1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2006 The FreeBSD Project.
5 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31#include "opt_inet.h"
32#include "opt_inet6.h"
33#include "opt_ipsec.h"
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/hhook.h>
38#include <sys/kernel.h>
39#include <sys/malloc.h>
40#include <sys/mbuf.h>
41#include <sys/module.h>
42#include <machine/bus.h>
43#include <sys/rman.h>
44#include <sys/socket.h>
45#include <sys/sockio.h>
46#include <sys/sysctl.h>
47
48#include <net/if.h>
49#include <net/if_enc.h>
50#include <net/if_var.h>
51#include <net/if_private.h>
52#include <net/if_clone.h>
53#include <net/if_types.h>
54#include <net/pfil.h>
55#include <net/route.h>
56#include <net/netisr.h>
57#include <net/bpf.h>
58#include <net/vnet.h>
59
60#include <netinet/in.h>
61#include <netinet/in_systm.h>
62#include <netinet/ip.h>
63#include <netinet/ip_var.h>
64#include <netinet/in_var.h>
65
66#ifdef INET6
67#include <netinet/ip6.h>
68#include <netinet6/ip6_var.h>
69#endif
70
71#include <netipsec/ipsec.h>
72#include <netipsec/xform.h>
73
74#define ENCMTU		(1024+512)
75
76/* XXX this define must have the same value as in OpenBSD */
77#define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
78#define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
79#define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
80
81struct enchdr {
82	u_int32_t af;
83	u_int32_t spi;
84	u_int32_t flags;
85};
86struct enc_softc {
87	struct	ifnet *sc_ifp;
88};
89VNET_DEFINE_STATIC(struct enc_softc *, enc_sc);
90#define	V_enc_sc	VNET(enc_sc)
91VNET_DEFINE_STATIC(struct if_clone *, enc_cloner);
92#define	V_enc_cloner	VNET(enc_cloner)
93
94static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
95static int	enc_output(struct ifnet *, struct mbuf *,
96    const struct sockaddr *, struct route *);
97static int	enc_clone_create(struct if_clone *, int, caddr_t);
98static void	enc_clone_destroy(struct ifnet *);
99static int	enc_add_hhooks(struct enc_softc *);
100static void	enc_remove_hhooks(struct enc_softc *);
101
102static const char encname[] = "enc";
103
104#define	IPSEC_ENC_AFTER_PFIL	0x04
105/*
106 * Before and after are relative to when we are stripping the
107 * outer IP header.
108 *
109 * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
110 * after PFIL hook execution. It might be useful when PFIL hook does
111 * some changes to the packet, e.g. address translation. If PFIL hook
112 * consumes mbuf, nothing will be captured.
113 */
114VNET_DEFINE_STATIC(int, filter_mask_in) = IPSEC_ENC_BEFORE;
115VNET_DEFINE_STATIC(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
116VNET_DEFINE_STATIC(int, filter_mask_out) = IPSEC_ENC_BEFORE;
117VNET_DEFINE_STATIC(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
118#define	V_filter_mask_in	VNET(filter_mask_in)
119#define	V_bpf_mask_in		VNET(bpf_mask_in)
120#define	V_filter_mask_out	VNET(filter_mask_out)
121#define	V_bpf_mask_out		VNET(bpf_mask_out)
122
123static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
124    "enc sysctl");
125static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
126    "enc input sysctl");
127static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
128    "enc output sysctl");
129SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
130    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
131    "IPsec input firewall filter mask");
132SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
133    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
134    "IPsec input bpf mask");
135SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
136    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
137    "IPsec output firewall filter mask");
138SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
139    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
140    "IPsec output bpf mask");
141
142static void
143enc_clone_destroy(struct ifnet *ifp)
144{
145	struct enc_softc *sc;
146
147	sc = ifp->if_softc;
148	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
149
150	bpfdetach(ifp);
151	if_detach(ifp);
152	if_free(ifp);
153	free(sc, M_DEVBUF);
154	V_enc_sc = NULL;
155}
156
157static int
158enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
159{
160	struct ifnet *ifp;
161	struct enc_softc *sc;
162
163	sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
164	    M_WAITOK | M_ZERO);
165	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
166	if (ifp == NULL) {
167		free(sc, M_DEVBUF);
168		return (ENOSPC);
169	}
170	if (V_enc_sc != NULL) {
171		if_free(ifp);
172		free(sc, M_DEVBUF);
173		return (EEXIST);
174	}
175	V_enc_sc = sc;
176	if_initname(ifp, encname, unit);
177	ifp->if_mtu = ENCMTU;
178	ifp->if_ioctl = enc_ioctl;
179	ifp->if_output = enc_output;
180	ifp->if_softc = sc;
181	if_attach(ifp);
182	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
183	return (0);
184}
185
186static int
187enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
188    struct route *ro)
189{
190
191	m_freem(m);
192	return (0);
193}
194
195static int
196enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
197{
198
199	if (cmd != SIOCSIFFLAGS)
200		return (EINVAL);
201	if (ifp->if_flags & IFF_UP)
202		ifp->if_drv_flags |= IFF_DRV_RUNNING;
203	else
204		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
205	return (0);
206}
207
208static void
209enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
210    int32_t hhook_type, uint8_t enc, uint8_t af)
211{
212	struct enchdr hdr;
213
214	if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
215	    (enc & V_bpf_mask_in) == 0)
216		return;
217	else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
218	    (enc & V_bpf_mask_out) == 0)
219		return;
220	if (bpf_peers_present(ifp->if_bpf) == 0)
221		return;
222	hdr.af = af;
223	hdr.spi = sav->spi;
224	hdr.flags = 0;
225	if (sav->alg_enc != SADB_EALG_NONE)
226		hdr.flags |= M_CONF;
227	if (sav->alg_auth != SADB_AALG_NONE)
228		hdr.flags |= M_AUTH;
229	bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
230}
231
232/*
233 * One helper hook function is used by any hook points.
234 * + from hhook_type we can determine the packet direction:
235 *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
236 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
237 * + udata contains pointer to enc_softc;
238 * + ctx_data contains pointer to struct ipsec_ctx_data.
239 */
240static int
241enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
242    void *hdata, struct osd *hosd)
243{
244	struct ipsec_ctx_data *ctx;
245	struct enc_softc *sc;
246	struct ifnet *ifp, *rcvif;
247	struct pfil_head *ph;
248	int pdir, ret;
249
250	sc = (struct enc_softc *)udata;
251	ifp = sc->sc_ifp;
252	if ((ifp->if_flags & IFF_UP) == 0)
253		return (0);
254
255	ctx = (struct ipsec_ctx_data *)ctx_data;
256	/* XXX: wrong hook point was used by caller? */
257	if (ctx->af != hhook_id)
258		return (EPFNOSUPPORT);
259
260	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
261	switch (hhook_type) {
262	case HHOOK_TYPE_IPSEC_IN:
263		if (ctx->enc == IPSEC_ENC_BEFORE) {
264			/* Do accounting only once */
265			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
266			if_inc_counter(ifp, IFCOUNTER_IBYTES,
267			    (*ctx->mp)->m_pkthdr.len);
268		}
269		if ((ctx->enc & V_filter_mask_in) == 0)
270			return (0); /* skip pfil processing */
271		pdir = PFIL_IN;
272		break;
273	case HHOOK_TYPE_IPSEC_OUT:
274		if (ctx->enc == IPSEC_ENC_BEFORE) {
275			/* Do accounting only once */
276			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
277			if_inc_counter(ifp, IFCOUNTER_OBYTES,
278			    (*ctx->mp)->m_pkthdr.len);
279		}
280		if ((ctx->enc & V_filter_mask_out) == 0)
281			return (0); /* skip pfil processing */
282		pdir = PFIL_OUT;
283		break;
284	default:
285		return (EINVAL);
286	}
287
288	switch (hhook_id) {
289#ifdef INET
290	case AF_INET:
291		ph = V_inet_pfil_head;
292		break;
293#endif
294#ifdef INET6
295	case AF_INET6:
296		ph = V_inet6_pfil_head;
297		break;
298#endif
299	default:
300		ph = NULL;
301	}
302	if (ph == NULL || (pdir == PFIL_OUT && !PFIL_HOOKED_OUT(ph)) ||
303	    (pdir == PFIL_IN && !PFIL_HOOKED_IN(ph)))
304		return (0);
305	/* Make a packet looks like it was received on enc(4) */
306	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
307	(*ctx->mp)->m_pkthdr.rcvif = ifp;
308	if (pdir == PFIL_IN)
309		ret = pfil_mbuf_in(ph, ctx->mp, ifp, ctx->inp);
310	else
311		ret = pfil_mbuf_out(ph, ctx->mp, ifp, ctx->inp);
312	if (ret != PFIL_PASS) {
313		*ctx->mp = NULL; /* consumed by filter */
314		return (EACCES);
315	}
316	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
317	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
318	    IPSEC_ENC_AFTER_PFIL, ctx->af);
319	return (0);
320}
321
322static int
323enc_add_hhooks(struct enc_softc *sc)
324{
325	struct hookinfo hki;
326	int error;
327
328	error = EPFNOSUPPORT;
329	hki.hook_func = enc_hhook;
330	hki.hook_helper = NULL;
331	hki.hook_udata = sc;
332#ifdef INET
333	hki.hook_id = AF_INET;
334	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
335	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
336	    &hki, HHOOK_WAITOK);
337	if (error != 0)
338		return (error);
339	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
340	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
341	    &hki, HHOOK_WAITOK);
342	if (error != 0)
343		return (error);
344#endif
345#ifdef INET6
346	hki.hook_id = AF_INET6;
347	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
348	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
349	    &hki, HHOOK_WAITOK);
350	if (error != 0)
351		return (error);
352	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
353	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
354	    &hki, HHOOK_WAITOK);
355	if (error != 0)
356		return (error);
357#endif
358	return (error);
359}
360
361static void
362enc_remove_hhooks(struct enc_softc *sc)
363{
364	struct hookinfo hki;
365
366	hki.hook_func = enc_hhook;
367	hki.hook_helper = NULL;
368	hki.hook_udata = sc;
369#ifdef INET
370	hki.hook_id = AF_INET;
371	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
372	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
373	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
374	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
375#endif
376#ifdef INET6
377	hki.hook_id = AF_INET6;
378	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
379	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
380	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
381	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
382#endif
383}
384
385static void
386vnet_enc_init(const void *unused __unused)
387{
388
389	V_enc_sc = NULL;
390	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
391	    enc_clone_destroy, 1);
392}
393VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
394    vnet_enc_init, NULL);
395
396static void
397vnet_enc_init_proto(void *unused __unused)
398{
399	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
400
401	if (enc_add_hhooks(V_enc_sc) != 0)
402		enc_clone_destroy(V_enc_sc->sc_ifp);
403}
404VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
405    vnet_enc_init_proto, NULL);
406
407static void
408vnet_enc_uninit(const void *unused __unused)
409{
410	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
411
412	if_clone_detach(V_enc_cloner);
413}
414VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
415    vnet_enc_uninit, NULL);
416
417/*
418 * The hhook consumer needs to go before ip[6]_destroy are called on
419 * SI_ORDER_THIRD.
420 */
421static void
422vnet_enc_uninit_hhook(const void *unused __unused)
423{
424	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
425
426	enc_remove_hhooks(V_enc_sc);
427}
428VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
429    vnet_enc_uninit_hhook, NULL);
430
431static int
432enc_modevent(module_t mod, int type, void *data)
433{
434
435	switch (type) {
436	case MOD_LOAD:
437	case MOD_UNLOAD:
438		break;
439	default:
440		return (EOPNOTSUPP);
441	}
442	return (0);
443}
444
445static moduledata_t enc_mod = {
446	"if_enc",
447	enc_modevent,
448	0
449};
450
451DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
452MODULE_VERSION(if_enc, 1);
453