297 * This is the least painful way of dealing with IPv4 header 298 * and option processing -- just make sure they're in 299 * contiguous memory. 300 */ 301 *m0 = m = m_pullup(m, skip); 302 if (m == NULL) { 303 DPRINTF(("%s: m_pullup failed\n", __func__)); 304 return ENOBUFS; 305 } 306 307 /* Fix the IP header */ 308 ip = mtod(m, struct ip *); 309 if (V_ah_cleartos) 310 ip->ip_tos = 0; 311 ip->ip_ttl = 0; 312 ip->ip_sum = 0; 313 314 if (alg == CRYPTO_MD5_KPDK || alg == CRYPTO_SHA1_KPDK) 315 ip->ip_off &= htons(IP_DF); 316 else 317 ip->ip_off = htons(0); 318 319 ptr = mtod(m, unsigned char *) + sizeof(struct ip); 320 321 /* IPv4 option processing */ 322 for (off = sizeof(struct ip); off < skip;) { 323 if (ptr[off] == IPOPT_EOL || ptr[off] == IPOPT_NOP || 324 off + 1 < skip) 325 ; 326 else { 327 DPRINTF(("%s: illegal IPv4 option length for " 328 "option %d\n", __func__, ptr[off])); 329 330 m_freem(m); 331 return EINVAL; 332 } 333 334 switch (ptr[off]) { 335 case IPOPT_EOL: 336 off = skip; /* End the loop. */ 337 break; 338 339 case IPOPT_NOP: 340 off++; 341 break; 342 343 case IPOPT_SECURITY: /* 0x82 */ 344 case 0x85: /* Extended security. */ 345 case 0x86: /* Commercial security. */ 346 case 0x94: /* Router alert */ 347 case 0x95: /* RFC1770 */ 348 /* Sanity check for option length. */ 349 if (ptr[off + 1] < 2) { 350 DPRINTF(("%s: illegal IPv4 option " 351 "length for option %d\n", 352 __func__, ptr[off])); 353 354 m_freem(m); 355 return EINVAL; 356 } 357 358 off += ptr[off + 1]; 359 break; 360 361 case IPOPT_LSRR: 362 case IPOPT_SSRR: 363 /* Sanity check for option length. */ 364 if (ptr[off + 1] < 2) { 365 DPRINTF(("%s: illegal IPv4 option " 366 "length for option %d\n", 367 __func__, ptr[off])); 368 369 m_freem(m); 370 return EINVAL; 371 } 372 373 /* 374 * On output, if we have either of the 375 * source routing options, we should 376 * swap the destination address of the 377 * IP header with the last address 378 * specified in the option, as that is 379 * what the destination's IP header 380 * will look like. 381 */ 382 if (out) 383 bcopy(ptr + off + ptr[off + 1] - 384 sizeof(struct in_addr), 385 &(ip->ip_dst), sizeof(struct in_addr)); 386 387 /* Fall through */ 388 default: 389 /* Sanity check for option length. */ 390 if (ptr[off + 1] < 2) { 391 DPRINTF(("%s: illegal IPv4 option " 392 "length for option %d\n", 393 __func__, ptr[off])); 394 m_freem(m); 395 return EINVAL; 396 } 397 398 /* Zeroize all other options. */ 399 count = ptr[off + 1]; 400 bcopy(ipseczeroes, ptr, count); 401 off += count; 402 break; 403 } 404 405 /* Sanity check. */ 406 if (off > skip) { 407 DPRINTF(("%s: malformed IPv4 options header\n", 408 __func__)); 409 410 m_freem(m); 411 return EINVAL; 412 } 413 } 414 415 break; 416 #endif /* INET */ 417 418 #ifdef INET6 419 case AF_INET6: /* Ugly... */ 420 /* Copy and "cook" the IPv6 header. */ 421 m_copydata(m, 0, sizeof(ip6), (caddr_t) &ip6); 422 423 /* We don't do IPv6 Jumbograms. */ 424 if (ip6.ip6_plen == 0) { 425 DPRINTF(("%s: unsupported IPv6 jumbogram\n", __func__)); 426 m_freem(m); 427 return EMSGSIZE; 428 } 429 430 ip6.ip6_flow = 0; 431 ip6.ip6_hlim = 0; 432 ip6.ip6_vfc &= ~IPV6_VERSION_MASK; 433 ip6.ip6_vfc |= IPV6_VERSION; 434 435 /* Scoped address handling. */ 436 if (IN6_IS_SCOPE_LINKLOCAL(&ip6.ip6_src)) 437 ip6.ip6_src.s6_addr16[1] = 0; 438 if (IN6_IS_SCOPE_LINKLOCAL(&ip6.ip6_dst)) 439 ip6.ip6_dst.s6_addr16[1] = 0; 440 441 /* Done with IPv6 header. */ 442 m_copyback(m, 0, sizeof(struct ip6_hdr), (caddr_t) &ip6); 443 444 /* Let's deal with the remaining headers (if any). */ 445 if (skip - sizeof(struct ip6_hdr) > 0) { 446 if (m->m_len <= skip) { 447 ptr = (unsigned char *) malloc( 448 skip - sizeof(struct ip6_hdr), 449 M_XDATA, M_NOWAIT); 450 if (ptr == NULL) { 451 DPRINTF(("%s: failed to allocate memory" 452 "for IPv6 headers\n",__func__)); 453 m_freem(m); 454 return ENOBUFS; 455 } 456 457 /* 458 * Copy all the protocol headers after 459 * the IPv6 header. 460 */ 461 m_copydata(m, sizeof(struct ip6_hdr), 462 skip - sizeof(struct ip6_hdr), ptr); 463 alloc = 1; 464 } else { 465 /* No need to allocate memory. */ 466 ptr = mtod(m, unsigned char *) + 467 sizeof(struct ip6_hdr); 468 alloc = 0; 469 } 470 } else 471 break; 472 473 off = ip6.ip6_nxt & 0xff; /* Next header type. */ 474 475 for (len = 0; len < skip - sizeof(struct ip6_hdr);) 476 switch (off) { 477 case IPPROTO_HOPOPTS: 478 case IPPROTO_DSTOPTS: 479 ip6e = (struct ip6_ext *) (ptr + len); 480 481 /* 482 * Process the mutable/immutable 483 * options -- borrows heavily from the 484 * KAME code. 485 */ 486 for (count = len + sizeof(struct ip6_ext); 487 count < len + ((ip6e->ip6e_len + 1) << 3);) { 488 if (ptr[count] == IP6OPT_PAD1) { 489 count++; 490 continue; /* Skip padding. */ 491 } 492 493 /* Sanity check. */ 494 if (count > len + 495 ((ip6e->ip6e_len + 1) << 3)) { 496 m_freem(m); 497 498 /* Free, if we allocated. */ 499 if (alloc) 500 free(ptr, M_XDATA); 501 return EINVAL; 502 } 503 504 ad = ptr[count + 1]; 505 506 /* If mutable option, zeroize. */ 507 if (ptr[count] & IP6OPT_MUTABLE) 508 bcopy(ipseczeroes, ptr + count, 509 ptr[count + 1]); 510 511 count += ad; 512 513 /* Sanity check. */ 514 if (count > 515 skip - sizeof(struct ip6_hdr)) { 516 m_freem(m); 517 518 /* Free, if we allocated. */ 519 if (alloc) 520 free(ptr, M_XDATA); 521 return EINVAL; 522 } 523 } 524 525 /* Advance. */ 526 len += ((ip6e->ip6e_len + 1) << 3); 527 off = ip6e->ip6e_nxt; 528 break; 529 530 case IPPROTO_ROUTING: 531 /* 532 * Always include routing headers in 533 * computation. 534 */ 535 ip6e = (struct ip6_ext *) (ptr + len); 536 len += ((ip6e->ip6e_len + 1) << 3); 537 off = ip6e->ip6e_nxt; 538 break; 539 540 default: 541 DPRINTF(("%s: unexpected IPv6 header type %d", 542 __func__, off)); 543 if (alloc) 544 free(ptr, M_XDATA); 545 m_freem(m); 546 return EINVAL; 547 } 548 549 /* Copyback and free, if we allocated. */ 550 if (alloc) { 551 m_copyback(m, sizeof(struct ip6_hdr), 552 skip - sizeof(struct ip6_hdr), ptr); 553 free(ptr, M_XDATA); 554 } 555 556 break; 557 #endif /* INET6 */ 558 } 559 560 return 0; 561 } 562 563 /* 564 * ah_input() gets called to verify that an input packet 565 * passes authentication. 566 */ 567 static int 568 ah_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff) 569 { 570 struct auth_hash *ahx; 571 struct tdb_ident *tdbi; 572 struct tdb_crypto *tc; 573 struct m_tag *mtag; 574 struct newah *ah; 575 int hl, rplen, authsize; 576 577 struct cryptodesc *crda; 578 struct cryptop *crp; 579 580 IPSEC_ASSERT(sav != NULL, ("null SA")); 581 IPSEC_ASSERT(sav->key_auth != NULL, ("null authentication key")); 582 IPSEC_ASSERT(sav->tdb_authalgxform != NULL, 583 ("null authentication xform")); 584 585 /* Figure out header size. */ 586 rplen = HDRSIZE(sav); 587 588 /* XXX don't pullup, just copy header */ 589 IP6_EXTHDR_GET(ah, struct newah *, m, skip, rplen); 590 if (ah == NULL) { 591 DPRINTF(("ah_input: cannot pullup header\n")); 592 AHSTAT_INC(ahs_hdrops); /*XXX*/ 593 m_freem(m); 594 return ENOBUFS; 595 } 596 597 /* Check replay window, if applicable. */ 598 if (sav->replay && !ipsec_chkreplay(ntohl(ah->ah_seq), sav)) { 599 AHSTAT_INC(ahs_replay); 600 DPRINTF(("%s: packet replay failure: %s\n", __func__, 601 ipsec_logsastr(sav))); 602 m_freem(m); 603 return ENOBUFS; 604 } 605 606 /* Verify AH header length. */ 607 hl = ah->ah_len * sizeof (u_int32_t); 608 ahx = sav->tdb_authalgxform; 609 authsize = AUTHSIZE(sav); 610 if (hl != authsize + rplen - sizeof (struct ah)) { 611 DPRINTF(("%s: bad authenticator length %u (expecting %lu)" 612 " for packet in SA %s/%08lx\n", __func__, 613 hl, (u_long) (authsize + rplen - sizeof (struct ah)), 614 ipsec_address(&sav->sah->saidx.dst), 615 (u_long) ntohl(sav->spi))); 616 AHSTAT_INC(ahs_badauthl); 617 m_freem(m); 618 return EACCES; 619 } 620 AHSTAT_ADD(ahs_ibytes, m->m_pkthdr.len - skip - hl); 621 622 /* Get crypto descriptors. */ 623 crp = crypto_getreq(1); 624 if (crp == NULL) { 625 DPRINTF(("%s: failed to acquire crypto descriptor\n",__func__)); 626 AHSTAT_INC(ahs_crypto); 627 m_freem(m); 628 return ENOBUFS; 629 } 630 631 crda = crp->crp_desc; 632 IPSEC_ASSERT(crda != NULL, ("null crypto descriptor")); 633 634 crda->crd_skip = 0; 635 crda->crd_len = m->m_pkthdr.len; 636 crda->crd_inject = skip + rplen; 637 638 /* Authentication operation. */ 639 crda->crd_alg = ahx->type; 640 crda->crd_klen = _KEYBITS(sav->key_auth); 641 crda->crd_key = sav->key_auth->key_data; 642 643 /* Find out if we've already done crypto. */ 644 for (mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, NULL); 645 mtag != NULL; 646 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, mtag)) { 647 tdbi = (struct tdb_ident *) (mtag + 1); 648 if (tdbi->proto == sav->sah->saidx.proto && 649 tdbi->spi == sav->spi && 650 !bcmp(&tdbi->dst, &sav->sah->saidx.dst, 651 sizeof (union sockaddr_union))) 652 break; 653 } 654 655 /* Allocate IPsec-specific opaque crypto info. */ 656 if (mtag == NULL) { 657 tc = (struct tdb_crypto *) malloc(sizeof (struct tdb_crypto) + 658 skip + rplen + authsize, M_XDATA, M_NOWAIT|M_ZERO); 659 } else { 660 /* Hash verification has already been done successfully. */ 661 tc = (struct tdb_crypto *) malloc(sizeof (struct tdb_crypto), 662 M_XDATA, M_NOWAIT|M_ZERO); 663 } 664 if (tc == NULL) { 665 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__)); 666 AHSTAT_INC(ahs_crypto); 667 crypto_freereq(crp); 668 m_freem(m); 669 return ENOBUFS; 670 } 671 672 /* Only save information if crypto processing is needed. */ 673 if (mtag == NULL) { 674 int error; 675 676 /* 677 * Save the authenticator, the skipped portion of the packet, 678 * and the AH header. 679 */ 680 m_copydata(m, 0, skip + rplen + authsize, (caddr_t)(tc+1)); 681 682 /* Zeroize the authenticator on the packet. */ 683 m_copyback(m, skip + rplen, authsize, ipseczeroes); 684 685 /* "Massage" the packet headers for crypto processing. */ 686 error = ah_massage_headers(&m, sav->sah->saidx.dst.sa.sa_family, 687 skip, ahx->type, 0); 688 if (error != 0) { 689 /* NB: mbuf is free'd by ah_massage_headers */ 690 AHSTAT_INC(ahs_hdrops); 691 free(tc, M_XDATA); 692 crypto_freereq(crp); 693 return error; 694 } 695 } 696 697 /* Crypto operation descriptor. */ 698 crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */ 699 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC; 700 crp->crp_buf = (caddr_t) m; 701 crp->crp_callback = ah_input_cb; 702 crp->crp_sid = sav->tdb_cryptoid; 703 crp->crp_opaque = (caddr_t) tc; 704 705 /* These are passed as-is to the callback. */ 706 tc->tc_spi = sav->spi; 707 tc->tc_dst = sav->sah->saidx.dst; 708 tc->tc_proto = sav->sah->saidx.proto; 709 tc->tc_nxt = ah->ah_nxt; 710 tc->tc_protoff = protoff; 711 tc->tc_skip = skip; 712 tc->tc_ptr = (caddr_t) mtag; /* Save the mtag we've identified. */ 713 KEY_ADDREFSA(sav); 714 tc->tc_sav = sav; 715 716 if (mtag == NULL) 717 return crypto_dispatch(crp); 718 else 719 return ah_input_cb(crp); 720 } 721 722 /* 723 * AH input callback from the crypto driver. 724 */ 725 static int 726 ah_input_cb(struct cryptop *crp) 727 { 728 int rplen, error, skip, protoff; 729 unsigned char calc[AH_ALEN_MAX]; 730 struct mbuf *m; 731 struct cryptodesc *crd; 732 struct auth_hash *ahx; 733 struct tdb_crypto *tc; 734 struct m_tag *mtag; 735 struct secasvar *sav; 736 struct secasindex *saidx; 737 u_int8_t nxt; 738 caddr_t ptr; 739 int authsize; 740 741 crd = crp->crp_desc; 742 743 tc = (struct tdb_crypto *) crp->crp_opaque; 744 IPSEC_ASSERT(tc != NULL, ("null opaque crypto data area!")); 745 skip = tc->tc_skip; 746 nxt = tc->tc_nxt; 747 protoff = tc->tc_protoff; 748 mtag = (struct m_tag *) tc->tc_ptr; 749 m = (struct mbuf *) crp->crp_buf; 750 751 sav = tc->tc_sav; 752 IPSEC_ASSERT(sav != NULL, ("null SA!")); 753 754 saidx = &sav->sah->saidx; 755 IPSEC_ASSERT(saidx->dst.sa.sa_family == AF_INET || 756 saidx->dst.sa.sa_family == AF_INET6, 757 ("unexpected protocol family %u", saidx->dst.sa.sa_family)); 758 759 ahx = (struct auth_hash *) sav->tdb_authalgxform; 760 761 /* Check for crypto errors. */ 762 if (crp->crp_etype) { 763 if (sav->tdb_cryptoid != 0) 764 sav->tdb_cryptoid = crp->crp_sid; 765 766 if (crp->crp_etype == EAGAIN) 767 return (crypto_dispatch(crp)); 768 769 AHSTAT_INC(ahs_noxform); 770 DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype)); 771 error = crp->crp_etype; 772 goto bad; 773 } else { 774 AHSTAT_INC(ahs_hist[sav->alg_auth]); 775 crypto_freereq(crp); /* No longer needed. */ 776 crp = NULL; 777 } 778 779 /* Shouldn't happen... */ 780 if (m == NULL) { 781 AHSTAT_INC(ahs_crypto); 782 DPRINTF(("%s: bogus returned buffer from crypto\n", __func__)); 783 error = EINVAL; 784 goto bad; 785 } 786 787 /* Figure out header size. */ 788 rplen = HDRSIZE(sav); 789 authsize = AUTHSIZE(sav); 790 791 /* Copy authenticator off the packet. */ 792 m_copydata(m, skip + rplen, authsize, calc); 793 794 /* 795 * If we have an mtag, we don't need to verify the authenticator -- 796 * it has been verified by an IPsec-aware NIC. 797 */ 798 if (mtag == NULL) { 799 ptr = (caddr_t) (tc + 1); 800 801 /* Verify authenticator. */ 802 if (bcmp(ptr + skip + rplen, calc, authsize)) { 803 DPRINTF(("%s: authentication hash mismatch for packet " 804 "in SA %s/%08lx\n", __func__, 805 ipsec_address(&saidx->dst), 806 (u_long) ntohl(sav->spi))); 807 AHSTAT_INC(ahs_badauth); 808 error = EACCES; 809 goto bad; 810 } 811 812 /* Fix the Next Protocol field. */ 813 ((u_int8_t *) ptr)[protoff] = nxt; 814 815 /* Copyback the saved (uncooked) network headers. */ 816 m_copyback(m, 0, skip, ptr); 817 } else { 818 /* Fix the Next Protocol field. */ 819 m_copyback(m, protoff, sizeof(u_int8_t), &nxt); 820 } 821 822 free(tc, M_XDATA), tc = NULL; /* No longer needed */ 823 824 /* 825 * Header is now authenticated. 826 */ 827 m->m_flags |= M_AUTHIPHDR|M_AUTHIPDGM; 828 829 /* 830 * Update replay sequence number, if appropriate. 831 */ 832 if (sav->replay) { 833 u_int32_t seq; 834 835 m_copydata(m, skip + offsetof(struct newah, ah_seq), 836 sizeof (seq), (caddr_t) &seq); 837 if (ipsec_updatereplay(ntohl(seq), sav)) { 838 AHSTAT_INC(ahs_replay); 839 error = ENOBUFS; /*XXX as above*/ 840 goto bad; 841 } 842 } 843 844 /* 845 * Remove the AH header and authenticator from the mbuf. 846 */ 847 error = m_striphdr(m, skip, rplen + authsize); 848 if (error) { 849 DPRINTF(("%s: mangled mbuf chain for SA %s/%08lx\n", __func__, 850 ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi))); 851 852 AHSTAT_INC(ahs_hdrops); 853 goto bad; 854 } 855 856 switch (saidx->dst.sa.sa_family) { 857 #ifdef INET6 858 case AF_INET6: 859 error = ipsec6_common_input_cb(m, sav, skip, protoff, mtag); 860 break; 861 #endif 862 #ifdef INET 863 case AF_INET: 864 error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag); 865 break; 866 #endif 867 default: 868 panic("%s: Unexpected address family: %d saidx=%p", __func__, 869 saidx->dst.sa.sa_family, saidx); 870 } 871 872 KEY_FREESAV(&sav); 873 return error; 874 bad: 875 if (sav) 876 KEY_FREESAV(&sav); 877 if (m != NULL) 878 m_freem(m); 879 if (tc != NULL) 880 free(tc, M_XDATA); 881 if (crp != NULL) 882 crypto_freereq(crp); 883 return error; 884 } 885 886 /* 887 * AH output routine, called by ipsec[46]_process_packet(). 888 */ 889 static int 890 ah_output( 891 struct mbuf *m, 892 struct ipsecrequest *isr, 893 struct mbuf **mp, 894 int skip, 895 int protoff) 896 { 897 struct secasvar *sav; 898 struct auth_hash *ahx; 899 struct cryptodesc *crda; 900 struct tdb_crypto *tc; 901 struct mbuf *mi; 902 struct cryptop *crp; 903 u_int16_t iplen; 904 int error, rplen, authsize, maxpacketsize, roff; 905 u_int8_t prot; 906 struct newah *ah; 907 908 sav = isr->sav; 909 IPSEC_ASSERT(sav != NULL, ("null SA")); 910 ahx = sav->tdb_authalgxform; 911 IPSEC_ASSERT(ahx != NULL, ("null authentication xform")); 912 913 AHSTAT_INC(ahs_output); 914 915 /* Figure out header size. */ 916 rplen = HDRSIZE(sav); 917 918 /* Check for maximum packet size violations. */ 919 switch (sav->sah->saidx.dst.sa.sa_family) { 920 #ifdef INET 921 case AF_INET: 922 maxpacketsize = IP_MAXPACKET; 923 break; 924 #endif /* INET */ 925 #ifdef INET6 926 case AF_INET6: 927 maxpacketsize = IPV6_MAXPACKET; 928 break; 929 #endif /* INET6 */ 930 default: 931 DPRINTF(("%s: unknown/unsupported protocol family %u, " 932 "SA %s/%08lx\n", __func__, 933 sav->sah->saidx.dst.sa.sa_family, 934 ipsec_address(&sav->sah->saidx.dst), 935 (u_long) ntohl(sav->spi))); 936 AHSTAT_INC(ahs_nopf); 937 error = EPFNOSUPPORT; 938 goto bad; 939 } 940 authsize = AUTHSIZE(sav); 941 if (rplen + authsize + m->m_pkthdr.len > maxpacketsize) { 942 DPRINTF(("%s: packet in SA %s/%08lx got too big " 943 "(len %u, max len %u)\n", __func__, 944 ipsec_address(&sav->sah->saidx.dst), 945 (u_long) ntohl(sav->spi), 946 rplen + authsize + m->m_pkthdr.len, maxpacketsize)); 947 AHSTAT_INC(ahs_toobig); 948 error = EMSGSIZE; 949 goto bad; 950 } 951 952 /* Update the counters. */ 953 AHSTAT_ADD(ahs_obytes, m->m_pkthdr.len - skip); 954 955 m = m_unshare(m, M_NOWAIT); 956 if (m == NULL) { 957 DPRINTF(("%s: cannot clone mbuf chain, SA %s/%08lx\n", __func__, 958 ipsec_address(&sav->sah->saidx.dst), 959 (u_long) ntohl(sav->spi))); 960 AHSTAT_INC(ahs_hdrops); 961 error = ENOBUFS; 962 goto bad; 963 } 964 965 /* Inject AH header. */ 966 mi = m_makespace(m, skip, rplen + authsize, &roff); 967 if (mi == NULL) { 968 DPRINTF(("%s: failed to inject %u byte AH header for SA " 969 "%s/%08lx\n", __func__, 970 rplen + authsize, 971 ipsec_address(&sav->sah->saidx.dst), 972 (u_long) ntohl(sav->spi))); 973 AHSTAT_INC(ahs_hdrops); /*XXX differs from openbsd */ 974 error = ENOBUFS; 975 goto bad; 976 } 977 978 /* 979 * The AH header is guaranteed by m_makespace() to be in 980 * contiguous memory, at roff bytes offset into the returned mbuf. 981 */ 982 ah = (struct newah *)(mtod(mi, caddr_t) + roff); 983 984 /* Initialize the AH header. */ 985 m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &ah->ah_nxt); 986 ah->ah_len = (rplen + authsize - sizeof(struct ah)) / sizeof(u_int32_t); 987 ah->ah_reserve = 0; 988 ah->ah_spi = sav->spi; 989 990 /* Zeroize authenticator. */ 991 m_copyback(m, skip + rplen, authsize, ipseczeroes); 992 993 /* Insert packet replay counter, as requested. */ 994 if (sav->replay) { 995 if (sav->replay->count == ~0 && 996 (sav->flags & SADB_X_EXT_CYCSEQ) == 0) { 997 DPRINTF(("%s: replay counter wrapped for SA %s/%08lx\n", 998 __func__, 999 ipsec_address(&sav->sah->saidx.dst), 1000 (u_long) ntohl(sav->spi))); 1001 AHSTAT_INC(ahs_wrap); 1002 error = EINVAL; 1003 goto bad; 1004 } 1005 #ifdef REGRESSION 1006 /* Emulate replay attack when ipsec_replay is TRUE. */ 1007 if (!V_ipsec_replay) 1008 #endif 1009 sav->replay->count++; 1010 ah->ah_seq = htonl(sav->replay->count); 1011 } 1012 1013 /* Get crypto descriptors. */ 1014 crp = crypto_getreq(1); 1015 if (crp == NULL) { 1016 DPRINTF(("%s: failed to acquire crypto descriptors\n", 1017 __func__)); 1018 AHSTAT_INC(ahs_crypto); 1019 error = ENOBUFS; 1020 goto bad; 1021 } 1022 1023 crda = crp->crp_desc; 1024 1025 crda->crd_skip = 0; 1026 crda->crd_inject = skip + rplen; 1027 crda->crd_len = m->m_pkthdr.len; 1028 1029 /* Authentication operation. */ 1030 crda->crd_alg = ahx->type; 1031 crda->crd_key = sav->key_auth->key_data; 1032 crda->crd_klen = _KEYBITS(sav->key_auth); 1033 1034 /* Allocate IPsec-specific opaque crypto info. */ 1035 tc = (struct tdb_crypto *) malloc( 1036 sizeof(struct tdb_crypto) + skip, M_XDATA, M_NOWAIT|M_ZERO); 1037 if (tc == NULL) { 1038 crypto_freereq(crp); 1039 DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__)); 1040 AHSTAT_INC(ahs_crypto); 1041 error = ENOBUFS; 1042 goto bad; 1043 } 1044 1045 /* Save the skipped portion of the packet. */ 1046 m_copydata(m, 0, skip, (caddr_t) (tc + 1)); 1047 1048 /* 1049 * Fix IP header length on the header used for 1050 * authentication. We don't need to fix the original 1051 * header length as it will be fixed by our caller. 1052 */ 1053 switch (sav->sah->saidx.dst.sa.sa_family) { 1054 #ifdef INET 1055 case AF_INET: 1056 bcopy(((caddr_t)(tc + 1)) + 1057 offsetof(struct ip, ip_len), 1058 (caddr_t) &iplen, sizeof(u_int16_t)); 1059 iplen = htons(ntohs(iplen) + rplen + authsize); 1060 m_copyback(m, offsetof(struct ip, ip_len), 1061 sizeof(u_int16_t), (caddr_t) &iplen); 1062 break; 1063 #endif /* INET */ 1064 1065 #ifdef INET6 1066 case AF_INET6: 1067 bcopy(((caddr_t)(tc + 1)) + 1068 offsetof(struct ip6_hdr, ip6_plen), 1069 (caddr_t) &iplen, sizeof(u_int16_t)); 1070 iplen = htons(ntohs(iplen) + rplen + authsize); 1071 m_copyback(m, offsetof(struct ip6_hdr, ip6_plen), 1072 sizeof(u_int16_t), (caddr_t) &iplen); 1073 break; 1074 #endif /* INET6 */ 1075 } 1076 1077 /* Fix the Next Header field in saved header. */ 1078 ((u_int8_t *) (tc + 1))[protoff] = IPPROTO_AH; 1079 1080 /* Update the Next Protocol field in the IP header. */ 1081 prot = IPPROTO_AH; 1082 m_copyback(m, protoff, sizeof(u_int8_t), (caddr_t) &prot); 1083 1084 /* "Massage" the packet headers for crypto processing. */ 1085 error = ah_massage_headers(&m, sav->sah->saidx.dst.sa.sa_family, 1086 skip, ahx->type, 1); 1087 if (error != 0) { 1088 m = NULL; /* mbuf was free'd by ah_massage_headers. */ 1089 free(tc, M_XDATA); 1090 crypto_freereq(crp); 1091 goto bad; 1092 } 1093 1094 /* Crypto operation descriptor. */ 1095 crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */ 1096 crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC; 1097 crp->crp_buf = (caddr_t) m; 1098 crp->crp_callback = ah_output_cb; 1099 crp->crp_sid = sav->tdb_cryptoid; 1100 crp->crp_opaque = (caddr_t) tc; 1101 1102 /* These are passed as-is to the callback. */ 1103 tc->tc_isr = isr; 1104 KEY_ADDREFSA(sav); 1105 tc->tc_sav = sav; 1106 tc->tc_spi = sav->spi; 1107 tc->tc_dst = sav->sah->saidx.dst; 1108 tc->tc_proto = sav->sah->saidx.proto; 1109 tc->tc_skip = skip; 1110 tc->tc_protoff = protoff; 1111 1112 return crypto_dispatch(crp); 1113 bad: 1114 if (m) 1115 m_freem(m); 1116 return (error); 1117 } 1118 1119 /* 1120 * AH output callback from the crypto driver. 1121 */ 1122 static int 1123 ah_output_cb(struct cryptop *crp) 1124 { 1125 int skip, protoff, error; 1126 struct tdb_crypto *tc; 1127 struct ipsecrequest *isr; 1128 struct secasvar *sav; 1129 struct mbuf *m; 1130 caddr_t ptr; 1131 1132 tc = (struct tdb_crypto *) crp->crp_opaque; 1133 IPSEC_ASSERT(tc != NULL, ("null opaque data area!")); 1134 skip = tc->tc_skip; 1135 protoff = tc->tc_protoff; 1136 ptr = (caddr_t) (tc + 1); 1137 m = (struct mbuf *) crp->crp_buf; 1138 1139 isr = tc->tc_isr; 1140 IPSECREQUEST_LOCK(isr); 1141 sav = tc->tc_sav; 1142 /* With the isr lock released SA pointer can be updated. */ 1143 if (sav != isr->sav) { 1144 AHSTAT_INC(ahs_notdb); 1145 DPRINTF(("%s: SA expired while in crypto\n", __func__)); 1146 error = ENOBUFS; /*XXX*/ 1147 goto bad; 1148 } 1149 1150 /* Check for crypto errors. */ 1151 if (crp->crp_etype) { 1152 if (sav->tdb_cryptoid != 0) 1153 sav->tdb_cryptoid = crp->crp_sid; 1154 1155 if (crp->crp_etype == EAGAIN) { 1156 IPSECREQUEST_UNLOCK(isr); 1157 return (crypto_dispatch(crp)); 1158 } 1159 1160 AHSTAT_INC(ahs_noxform); 1161 DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype)); 1162 error = crp->crp_etype; 1163 goto bad; 1164 } 1165 1166 /* Shouldn't happen... */ 1167 if (m == NULL) { 1168 AHSTAT_INC(ahs_crypto); 1169 DPRINTF(("%s: bogus returned buffer from crypto\n", __func__)); 1170 error = EINVAL; 1171 goto bad; 1172 } 1173 AHSTAT_INC(ahs_hist[sav->alg_auth]); 1174 1175 /* 1176 * Copy original headers (with the new protocol number) back 1177 * in place. 1178 */ 1179 m_copyback(m, 0, skip, ptr); 1180 1181 /* No longer needed. */ 1182 free(tc, M_XDATA); 1183 crypto_freereq(crp); 1184 1185 #ifdef REGRESSION 1186 /* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */ 1187 if (V_ipsec_integrity) { 1188 int alen; 1189 1190 /* 1191 * Corrupt HMAC if we want to test integrity verification of 1192 * the other side. 1193 */ 1194 alen = AUTHSIZE(sav); 1195 m_copyback(m, m->m_pkthdr.len - alen, alen, ipseczeroes); 1196 } 1197 #endif 1198 1199 /* NB: m is reclaimed by ipsec_process_done. */ 1200 error = ipsec_process_done(m, isr); 1201 KEY_FREESAV(&sav); 1202 IPSECREQUEST_UNLOCK(isr); 1203 return error; 1204 bad: 1205 if (sav) 1206 KEY_FREESAV(&sav); 1207 IPSECREQUEST_UNLOCK(isr); 1208 if (m) 1209 m_freem(m); 1210 free(tc, M_XDATA); 1211 crypto_freereq(crp); 1212 return error; 1213 } 1214 1215 static struct xformsw ah_xformsw = { 1216 XF_AH, XFT_AUTH, "IPsec AH", 1217 ah_init, ah_zeroize, ah_input, ah_output, 1218 }; 1219 1220 static void 1221 ah_attach(void) 1222 { 1223 1224 xform_register(&ah_xformsw); 1225 } 1226 1227 SYSINIT(ah_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ah_attach, NULL); 1228