sys/netipsec/ipsec_input.c

   1 /*      $NetBSD: ipsec_input.c,v 1.22 2009/03/18 17:06:52 cegger Exp $  */
   2 /*      $FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $ */
   3 /*      $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $        */
   4
   5 /*
   6  * The authors of this code are John Ioannidis (ji@tla.org),
   7  * Angelos D. Keromytis (kermit@csd.uch.gr) and
   8  * Niels Provos (provos@physnet.uni-hamburg.de).
   9  *
  10  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
  11  * in November 1995.
  12  *
  13  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  14  * by Angelos D. Keromytis.
  15  *
  16  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  17  * and Niels Provos.
  18  *
  19  * Additional features in 1999 by Angelos D. Keromytis.
  20  *
  21  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
  22  * Angelos D. Keromytis and Niels Provos.
  23  * Copyright (c) 2001, Angelos D. Keromytis.
  24  *
  25  * Permission to use, copy, and modify this software with or without fee
  26  * is hereby granted, provided that this entire notice is included in
  27  * all copies of any software which is or includes a copy or
  28  * modification of this software.
  29  * You may use this code under the GNU public license if you so wish. Please
  30  * contribute changes back to the authors under this freer than GPL license
  31  * so that we may further the use of strong encryption without limitations to
  32  * all.
  33  *
  34  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  35  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  36  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  37  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  38  * PURPOSE.
  39  */
  40
  41 #include <sys/cdefs.h>
  42 __KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.22 2009/03/18 17:06:52 cegger Exp $");
  43
  44 /*
  45  * IPsec input processing.
  46  */
  47
  48 #include "opt_inet.h"
  49 #ifdef __FreeBSD__
  50 #include "opt_inet6.h"
  51 #endif
  52 #include "opt_ipsec.h"
  53
  54 #include <sys/param.h>
  55 #include <sys/systm.h>
  56 #include <sys/malloc.h>
  57 #include <sys/mbuf.h>
  58 #include <sys/domain.h>
  59 #include <sys/protosw.h>
  60 #include <sys/socket.h>
  61 #include <sys/errno.h>
  62 #include <sys/syslog.h>
  63
  64 #include <net/if.h>
  65 #include <net/route.h>
  66 #include <net/netisr.h>
  67
  68 #include <netinet/in.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/ip.h>
  71 #include <netinet/ip_var.h>
  72 #include <netinet/in_var.h>
  73
  74 #include <netinet/ip6.h>
  75 #ifdef INET6
  76 #include <netinet6/ip6_var.h>
  77 #include <netinet6/ip6_private.h>
  78 #endif
  79 #include <netinet/in_pcb.h>
  80 #ifdef INET6
  81 #include <netinet/icmp6.h>
  82 #endif
  83
  84 #include <netipsec/ipsec.h>
  85 #include <netipsec/ipsec_private.h>
  86 #ifdef INET6
  87 #include <netipsec/ipsec6.h>
  88 #endif
  89 #include <netipsec/ah_var.h>
  90 #include <netipsec/esp.h>
  91 #include <netipsec/esp_var.h>
  92 #include <netipsec/ipcomp_var.h>
  93
  94 #include <netipsec/key.h>
  95 #include <netipsec/keydb.h>
  96
  97 #include <netipsec/xform.h>
  98 #include <netinet6/ip6protosw.h>
  99
 100 #include <netipsec/ipsec_osdep.h>
 101
 102 #include <machine/stdarg.h>
 103
 104 #include <net/net_osdep.h>
 105
 106 #define IPSEC_ISTAT(p, x, y, z)                                         \
 107 do {                                                                    \
 108         switch (p) {                                                    \
 109         case IPPROTO_ESP:                                               \
 110                 ESP_STATINC(x);                                         \
 111                 break;                                                  \
 112         case IPPROTO_AH:                                                \
 113                 AH_STATINC(y);                                          \
 114                 break;                                                  \
 115         default:                                                        \
 116                 IPCOMP_STATINC(z);                                      \
 117                 break;                                                  \
 118         }                                                               \
 119 } while (/*CONSTCOND*/0)
 120
 121 /*
 122  * ipsec_common_input gets called when an IPsec-protected packet
 123  * is received by IPv4 or IPv6.  It's job is to find the right SA
 124  # and call the appropriate transform.  The transform callback
 125  * takes care of further processing (like ingress filtering).
 126  */
 127 static int
 128 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
 129 {
 130         union sockaddr_union dst_address;
 131         struct secasvar *sav;
 132         u_int32_t spi;
 133         u_int16_t sport = 0;
 134         u_int16_t dport = 0;
 135         int s, error;
 136 #ifdef IPSEC_NAT_T
 137         struct m_tag * tag = NULL;
 138 #endif
 139
 140         IPSEC_ISTAT(sproto, ESP_STAT_INPUT, AH_STAT_INPUT,
 141                 IPCOMP_STAT_INPUT);
 142
 143         IPSEC_ASSERT(m != NULL, ("ipsec_common_input: null packet"));
 144
 145         if ((sproto == IPPROTO_ESP && !esp_enable) ||
 146             (sproto == IPPROTO_AH && !ah_enable) ||
 147             (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
 148                 m_freem(m);
 149                 IPSEC_ISTAT(sproto, ESP_STAT_PDROPS, AH_STAT_PDROPS,
 150                     IPCOMP_STAT_PDROPS);
 151                 return EOPNOTSUPP;
 152         }
 153
 154         if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
 155                 m_freem(m);
 156                 IPSEC_ISTAT(sproto, ESP_STAT_HDROPS, AH_STAT_HDROPS,
 157                     IPCOMP_STAT_HDROPS);
 158                 DPRINTF(("ipsec_common_input: packet too small\n"));
 159                 return EINVAL;
 160         }
 161
 162         /* Retrieve the SPI from the relevant IPsec header */
 163         if (sproto == IPPROTO_ESP)
 164                 m_copydata(m, skip, sizeof(u_int32_t), &spi);
 165         else if (sproto == IPPROTO_AH)
 166                 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), &spi);
 167         else if (sproto == IPPROTO_IPCOMP) {
 168                 u_int16_t cpi;
 169                 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), &cpi);
 170                 spi = ntohl(htons(cpi));
 171         } else {
 172                 panic("ipsec_common_input called with bad protocol number :"
 173                       "%d\n", sproto);
 174         }
 175
 176
 177 #ifdef IPSEC_NAT_T
 178         /* find the source port for NAT-T */
 179         if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) {
 180                 sport = ((u_int16_t *)(tag + 1))[0];
 181                 dport = ((u_int16_t *)(tag + 1))[1];
 182         }
 183 #endif
 184
 185         /*
 186          * Find the SA and (indirectly) call the appropriate
 187          * kernel crypto routine. The resulting mbuf chain is a valid
 188          * IP packet ready to go through input processing.
 189          */
 190         memset(&dst_address, 0, sizeof (dst_address));
 191         dst_address.sa.sa_family = af;
 192         switch (af) {
 193 #ifdef INET
 194         case AF_INET:
 195                 dst_address.sin.sin_len = sizeof(struct sockaddr_in);
 196                 m_copydata(m, offsetof(struct ip, ip_dst),
 197                     sizeof(struct in_addr),
 198                     &dst_address.sin.sin_addr);
 199                 break;
 200 #endif /* INET */
 201 #ifdef INET6
 202         case AF_INET6:
 203                 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
 204                 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
 205                     sizeof(struct in6_addr),
 206                     &dst_address.sin6.sin6_addr);
 207                 break;
 208 #endif /* INET6 */
 209         default:
 210                 DPRINTF(("ipsec_common_input: unsupported protocol "
 211                         "family %u\n", af));
 212                 m_freem(m);
 213                 IPSEC_ISTAT(sproto, ESP_STAT_NOPF, AH_STAT_NOPF,
 214                     IPCOMP_STAT_NOPF);
 215                 return EPFNOSUPPORT;
 216         }
 217
 218         s = splsoftnet();
 219
 220         /* NB: only pass dst since key_allocsa follows RFC2401 */
 221         sav = KEY_ALLOCSA(&dst_address, sproto, spi, sport, dport);
 222         if (sav == NULL) {
 223                 DPRINTF(("ipsec_common_input: no key association found for"
 224                           " SA %s/%08lx/%u/%u\n",
 225                           ipsec_address(&dst_address),
 226                           (u_long) ntohl(spi), sproto, ntohs(dport)));
 227                 IPSEC_ISTAT(sproto, ESP_STAT_NOTDB, AH_STAT_NOTDB,
 228                     IPCOMP_STAT_NOTDB);
 229                 splx(s);
 230                 m_freem(m);
 231                 return ENOENT;
 232         }
 233
 234         if (sav->tdb_xform == NULL) {
 235                 DPRINTF(("ipsec_common_input: attempted to use uninitialized"
 236                          " SA %s/%08lx/%u\n",
 237                          ipsec_address(&dst_address),
 238                          (u_long) ntohl(spi), sproto));
 239                 IPSEC_ISTAT(sproto, ESP_STAT_NOXFORM, AH_STAT_NOXFORM,
 240                     IPCOMP_STAT_NOXFORM);
 241                 KEY_FREESAV(&sav);
 242                 splx(s);
 243                 m_freem(m);
 244                 return ENXIO;
 245         }
 246
 247         /*
 248          * Call appropriate transform and return -- callback takes care of
 249          * everything else.
 250          */
 251         error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
 252         KEY_FREESAV(&sav);
 253         splx(s);
 254         return error;
 255 }
 256
 257 #ifdef INET
 258 /*
 259  * Common input handler for IPv4 AH, ESP, and IPCOMP.
 260  */
 261 void
 262 ipsec4_common_input(struct mbuf *m, ...)
 263 {
 264         va_list ap;
 265         int off, nxt;
 266
 267         va_start(ap, m);
 268         off = va_arg(ap, int);
 269         nxt = va_arg(ap, int);
 270         va_end(ap);
 271
 272         (void) ipsec_common_input(m, off, offsetof(struct ip, ip_p),
 273                                   AF_INET, nxt);
 274 }
 275
 276 /*
 277  * IPsec input callback for INET protocols.
 278  * This routine is called as the transform callback.
 279  * Takes care of filtering and other sanity checks on
 280  * the processed packet.
 281  */
 282 int
 283 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
 284     int skip, int protoff, struct m_tag *mt)
 285 {
 286         int prot, af, sproto;
 287         struct ip *ip;
 288         struct m_tag *mtag;
 289         struct tdb_ident *tdbi;
 290         struct secasindex *saidx;
 291         int error;
 292
 293         IPSEC_SPLASSERT_SOFTNET("ipsec4_common_input_cb");
 294
 295         IPSEC_ASSERT(m != NULL, ("ipsec4_common_input_cb: null mbuf"));
 296         IPSEC_ASSERT(sav != NULL, ("ipsec4_common_input_cb: null SA"));
 297         IPSEC_ASSERT(sav->sah != NULL, ("ipsec4_common_input_cb: null SAH"));
 298         saidx = &sav->sah->saidx;
 299         af = saidx->dst.sa.sa_family;
 300         IPSEC_ASSERT(af == AF_INET, ("ipsec4_common_input_cb: unexpected af %u",af));
 301         sproto = saidx->proto;
 302         IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
 303                 sproto == IPPROTO_IPCOMP,
 304                 ("ipsec4_common_input_cb: unexpected security protocol %u",
 305                 sproto));
 306
 307         /* Sanity check */
 308         if (m == NULL) {
 309                 DPRINTF(("ipsec4_common_input_cb: null mbuf"));
 310                 IPSEC_ISTAT(sproto, ESP_STAT_BADKCR, AH_STAT_BADKCR,
 311                     IPCOMP_STAT_BADKCR);
 312                 KEY_FREESAV(&sav);
 313                 return EINVAL;
 314         }
 315
 316         if (skip != 0) {
 317                 /* Fix IPv4 header */
 318                 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
 319                         DPRINTF(("ipsec4_common_input_cb: processing failed "
 320                             "for SA %s/%08lx\n",
 321                             ipsec_address(&sav->sah->saidx.dst),
 322                             (u_long) ntohl(sav->spi)));
 323                         IPSEC_ISTAT(sproto, ESP_STAT_HDROPS, AH_STAT_HDROPS,
 324                             IPCOMP_STAT_HDROPS);
 325                         error = ENOBUFS;
 326                         goto bad;
 327                 }
 328
 329                 ip = mtod(m, struct ip *);
 330                 ip->ip_len = htons(m->m_pkthdr.len);
 331 #ifdef __FreeBSD__
 332                 /* On FreeBSD, ip_off and ip_len assumed in host endian. */
 333                 ip->ip_off = htons(ip->ip_off);
 334 #endif
 335                 ip->ip_sum = 0;
 336                 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
 337         } else {
 338                 ip = mtod(m, struct ip *);
 339         }
 340         prot = ip->ip_p;
 341
 342         /* IP-in-IP encapsulation */
 343         if (prot == IPPROTO_IPIP) {
 344                 struct ip ipn;
 345
 346                 /* ipn will now contain the inner IPv4 header */
 347                 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), &ipn);
 348
 349 #ifdef notyet
 350                 /* XXX PROXY address isn't recorded in SAH */
 351                 /*
 352                  * Check that the inner source address is the same as
 353                  * the proxy address, if available.
 354                  */
 355                 if ((saidx->proxy.sa.sa_family == AF_INET &&
 356                     saidx->proxy.sin.sin_addr.s_addr !=
 357                     INADDR_ANY &&
 358                     ipn.ip_src.s_addr !=
 359                     saidx->proxy.sin.sin_addr.s_addr) ||
 360                     (saidx->proxy.sa.sa_family != AF_INET &&
 361                         saidx->proxy.sa.sa_family != 0)) {
 362
 363                         DPRINTF(("ipsec4_common_input_cb: inner "
 364                             "source address %s doesn't correspond to "
 365                             "expected proxy source %s, SA %s/%08lx\n",
 366                             inet_ntoa4(ipn.ip_src),
 367                             ipsp_address(saidx->proxy),
 368                             ipsp_address(saidx->dst),
 369                             (u_long) ntohl(sav->spi)));
 370
 371                         IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 372                             AH_STAT_PDROPS,
 373                             IPCOMP_STAT_PDROPS);
 374                         error = EACCES;
 375                         goto bad;
 376                 }
 377 #endif /*XXX*/
 378         }
 379 #if INET6
 380         /* IPv6-in-IP encapsulation. */
 381         if (prot == IPPROTO_IPV6) {
 382                 struct ip6_hdr ip6n;
 383
 384                 /* ip6n will now contain the inner IPv6 header. */
 385                 m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), &ip6n);
 386
 387 #ifdef notyet
 388                 /*
 389                  * Check that the inner source address is the same as
 390                  * the proxy address, if available.
 391                  */
 392                 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
 393                     !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
 394                     !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
 395                         &saidx->proxy.sin6.sin6_addr)) ||
 396                     (saidx->proxy.sa.sa_family != AF_INET6 &&
 397                         saidx->proxy.sa.sa_family != 0)) {
 398
 399                         DPRINTF(("ipsec4_common_input_cb: inner "
 400                             "source address %s doesn't correspond to "
 401                             "expected proxy source %s, SA %s/%08lx\n",
 402                             ip6_sprintf(&ip6n.ip6_src),
 403                             ipsec_address(&saidx->proxy),
 404                             ipsec_address(&saidx->dst),
 405                             (u_long) ntohl(sav->spi)));
 406
 407                         IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 408                             AH_STAT_PDROPS,
 409                             IPCOMP_STAT_PDROPS);
 410                         error = EACCES;
 411                         goto bad;
 412                 }
 413 #endif /*XXX*/
 414         }
 415 #endif /* INET6 */
 416
 417         /*
 418          * Record what we've done to the packet (under what SA it was
 419          * processed). If we've been passed an mtag, it means the packet
 420          * was already processed by an ethernet/crypto combo card and
 421          * thus has a tag attached with all the right information, but
 422          * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
 423          * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
 424          */
 425         if (mt == NULL && sproto != IPPROTO_IPCOMP) {
 426                 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 427                     sizeof(struct tdb_ident), M_NOWAIT);
 428                 if (mtag == NULL) {
 429                         DPRINTF(("ipsec4_common_input_cb: failed to get tag\n"));
 430                         IPSEC_ISTAT(sproto, ESP_STAT_HDROPS,
 431                             AH_STAT_HDROPS, IPCOMP_STAT_HDROPS);
 432                         error = ENOMEM;
 433                         goto bad;
 434                 }
 435
 436                 tdbi = (struct tdb_ident *)(mtag + 1);
 437                 memcpy(&tdbi->dst, &saidx->dst, saidx->dst.sa.sa_len);
 438                 tdbi->proto = sproto;
 439                 tdbi->spi = sav->spi;
 440
 441                 m_tag_prepend(m, mtag);
 442         } else {
 443                 if (mt != NULL)
 444                         mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
 445                         /* XXX do we need to mark m_flags??? */
 446         }
 447
 448         key_sa_recordxfer(sav, m);              /* record data transfer */
 449
 450         /*
 451          * Re-dispatch via software interrupt.
 452          */
 453         if (!IF_HANDOFF(&ipintrq, m, NULL)) {
 454                 IPSEC_ISTAT(sproto, ESP_STAT_QFULL, AH_STAT_QFULL,
 455                             IPCOMP_STAT_QFULL);
 456
 457                 DPRINTF(("ipsec4_common_input_cb: queue full; "
 458                         "proto %u packet dropped\n", sproto));
 459                 return ENOBUFS;
 460         }
 461         schednetisr(NETISR_IP);
 462         return 0;
 463 bad:
 464         m_freem(m);
 465         return error;
 466 }
 467 #endif /* INET */
 468
 469 #ifdef INET6
 470 /* IPv6 AH wrapper. */
 471 int
 472 ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
 473 {
 474         int l = 0;
 475         int protoff;
 476         struct ip6_ext ip6e;
 477
 478         if (*offp < sizeof(struct ip6_hdr)) {
 479                 DPRINTF(("ipsec6_common_input: bad offset %u\n", *offp));
 480                 return IPPROTO_DONE;
 481         } else if (*offp == sizeof(struct ip6_hdr)) {
 482                 protoff = offsetof(struct ip6_hdr, ip6_nxt);
 483         } else {
 484                 /* Chase down the header chain... */
 485                 protoff = sizeof(struct ip6_hdr);
 486
 487                 do {
 488                         protoff += l;
 489                         m_copydata(*mp, protoff, sizeof(ip6e), &ip6e);
 490
 491                         if (ip6e.ip6e_nxt == IPPROTO_AH)
 492                                 l = (ip6e.ip6e_len + 2) << 2;
 493                         else
 494                                 l = (ip6e.ip6e_len + 1) << 3;
 495                         IPSEC_ASSERT(l > 0, ("ah6_input: l went zero or negative"));
 496                 } while (protoff + l < *offp);
 497
 498                 /* Malformed packet check */
 499                 if (protoff + l != *offp) {
 500                         DPRINTF(("ipsec6_common_input: bad packet header chain, "
 501                                 "protoff %u, l %u, off %u\n", protoff, l, *offp));
 502                         IPSEC_ISTAT(proto, ESP_STAT_HDROPS,
 503                                     AH_STAT_HDROPS,
 504                                     IPCOMP_STAT_HDROPS);
 505                         m_freem(*mp);
 506                         *mp = NULL;
 507                         return IPPROTO_DONE;
 508                 }
 509                 protoff += offsetof(struct ip6_ext, ip6e_nxt);
 510         }
 511         (void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
 512         return IPPROTO_DONE;
 513 }
 514
 515 /*
 516  * NB: ipsec_netbsd.c has a duplicate definition of esp6_ctlinput(),
 517  * with slightly ore recent multicast tests. These should be merged.
 518  * For now, ifdef accordingly.
 519  */
 520 #ifdef __FreeBSD__
 521 void
 522 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
 523 {
 524         if (sa->sa_family != AF_INET6 ||
 525             sa->sa_len != sizeof(struct sockaddr_in6))
 526                 return;
 527         if ((unsigned)cmd >= PRC_NCMDS)
 528                 return;
 529
 530         /* if the parameter is from icmp6, decode it. */
 531         if (d !=  NULL) {
 532                 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
 533                 struct mbuf *m = ip6cp->ip6c_m;
 534                 int off = ip6cp->ip6c_off;
 535
 536                 struct ip6ctlparam ip6cp1;
 537
 538                 /*
 539                  * Notify the error to all possible sockets via pfctlinput2.
 540                  * Since the upper layer information (such as protocol type,
 541                  * source and destination ports) is embedded in the encrypted
 542                  * data and might have been cut, we can't directly call
 543                  * an upper layer ctlinput function. However, the pcbnotify
 544                  * function will consider source and destination addresses
 545                  * as well as the flow info value, and may be able to find
 546                  * some PCB that should be notified.
 547                  * Although pfctlinput2 will call esp6_ctlinput(), there is
 548                  * no possibility of an infinite loop of function calls,
 549                  * because we don't pass the inner IPv6 header.
 550                  */
 551                 memset(&ip6cp1, 0, sizeof(ip6cp1));
 552                 ip6cp1.ip6c_src = ip6cp->ip6c_src;
 553                 pfctlinput2(cmd, sa, &ip6cp1);
 554
 555                 /*
 556                  * Then go to special cases that need ESP header information.
 557                  * XXX: We assume that when ip6 is non NULL,
 558                  * M and OFF are valid.
 559                  */
 560
 561                 if (cmd == PRC_MSGSIZE) {
 562                         struct secasvar *sav;
 563                         u_int32_t spi;
 564                         int valid;
 565
 566                         /* check header length before using m_copydata */
 567                         if (m->m_pkthdr.len < off + sizeof (struct esp))
 568                                 return;
 569                         m_copydata(m, off + offsetof(struct esp, esp_spi),
 570                                 sizeof(u_int32_t), &spi);
 571                         /*
 572                          * Check to see if we have a valid SA corresponding to
 573                          * the address in the ICMP message payload.
 574                          */
 575                         sav = KEY_ALLOCSA((union sockaddr_union *)sa,
 576                                         IPPROTO_ESP, spi);
 577                         valid = (sav != NULL);
 578                         if (sav)
 579                                 KEY_FREESAV(&sav);
 580
 581                         /* XXX Further validation? */
 582
 583                         /*
 584                          * Depending on whether the SA is "valid" and
 585                          * routing table size (mtudisc_{hi,lo}wat), we will:
 586                          * - recalcurate the new MTU and create the
 587                          *   corresponding routing entry, or
 588                          * - ignore the MTU change notification.
 589                          */
 590                         icmp6_mtudisc_update(ip6cp, valid);
 591                 }
 592         } else {
 593                 /* we normally notify any pcb here */
 594         }
 595 }
 596 #endif /* __FreeBSD__ */
 597
 598 extern  const struct ip6protosw inet6sw[];
 599 extern  u_char ip6_protox[];
 600
 601 /*
 602  * IPsec input callback, called by the transform callback. Takes care of
 603  * filtering and other sanity checks on the processed packet.
 604  */
 605 int
 606 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
 607     struct m_tag *mt)
 608 {
 609         int prot, af, sproto;
 610         struct ip6_hdr *ip6;
 611         struct m_tag *mtag;
 612         struct tdb_ident *tdbi;
 613         struct secasindex *saidx;
 614         int nxt;
 615         u_int8_t nxt8;
 616         int error, nest;
 617
 618         IPSEC_ASSERT(m != NULL, ("ipsec6_common_input_cb: null mbuf"));
 619         IPSEC_ASSERT(sav != NULL, ("ipsec6_common_input_cb: null SA"));
 620         IPSEC_ASSERT(sav->sah != NULL, ("ipsec6_common_input_cb: null SAH"));
 621         saidx = &sav->sah->saidx;
 622         af = saidx->dst.sa.sa_family;
 623         IPSEC_ASSERT(af == AF_INET6,
 624                 ("ipsec6_common_input_cb: unexpected af %u", af));
 625         sproto = saidx->proto;
 626         IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
 627                 sproto == IPPROTO_IPCOMP,
 628                 ("ipsec6_common_input_cb: unexpected security protocol %u",
 629                 sproto));
 630
 631         /* Sanity check */
 632         if (m == NULL) {
 633                 DPRINTF(("ipsec6_common_input_cb: null mbuf"));
 634                 IPSEC_ISTAT(sproto, ESP_STAT_BADKCR, AH_STAT_BADKCR,
 635                     IPCOMP_STAT_BADKCR);
 636                 error = EINVAL;
 637                 goto bad;
 638         }
 639
 640         /* Fix IPv6 header */
 641         if (m->m_len < sizeof(struct ip6_hdr) &&
 642             (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
 643
 644                 DPRINTF(("ipsec6_common_input_cb: processing failed "
 645                     "for SA %s/%08lx\n", ipsec_address(&sav->sah->saidx.dst),
 646                     (u_long) ntohl(sav->spi)));
 647
 648                 IPSEC_ISTAT(sproto, ESP_STAT_HDROPS, AH_STAT_HDROPS,
 649                     IPCOMP_STAT_HDROPS);
 650                 error = EACCES;
 651                 goto bad;
 652         }
 653
 654         ip6 = mtod(m, struct ip6_hdr *);
 655         ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 656
 657         /* Save protocol */
 658         m_copydata(m, protoff, 1, (unsigned char *) &prot);
 659
 660 #ifdef INET
 661         /* IP-in-IP encapsulation */
 662         if (prot == IPPROTO_IPIP) {
 663                 struct ip ipn;
 664
 665                 /* ipn will now contain the inner IPv4 header */
 666                 m_copydata(m, skip, sizeof(struct ip), &ipn);
 667
 668 #ifdef notyet
 669                 /*
 670                  * Check that the inner source address is the same as
 671                  * the proxy address, if available.
 672                  */
 673                 if ((saidx->proxy.sa.sa_family == AF_INET &&
 674                     saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
 675                     ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
 676                     (saidx->proxy.sa.sa_family != AF_INET &&
 677                         saidx->proxy.sa.sa_family != 0)) {
 678
 679                         DPRINTF(("ipsec6_common_input_cb: inner "
 680                             "source address %s doesn't correspond to "
 681                             "expected proxy source %s, SA %s/%08lx\n",
 682                             inet_ntoa4(ipn.ip_src),
 683                             ipsec_address(&saidx->proxy),
 684                             ipsec_address(&saidx->dst),
 685                             (u_long) ntohl(sav->spi)));
 686
 687                         IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 688                             AH_STAT_PDROPS, IPCOMP_STAT_PDROPS);
 689                         error = EACCES;
 690                         goto bad;
 691                 }
 692 #endif /*XXX*/
 693         }
 694 #endif /* INET */
 695
 696         /* IPv6-in-IP encapsulation */
 697         if (prot == IPPROTO_IPV6) {
 698                 struct ip6_hdr ip6n;
 699
 700                 /* ip6n will now contain the inner IPv6 header. */
 701                 m_copydata(m, skip, sizeof(struct ip6_hdr), &ip6n);
 702
 703 #ifdef notyet
 704                 /*
 705                  * Check that the inner source address is the same as
 706                  * the proxy address, if available.
 707                  */
 708                 if ((saidx->proxy.sa.sa_family == AF_INET6 &&
 709                     !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
 710                     !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
 711                         &saidx->proxy.sin6.sin6_addr)) ||
 712                     (saidx->proxy.sa.sa_family != AF_INET6 &&
 713                         saidx->proxy.sa.sa_family != 0)) {
 714
 715                         DPRINTF(("ipsec6_common_input_cb: inner "
 716                             "source address %s doesn't correspond to "
 717                             "expected proxy source %s, SA %s/%08lx\n",
 718                             ip6_sprintf(&ip6n.ip6_src),
 719                             ipsec_address(&saidx->proxy),
 720                             ipsec_address(&saidx->dst),
 721                             (u_long) ntohl(sav->spi)));
 722
 723                         IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 724                             AH_STAT_PDROPS, IPCOMP_STAT_PDROPS);
 725                         error = EACCES;
 726                         goto bad;
 727                 }
 728 #endif /*XXX*/
 729         }
 730
 731         /*
 732          * Record what we've done to the packet (under what SA it was
 733          * processed). If we've been passed an mtag, it means the packet
 734          * was already processed by an ethernet/crypto combo card and
 735          * thus has a tag attached with all the right information, but
 736          * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
 737          * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
 738          */
 739         if (mt == NULL && sproto != IPPROTO_IPCOMP) {
 740                 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 741                     sizeof(struct tdb_ident), M_NOWAIT);
 742                 if (mtag == NULL) {
 743                         DPRINTF(("ipsec_common_input_cb: failed to "
 744                             "get tag\n"));
 745                         IPSEC_ISTAT(sproto, ESP_STAT_HDROPS,
 746                             AH_STAT_HDROPS, IPCOMP_STAT_HDROPS);
 747                         error = ENOMEM;
 748                         goto bad;
 749                 }
 750
 751                 tdbi = (struct tdb_ident *)(mtag + 1);
 752                 memcpy(&tdbi->dst, &saidx->dst, sizeof(union sockaddr_union));
 753                 tdbi->proto = sproto;
 754                 tdbi->spi = sav->spi;
 755
 756                 m_tag_prepend(m, mtag);
 757         } else {
 758                 if (mt != NULL)
 759                         mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
 760                         /* XXX do we need to mark m_flags??? */
 761         }
 762
 763         key_sa_recordxfer(sav, m);
 764
 765         /* Retrieve new protocol */
 766         m_copydata(m, protoff, sizeof(u_int8_t), &nxt8);
 767
 768         /*
 769          * See the end of ip6_input for this logic.
 770          * IPPROTO_IPV[46] case will be processed just like other ones
 771          */
 772         nest = 0;
 773         nxt = nxt8;
 774         while (nxt != IPPROTO_DONE) {
 775                 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
 776                         IP6_STATINC(IP6_STAT_TOOMANYHDR);
 777                         error = EINVAL;
 778                         goto bad;
 779                 }
 780
 781                 /*
 782                  * Protection against faulty packet - there should be
 783                  * more sanity checks in header chain processing.
 784                  */
 785                 if (m->m_pkthdr.len < skip) {
 786                         IP6_STATINC(IP6_STAT_TOOSHORT);
 787                         in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
 788                         error = EINVAL;
 789                         goto bad;
 790                 }
 791                 /*
 792                  * Enforce IPsec policy checking if we are seeing last header.
 793                  * note that we do not visit this with protocols with pcb layer
 794                  * code - like udp/tcp/raw ip.
 795                  */
 796                 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
 797                     ipsec6_in_reject(m, NULL)) {
 798                         error = EINVAL;
 799                         goto bad;
 800                 }
 801                 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
 802         }
 803         return 0;
 804 bad:
 805         if (m)
 806                 m_freem(m);
 807         return error;
 808 }
 809 #endif /* INET6 */