1/*-
2 * Copyright (c) 2006 The FreeBSD Project.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 * $FreeBSD$
28 */
29
30#include "opt_inet.h"
31#include "opt_inet6.h"
32#include "opt_enc.h"
33
34#include <sys/param.h>
35#include <sys/systm.h>
36#include <sys/kernel.h>
37#include <sys/malloc.h>
38#include <sys/mbuf.h>
39#include <sys/module.h>
40#include <machine/bus.h>
41#include <sys/rman.h>
42#include <sys/socket.h>
43#include <sys/sockio.h>
44#include <sys/sysctl.h>
45
46#include <net/if.h>
47#include <net/if_clone.h>
48#include <net/if_types.h>
49#include <net/pfil.h>
50#include <net/route.h>
51#include <net/netisr.h>
52#include <net/bpf.h>
53#include <net/vnet.h>
54
55#include <netinet/in.h>
56#include <netinet/in_systm.h>
57#include <netinet/ip.h>
58#include <netinet/ip_var.h>
59#include <netinet/in_var.h>
60
61#ifdef INET6
62#include <netinet/ip6.h>
63#include <netinet6/ip6_var.h>
64#endif
65
66#include <netipsec/ipsec.h>
67#include <netipsec/xform.h>
68
69#define ENCMTU		(1024+512)
70
71/* XXX this define must have the same value as in OpenBSD */
72#define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
73#define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
74#define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
75
76struct enchdr {
77	u_int32_t af;
78	u_int32_t spi;
79	u_int32_t flags;
80};
81
82struct ifnet	*encif;
83static struct mtx	enc_mtx;
84
85struct enc_softc {
86	struct	ifnet *sc_ifp;
87};
88
89static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
90static int	enc_output(struct ifnet *ifp, struct mbuf *m,
91		    const struct sockaddr *dst, struct route *ro);
92static int	enc_clone_create(struct if_clone *, int, caddr_t);
93static void	enc_clone_destroy(struct ifnet *);
94static struct if_clone *enc_cloner;
95static const char encname[] = "enc";
96
97/*
98 * Sysctls.
99 */
100
101/*
102 * Before and after are relative to when we are stripping the
103 * outer IP header.
104 */
105static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
106
107static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
108static int ipsec_filter_mask_in = ENC_BEFORE;
109SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
110	&ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
111static int ipsec_bpf_mask_in = ENC_BEFORE;
112SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
113	&ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
114
115static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
116static int ipsec_filter_mask_out = ENC_BEFORE;
117SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
118	&ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
119static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
120SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
121	&ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
122
123static void
124enc_clone_destroy(struct ifnet *ifp)
125{
126	KASSERT(ifp != encif, ("%s: destroying encif", __func__));
127
128	bpfdetach(ifp);
129	if_detach(ifp);
130	if_free(ifp);
131}
132
133static int
134enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
135{
136	struct ifnet *ifp;
137	struct enc_softc *sc;
138
139	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
140	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
141	if (ifp == NULL) {
142		free(sc, M_DEVBUF);
143		return (ENOSPC);
144	}
145
146	if_initname(ifp, encname, unit);
147	ifp->if_mtu = ENCMTU;
148	ifp->if_ioctl = enc_ioctl;
149	ifp->if_output = enc_output;
150	ifp->if_snd.ifq_maxlen = ifqmaxlen;
151	ifp->if_softc = sc;
152	if_attach(ifp);
153	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
154
155	mtx_lock(&enc_mtx);
156	/* grab a pointer to enc0, ignore the rest */
157	if (encif == NULL)
158		encif = ifp;
159	mtx_unlock(&enc_mtx);
160
161	return (0);
162}
163
164static int
165enc_modevent(module_t mod, int type, void *data)
166{
167	switch (type) {
168	case MOD_LOAD:
169		mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
170		enc_cloner = if_clone_simple(encname, enc_clone_create,
171		    enc_clone_destroy, 1);
172		break;
173	case MOD_UNLOAD:
174		printf("enc module unload - not possible for this module\n");
175		return (EINVAL);
176	default:
177		return (EOPNOTSUPP);
178	}
179	return (0);
180}
181
182static moduledata_t enc_mod = {
183	"if_enc",
184	enc_modevent,
185	0
186};
187
188DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
189
190static int
191enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
192    struct route *ro)
193{
194	m_freem(m);
195	return (0);
196}
197
198/*
199 * Process an ioctl request.
200 */
201/* ARGSUSED */
202static int
203enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
204{
205	int error = 0;
206
207	mtx_lock(&enc_mtx);
208
209	switch (cmd) {
210
211	case SIOCSIFFLAGS:
212		if (ifp->if_flags & IFF_UP)
213			ifp->if_drv_flags |= IFF_DRV_RUNNING;
214		else
215			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
216
217		break;
218
219	default:
220		error = EINVAL;
221	}
222
223	mtx_unlock(&enc_mtx);
224	return (error);
225}
226
227int
228ipsec_filter(struct mbuf **mp, int dir, int flags)
229{
230	int error, i;
231	struct ip *ip;
232
233	KASSERT(encif != NULL, ("%s: encif is null", __func__));
234	KASSERT(flags & (ENC_IN|ENC_OUT),
235		("%s: invalid flags: %04x", __func__, flags));
236
237	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
238		return (0);
239
240	if (flags & ENC_IN) {
241		if ((flags & ipsec_filter_mask_in) == 0)
242			return (0);
243	} else {
244		if ((flags & ipsec_filter_mask_out) == 0)
245			return (0);
246	}
247
248	/* Skip pfil(9) if no filters are loaded */
249	if (1
250#ifdef INET
251	    && !PFIL_HOOKED(&V_inet_pfil_hook)
252#endif
253#ifdef INET6
254	    && !PFIL_HOOKED(&V_inet6_pfil_hook)
255#endif
256	    ) {
257		return (0);
258	}
259
260	i = min((*mp)->m_pkthdr.len, max_protohdr);
261	if ((*mp)->m_len < i) {
262		*mp = m_pullup(*mp, i);
263		if (*mp == NULL) {
264			printf("%s: m_pullup failed\n", __func__);
265			return (-1);
266		}
267	}
268
269	error = 0;
270	ip = mtod(*mp, struct ip *);
271	switch (ip->ip_v) {
272#ifdef INET
273		case 4:
274			error = pfil_run_hooks(&V_inet_pfil_hook, mp,
275			    encif, dir, NULL);
276			break;
277#endif
278#ifdef INET6
279		case 6:
280			error = pfil_run_hooks(&V_inet6_pfil_hook, mp,
281			    encif, dir, NULL);
282			break;
283#endif
284		default:
285			printf("%s: unknown IP version\n", __func__);
286	}
287
288	/*
289	 * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
290	 * then error will be zero but we still want to return an error to our
291	 * caller so the null mbuf isn't forwarded further.
292	 */
293	if (*mp == NULL && error == 0)
294		return (-1);	/* Consumed by the filter */
295	if (*mp == NULL)
296		return (error);
297	if (error != 0)
298		goto bad;
299
300	return (error);
301
302bad:
303	m_freem(*mp);
304	*mp = NULL;
305	return (error);
306}
307
308void
309ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
310{
311	int mflags;
312	struct enchdr hdr;
313
314	KASSERT(encif != NULL, ("%s: encif is null", __func__));
315	KASSERT(flags & (ENC_IN|ENC_OUT),
316		("%s: invalid flags: %04x", __func__, flags));
317
318	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
319		return;
320
321	if (flags & ENC_IN) {
322		if ((flags & ipsec_bpf_mask_in) == 0)
323			return;
324	} else {
325		if ((flags & ipsec_bpf_mask_out) == 0)
326			return;
327	}
328
329	if (bpf_peers_present(encif->if_bpf)) {
330		mflags = 0;
331		hdr.spi = 0;
332		if (!sav) {
333			struct m_tag *mtag;
334			mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
335			if (mtag != NULL) {
336				struct tdb_ident *tdbi;
337				tdbi = (struct tdb_ident *) (mtag + 1);
338				if (tdbi->alg_enc != SADB_EALG_NONE)
339					mflags |= M_CONF;
340				if (tdbi->alg_auth != SADB_AALG_NONE)
341					mflags |= M_AUTH;
342				hdr.spi = tdbi->spi;
343			}
344		} else {
345			if (sav->alg_enc != SADB_EALG_NONE)
346				mflags |= M_CONF;
347			if (sav->alg_auth != SADB_AALG_NONE)
348				mflags |= M_AUTH;
349			hdr.spi = sav->spi;
350		}
351
352		/*
353		 * We need to prepend the address family as a four byte
354		 * field.  Cons up a dummy header to pacify bpf.  This
355		 * is safe because bpf will only read from the mbuf
356		 * (i.e., it won't try to free it or keep a pointer a
357		 * to it).
358		 */
359		hdr.af = af;
360		/* hdr.spi already set above */
361		hdr.flags = mflags;
362
363		bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
364	}
365}
366