2 * Copyright (c) 2006 The FreeBSD Project.
3 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 #include "opt_inet6.h"
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/hhook.h>
37 #include <sys/kernel.h>
38 #include <sys/malloc.h>
40 #include <sys/module.h>
41 #include <machine/bus.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/sysctl.h>
48 #include <net/if_enc.h>
49 #include <net/if_var.h>
50 #include <net/if_clone.h>
51 #include <net/if_types.h>
53 #include <net/route.h>
54 #include <net/netisr.h>
58 #include <netinet/in.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/ip.h>
61 #include <netinet/ip_var.h>
62 #include <netinet/in_var.h>
65 #include <netinet/ip6.h>
66 #include <netinet6/ip6_var.h>
69 #include <netipsec/ipsec.h>
70 #include <netipsec/xform.h>
72 #define ENCMTU (1024+512)
74 /* XXX this define must have the same value as in OpenBSD */
75 #define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */
76 #define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */
77 #define M_AUTH_AH 0x2000 /* header was authenticated (AH) */
87 static VNET_DEFINE(struct enc_softc
*, enc_sc
);
88 #define V_enc_sc VNET(enc_sc)
89 static VNET_DEFINE(struct if_clone
*, enc_cloner
);
90 #define V_enc_cloner VNET(enc_cloner)
92 static int enc_ioctl(struct ifnet
*, u_long
, caddr_t
);
93 static int enc_output(struct ifnet
*, struct mbuf
*,
94 const struct sockaddr
*, struct route
*);
95 static int enc_clone_create(struct if_clone
*, int, caddr_t
);
96 static void enc_clone_destroy(struct ifnet
*);
97 static int enc_add_hhooks(struct enc_softc
*);
98 static void enc_remove_hhooks(struct enc_softc
*);
100 static const char encname
[] = "enc";
103 * Before and after are relative to when we are stripping the
106 static VNET_DEFINE(int, filter_mask_in
) = IPSEC_ENC_BEFORE
;
107 static VNET_DEFINE(int, bpf_mask_in
) = IPSEC_ENC_BEFORE
;
108 static VNET_DEFINE(int, filter_mask_out
) = IPSEC_ENC_BEFORE
;
109 static VNET_DEFINE(int, bpf_mask_out
) = IPSEC_ENC_BEFORE
| IPSEC_ENC_AFTER
;
110 #define V_filter_mask_in VNET(filter_mask_in)
111 #define V_bpf_mask_in VNET(bpf_mask_in)
112 #define V_filter_mask_out VNET(filter_mask_out)
113 #define V_bpf_mask_out VNET(bpf_mask_out)
115 static SYSCTL_NODE(_net
, OID_AUTO
, enc
, CTLFLAG_RW
, 0, "enc sysctl");
116 static SYSCTL_NODE(_net_enc
, OID_AUTO
, in
, CTLFLAG_RW
, 0, "enc input sysctl");
117 static SYSCTL_NODE(_net_enc
, OID_AUTO
, out
, CTLFLAG_RW
, 0, "enc output sysctl");
118 SYSCTL_INT(_net_enc_in
, OID_AUTO
, ipsec_filter_mask
,
119 CTLFLAG_RW
| CTLFLAG_VNET
, &VNET_NAME(filter_mask_in
), 0,
120 "IPsec input firewall filter mask");
121 SYSCTL_INT(_net_enc_in
, OID_AUTO
, ipsec_bpf_mask
,
122 CTLFLAG_RW
| CTLFLAG_VNET
, &VNET_NAME(bpf_mask_in
), 0,
123 "IPsec input bpf mask");
124 SYSCTL_INT(_net_enc_out
, OID_AUTO
, ipsec_filter_mask
,
125 CTLFLAG_RW
| CTLFLAG_VNET
, &VNET_NAME(filter_mask_out
), 0,
126 "IPsec output firewall filter mask");
127 SYSCTL_INT(_net_enc_out
, OID_AUTO
, ipsec_bpf_mask
,
128 CTLFLAG_RW
| CTLFLAG_VNET
, &VNET_NAME(bpf_mask_out
), 0,
129 "IPsec output bpf mask");
132 enc_clone_destroy(struct ifnet
*ifp
)
134 struct enc_softc
*sc
;
137 KASSERT(sc
== V_enc_sc
, ("sc != ifp->if_softc"));
139 enc_remove_hhooks(sc
);
148 enc_clone_create(struct if_clone
*ifc
, int unit
, caddr_t params
)
151 struct enc_softc
*sc
;
153 sc
= malloc(sizeof(struct enc_softc
), M_DEVBUF
,
155 ifp
= sc
->sc_ifp
= if_alloc(IFT_ENC
);
160 if (V_enc_sc
!= NULL
) {
166 if_initname(ifp
, encname
, unit
);
167 ifp
->if_mtu
= ENCMTU
;
168 ifp
->if_ioctl
= enc_ioctl
;
169 ifp
->if_output
= enc_output
;
172 bpfattach(ifp
, DLT_ENC
, sizeof(struct enchdr
));
173 if (enc_add_hhooks(sc
) != 0) {
174 enc_clone_destroy(ifp
);
181 enc_output(struct ifnet
*ifp
, struct mbuf
*m
, const struct sockaddr
*dst
,
190 enc_ioctl(struct ifnet
*ifp
, u_long cmd
, caddr_t data
)
193 if (cmd
!= SIOCSIFFLAGS
)
195 if (ifp
->if_flags
& IFF_UP
)
196 ifp
->if_drv_flags
|= IFF_DRV_RUNNING
;
198 ifp
->if_drv_flags
&= ~IFF_DRV_RUNNING
;
203 * One helper hook function is used by any hook points.
204 * + from hhook_type we can determine the packet direction:
205 * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
206 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
207 * + udata contains pointer to enc_softc;
208 * + ctx_data contains pointer to struct ipsec_ctx_data.
211 enc_hhook(int32_t hhook_type
, int32_t hhook_id
, void *udata
, void *ctx_data
,
212 void *hdata
, struct osd
*hosd
)
215 struct ipsec_ctx_data
*ctx
;
216 struct enc_softc
*sc
;
217 struct ifnet
*ifp
, *rcvif
;
218 struct pfil_head
*ph
;
221 sc
= (struct enc_softc
*)udata
;
223 if ((ifp
->if_flags
& IFF_UP
) == 0)
226 ctx
= (struct ipsec_ctx_data
*)ctx_data
;
227 /* XXX: wrong hook point was used by caller? */
228 if (ctx
->af
!= hhook_id
)
229 return (EPFNOSUPPORT
);
231 if (((hhook_type
== HHOOK_TYPE_IPSEC_IN
&&
232 (ctx
->enc
& V_bpf_mask_in
) != 0) ||
233 (hhook_type
== HHOOK_TYPE_IPSEC_OUT
&&
234 (ctx
->enc
& V_bpf_mask_out
) != 0)) &&
235 bpf_peers_present(ifp
->if_bpf
) != 0) {
237 hdr
.spi
= ctx
->sav
->spi
;
239 if (ctx
->sav
->alg_enc
!= SADB_EALG_NONE
)
241 if (ctx
->sav
->alg_auth
!= SADB_AALG_NONE
)
243 bpf_mtap2(ifp
->if_bpf
, &hdr
, sizeof(hdr
), *ctx
->mp
);
246 switch (hhook_type
) {
247 case HHOOK_TYPE_IPSEC_IN
:
248 if (ctx
->enc
== IPSEC_ENC_BEFORE
) {
249 /* Do accounting only once */
250 if_inc_counter(ifp
, IFCOUNTER_IPACKETS
, 1);
251 if_inc_counter(ifp
, IFCOUNTER_IBYTES
,
252 (*ctx
->mp
)->m_pkthdr
.len
);
254 if ((ctx
->enc
& V_filter_mask_in
) == 0)
255 return (0); /* skip pfil processing */
258 case HHOOK_TYPE_IPSEC_OUT
:
259 if (ctx
->enc
== IPSEC_ENC_BEFORE
) {
260 /* Do accounting only once */
261 if_inc_counter(ifp
, IFCOUNTER_OPACKETS
, 1);
262 if_inc_counter(ifp
, IFCOUNTER_OBYTES
,
263 (*ctx
->mp
)->m_pkthdr
.len
);
265 if ((ctx
->enc
& V_filter_mask_out
) == 0)
266 return (0); /* skip pfil processing */
276 ph
= &V_inet_pfil_hook
;
281 ph
= &V_inet6_pfil_hook
;
287 if (ph
== NULL
|| !PFIL_HOOKED(ph
))
289 /* Make a packet looks like it was received on enc(4) */
290 rcvif
= (*ctx
->mp
)->m_pkthdr
.rcvif
;
291 (*ctx
->mp
)->m_pkthdr
.rcvif
= ifp
;
292 if (pfil_run_hooks(ph
, ctx
->mp
, ifp
, pdir
, NULL
) != 0 ||
294 *ctx
->mp
= NULL
; /* consumed by filter */
297 (*ctx
->mp
)->m_pkthdr
.rcvif
= rcvif
;
302 enc_add_hhooks(struct enc_softc
*sc
)
307 error
= EPFNOSUPPORT
;
308 hki
.hook_func
= enc_hhook
;
309 hki
.hook_helper
= NULL
;
312 hki
.hook_id
= AF_INET
;
313 hki
.hook_type
= HHOOK_TYPE_IPSEC_IN
;
314 error
= hhook_add_hook(V_ipsec_hhh_in
[HHOOK_IPSEC_INET
],
318 hki
.hook_type
= HHOOK_TYPE_IPSEC_OUT
;
319 error
= hhook_add_hook(V_ipsec_hhh_out
[HHOOK_IPSEC_INET
],
325 hki
.hook_id
= AF_INET6
;
326 hki
.hook_type
= HHOOK_TYPE_IPSEC_IN
;
327 error
= hhook_add_hook(V_ipsec_hhh_in
[HHOOK_IPSEC_INET6
],
331 hki
.hook_type
= HHOOK_TYPE_IPSEC_OUT
;
332 error
= hhook_add_hook(V_ipsec_hhh_out
[HHOOK_IPSEC_INET6
],
341 enc_remove_hhooks(struct enc_softc
*sc
)
345 hki
.hook_func
= enc_hhook
;
346 hki
.hook_helper
= NULL
;
349 hki
.hook_id
= AF_INET
;
350 hki
.hook_type
= HHOOK_TYPE_IPSEC_IN
;
351 hhook_remove_hook(V_ipsec_hhh_in
[HHOOK_IPSEC_INET
], &hki
);
352 hki
.hook_type
= HHOOK_TYPE_IPSEC_OUT
;
353 hhook_remove_hook(V_ipsec_hhh_out
[HHOOK_IPSEC_INET
], &hki
);
356 hki
.hook_id
= AF_INET6
;
357 hki
.hook_type
= HHOOK_TYPE_IPSEC_IN
;
358 hhook_remove_hook(V_ipsec_hhh_in
[HHOOK_IPSEC_INET6
], &hki
);
359 hki
.hook_type
= HHOOK_TYPE_IPSEC_OUT
;
360 hhook_remove_hook(V_ipsec_hhh_out
[HHOOK_IPSEC_INET6
], &hki
);
365 vnet_enc_init(const void *unused __unused
)
369 V_enc_cloner
= if_clone_simple(encname
, enc_clone_create
,
370 enc_clone_destroy
, 1);
372 VNET_SYSINIT(vnet_enc_init
, SI_SUB_PROTO_IFATTACHDOMAIN
, SI_ORDER_ANY
,
373 vnet_enc_init
, NULL
);
376 vnet_enc_uninit(const void *unused __unused
)
379 if_clone_detach(V_enc_cloner
);
381 VNET_SYSUNINIT(vnet_enc_uninit
, SI_SUB_PROTO_IFATTACHDOMAIN
, SI_ORDER_ANY
,
382 vnet_enc_uninit
, NULL
);
385 enc_modevent(module_t mod
, int type
, void *data
)
398 static moduledata_t enc_mod
= {
404 DECLARE_MODULE(if_enc
, enc_mod
, SI_SUB_PROTO_IFATTACHDOMAIN
, SI_ORDER_ANY
);