root/netinet/ipsec_input.c

DEFINITIONS

1. ipsec_common_input
2. ipsec_common_input_cb
3. esp_sysctl
4. ah_sysctl
5. ipcomp_sysctl
6. ah4_input
7. ah4_input_cb
8. ah4_ctlinput
9. esp4_input
10. esp4_input_cb
11. ipcomp4_input
12. ipcomp4_input_cb
13. ipsec_common_ctlinput
14. udpencap_ctlinput
15. esp4_ctlinput
16. ah6_input
17. ah6_input_cb
18. esp6_input
19. esp6_input_cb
20. ipcomp6_input
21. ipcomp6_input_cb

    1 /*      $OpenBSD: ipsec_input.c,v 1.84 2007/05/28 17:16:39 henning Exp $        */
    2 /*
    3  * The authors of this code are John Ioannidis (ji@tla.org),
    4  * Angelos D. Keromytis (kermit@csd.uch.gr) and
    5  * Niels Provos (provos@physnet.uni-hamburg.de).
    6  *
    7  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
    8  * in November 1995.
    9  *
   10  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
   11  * by Angelos D. Keromytis.
   12  *
   13  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
   14  * and Niels Provos.
   15  *
   16  * Additional features in 1999 by Angelos D. Keromytis.
   17  *
   18  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
   19  * Angelos D. Keromytis and Niels Provos.
   20  * Copyright (c) 2001, Angelos D. Keromytis.
   21  *
   22  * Permission to use, copy, and modify this software with or without fee
   23  * is hereby granted, provided that this entire notice is included in
   24  * all copies of any software which is or includes a copy or
   25  * modification of this software.
   26  * You may use this code under the GNU public license if you so wish. Please
   27  * contribute changes back to the authors under this freer than GPL license
   28  * so that we may further the use of strong encryption without limitations to
   29  * all.
   30  *
   31  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
   32  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
   33  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
   34  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
   35  * PURPOSE.
   36  */
   38 #include "pf.h"
   40 #include <sys/param.h>
   41 #include <sys/systm.h>
   42 #include <sys/protosw.h>
   43 #include <sys/mbuf.h>
   44 #include <sys/socket.h>
   45 #include <sys/sysctl.h>
   46 #include <sys/kernel.h>
   48 #include <net/if.h>
   49 #include <net/netisr.h>
   50 #include <net/bpf.h>
   52 #if NPF > 0
   53 #include <net/pfvar.h>
   54 #endif
   56 #include <netinet/in.h>
   57 #include <netinet/in_systm.h>
   58 #include <netinet/ip.h>
   59 #include <netinet/ip_var.h>
   60 #include <netinet/in_var.h>
   61 #include <netinet/ip_icmp.h>
   62 #include <netinet/tcp.h>
   63 #include <netinet/udp.h>
   65 #ifdef INET6
   66 #ifndef INET
   67 #include <netinet/in.h>
   68 #endif
   69 #include <netinet/ip6.h>
   70 #include <netinet6/ip6_var.h>
   71 #include <netinet6/ip6protosw.h>
   72 #endif /* INET6 */
   74 #include <netinet/ip_ipsp.h>
   75 #include <netinet/ip_esp.h>
   76 #include <netinet/ip_ah.h>
   77 #include <netinet/ip_ipcomp.h>
   79 #include <net/if_enc.h>
   81 #include "bpfilter.h"
   83 void *ipsec_common_ctlinput(int, struct sockaddr *, void *, int);
   85 #ifdef ENCDEBUG
   86 #define DPRINTF(x)      if (encdebug) printf x
   87 #else
   88 #define DPRINTF(x)
   89 #endif
   91 /* sysctl variables */
   92 int esp_enable = 1;
   93 int ah_enable = 1;
   94 int ipcomp_enable = 0;
   96 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS;
   97 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS;
   98 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS;
  100 #ifdef INET6
  101 extern struct ip6protosw inet6sw[];
  102 extern u_char ip6_protox[];
  103 #endif
  105 /*
  106  * ipsec_common_input() gets called when we receive an IPsec-protected packet
  107  * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate
  108  * transform. The callback takes care of further processing (like ingress
  109  * filtering).
  110  */
  111 int
ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
  113     int udpencap)
  114 {
  115 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \
sproto == IPPROTO_AH ? (y)++ : (z)++)
  118         union sockaddr_union dst_address;
  119         struct timeval tv;
  120         struct tdb *tdbp;
u_int32_t spi;
u_int16_t cpi;
  123         int s, error;
IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input,
ipcompstat.ipcomps_input);
  128         if (m == 0) {
DPRINTF(("ipsec_common_input(): NULL packet received\n"));
IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  132                 return EINVAL;
  133         }
  135         if ((sproto == IPPROTO_ESP && !esp_enable) ||
  136             (sproto == IPPROTO_AH && !ah_enable) ||
  137             (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
rip_input(m, skip, sproto);
  139                 return 0;
  140         }
  142         if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) {
m_freem(m);
IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
DPRINTF(("ipsec_common_input(): packet too small\n"));
  147                 return EINVAL;
  148         }
  150         /* Retrieve the SPI from the relevant IPsec header */
  151         if (sproto == IPPROTO_ESP)
m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
  153         else if (sproto == IPPROTO_AH)
m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
  155                     (caddr_t) &spi);
  156         else if (sproto == IPPROTO_IPCOMP) {
m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
  158                     (caddr_t) &cpi);
spi = ntohl(htons(cpi));
  160         }
  162         /*
  163          * Find tunnel control block and (indirectly) call the appropriate
  164          * kernel crypto routine. The resulting mbuf chain is a valid
  165          * IP packet ready to go through input processing.
  166          */
bzero(&dst_address, sizeof(dst_address));
dst_address.sa.sa_family = af;
  171         switch (af) {
  172 #ifdef INET
  173         case AF_INET:
dst_address.sin.sin_len = sizeof(struct sockaddr_in);
m_copydata(m, offsetof(struct ip, ip_dst),
  176                     sizeof(struct in_addr),
  177                     (caddr_t) &(dst_address.sin.sin_addr));
  178                 break;
  179 #endif /* INET */
  181 #ifdef INET6
  182         case AF_INET6:
dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
  185                     sizeof(struct in6_addr),
  186                     (caddr_t) &(dst_address.sin6.sin6_addr));
in6_recoverscope(&dst_address.sin6, &dst_address.sin6.sin6_addr,
NULL);
  189                 break;
  190 #endif /* INET6 */
  192         default:
DPRINTF(("ipsec_common_input(): unsupported protocol "
  194                     "family %d\n", af));
m_freem(m);
IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf,
ipcompstat.ipcomps_nopf);
  198                 return EPFNOSUPPORT;
  199         }
s = spltdb();
tdbp = gettdb(spi, &dst_address, sproto);
  203         if (tdbp == NULL) {
splx(s);
DPRINTF(("ipsec_common_input(): could not find SA for "
  206                     "packet to %s, spi %08x\n",
ipsp_address(dst_address), ntohl(spi)));
m_freem(m);
IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb,
ipcompstat.ipcomps_notdb);
  211                 return ENOENT;
  212         }
  214         if (tdbp->tdb_flags & TDBF_INVALID) {
splx(s);
DPRINTF(("ipsec_common_input(): attempted to use invalid SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
m_freem(m);
IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid,
ipcompstat.ipcomps_invalid);
  220                 return EINVAL;
  221         }
  223         if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) {
splx(s);
DPRINTF(("ipsec_common_input(): attempted to use non-udpencap SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
m_freem(m);
espstat.esps_udpinval++;
  228                 return EINVAL;
  229         }
  231         if (tdbp->tdb_xform == NULL) {
splx(s);
DPRINTF(("ipsec_common_input(): attempted to use uninitialized SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
m_freem(m);
IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform,
ipcompstat.ipcomps_noxform);
  237                 return ENXIO;
  238         }
  240         if (tdbp->tdb_dst.sa.sa_family == AF_INET &&
sproto != IPPROTO_IPCOMP) {
  242                 /*
  243                  * XXX The fragment conflicts with scoped nature of
  244                  * IPv6, so do it for only for IPv4 for now.
  245                  */
m->m_pkthdr.rcvif = &encif[0].sc_if;
  247         }
  249         /* Register first use, setup expiration timer. */
  250         if (tdbp->tdb_first_use == 0) {
tdbp->tdb_first_use = time_second;
tv.tv_usec = 0;
tv.tv_sec = tdbp->tdb_exp_first_use + tdbp->tdb_first_use;
  256                 if (tdbp->tdb_flags & TDBF_FIRSTUSE)
timeout_add(&tdbp->tdb_first_tmo, hzto(&tv));
tv.tv_sec = tdbp->tdb_first_use + tdbp->tdb_soft_first_use;
  260                 if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE)
timeout_add(&tdbp->tdb_sfirst_tmo, hzto(&tv));
  262         }
  264         /*
  265          * Call appropriate transform and return -- callback takes care of
  266          * everything else.
  267          */
error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff);
splx(s);
  270         return error;
  271 }
  273 /*
  274  * IPsec input callback, called by the transform callback. Takes care of
  275  * filtering and other sanity checks on the processed packet.
  276  */
  277 int
ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff,
  279     struct m_tag *mt)
  280 {
  281         int prot, af, sproto;
  283 #if NBPFILTER > 0
  284         struct ifnet *bpfif;
  285 #endif
  287 #ifdef INET
  288         struct ip *ip, ipn;
  289 #endif /* INET */
  291 #ifdef INET6
  292         struct ip6_hdr *ip6, ip6n;
  293 #endif /* INET6 */
  294         struct m_tag *mtag;
  295         struct tdb_ident *tdbi;
af = tdbp->tdb_dst.sa.sa_family;
sproto = tdbp->tdb_sproto;
tdbp->tdb_last_used = time_second;
  302         /* Sanity check */
  303         if (m == NULL) {
  304                 /* The called routine will print a message if necessary */
IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr,
ipcompstat.ipcomps_badkcr);
  307                 return EINVAL;
  308         }
  310 #ifdef INET
  311         /* Fix IPv4 header */
  312         if (tdbp->tdb_dst.sa.sa_family == AF_INET) {
  313                 if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) {
DPRINTF(("ipsec_common_input_cb(): processing failed "
  315                             "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst),
ntohl(tdbp->tdb_spi)));
IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  319                         return ENOBUFS;
  320                 }
ip = mtod(m, struct ip *);
ip->ip_len = htons(m->m_pkthdr.len);
ip->ip_sum = 0;
ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
prot = ip->ip_p;
  328                 /* IP-in-IP encapsulation */
  329                 if (prot == IPPROTO_IPIP) {
  330                         if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
m_freem(m);
IPSEC_ISTAT(espstat.esps_hdrops,
ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  335                                 return EINVAL;
  336                         }
  337                         /* ipn will now contain the inner IPv4 header */
m_copydata(m, skip, sizeof(struct ip),
  339                             (caddr_t) &ipn);
  341                         /*
  342                          * Check that the inner source address is the same as
  343                          * the proxy address, if available.
  344                          */
  345                         if ((tdbp->tdb_proxy.sa.sa_family == AF_INET &&
tdbp->tdb_proxy.sin.sin_addr.s_addr !=
INADDR_ANY &&
ipn.ip_src.s_addr !=
tdbp->tdb_proxy.sin.sin_addr.s_addr) ||
  350                             (tdbp->tdb_proxy.sa.sa_family != AF_INET &&
tdbp->tdb_proxy.sa.sa_family != 0)) {
DPRINTF(("ipsec_common_input_cb(): inner "
  354                                     "source address %s doesn't correspond to "
  355                                     "expected proxy source %s, SA %s/%08x\n",
inet_ntoa4(ipn.ip_src),
ipsp_address(tdbp->tdb_proxy),
ipsp_address(tdbp->tdb_dst),
ntohl(tdbp->tdb_spi)));
m_freem(m);
IPSEC_ISTAT(espstat.esps_pdrops,
ahstat.ahs_pdrops,
ipcompstat.ipcomps_pdrops);
  365                                 return EACCES;
  366                         }
  367                 }
  369 #if INET6
  370                 /* IPv6-in-IP encapsulation. */
  371                 if (prot == IPPROTO_IPV6) {
  372                         if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
m_freem(m);
IPSEC_ISTAT(espstat.esps_hdrops,
ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  377                                 return EINVAL;
  378                         }
  379                         /* ip6n will now contain the inner IPv6 header. */
m_copydata(m, skip, sizeof(struct ip6_hdr),
  381                             (caddr_t) &ip6n);
  383                         /*
  384                          * Check that the inner source address is the same as
  385                          * the proxy address, if available.
  386                          */
  387                         if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 &&
  388                             !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) &&
  389                             !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
  390                                 &tdbp->tdb_proxy.sin6.sin6_addr)) ||
  391                             (tdbp->tdb_proxy.sa.sa_family != AF_INET6 &&
tdbp->tdb_proxy.sa.sa_family != 0)) {
DPRINTF(("ipsec_common_input_cb(): inner "
  395                                     "source address %s doesn't correspond to "
  396                                     "expected proxy source %s, SA %s/%08x\n",
ip6_sprintf(&ip6n.ip6_src),
ipsp_address(tdbp->tdb_proxy),
ipsp_address(tdbp->tdb_dst),
ntohl(tdbp->tdb_spi)));
m_freem(m);
IPSEC_ISTAT(espstat.esps_pdrops,
ahstat.ahs_pdrops,
ipcompstat.ipcomps_pdrops);
  406                                 return EACCES;
  407                         }
  408                 }
  409 #endif /* INET6 */
  410         }
  411 #endif /* INET */
  413 #ifdef INET6
  414         /* Fix IPv6 header */
  415         if (af == INET6)
  416         {
  417                 if (m->m_len < sizeof(struct ip6_hdr) &&
  418                     (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
DPRINTF(("ipsec_common_input_cb(): processing failed "
  421                             "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst),
ntohl(tdbp->tdb_spi)));
IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  426                         return EACCES;
  427                 }
ip6 = mtod(m, struct ip6_hdr *);
ip6->ip6_plen = htons(m->m_pkthdr.len -
  431                     sizeof(struct ip6_hdr));
  433                 /* Save protocol */
m_copydata(m, protoff, 1, (unsigned char *) &prot);
  436 #ifdef INET
  437                 /* IP-in-IP encapsulation */
  438                 if (prot == IPPROTO_IPIP) {
  439                         if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
m_freem(m);
IPSEC_ISTAT(espstat.esps_hdrops,
ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  444                                 return EINVAL;
  445                         }
  446                         /* ipn will now contain the inner IPv4 header */
m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
  449                         /*
  450                          * Check that the inner source address is the same as
  451                          * the proxy address, if available.
  452                          */
  453                         if ((tdbp->tdb_proxy.sa.sa_family == AF_INET &&
tdbp->tdb_proxy.sin.sin_addr.s_addr !=
INADDR_ANY &&
ipn.ip_src.s_addr !=
tdbp->tdb_proxy.sin.sin_addr.s_addr) ||
  458                             (tdbp->tdb_proxy.sa.sa_family != AF_INET &&
tdbp->tdb_proxy.sa.sa_family != 0)) {
DPRINTF(("ipsec_common_input_cb(): inner "
  462                                     "source address %s doesn't correspond to "
  463                                     "expected proxy source %s, SA %s/%08x\n",
inet_ntoa4(ipn.ip_src),
ipsp_address(tdbp->tdb_proxy),
ipsp_address(tdbp->tdb_dst),
ntohl(tdbp->tdb_spi)));
m_freem(m);
IPSEC_ISTAT(espstat.esps_pdrops,
ahstat.ahs_pdrops,
ipcompstat.ipcomps_pdrops);
  473                                 return EACCES;
  474                         }
  475                 }
  476 #endif /* INET */
  478                 /* IPv6-in-IP encapsulation */
  479                 if (prot == IPPROTO_IPV6) {
  480                         if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
m_freem(m);
IPSEC_ISTAT(espstat.esps_hdrops,
ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  485                                 return EINVAL;
  486                         }
  487                         /* ip6n will now contain the inner IPv6 header. */
m_copydata(m, skip, sizeof(struct ip6_hdr),
  489                             (caddr_t) &ip6n);
  491                         /*
  492                          * Check that the inner source address is the same as
  493                          * the proxy address, if available.
  494                          */
  495                         if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 &&
  496                             !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) &&
  497                             !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
  498                                 &tdbp->tdb_proxy.sin6.sin6_addr)) ||
  499                             (tdbp->tdb_proxy.sa.sa_family != AF_INET6 &&
tdbp->tdb_proxy.sa.sa_family != 0)) {
DPRINTF(("ipsec_common_input_cb(): inner "
  503                                     "source address %s doesn't correspond to "
  504                                     "expected proxy source %s, SA %s/%08x\n",
ip6_sprintf(&ip6n.ip6_src),
ipsp_address(tdbp->tdb_proxy),
ipsp_address(tdbp->tdb_dst),
ntohl(tdbp->tdb_spi)));
m_freem(m);
IPSEC_ISTAT(espstat.esps_pdrops,
ahstat.ahs_pdrops,
ipcompstat.ipcomps_pdrops);
  514                                 return EACCES;
  515                         }
  516                 }
  517         }
  518 #endif /* INET6 */
  520         /*
  521          * Record what we've done to the packet (under what SA it was
  522          * processed). If we've been passed an mtag, it means the packet
  523          * was already processed by an ethernet/crypto combo card and
  524          * thus has a tag attached with all the right information, but
  525          * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
  526          * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
  527          */
  528         if (mt == NULL && tdbp->tdb_sproto != IPPROTO_IPCOMP) {
mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
  530                     sizeof(struct tdb_ident), M_NOWAIT);
  531                 if (mtag == NULL) {
m_freem(m);
DPRINTF(("ipsec_common_input_cb(): failed to "
  534                             "get tag\n"));
IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
ipcompstat.ipcomps_hdrops);
  537                         return ENOMEM;
  538                 }
tdbi = (struct tdb_ident *)(mtag + 1);
bcopy(&tdbp->tdb_dst, &tdbi->dst,
  542                     sizeof(union sockaddr_union));
tdbi->proto = tdbp->tdb_sproto;
tdbi->spi = tdbp->tdb_spi;
m_tag_prepend(m, mtag);
  547         } else {
  548                 if (mt != NULL)
mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
  550         }
  552         if (sproto == IPPROTO_ESP) {
  553                 /* Packet is confidential ? */
  554                 if (tdbp->tdb_encalgxform)
m->m_flags |= M_CONF;
  557                 /* Check if we had authenticated ESP. */
  558                 if (tdbp->tdb_authalgxform)
m->m_flags |= M_AUTH;
  560         } else if (sproto == IPPROTO_AH)
m->m_flags |= M_AUTH | M_AUTH_AH;
  563 #if NPF > 0
  564         /* Add pf tag if requested. */
  565         if (pf_tag_packet(m, tdbp->tdb_tag, -1))
DPRINTF(("failed to tag ipsec packet\n"));
  567 #endif
  569         if (tdbp->tdb_flags & TDBF_TUNNELING)
m->m_flags |= M_TUNNEL;
  572 #if NBPFILTER > 0
bpfif = &encif[0].sc_if;
bpfif->if_ipackets++;
bpfif->if_ibytes += m->m_pkthdr.len;
  577         if (bpfif->if_bpf) {
  578                 struct enchdr hdr;
hdr.af = af;
hdr.spi = tdbp->tdb_spi;
hdr.flags = m->m_flags & (M_AUTH|M_CONF|M_AUTH_AH);
bpf_mtap_hdr(bpfif->if_bpf, (char *)&hdr, ENC_HDRLEN, m,
BPF_DIRECTION_IN);
  586         }
  587 #endif
  589         /* Call the appropriate IPsec transform callback. */
  590         switch (af) {
  591 #ifdef INET
  592         case AF_INET:
  593                 switch (sproto)
  594                 {
  595                 case IPPROTO_ESP:
  596                         return esp4_input_cb(m);
  598                 case IPPROTO_AH:
  599                         return ah4_input_cb(m);
  601                 case IPPROTO_IPCOMP:
  602                         return ipcomp4_input_cb(m);
  604                 default:
DPRINTF(("ipsec_common_input_cb(): unknown/unsupported"
  606                             " security protocol %d\n", sproto));
m_freem(m);
  608                         return EPFNOSUPPORT;
  609                 }
  610                 break;
  611 #endif /* INET */
  613 #ifdef INET6
  614         case AF_INET6:
  615                 switch (sproto) {
  616                 case IPPROTO_ESP:
  617                         return esp6_input_cb(m, skip, protoff);
  619                 case IPPROTO_AH:
  620                         return ah6_input_cb(m, skip, protoff);
  622                 case IPPROTO_IPCOMP:
  623                         return ipcomp6_input_cb(m, skip, protoff);
  625                 default:
DPRINTF(("ipsec_common_input_cb(): unknown/unsupported"
  627                             " security protocol %d\n", sproto));
m_freem(m);
  629                         return EPFNOSUPPORT;
  630                 }
  631                 break;
  632 #endif /* INET6 */
  634         default:
DPRINTF(("ipsec_common_input_cb(): unknown/unsupported "
  636                     "protocol family %d\n", af));
m_freem(m);
  638                 return EPFNOSUPPORT;
  639         }
  640 #undef IPSEC_ISTAT
  641 }
  643 int
esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
size_t newlen)
  646 {
  647         if (name[0] < ESPCTL_MAXID)
  648                 return (sysctl_int_arr(espctl_vars, name, namelen,
oldp, oldlenp, newp, newlen));
  650         return (ENOPROTOOPT);
  651 }
  653 int
ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
size_t newlen)
  656 {
  657         if (name[0] < AHCTL_MAXID)
  658                 return (sysctl_int_arr(ahctl_vars, name, namelen,
oldp, oldlenp, newp, newlen));
  660         return (ENOPROTOOPT);
  661 }
  663 int
ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
size_t newlen)
  666 {
  667         if (name[0] < IPCOMPCTL_MAXID)
  668                 return (sysctl_int_arr(ipcompctl_vars, name, namelen,
oldp, oldlenp, newp, newlen));
  670         return (ENOPROTOOPT);
  671 }
  673 #ifdef INET
  674 /* IPv4 AH wrapper. */
  675 void
ah4_input(struct mbuf *m, ...)
  677 {
  678         int skip;
va_list ap;
va_start(ap, m);
skip = va_arg(ap, int);
va_end(ap);
ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
IPPROTO_AH, 0);
  687         return;
  688 }
  690 /* IPv4 AH callback. */
  691 int
ah4_input_cb(struct mbuf *m, ...)
  693 {
  694         struct ifqueue *ifq = &ipintrq;
  695         int s = splnet();
  697         /*
  698          * Interface pointer is already in first mbuf; chop off the
  699          * `outer' header and reschedule.
  700          */
  702         if (IF_QFULL(ifq)) {
IF_DROP(ifq);
ahstat.ahs_qfull++;
splx(s);
m_freem(m);
DPRINTF(("ah4_input_cb(): dropped packet because of full "
  709                     "IP queue\n"));
  710                 return ENOBUFS;
  711         }
IF_ENQUEUE(ifq, m);
schednetisr(NETISR_IP);
splx(s);
  716         return 0;
  717 }
  720 void *
ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
  722 {
  723         if (sa->sa_family != AF_INET ||
sa->sa_len != sizeof(struct sockaddr_in))
  725                 return (NULL);
  727         return (ipsec_common_ctlinput(cmd, sa, v, IPPROTO_AH));
  728 }
  730 /* IPv4 ESP wrapper. */
  731 void
esp4_input(struct mbuf *m, ...)
  733 {
  734         int skip;
va_list ap;
va_start(ap, m);
skip = va_arg(ap, int);
va_end(ap);
ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
IPPROTO_ESP, 0);
  743 }
  745 /* IPv4 ESP callback. */
  746 int
esp4_input_cb(struct mbuf *m, ...)
  748 {
  749         struct ifqueue *ifq = &ipintrq;
  750         int s = splnet();
  752         /*
  753          * Interface pointer is already in first mbuf; chop off the
  754          * `outer' header and reschedule.
  755          */
  756         if (IF_QFULL(ifq)) {
IF_DROP(ifq);
espstat.esps_qfull++;
splx(s);
m_freem(m);
DPRINTF(("esp4_input_cb(): dropped packet because of full "
  763                     "IP queue\n"));
  764                 return ENOBUFS;
  765         }
IF_ENQUEUE(ifq, m);
schednetisr(NETISR_IP);
splx(s);
  770         return 0;
  771 }
  773 /* IPv4 IPCOMP wrapper */
  774 void
ipcomp4_input(struct mbuf *m, ...)
  776 {
  777         int skip;
va_list ap;
va_start(ap, m);
skip = va_arg(ap, int);
va_end(ap);
ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
IPPROTO_IPCOMP, 0);
  785 }
  787 /* IPv4 IPCOMP callback */
  788 int
ipcomp4_input_cb(struct mbuf *m, ...)
  790 {
  791         struct ifqueue *ifq = &ipintrq;
  792         int s = splnet();
  794         /*
  795          * Interface pointer is already in first mbuf; chop off the
  796          * `outer' header and reschedule.
  797          */
  798         if (IF_QFULL(ifq)) {
IF_DROP(ifq);
ipcompstat.ipcomps_qfull++;
splx(s);
m_freem(m);
DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n"));
  805                 return ENOBUFS;
  806         }
IF_ENQUEUE(ifq, m);
schednetisr(NETISR_IP);
splx(s);
  812         return 0;
  813 }
  815 void *
ipsec_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
  817 {
  818         extern u_int ip_mtudisc_timeout;
  819         struct ip *ip = v;
  820         int s;
  822         if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) {
  823                 struct tdb *tdbp;
  824                 struct sockaddr_in dst;
  825                 struct icmp *icp;
  826                 int hlen = ip->ip_hl << 2;
u_int32_t spi, mtu;
ssize_t adjust;
  830                 /* Find the right MTU. */
icp = (struct icmp *)((caddr_t) ip -
offsetof(struct icmp, icmp_ip));
mtu = ntohs(icp->icmp_nextmtu);
  835                 /*
  836                  * Ignore the packet, if we do not receive a MTU
  837                  * or the MTU is too small to be acceptable.
  838                  */
  839                 if (mtu < 296)
  840                         return (NULL);
bzero(&dst, sizeof(struct sockaddr_in));
dst.sin_family = AF_INET;
dst.sin_len = sizeof(struct sockaddr_in);
dst.sin_addr.s_addr = ip->ip_dst.s_addr;
bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t));
s = spltdb();
tdbp = gettdb(spi, (union sockaddr_union *)&dst, proto);
  851                 if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) {
splx(s);
  853                         return (NULL);
  854                 }
  856                 /* Walk the chain backswards to the first tdb */
  857                 for (; tdbp; tdbp = tdbp->tdb_inext) {
  858                         if (tdbp->tdb_flags & TDBF_INVALID ||
  859                             (adjust = ipsec_hdrsz(tdbp)) == -1) {
splx(s);
  861                                 return (NULL);
  862                         }
mtu -= adjust;
  866                         /* Store adjusted MTU in tdb */
tdbp->tdb_mtu = mtu;
tdbp->tdb_mtutimeout = time_second +
ip_mtudisc_timeout;
DPRINTF(("ipsec_common_ctlinput: "
  871                             "spi %08x mtu %d adjust %d\n",
ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
adjust));
  874                 }
splx(s);
  876                 return (NULL);
  877         }
  878         return (NULL);
  879 }
  881 void *
udpencap_ctlinput(int cmd, struct sockaddr *sa, void *v)
  883 {
  884         struct ip *ip = v;
  885         struct tdb *tdbp;
  886         struct icmp *icp;
u_int32_t mtu;
ssize_t adjust;
  889         struct sockaddr_in dst, src;
  890         union sockaddr_union *su_dst, *su_src;
  891         int s;
icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip));
mtu = ntohs(icp->icmp_nextmtu);
  896         /*
  897          * Ignore the packet, if we do not receive a MTU
  898          * or the MTU is too small to be acceptable.
  899          */
  900         if (mtu < 296)
  901                 return (NULL);
bzero(&dst, sizeof(dst));
dst.sin_family = AF_INET;
dst.sin_len = sizeof(struct sockaddr_in);
dst.sin_addr.s_addr = ip->ip_dst.s_addr;
su_dst = (union sockaddr_union *)&dst;
bzero(&src, sizeof(src));
src.sin_family = AF_INET;
src.sin_len = sizeof(struct sockaddr_in);
src.sin_addr.s_addr = ip->ip_src.s_addr;
su_src = (union sockaddr_union *)&src;
s = spltdb();
tdbp = gettdbbysrcdst(0, su_src, su_dst, IPPROTO_ESP);
  917         for (; tdbp != NULL; tdbp = tdbp->tdb_snext) {
  918                 if (tdbp->tdb_sproto == IPPROTO_ESP &&
  919                     ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP))
  920                     == TDBF_UDPENCAP) &&
  921                     !bcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) &&
  922                     !bcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) {
  923                         if ((adjust = ipsec_hdrsz(tdbp)) != -1) {
  924                                 /* Store adjusted MTU in tdb */
tdbp->tdb_mtu = mtu - adjust;
tdbp->tdb_mtutimeout = time_second +
ip_mtudisc_timeout;
DPRINTF(("udpencap_ctlinput: "
  929                                     "spi %08x mtu %d adjust %d\n",
ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
adjust));
  932                         }
  933                 }
  934         }
splx(s);
  936         return (NULL);
  937 }
  939 void *
esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
  941 {
  942         if (sa->sa_family != AF_INET ||
sa->sa_len != sizeof(struct sockaddr_in))
  944                 return (NULL);
  946         return (ipsec_common_ctlinput(cmd, sa, v, IPPROTO_ESP));
  947 }
  948 #endif /* INET */
  950 #ifdef INET6
  951 /* IPv6 AH wrapper. */
  952 int
ah6_input(struct mbuf **mp, int *offp, int proto)
  954 {
  955         int l = 0;
  956         int protoff, nxt;
  957         struct ip6_ext ip6e;
  959         if (*offp < sizeof(struct ip6_hdr)) {
DPRINTF(("ah6_input(): bad offset\n"));
  961                 return IPPROTO_DONE;
  962         } else if (*offp == sizeof(struct ip6_hdr)) {
protoff = offsetof(struct ip6_hdr, ip6_nxt);
  964         } else {
  965                 /* Chase down the header chain... */
protoff = sizeof(struct ip6_hdr);
nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
  969                 do {
protoff += l;
m_copydata(*mp, protoff, sizeof(ip6e),
  972                             (caddr_t) &ip6e);
  974                         if (nxt == IPPROTO_AH)
l = (ip6e.ip6e_len + 2) << 2;
  976                         else
l = (ip6e.ip6e_len + 1) << 3;
  978 #ifdef DIAGNOSTIC
  979                         if (l <= 0)
panic("ah6_input: l went zero or negative");
  981 #endif
nxt = ip6e.ip6e_nxt;
  984                 } while (protoff + l < *offp);
  986                 /* Malformed packet check */
  987                 if (protoff + l != *offp) {
DPRINTF(("ah6_input(): bad packet header chain\n"));
ahstat.ahs_hdrops++;
m_freem(*mp);
  991                         *mp = NULL;
  992                         return IPPROTO_DONE;
  993                 }
protoff += offsetof(struct ip6_ext, ip6e_nxt);
  995         }
ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
  997         return IPPROTO_DONE;
  998 }
 1000 /* IPv6 AH callback. */
 1001 int
ah6_input_cb(struct mbuf *m, int off, int protoff)
 1003 {
 1004         int nxt;
u_int8_t nxt8;
 1006         int nest = 0;
 1008         /* Retrieve new protocol */
m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
nxt = nxt8;
 1012         /*
 1013          * see the end of ip6_input for this logic.
 1014          * IPPROTO_IPV[46] case will be processed just like other ones
 1015          */
 1016         while (nxt != IPPROTO_DONE) {
 1017                 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
ip6stat.ip6s_toomanyhdr++;
 1019                         goto bad;
 1020                 }
 1022                 /*
 1023                  * Protection against faulty packet - there should be
 1024                  * more sanity checks in header chain processing.
 1025                  */
 1026                 if (m->m_pkthdr.len < off) {
ip6stat.ip6s_tooshort++;
in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
 1029                         goto bad;
 1030                 }
nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
 1032         }
 1033         return 0;
bad:
m_freem(m);
 1037         return EINVAL;
 1038 }
 1040 /* IPv6 ESP wrapper. */
 1041 int
esp6_input(struct mbuf **mp, int *offp, int proto)
 1043 {
 1044         int l = 0;
 1045         int protoff, nxt;
 1046         struct ip6_ext ip6e;
 1048         if (*offp < sizeof(struct ip6_hdr)) {
DPRINTF(("esp6_input(): bad offset\n"));
 1050                 return IPPROTO_DONE;
 1051         } else if (*offp == sizeof(struct ip6_hdr)) {
protoff = offsetof(struct ip6_hdr, ip6_nxt);
 1053         } else {
 1054                 /* Chase down the header chain... */
protoff = sizeof(struct ip6_hdr);
nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
 1058                 do {
protoff += l;
m_copydata(*mp, protoff, sizeof(ip6e),
 1061                             (caddr_t) &ip6e);
 1063                         if (nxt == IPPROTO_AH)
l = (ip6e.ip6e_len + 2) << 2;
 1065                         else
l = (ip6e.ip6e_len + 1) << 3;
 1067 #ifdef DIAGNOSTIC
 1068                         if (l <= 0)
panic("esp6_input: l went zero or negative");
 1070 #endif
nxt = ip6e.ip6e_nxt;
 1073                 } while (protoff + l < *offp);
 1075                 /* Malformed packet check */
 1076                 if (protoff + l != *offp) {
DPRINTF(("esp6_input(): bad packet header chain\n"));
espstat.esps_hdrops++;
m_freem(*mp);
 1080                         *mp = NULL;
 1081                         return IPPROTO_DONE;
 1082                 }
protoff += offsetof(struct ip6_ext, ip6e_nxt);
 1084         }
ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
 1086         return IPPROTO_DONE;
 1088 }
 1090 /* IPv6 ESP callback */
 1091 int
esp6_input_cb(struct mbuf *m, int skip, int protoff)
 1093 {
 1094         return ah6_input_cb(m, skip, protoff);
 1095 }
 1097 /* IPv6 IPcomp wrapper */
 1098 int
ipcomp6_input(struct mbuf **mp, int *offp, int proto)
 1100 {
 1101         int l = 0;
 1102         int protoff, nxt;
 1103         struct ip6_ext ip6e;
 1105         if (*offp < sizeof(struct ip6_hdr)) {
DPRINTF(("ipcomp6_input(): bad offset\n"));
 1107                 return IPPROTO_DONE;
 1108         } else if (*offp == sizeof(struct ip6_hdr)) {
protoff = offsetof(struct ip6_hdr, ip6_nxt);
 1110         } else {
 1111                 /* Chase down the header chain... */
protoff = sizeof(struct ip6_hdr);
nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
 1115                 do {
protoff += l;
m_copydata(*mp, protoff, sizeof(ip6e),
 1118                             (caddr_t) &ip6e);
 1119                         if (nxt == IPPROTO_AH)
l = (ip6e.ip6e_len + 2) << 2;
 1121                         else
l = (ip6e.ip6e_len + 1) << 3;
 1123 #ifdef DIAGNOSTIC
 1124                         if (l <= 0)
panic("ipcomp6_input: l went zero or negative");
 1126 #endif
nxt = ip6e.ip6e_nxt;
 1129                 } while (protoff + l < *offp);
 1131                 /* Malformed packet check */
 1132                 if (protoff + l != *offp) {
DPRINTF(("ipcomp6_input(): bad packet header chain\n"));
ipcompstat.ipcomps_hdrops++;
m_freem(*mp);
 1136                         *mp = NULL;
 1137                         return IPPROTO_DONE;
 1138                 }
protoff += offsetof(struct ip6_ext, ip6e_nxt);
 1141         }
ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
 1143         return IPPROTO_DONE;
 1144 }
 1146 /* IPv6 IPcomp callback */
 1147 int
ipcomp6_input_cb(struct mbuf *m, int skip, int protoff)
 1149 {
 1150         return ah6_input_cb(m, skip, protoff);
 1151 }
 1153 #endif /* INET6 */