2002-10-16 02:10:08 +00:00
|
|
|
/* $FreeBSD$ */
|
|
|
|
/* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
|
|
|
|
|
2005-01-07 01:45:51 +00:00
|
|
|
/*-
|
2002-10-16 02:10:08 +00:00
|
|
|
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 3. Neither the name of the project nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* IPsec controller part.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "opt_inet.h"
|
|
|
|
#include "opt_inet6.h"
|
|
|
|
#include "opt_ipsec.h"
|
|
|
|
|
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/systm.h>
|
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/mbuf.h>
|
|
|
|
#include <sys/domain.h>
|
2006-11-07 08:58:06 +00:00
|
|
|
#include <sys/priv.h>
|
2002-10-16 02:10:08 +00:00
|
|
|
#include <sys/protosw.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/socketvar.h>
|
|
|
|
#include <sys/errno.h>
|
|
|
|
#include <sys/time.h>
|
|
|
|
#include <sys/kernel.h>
|
|
|
|
#include <sys/syslog.h>
|
|
|
|
#include <sys/sysctl.h>
|
|
|
|
#include <sys/proc.h>
|
|
|
|
|
|
|
|
#include <net/if.h>
|
2013-10-26 17:58:36 +00:00
|
|
|
#include <net/if_var.h>
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
#include <net/vnet.h>
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_systm.h>
|
|
|
|
#include <netinet/ip.h>
|
|
|
|
#include <netinet/ip_var.h>
|
|
|
|
#include <netinet/in_var.h>
|
|
|
|
#include <netinet/udp.h>
|
|
|
|
#include <netinet/udp_var.h>
|
|
|
|
#include <netinet/tcp.h>
|
|
|
|
#include <netinet/udp.h>
|
|
|
|
|
|
|
|
#include <netinet/ip6.h>
|
|
|
|
#ifdef INET6
|
|
|
|
#include <netinet6/ip6_var.h>
|
|
|
|
#endif
|
|
|
|
#include <netinet/in_pcb.h>
|
|
|
|
#ifdef INET6
|
|
|
|
#include <netinet/icmp6.h>
|
|
|
|
#endif
|
|
|
|
|
2007-07-01 11:41:27 +00:00
|
|
|
#include <sys/types.h>
|
2002-10-16 02:10:08 +00:00
|
|
|
#include <netipsec/ipsec.h>
|
|
|
|
#ifdef INET6
|
|
|
|
#include <netipsec/ipsec6.h>
|
|
|
|
#endif
|
|
|
|
#include <netipsec/ah_var.h>
|
|
|
|
#include <netipsec/esp_var.h>
|
|
|
|
#include <netipsec/ipcomp.h> /*XXX*/
|
|
|
|
#include <netipsec/ipcomp_var.h>
|
|
|
|
|
|
|
|
#include <netipsec/key.h>
|
|
|
|
#include <netipsec/keydb.h>
|
|
|
|
#include <netipsec/key_debug.h>
|
|
|
|
|
|
|
|
#include <netipsec/xform.h>
|
|
|
|
|
|
|
|
#include <machine/in_cksum.h>
|
|
|
|
|
2007-03-22 22:25:25 +00:00
|
|
|
#include <opencrypto/cryptodev.h>
|
|
|
|
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
#ifdef IPSEC_DEBUG
|
|
|
|
VNET_DEFINE(int, ipsec_debug) = 1;
|
|
|
|
#else
|
|
|
|
VNET_DEFINE(int, ipsec_debug) = 0;
|
Introduce an infrastructure for dismantling vnet instances.
Vnet modules and protocol domains may now register destructor
functions to clean up and release per-module state. The destructor
mechanisms can be triggered by invoking "vimage -d", or a future
equivalent command which will be provided via the new jail framework.
While this patch introduces numerous placeholder destructor functions,
many of those are currently incomplete, thus leaking memory or (even
worse) failing to stop all running timers. Many of such issues are
already known and will be incrementaly fixed over the next weeks in
smaller incremental commits.
Apart from introducing new fields in structs ifnet, domain, protosw
and vnet_net, which requires the kernel and modules to be rebuilt, this
change should have no impact on nooptions VIMAGE builds, since vnet
destructors can only be called in VIMAGE kernels. Moreover,
destructor functions should be in general compiled in only in
options VIMAGE builds, except for kernel modules which can be safely
kldunloaded at run time.
Bump __FreeBSD_version to 800097.
Reviewed by: bz, julian
Approved by: rwatson, kib (re), julian (mentor)
2009-06-08 17:15:40 +00:00
|
|
|
#endif
|
2010-04-29 11:52:42 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* NB: name changed so netstat doesn't use it. */
|
2013-07-09 10:08:13 +00:00
|
|
|
VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec4stat);
|
|
|
|
VNET_PCPUSTAT_SYSINIT(ipsec4stat);
|
|
|
|
|
|
|
|
#ifdef VIMAGE
|
|
|
|
VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
|
|
|
|
#endif /* VIMAGE */
|
|
|
|
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DEFINE(int, ip4_ah_offsetmask) = 0; /* maybe IP_DF? */
|
|
|
|
/* DF bit on encap. 0: clear 1: set 2: copy */
|
|
|
|
VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
|
|
|
|
VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
VNET_DEFINE(int, ip4_ah_net_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
/* ECN ignore(-1)/forbidden(0)/allowed(1) */
|
|
|
|
VNET_DEFINE(int, ip4_ipsec_ecn) = 0;
|
|
|
|
VNET_DEFINE(int, ip4_esp_randpad) = -1;
|
|
|
|
|
2014-12-24 18:34:56 +00:00
|
|
|
static VNET_DEFINE(struct secpolicy, def_policy);
|
|
|
|
#define V_def_policy VNET(def_policy)
|
2002-10-16 02:10:08 +00:00
|
|
|
/*
|
|
|
|
* Crypto support requirements:
|
|
|
|
*
|
|
|
|
* 1 require hardware support
|
|
|
|
* -1 require software support
|
|
|
|
* 0 take anything
|
|
|
|
*/
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DEFINE(int, crypto_support) = CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE;
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2010-10-30 18:52:44 +00:00
|
|
|
FEATURE(ipsec, "Internet Protocol Security (IPsec)");
|
|
|
|
#ifdef IPSEC_NAT_T
|
|
|
|
FEATURE(ipsec_natt, "UDP Encapsulation of IPsec ESP Packets ('NAT-T')");
|
|
|
|
#endif
|
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
SYSCTL_DECL(_net_inet_ipsec);
|
|
|
|
|
|
|
|
/* net.inet.ipsec */
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy,
|
2014-12-24 18:34:56 +00:00
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(def_policy).policy, 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"IPsec default policy.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_trans_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Default ESP transport mode level");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_net_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Default ESP tunnel mode level.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_trans_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"AH transfer mode default level.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_net_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"AH tunnel mode default level.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"If set clear type-of-service field when doing AH computation.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK, ah_offsetmask,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_offsetmask), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"If not set clear offset field mask when doing AH computation.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Do not fragment bit on encap.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Explicit Congestion Notification handling.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG, debug,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Enable IPsec debugging output when set.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, OID_AUTO, crypto_support,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(crypto_support), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Crypto driver selection.");
|
2013-07-09 10:08:13 +00:00
|
|
|
SYSCTL_VNET_PCPUSTAT(_net_inet_ipsec, OID_AUTO, ipsecstats, struct ipsecstat,
|
|
|
|
ipsec4stat, "IPsec IPv4 statistics.");
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2006-04-10 15:04:36 +00:00
|
|
|
#ifdef REGRESSION
|
2006-04-09 19:11:45 +00:00
|
|
|
/*
|
|
|
|
* When set to 1, IPsec will send packets with the same sequence number.
|
|
|
|
* This allows to verify if the other side has proper replay attacks detection.
|
|
|
|
*/
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DEFINE(int, ipsec_replay) = 0;
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_replay), 0,
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
"Emulate replay attack");
|
2006-04-09 19:11:45 +00:00
|
|
|
/*
|
|
|
|
* When set 1, IPsec will send packets with corrupted HMAC.
|
|
|
|
* This allows to verify if the other side properly detects modified packets.
|
|
|
|
*/
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DEFINE(int, ipsec_integrity) = 0;
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_integrity), 0,
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
"Emulate man-in-the-middle attack");
|
2006-04-10 15:04:36 +00:00
|
|
|
#endif
|
2006-04-09 19:11:45 +00:00
|
|
|
|
2007-07-01 11:41:27 +00:00
|
|
|
#ifdef INET6
|
2013-07-09 10:08:13 +00:00
|
|
|
VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec6stat);
|
|
|
|
VNET_PCPUSTAT_SYSINIT(ipsec6stat);
|
|
|
|
|
|
|
|
#ifdef VIMAGE
|
|
|
|
VNET_PCPUSTAT_SYSUNINIT(ipsec6stat);
|
|
|
|
#endif /* VIMAGE */
|
|
|
|
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DEFINE(int, ip6_esp_trans_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
VNET_DEFINE(int, ip6_esp_net_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
VNET_DEFINE(int, ip6_ah_trans_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
VNET_DEFINE(int, ip6_ah_net_deflev) = IPSEC_LEVEL_USE;
|
|
|
|
VNET_DEFINE(int, ip6_ipsec_ecn) = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
SYSCTL_DECL(_net_inet6_ipsec6);
|
|
|
|
|
|
|
|
/* net.inet6.ipsec6 */
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy,
|
2014-12-24 18:34:56 +00:00
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(def_policy).policy, 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"IPsec default policy.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_trans_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Default ESP transport mode level.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_net_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Default ESP tunnel mode level.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_trans_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"AH transfer mode default level.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_net_deflev), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"AH tunnel mode default level.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, ecn,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ipsec_ecn), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Explicit Congestion Notification handling.");
|
2014-11-07 09:39:05 +00:00
|
|
|
SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, debug,
|
|
|
|
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_debug), 0,
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
"Enable IPsec debugging output when set.");
|
2013-07-09 10:08:13 +00:00
|
|
|
SYSCTL_VNET_PCPUSTAT(_net_inet6_ipsec6, IPSECCTL_STATS, ipsecstats,
|
|
|
|
struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics.");
|
2002-10-16 02:10:08 +00:00
|
|
|
#endif /* INET6 */
|
|
|
|
|
2015-04-27 01:12:51 +00:00
|
|
|
static int ipsec_in_reject(struct secpolicy *, struct mbuf *);
|
2014-12-03 04:08:41 +00:00
|
|
|
static int ipsec_setspidx_inpcb(struct mbuf *, struct inpcb *);
|
|
|
|
static int ipsec_setspidx(struct mbuf *, struct secpolicyindex *, int);
|
|
|
|
static void ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *, int);
|
|
|
|
static int ipsec4_setspidx_ipaddr(struct mbuf *, struct secpolicyindex *);
|
2002-10-16 02:10:08 +00:00
|
|
|
#ifdef INET6
|
2014-12-03 04:08:41 +00:00
|
|
|
static void ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *, int);
|
|
|
|
static int ipsec6_setspidx_ipaddr(struct mbuf *, struct secpolicyindex *);
|
2002-10-16 02:10:08 +00:00
|
|
|
#endif
|
2014-12-03 04:08:41 +00:00
|
|
|
static void ipsec_delpcbpolicy(struct inpcbpolicy *);
|
|
|
|
static struct secpolicy *ipsec_deepcopy_policy(struct secpolicy *src);
|
|
|
|
static void vshiftl(unsigned char *, int, int);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2003-09-01 05:35:55 +00:00
|
|
|
MALLOC_DEFINE(M_IPSEC_INPCB, "inpcbpolicy", "inpcb-resident ipsec policy");
|
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
/*
|
|
|
|
* Return a held reference to the default SP.
|
|
|
|
*/
|
|
|
|
static struct secpolicy *
|
|
|
|
key_allocsp_default(const char* where, int tag)
|
|
|
|
{
|
|
|
|
struct secpolicy *sp;
|
|
|
|
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
|
|
|
|
printf("DP key_allocsp_default from %s:%u\n", where, tag));
|
|
|
|
|
2014-12-24 18:34:56 +00:00
|
|
|
sp = &V_def_policy;
|
2002-10-16 02:10:08 +00:00
|
|
|
if (sp->policy != IPSEC_POLICY_DISCARD &&
|
|
|
|
sp->policy != IPSEC_POLICY_NONE) {
|
|
|
|
ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n",
|
|
|
|
sp->policy, IPSEC_POLICY_NONE));
|
|
|
|
sp->policy = IPSEC_POLICY_NONE;
|
|
|
|
}
|
2004-09-30 01:08:02 +00:00
|
|
|
key_addref(sp);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
|
|
|
|
printf("DP key_allocsp_default returns SP:%p (%u)\n",
|
|
|
|
sp, sp->refcnt));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (sp);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
#define KEY_ALLOCSP_DEFAULT() \
|
|
|
|
key_allocsp_default(__FILE__, __LINE__)
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For OUTBOUND packet having a socket. Searching SPD for packet,
|
|
|
|
* and return a pointer to SP.
|
|
|
|
* OUT: NULL: no apropreate SP found, the following value is set to error.
|
|
|
|
* 0 : bypass
|
|
|
|
* EACCES : discard packet.
|
|
|
|
* ENOENT : ipsec_acquire() in progress, maybe.
|
|
|
|
* others : error occured.
|
|
|
|
* others: a pointer to SP
|
|
|
|
*
|
|
|
|
* NOTE: IPv6 mapped adddress concern is implemented here.
|
|
|
|
*/
|
|
|
|
struct secpolicy *
|
|
|
|
ipsec_getpolicy(struct tdb_ident *tdbi, u_int dir)
|
|
|
|
{
|
|
|
|
struct secpolicy *sp;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(tdbi != NULL, ("null tdbi"));
|
|
|
|
IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
|
|
|
|
("invalid direction %u", dir));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
sp = KEY_ALLOCSP2(tdbi->spi, &tdbi->dst, tdbi->proto, dir);
|
|
|
|
if (sp == NULL) /*XXX????*/
|
|
|
|
sp = KEY_ALLOCSP_DEFAULT();
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(sp != NULL, ("null SP"));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (sp);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For OUTBOUND packet having a socket. Searching SPD for packet,
|
|
|
|
* and return a pointer to SP.
|
|
|
|
* OUT: NULL: no apropreate SP found, the following value is set to error.
|
|
|
|
* 0 : bypass
|
|
|
|
* EACCES : discard packet.
|
|
|
|
* ENOENT : ipsec_acquire() in progress, maybe.
|
|
|
|
* others : error occured.
|
|
|
|
* others: a pointer to SP
|
|
|
|
*
|
|
|
|
* NOTE: IPv6 mapped adddress concern is implemented here.
|
|
|
|
*/
|
2008-12-27 09:36:22 +00:00
|
|
|
static struct secpolicy *
|
|
|
|
ipsec_getpolicybysock(struct mbuf *m, u_int dir, struct inpcb *inp, int *error)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
2009-02-08 09:27:07 +00:00
|
|
|
struct inpcbpolicy *pcbsp;
|
2008-12-27 22:58:16 +00:00
|
|
|
struct secpolicy *currsp = NULL; /* Policy on socket. */
|
2002-10-16 02:10:08 +00:00
|
|
|
struct secpolicy *sp;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
|
|
|
IPSEC_ASSERT(inp != NULL, ("null inpcb"));
|
|
|
|
IPSEC_ASSERT(error != NULL, ("null error"));
|
|
|
|
IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
|
|
|
|
("invalid direction %u", dir));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2015-07-03 15:31:56 +00:00
|
|
|
if (!key_havesp(dir)) {
|
|
|
|
/* No SP found, use system default. */
|
|
|
|
sp = KEY_ALLOCSP_DEFAULT();
|
|
|
|
return (sp);
|
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Set spidx in pcb. */
|
2009-02-08 09:27:07 +00:00
|
|
|
*error = ipsec_setspidx_inpcb(m, inp);
|
2002-10-16 02:10:08 +00:00
|
|
|
if (*error)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
pcbsp = inp->inp_sp;
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(pcbsp != NULL, ("null pcbsp"));
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (dir) {
|
|
|
|
case IPSEC_DIR_INBOUND:
|
|
|
|
currsp = pcbsp->sp_in;
|
|
|
|
break;
|
|
|
|
case IPSEC_DIR_OUTBOUND:
|
|
|
|
currsp = pcbsp->sp_out;
|
|
|
|
break;
|
|
|
|
}
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(currsp != NULL, ("null currsp"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
if (pcbsp->priv) { /* When privilieged socket. */
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (currsp->policy) {
|
|
|
|
case IPSEC_POLICY_BYPASS:
|
|
|
|
case IPSEC_POLICY_IPSEC:
|
2004-09-30 01:08:02 +00:00
|
|
|
key_addref(currsp);
|
2002-10-16 02:10:08 +00:00
|
|
|
sp = currsp;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPSEC_POLICY_ENTRUST:
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Look for a policy in SPD. */
|
2002-10-16 02:10:08 +00:00
|
|
|
sp = KEY_ALLOCSP(&currsp->spidx, dir);
|
2008-12-27 22:58:16 +00:00
|
|
|
if (sp == NULL) /* No SP found. */
|
2002-10-16 02:10:08 +00:00
|
|
|
sp = KEY_ALLOCSP_DEFAULT();
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_ERR, "%s: Invalid policy for PCB %d\n",
|
|
|
|
__func__, currsp->policy));
|
2002-10-16 02:10:08 +00:00
|
|
|
*error = EINVAL;
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
} else { /* Unpriv, SPD has policy. */
|
2002-10-16 02:10:08 +00:00
|
|
|
sp = KEY_ALLOCSP(&currsp->spidx, dir);
|
2008-12-27 22:58:16 +00:00
|
|
|
if (sp == NULL) { /* No SP found. */
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (currsp->policy) {
|
|
|
|
case IPSEC_POLICY_BYPASS:
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_ERR, "%s: Illegal policy for "
|
|
|
|
"non-priviliged defined %d\n",
|
|
|
|
__func__, currsp->policy));
|
2002-10-16 02:10:08 +00:00
|
|
|
*error = EINVAL;
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
case IPSEC_POLICY_ENTRUST:
|
|
|
|
sp = KEY_ALLOCSP_DEFAULT();
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPSEC_POLICY_IPSEC:
|
2004-09-30 01:08:02 +00:00
|
|
|
key_addref(currsp);
|
2002-10-16 02:10:08 +00:00
|
|
|
sp = currsp;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_ERR, "%s: Invalid policy for "
|
|
|
|
"PCB %d\n", __func__, currsp->policy));
|
2002-10-16 02:10:08 +00:00
|
|
|
*error = EINVAL;
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(sp != NULL,
|
|
|
|
("null SP (priv %u policy %u", pcbsp->priv, currsp->policy));
|
2002-10-16 02:10:08 +00:00
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("DP %s (priv %u policy %u) allocate SP:%p (refcnt %u)\n",
|
|
|
|
__func__, pcbsp->priv, currsp->policy, sp, sp->refcnt));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (sp);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
|
|
|
|
* and return a pointer to SP.
|
|
|
|
* OUT: positive: a pointer to the entry for security policy leaf matched.
|
|
|
|
* NULL: no apropreate SP found, the following value is set to error.
|
|
|
|
* 0 : bypass
|
|
|
|
* EACCES : discard packet.
|
|
|
|
* ENOENT : ipsec_acquire() in progress, maybe.
|
|
|
|
* others : error occured.
|
|
|
|
*/
|
|
|
|
struct secpolicy *
|
2014-12-11 18:35:34 +00:00
|
|
|
ipsec_getpolicybyaddr(struct mbuf *m, u_int dir, int *error)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct secpolicyindex spidx;
|
|
|
|
struct secpolicy *sp;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
|
|
|
IPSEC_ASSERT(error != NULL, ("null error"));
|
|
|
|
IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
|
|
|
|
("invalid direction %u", dir));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
sp = NULL;
|
2014-12-11 18:40:56 +00:00
|
|
|
*error = 0;
|
2002-10-16 02:10:08 +00:00
|
|
|
if (key_havesp(dir)) {
|
2003-01-01 18:49:04 +00:00
|
|
|
/* Make an index to look for a policy. */
|
2014-12-11 18:35:34 +00:00
|
|
|
*error = ipsec_setspidx(m, &spidx, 0);
|
2002-10-16 02:10:08 +00:00
|
|
|
if (*error != 0) {
|
2014-12-11 18:35:34 +00:00
|
|
|
DPRINTF(("%s: setpidx failed, dir %u\n",
|
|
|
|
__func__, dir));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
spidx.dir = dir;
|
|
|
|
sp = KEY_ALLOCSP(&spidx, dir);
|
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
if (sp == NULL) /* No SP found, use system default. */
|
2002-10-16 02:10:08 +00:00
|
|
|
sp = KEY_ALLOCSP_DEFAULT();
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(sp != NULL, ("null SP"));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (sp);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
struct secpolicy *
|
2014-12-11 18:35:34 +00:00
|
|
|
ipsec4_checkpolicy(struct mbuf *m, u_int dir, int *error, struct inpcb *inp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct secpolicy *sp;
|
|
|
|
|
|
|
|
*error = 0;
|
|
|
|
if (inp == NULL)
|
2014-12-11 18:35:34 +00:00
|
|
|
sp = ipsec_getpolicybyaddr(m, dir, error);
|
2002-10-16 02:10:08 +00:00
|
|
|
else
|
|
|
|
sp = ipsec_getpolicybysock(m, dir, inp, error);
|
|
|
|
if (sp == NULL) {
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(*error != 0, ("getpolicy failed w/o error"));
|
2013-06-20 09:55:53 +00:00
|
|
|
IPSECSTAT_INC(ips_out_inval);
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(*error == 0, ("sp w/ error set to %u", *error));
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (sp->policy) {
|
|
|
|
case IPSEC_POLICY_ENTRUST:
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: invalid policy %u\n", __func__, sp->policy);
|
2008-12-27 22:58:16 +00:00
|
|
|
/* FALLTHROUGH */
|
2002-10-16 02:10:08 +00:00
|
|
|
case IPSEC_POLICY_DISCARD:
|
2013-06-20 09:55:53 +00:00
|
|
|
IPSECSTAT_INC(ips_out_polvio);
|
2008-12-27 22:58:16 +00:00
|
|
|
*error = -EINVAL; /* Packet is discarded by caller. */
|
2002-10-16 02:10:08 +00:00
|
|
|
break;
|
|
|
|
case IPSEC_POLICY_BYPASS:
|
|
|
|
case IPSEC_POLICY_NONE:
|
|
|
|
KEY_FREESP(&sp);
|
2008-12-27 22:58:16 +00:00
|
|
|
sp = NULL; /* NB: force NULL result. */
|
2002-10-16 02:10:08 +00:00
|
|
|
break;
|
|
|
|
case IPSEC_POLICY_IPSEC:
|
2008-12-27 22:58:16 +00:00
|
|
|
if (sp->req == NULL) /* Acquire a SA. */
|
2002-10-16 02:10:08 +00:00
|
|
|
*error = key_spdacquire(sp);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (*error != 0) {
|
|
|
|
KEY_FREESP(&sp);
|
|
|
|
sp = NULL;
|
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
return (sp);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2009-02-08 09:27:07 +00:00
|
|
|
ipsec_setspidx_inpcb(struct mbuf *m, struct inpcb *inp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
int error;
|
|
|
|
|
2008-12-27 23:24:59 +00:00
|
|
|
IPSEC_ASSERT(inp != NULL, ("null inp"));
|
|
|
|
IPSEC_ASSERT(inp->inp_sp != NULL, ("null inp_sp"));
|
|
|
|
IPSEC_ASSERT(inp->inp_sp->sp_out != NULL && inp->inp_sp->sp_in != NULL,
|
2003-09-29 22:57:43 +00:00
|
|
|
("null sp_in || sp_out"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 23:24:59 +00:00
|
|
|
error = ipsec_setspidx(m, &inp->inp_sp->sp_in->spidx, 1);
|
2002-10-16 02:10:08 +00:00
|
|
|
if (error == 0) {
|
2008-12-27 23:24:59 +00:00
|
|
|
inp->inp_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND;
|
|
|
|
inp->inp_sp->sp_out->spidx = inp->inp_sp->sp_in->spidx;
|
|
|
|
inp->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND;
|
2002-10-16 02:10:08 +00:00
|
|
|
} else {
|
2008-12-27 23:24:59 +00:00
|
|
|
bzero(&inp->inp_sp->sp_in->spidx,
|
|
|
|
sizeof (inp->inp_sp->sp_in->spidx));
|
|
|
|
bzero(&inp->inp_sp->sp_out->spidx,
|
|
|
|
sizeof (inp->inp_sp->sp_in->spidx));
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
return (error);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Configure security policy index (src/dst/proto/sport/dport)
|
2002-10-16 02:10:08 +00:00
|
|
|
* by looking at the content of mbuf.
|
2008-12-27 22:58:16 +00:00
|
|
|
* The caller is responsible for error recovery (like clearing up spidx).
|
2002-10-16 02:10:08 +00:00
|
|
|
*/
|
|
|
|
static int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_setspidx(struct mbuf *m, struct secpolicyindex *spidx, int needport)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct ip *ip = NULL;
|
|
|
|
struct ip ipbuf;
|
|
|
|
u_int v;
|
|
|
|
struct mbuf *n;
|
|
|
|
int len;
|
|
|
|
int error;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Validate m->m_pkthdr.len. We see incorrect length if we
|
2002-10-16 02:10:08 +00:00
|
|
|
* mistakenly call this function with inconsistent mbuf chain
|
2008-12-27 22:58:16 +00:00
|
|
|
* (like 4.4BSD tcp/udp processing). XXX Should we panic here?
|
2002-10-16 02:10:08 +00:00
|
|
|
*/
|
|
|
|
len = 0;
|
|
|
|
for (n = m; n; n = n->m_next)
|
|
|
|
len += n->m_len;
|
|
|
|
if (m->m_pkthdr.len != len) {
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: pkthdr len(%d) mismatch (%d), ignored.\n",
|
|
|
|
__func__, len, m->m_pkthdr.len));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (m->m_pkthdr.len < sizeof(struct ip)) {
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: pkthdr len(%d) too small (v4), ignored.\n",
|
|
|
|
__func__, m->m_pkthdr.len));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (m->m_len >= sizeof(*ip))
|
|
|
|
ip = mtod(m, struct ip *);
|
|
|
|
else {
|
|
|
|
m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
|
|
|
|
ip = &ipbuf;
|
|
|
|
}
|
|
|
|
v = ip->ip_v;
|
|
|
|
switch (v) {
|
|
|
|
case 4:
|
|
|
|
error = ipsec4_setspidx_ipaddr(m, spidx);
|
|
|
|
if (error)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (error);
|
2002-10-16 02:10:08 +00:00
|
|
|
ipsec4_get_ulp(m, spidx, needport);
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
#ifdef INET6
|
|
|
|
case 6:
|
|
|
|
if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) {
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: pkthdr len(%d) too small (v6), "
|
|
|
|
"ignored\n", __func__, m->m_pkthdr.len));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
error = ipsec6_setspidx_ipaddr(m, spidx);
|
|
|
|
if (error)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (error);
|
2002-10-16 02:10:08 +00:00
|
|
|
ipsec6_get_ulp(m, spidx, needport);
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
#endif
|
|
|
|
default:
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: " "unknown IP version %u, ignored.\n",
|
|
|
|
__func__, v));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
|
|
|
|
{
|
|
|
|
u_int8_t nxt;
|
|
|
|
int off;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sanity check. */
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
|
|
|
IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip),("packet too short"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2010-04-02 18:15:23 +00:00
|
|
|
if (m->m_len >= sizeof (struct ip)) {
|
2002-10-16 02:10:08 +00:00
|
|
|
struct ip *ip = mtod(m, struct ip *);
|
2012-10-22 21:09:03 +00:00
|
|
|
if (ip->ip_off & htons(IP_MF | IP_OFFMASK))
|
2002-10-16 02:10:08 +00:00
|
|
|
goto done;
|
|
|
|
off = ip->ip_hl << 2;
|
|
|
|
nxt = ip->ip_p;
|
|
|
|
} else {
|
|
|
|
struct ip ih;
|
|
|
|
|
|
|
|
m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih);
|
2012-10-22 21:09:03 +00:00
|
|
|
if (ih.ip_off & htons(IP_MF | IP_OFFMASK))
|
2002-10-16 02:10:08 +00:00
|
|
|
goto done;
|
|
|
|
off = ih.ip_hl << 2;
|
|
|
|
nxt = ih.ip_p;
|
|
|
|
}
|
|
|
|
|
|
|
|
while (off < m->m_pkthdr.len) {
|
|
|
|
struct ip6_ext ip6e;
|
|
|
|
struct tcphdr th;
|
|
|
|
struct udphdr uh;
|
|
|
|
|
|
|
|
switch (nxt) {
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
spidx->ul_proto = nxt;
|
|
|
|
if (!needport)
|
|
|
|
goto done_proto;
|
|
|
|
if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
|
|
|
|
goto done;
|
|
|
|
m_copydata(m, off, sizeof (th), (caddr_t) &th);
|
|
|
|
spidx->src.sin.sin_port = th.th_sport;
|
|
|
|
spidx->dst.sin.sin_port = th.th_dport;
|
|
|
|
return;
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
spidx->ul_proto = nxt;
|
|
|
|
if (!needport)
|
|
|
|
goto done_proto;
|
|
|
|
if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
|
|
|
|
goto done;
|
|
|
|
m_copydata(m, off, sizeof (uh), (caddr_t) &uh);
|
|
|
|
spidx->src.sin.sin_port = uh.uh_sport;
|
|
|
|
spidx->dst.sin.sin_port = uh.uh_dport;
|
|
|
|
return;
|
|
|
|
case IPPROTO_AH:
|
2005-03-09 15:28:48 +00:00
|
|
|
if (off + sizeof(ip6e) > m->m_pkthdr.len)
|
2002-10-16 02:10:08 +00:00
|
|
|
goto done;
|
2008-12-27 22:58:16 +00:00
|
|
|
/* XXX Sigh, this works but is totally bogus. */
|
2002-10-16 02:10:08 +00:00
|
|
|
m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e);
|
|
|
|
off += (ip6e.ip6e_len + 2) << 2;
|
|
|
|
nxt = ip6e.ip6e_nxt;
|
|
|
|
break;
|
|
|
|
case IPPROTO_ICMP:
|
|
|
|
default:
|
2008-12-27 22:58:16 +00:00
|
|
|
/* XXX Intermediate headers??? */
|
2002-10-16 02:10:08 +00:00
|
|
|
spidx->ul_proto = nxt;
|
|
|
|
goto done_proto;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
done:
|
|
|
|
spidx->ul_proto = IPSEC_ULPROTO_ANY;
|
|
|
|
done_proto:
|
|
|
|
spidx->src.sin.sin_port = IPSEC_PORT_ANY;
|
|
|
|
spidx->dst.sin.sin_port = IPSEC_PORT_ANY;
|
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Assumes that m is sane. */
|
2002-10-16 02:10:08 +00:00
|
|
|
static int
|
|
|
|
ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
|
|
|
|
{
|
|
|
|
static const struct sockaddr_in template = {
|
|
|
|
sizeof (struct sockaddr_in),
|
|
|
|
AF_INET,
|
|
|
|
0, { 0 }, { 0, 0, 0, 0, 0, 0, 0, 0 }
|
|
|
|
};
|
|
|
|
|
|
|
|
spidx->src.sin = template;
|
|
|
|
spidx->dst.sin = template;
|
|
|
|
|
|
|
|
if (m->m_len < sizeof (struct ip)) {
|
|
|
|
m_copydata(m, offsetof(struct ip, ip_src),
|
|
|
|
sizeof (struct in_addr),
|
|
|
|
(caddr_t) &spidx->src.sin.sin_addr);
|
|
|
|
m_copydata(m, offsetof(struct ip, ip_dst),
|
|
|
|
sizeof (struct in_addr),
|
|
|
|
(caddr_t) &spidx->dst.sin.sin_addr);
|
|
|
|
} else {
|
|
|
|
struct ip *ip = mtod(m, struct ip *);
|
|
|
|
spidx->src.sin.sin_addr = ip->ip_src;
|
|
|
|
spidx->dst.sin.sin_addr = ip->ip_dst;
|
|
|
|
}
|
|
|
|
|
|
|
|
spidx->prefs = sizeof(struct in_addr) << 3;
|
|
|
|
spidx->prefd = sizeof(struct in_addr) << 3;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef INET6
|
|
|
|
static void
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
int off, nxt;
|
|
|
|
struct tcphdr th;
|
|
|
|
struct udphdr uh;
|
2007-05-29 22:32:12 +00:00
|
|
|
struct icmp6_hdr ih;
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sanity check. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (m == NULL)
|
2003-09-29 22:57:43 +00:00
|
|
|
panic("%s: NULL pointer was passed.\n", __func__);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s:\n", __func__); kdebug_mbuf(m));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Set default. */
|
2002-10-16 02:10:08 +00:00
|
|
|
spidx->ul_proto = IPSEC_ULPROTO_ANY;
|
|
|
|
((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY;
|
|
|
|
((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY;
|
|
|
|
|
|
|
|
nxt = -1;
|
|
|
|
off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
|
|
|
|
if (off < 0 || m->m_pkthdr.len < off)
|
|
|
|
return;
|
|
|
|
|
|
|
|
switch (nxt) {
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
spidx->ul_proto = nxt;
|
|
|
|
if (!needport)
|
|
|
|
break;
|
|
|
|
if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
|
|
|
|
break;
|
|
|
|
m_copydata(m, off, sizeof(th), (caddr_t)&th);
|
|
|
|
((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport;
|
|
|
|
((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport;
|
|
|
|
break;
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
spidx->ul_proto = nxt;
|
|
|
|
if (!needport)
|
|
|
|
break;
|
|
|
|
if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
|
|
|
|
break;
|
|
|
|
m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
|
|
|
|
((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport;
|
|
|
|
((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport;
|
|
|
|
break;
|
|
|
|
case IPPROTO_ICMPV6:
|
2007-05-29 22:32:12 +00:00
|
|
|
spidx->ul_proto = nxt;
|
|
|
|
if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len)
|
|
|
|
break;
|
|
|
|
m_copydata(m, off, sizeof(ih), (caddr_t)&ih);
|
|
|
|
((struct sockaddr_in6 *)&spidx->src)->sin6_port =
|
|
|
|
htons((uint16_t)ih.icmp6_type);
|
|
|
|
((struct sockaddr_in6 *)&spidx->dst)->sin6_port =
|
|
|
|
htons((uint16_t)ih.icmp6_code);
|
|
|
|
break;
|
2002-10-16 02:10:08 +00:00
|
|
|
default:
|
2008-12-27 22:58:16 +00:00
|
|
|
/* XXX Intermediate headers??? */
|
2002-10-16 02:10:08 +00:00
|
|
|
spidx->ul_proto = nxt;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Assumes that m is sane. */
|
2002-10-16 02:10:08 +00:00
|
|
|
static int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec6_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct ip6_hdr *ip6 = NULL;
|
|
|
|
struct ip6_hdr ip6buf;
|
|
|
|
struct sockaddr_in6 *sin6;
|
|
|
|
|
|
|
|
if (m->m_len >= sizeof(*ip6))
|
|
|
|
ip6 = mtod(m, struct ip6_hdr *);
|
|
|
|
else {
|
|
|
|
m_copydata(m, 0, sizeof(ip6buf), (caddr_t)&ip6buf);
|
|
|
|
ip6 = &ip6buf;
|
|
|
|
}
|
|
|
|
|
|
|
|
sin6 = (struct sockaddr_in6 *)&spidx->src;
|
|
|
|
bzero(sin6, sizeof(*sin6));
|
|
|
|
sin6->sin6_family = AF_INET6;
|
|
|
|
sin6->sin6_len = sizeof(struct sockaddr_in6);
|
|
|
|
bcopy(&ip6->ip6_src, &sin6->sin6_addr, sizeof(ip6->ip6_src));
|
|
|
|
if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
|
|
|
|
sin6->sin6_addr.s6_addr16[1] = 0;
|
|
|
|
sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
|
|
|
|
}
|
|
|
|
spidx->prefs = sizeof(struct in6_addr) << 3;
|
|
|
|
|
|
|
|
sin6 = (struct sockaddr_in6 *)&spidx->dst;
|
|
|
|
bzero(sin6, sizeof(*sin6));
|
|
|
|
sin6->sin6_family = AF_INET6;
|
|
|
|
sin6->sin6_len = sizeof(struct sockaddr_in6);
|
|
|
|
bcopy(&ip6->ip6_dst, &sin6->sin6_addr, sizeof(ip6->ip6_dst));
|
|
|
|
if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
|
|
|
|
sin6->sin6_addr.s6_addr16[1] = 0;
|
|
|
|
sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
|
|
|
|
}
|
|
|
|
spidx->prefd = sizeof(struct in6_addr) << 3;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static void
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_delpcbpolicy(struct inpcbpolicy *p)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
2008-12-27 22:58:16 +00:00
|
|
|
|
2003-09-01 05:35:55 +00:00
|
|
|
free(p, M_IPSEC_INPCB);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Initialize policy in PCB. */
|
2002-10-16 02:10:08 +00:00
|
|
|
int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_init_policy(struct socket *so, struct inpcbpolicy **pcb_sp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct inpcbpolicy *new;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sanity check. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (so == NULL || pcb_sp == NULL)
|
2003-09-29 22:57:43 +00:00
|
|
|
panic("%s: NULL pointer was passed.\n", __func__);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
new = (struct inpcbpolicy *) malloc(sizeof(struct inpcbpolicy),
|
2003-09-01 05:35:55 +00:00
|
|
|
M_IPSEC_INPCB, M_NOWAIT|M_ZERO);
|
2002-10-16 02:10:08 +00:00
|
|
|
if (new == NULL) {
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (ENOBUFS);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
new->priv = IPSEC_IS_PRIVILEGED_SO(so);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
if ((new->sp_in = KEY_NEWSP()) == NULL) {
|
|
|
|
ipsec_delpcbpolicy(new);
|
2008-12-27 22:58:16 +00:00
|
|
|
return (ENOBUFS);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
new->sp_in->policy = IPSEC_POLICY_ENTRUST;
|
|
|
|
if ((new->sp_out = KEY_NEWSP()) == NULL) {
|
|
|
|
KEY_FREESP(&new->sp_in);
|
|
|
|
ipsec_delpcbpolicy(new);
|
2008-12-27 22:58:16 +00:00
|
|
|
return (ENOBUFS);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
new->sp_out->policy = IPSEC_POLICY_ENTRUST;
|
|
|
|
*pcb_sp = new;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Copy old IPsec policy into new. */
|
2002-10-16 02:10:08 +00:00
|
|
|
int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_copy_policy(struct inpcbpolicy *old, struct inpcbpolicy *new)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct secpolicy *sp;
|
|
|
|
|
|
|
|
sp = ipsec_deepcopy_policy(old->sp_in);
|
|
|
|
if (sp) {
|
|
|
|
KEY_FREESP(&new->sp_in);
|
|
|
|
new->sp_in = sp;
|
|
|
|
} else
|
2008-12-27 22:58:16 +00:00
|
|
|
return (ENOBUFS);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
sp = ipsec_deepcopy_policy(old->sp_out);
|
|
|
|
if (sp) {
|
|
|
|
KEY_FREESP(&new->sp_out);
|
|
|
|
new->sp_out = sp;
|
|
|
|
} else
|
2008-12-27 22:58:16 +00:00
|
|
|
return (ENOBUFS);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
new->priv = old->priv;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2003-09-01 05:35:55 +00:00
|
|
|
struct ipsecrequest *
|
|
|
|
ipsec_newisr(void)
|
|
|
|
{
|
|
|
|
struct ipsecrequest *p;
|
|
|
|
|
|
|
|
p = malloc(sizeof(struct ipsecrequest), M_IPSEC_SR, M_NOWAIT|M_ZERO);
|
|
|
|
if (p != NULL)
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSECREQUEST_LOCK_INIT(p);
|
2008-12-27 22:58:16 +00:00
|
|
|
return (p);
|
2003-09-01 05:35:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
ipsec_delisr(struct ipsecrequest *p)
|
|
|
|
{
|
2008-12-27 22:58:16 +00:00
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSECREQUEST_LOCK_DESTROY(p);
|
2003-09-01 05:35:55 +00:00
|
|
|
free(p, M_IPSEC_SR);
|
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Deep-copy a policy in PCB. */
|
2002-10-16 02:10:08 +00:00
|
|
|
static struct secpolicy *
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_deepcopy_policy(struct secpolicy *src)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct ipsecrequest *newchain = NULL;
|
|
|
|
struct ipsecrequest *p;
|
|
|
|
struct ipsecrequest **q;
|
|
|
|
struct ipsecrequest *r;
|
|
|
|
struct secpolicy *dst;
|
|
|
|
|
|
|
|
if (src == NULL)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
dst = KEY_NEWSP();
|
|
|
|
if (dst == NULL)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Deep-copy IPsec request chain. This is required since struct
|
2002-10-16 02:10:08 +00:00
|
|
|
* ipsecrequest is not reference counted.
|
|
|
|
*/
|
|
|
|
q = &newchain;
|
|
|
|
for (p = src->req; p; p = p->next) {
|
2003-09-01 05:35:55 +00:00
|
|
|
*q = ipsec_newisr();
|
2002-10-16 02:10:08 +00:00
|
|
|
if (*q == NULL)
|
|
|
|
goto fail;
|
|
|
|
(*q)->saidx.proto = p->saidx.proto;
|
|
|
|
(*q)->saidx.mode = p->saidx.mode;
|
|
|
|
(*q)->level = p->level;
|
|
|
|
(*q)->saidx.reqid = p->saidx.reqid;
|
|
|
|
|
|
|
|
bcopy(&p->saidx.src, &(*q)->saidx.src, sizeof((*q)->saidx.src));
|
|
|
|
bcopy(&p->saidx.dst, &(*q)->saidx.dst, sizeof((*q)->saidx.dst));
|
|
|
|
|
|
|
|
(*q)->sp = dst;
|
|
|
|
|
|
|
|
q = &((*q)->next);
|
|
|
|
}
|
|
|
|
|
|
|
|
dst->req = newchain;
|
|
|
|
dst->policy = src->policy;
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Do not touch the refcnt fields. */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (dst);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
fail:
|
|
|
|
for (p = newchain; p; p = r) {
|
|
|
|
r = p->next;
|
2003-09-01 05:35:55 +00:00
|
|
|
ipsec_delisr(p);
|
2002-10-16 02:10:08 +00:00
|
|
|
p = NULL;
|
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
return (NULL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Set policy and IPsec request if present. */
|
2002-10-16 02:10:08 +00:00
|
|
|
static int
|
2009-02-08 09:27:07 +00:00
|
|
|
ipsec_set_policy_internal(struct secpolicy **pcb_sp, int optname,
|
|
|
|
caddr_t request, size_t len, struct ucred *cred)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct sadb_x_policy *xpl;
|
|
|
|
struct secpolicy *newsp = NULL;
|
|
|
|
int error;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sanity check. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (pcb_sp == NULL || *pcb_sp == NULL || request == NULL)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
if (len < sizeof(*xpl))
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
xpl = (struct sadb_x_policy *)request;
|
|
|
|
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: passed policy\n", __func__);
|
2002-10-16 02:10:08 +00:00
|
|
|
kdebug_sadb_x_policy((struct sadb_ext *)xpl));
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Check policy type. */
|
2009-02-08 09:27:07 +00:00
|
|
|
/* ipsec_set_policy_internal() accepts IPSEC, ENTRUST and BYPASS. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD
|
|
|
|
|| xpl->sadb_x_policy_type == IPSEC_POLICY_NONE)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Check privileged socket. */
|
2008-02-02 14:11:31 +00:00
|
|
|
if (cred != NULL && xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS) {
|
|
|
|
error = priv_check_cred(cred, PRIV_NETINET_IPSEC, 0);
|
|
|
|
if (error)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EACCES);
|
2008-02-02 14:11:31 +00:00
|
|
|
}
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Allocating new SP entry. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if ((newsp = key_msg2sp(xpl, len, &error)) == NULL)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (error);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Clear old SP and set new SP. */
|
2002-10-16 02:10:08 +00:00
|
|
|
KEY_FREESP(pcb_sp);
|
|
|
|
*pcb_sp = newsp;
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: new policy\n", __func__);
|
2002-10-16 02:10:08 +00:00
|
|
|
kdebug_secpolicy(newsp));
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
2009-02-08 09:27:07 +00:00
|
|
|
ipsec_set_policy(struct inpcb *inp, int optname, caddr_t request,
|
2008-12-27 21:20:34 +00:00
|
|
|
size_t len, struct ucred *cred)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct sadb_x_policy *xpl;
|
|
|
|
struct secpolicy **pcb_sp;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sanity check. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (inp == NULL || request == NULL)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
if (len < sizeof(*xpl))
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
xpl = (struct sadb_x_policy *)request;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Select direction. */
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (xpl->sadb_x_policy_dir) {
|
|
|
|
case IPSEC_DIR_INBOUND:
|
|
|
|
pcb_sp = &inp->inp_sp->sp_in;
|
|
|
|
break;
|
|
|
|
case IPSEC_DIR_OUTBOUND:
|
|
|
|
pcb_sp = &inp->inp_sp->sp_out;
|
|
|
|
break;
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
xpl->sadb_x_policy_dir));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
return (ipsec_set_policy_internal(pcb_sp, optname, request, len, cred));
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
2009-02-08 09:27:07 +00:00
|
|
|
ipsec_get_policy(struct inpcb *inp, caddr_t request, size_t len,
|
2008-12-27 21:20:34 +00:00
|
|
|
struct mbuf **mp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct sadb_x_policy *xpl;
|
|
|
|
struct secpolicy *pcb_sp;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sanity check. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (inp == NULL || request == NULL || mp == NULL)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(inp->inp_sp != NULL, ("null inp_sp"));
|
2002-10-16 02:10:08 +00:00
|
|
|
if (len < sizeof(*xpl))
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
xpl = (struct sadb_x_policy *)request;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Select direction. */
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (xpl->sadb_x_policy_dir) {
|
|
|
|
case IPSEC_DIR_INBOUND:
|
|
|
|
pcb_sp = inp->inp_sp->sp_in;
|
|
|
|
break;
|
|
|
|
case IPSEC_DIR_OUTBOUND:
|
|
|
|
pcb_sp = inp->inp_sp->sp_out;
|
|
|
|
break;
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_ERR, "%s: invalid direction=%u\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
xpl->sadb_x_policy_dir));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
/* Sanity check. Should be an IPSEC_ASSERT. */
|
|
|
|
if (pcb_sp == NULL)
|
|
|
|
return (EINVAL);
|
|
|
|
|
|
|
|
*mp = key_sp2msg(pcb_sp);
|
|
|
|
if (!*mp) {
|
|
|
|
ipseclog((LOG_DEBUG, "%s: No more memory.\n", __func__));
|
|
|
|
return (ENOBUFS);
|
|
|
|
}
|
|
|
|
|
|
|
|
(*mp)->m_type = MT_DATA;
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
|
|
|
printf("%s:\n", __func__); kdebug_mbuf(*mp));
|
|
|
|
|
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Delete policy in PCB. */
|
2002-10-16 02:10:08 +00:00
|
|
|
int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_delete_pcbpolicy(struct inpcb *inp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(inp != NULL, ("null inp"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
if (inp->inp_sp == NULL)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
if (inp->inp_sp->sp_in != NULL)
|
|
|
|
KEY_FREESP(&inp->inp_sp->sp_in);
|
|
|
|
|
|
|
|
if (inp->inp_sp->sp_out != NULL)
|
|
|
|
KEY_FREESP(&inp->inp_sp->sp_out);
|
|
|
|
|
|
|
|
ipsec_delpcbpolicy(inp->inp_sp);
|
|
|
|
inp->inp_sp = NULL;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Return current level.
|
2002-10-16 02:10:08 +00:00
|
|
|
* Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
|
|
|
|
*/
|
|
|
|
u_int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_get_reqlevel(struct ipsecrequest *isr)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
u_int level = 0;
|
|
|
|
u_int esp_trans_deflev, esp_net_deflev;
|
|
|
|
u_int ah_trans_deflev, ah_net_deflev;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(isr != NULL && isr->sp != NULL, ("null argument"));
|
|
|
|
IPSEC_ASSERT(isr->sp->spidx.src.sa.sa_family == isr->sp->spidx.dst.sa.sa_family,
|
|
|
|
("af family mismatch, src %u, dst %u",
|
2002-10-16 02:10:08 +00:00
|
|
|
isr->sp->spidx.src.sa.sa_family,
|
|
|
|
isr->sp->spidx.dst.sa.sa_family));
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* XXX Note that we have ipseclog() expanded here - code sync issue. */
|
2002-10-16 02:10:08 +00:00
|
|
|
#define IPSEC_CHECK_DEFAULT(lev) \
|
|
|
|
(((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE \
|
|
|
|
&& (lev) != IPSEC_LEVEL_UNIQUE) \
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
? (V_ipsec_debug \
|
2002-10-16 02:10:08 +00:00
|
|
|
? log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
|
|
|
|
(lev), IPSEC_LEVEL_REQUIRE) \
|
|
|
|
: 0), \
|
|
|
|
(lev) = IPSEC_LEVEL_REQUIRE, \
|
|
|
|
(lev) \
|
|
|
|
: (lev))
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Set default level. */
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) {
|
|
|
|
#ifdef INET
|
|
|
|
case AF_INET:
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_trans_deflev);
|
|
|
|
esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_net_deflev);
|
|
|
|
ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_trans_deflev);
|
|
|
|
ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_net_deflev);
|
2002-10-16 02:10:08 +00:00
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
case AF_INET6:
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_trans_deflev);
|
|
|
|
esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_net_deflev);
|
|
|
|
ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_trans_deflev);
|
|
|
|
ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_net_deflev);
|
2002-10-16 02:10:08 +00:00
|
|
|
break;
|
|
|
|
#endif /* INET6 */
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
panic("%s: unknown af %u",
|
|
|
|
__func__, isr->sp->spidx.src.sa.sa_family);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#undef IPSEC_CHECK_DEFAULT
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Set level. */
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (isr->level) {
|
|
|
|
case IPSEC_LEVEL_DEFAULT:
|
|
|
|
switch (isr->saidx.proto) {
|
|
|
|
case IPPROTO_ESP:
|
|
|
|
if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
|
|
|
|
level = esp_net_deflev;
|
|
|
|
else
|
|
|
|
level = esp_trans_deflev;
|
|
|
|
break;
|
|
|
|
case IPPROTO_AH:
|
|
|
|
if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
|
|
|
|
level = ah_net_deflev;
|
|
|
|
else
|
|
|
|
level = ah_trans_deflev;
|
2004-01-27 17:45:28 +00:00
|
|
|
break;
|
2002-10-16 02:10:08 +00:00
|
|
|
case IPPROTO_IPCOMP:
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* We don't really care, as IPcomp document says that
|
|
|
|
* we shouldn't compress small packets.
|
2002-10-16 02:10:08 +00:00
|
|
|
*/
|
|
|
|
level = IPSEC_LEVEL_USE;
|
|
|
|
break;
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
panic("%s: Illegal protocol defined %u\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
isr->saidx.proto);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPSEC_LEVEL_USE:
|
|
|
|
case IPSEC_LEVEL_REQUIRE:
|
|
|
|
level = isr->level;
|
|
|
|
break;
|
|
|
|
case IPSEC_LEVEL_UNIQUE:
|
|
|
|
level = IPSEC_LEVEL_REQUIRE;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
panic("%s: Illegal IPsec level %u\n", __func__, isr->level);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (level);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check security policy requirements against the actual
|
|
|
|
* packet contents. Return one if the packet should be
|
|
|
|
* reject as "invalid"; otherwiser return zero to have the
|
|
|
|
* packet treated as "valid".
|
|
|
|
*
|
|
|
|
* OUT:
|
|
|
|
* 0: valid
|
|
|
|
* 1: invalid
|
|
|
|
*/
|
2015-04-27 01:12:51 +00:00
|
|
|
static int
|
2002-10-16 02:10:08 +00:00
|
|
|
ipsec_in_reject(struct secpolicy *sp, struct mbuf *m)
|
|
|
|
{
|
|
|
|
struct ipsecrequest *isr;
|
|
|
|
int need_auth;
|
|
|
|
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DATA,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: using SP\n", __func__); kdebug_secpolicy(sp));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Check policy. */
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (sp->policy) {
|
|
|
|
case IPSEC_POLICY_DISCARD:
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
case IPSEC_POLICY_BYPASS:
|
|
|
|
case IPSEC_POLICY_NONE:
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
|
|
|
|
("invalid policy %u", sp->policy));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* XXX Should compare policy against IPsec header history. */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
need_auth = 0;
|
|
|
|
for (isr = sp->req; isr != NULL; isr = isr->next) {
|
|
|
|
if (ipsec_get_reqlevel(isr) != IPSEC_LEVEL_REQUIRE)
|
|
|
|
continue;
|
|
|
|
switch (isr->saidx.proto) {
|
|
|
|
case IPPROTO_ESP:
|
|
|
|
if ((m->m_flags & M_DECRYPTED) == 0) {
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: ESP m_flags:%x\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
m->m_flags));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (!need_auth &&
|
|
|
|
isr->sav != NULL &&
|
|
|
|
isr->sav->tdb_authalgxform != NULL &&
|
|
|
|
(m->m_flags & M_AUTHIPDGM) == 0) {
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: ESP/AH m_flags:%x\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
m->m_flags));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
case IPPROTO_AH:
|
|
|
|
need_auth = 1;
|
|
|
|
if ((m->m_flags & M_AUTHIPHDR) == 0) {
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: AH m_flags:%x\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
m->m_flags));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
case IPPROTO_IPCOMP:
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* We don't really care, as IPcomp document
|
2002-10-16 02:10:08 +00:00
|
|
|
* says that we shouldn't compress small
|
2008-12-27 22:58:16 +00:00
|
|
|
* packets. IPComp policy should always be
|
2002-10-16 02:10:08 +00:00
|
|
|
* treated as being in "use" level.
|
|
|
|
*/
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0); /* Valid. */
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2014-12-11 18:46:11 +00:00
|
|
|
/*
|
|
|
|
* Non zero return value means security policy DISCARD or policy violation.
|
|
|
|
*/
|
2009-02-08 09:27:07 +00:00
|
|
|
static int
|
|
|
|
ipsec46_in_reject(struct mbuf *m, struct inpcb *inp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct secpolicy *sp;
|
|
|
|
int error;
|
|
|
|
int result;
|
|
|
|
|
2015-10-27 00:42:15 +00:00
|
|
|
if (!key_havesp(IPSEC_DIR_INBOUND))
|
|
|
|
return 0;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2014-12-11 18:35:34 +00:00
|
|
|
/* Get SP for this packet. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (inp == NULL)
|
2014-12-11 18:35:34 +00:00
|
|
|
sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, &error);
|
2002-10-16 02:10:08 +00:00
|
|
|
else
|
|
|
|
sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, inp, &error);
|
|
|
|
|
|
|
|
if (sp != NULL) {
|
|
|
|
result = ipsec_in_reject(sp, m);
|
|
|
|
KEY_FREESP(&sp);
|
|
|
|
} else {
|
2014-12-11 18:46:11 +00:00
|
|
|
result = 1; /* treat errors as policy violation */
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
return (result);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
/*
|
|
|
|
* Check AH/ESP integrity.
|
|
|
|
* This function is called from tcp_input(), udp_input(),
|
|
|
|
* and {ah,esp}4_input for tunnel mode.
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
ipsec4_in_reject(struct mbuf *m, struct inpcb *inp)
|
|
|
|
{
|
|
|
|
int result;
|
|
|
|
|
|
|
|
result = ipsec46_in_reject(m, inp);
|
|
|
|
if (result)
|
2013-06-20 09:55:53 +00:00
|
|
|
IPSECSTAT_INC(ips_in_polvio);
|
2009-02-08 09:27:07 +00:00
|
|
|
|
|
|
|
return (result);
|
|
|
|
}
|
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
#ifdef INET6
|
|
|
|
/*
|
|
|
|
* Check AH/ESP integrity.
|
|
|
|
* This function is called from tcp6_input(), udp6_input(),
|
2008-12-27 22:58:16 +00:00
|
|
|
* and {ah,esp}6_input for tunnel mode.
|
2002-10-16 02:10:08 +00:00
|
|
|
*/
|
|
|
|
int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec6_in_reject(struct mbuf *m, struct inpcb *inp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
int result;
|
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
result = ipsec46_in_reject(m, inp);
|
|
|
|
if (result)
|
2013-06-20 09:55:53 +00:00
|
|
|
IPSEC6STAT_INC(ips_in_polvio);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (result);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Compute the byte size to be occupied by IPsec header.
|
|
|
|
* In case it is tunnelled, it includes the size of outer IP header.
|
|
|
|
* NOTE: SP passed is freed in this function.
|
2002-10-16 02:10:08 +00:00
|
|
|
*/
|
|
|
|
static size_t
|
2009-02-08 09:27:07 +00:00
|
|
|
ipsec_hdrsiz_internal(struct secpolicy *sp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct ipsecrequest *isr;
|
2008-12-27 23:24:59 +00:00
|
|
|
size_t size;
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DATA,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: using SP\n", __func__); kdebug_secpolicy(sp));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
switch (sp->policy) {
|
|
|
|
case IPSEC_POLICY_DISCARD:
|
|
|
|
case IPSEC_POLICY_BYPASS:
|
|
|
|
case IPSEC_POLICY_NONE:
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
|
|
|
|
("invalid policy %u", sp->policy));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 23:24:59 +00:00
|
|
|
size = 0;
|
2002-10-16 02:10:08 +00:00
|
|
|
for (isr = sp->req; isr != NULL; isr = isr->next) {
|
|
|
|
size_t clen = 0;
|
|
|
|
|
|
|
|
switch (isr->saidx.proto) {
|
|
|
|
case IPPROTO_ESP:
|
|
|
|
clen = esp_hdrsiz(isr->sav);
|
|
|
|
break;
|
|
|
|
case IPPROTO_AH:
|
|
|
|
clen = ah_hdrsiz(isr->sav);
|
|
|
|
break;
|
|
|
|
case IPPROTO_IPCOMP:
|
|
|
|
clen = sizeof(struct ipcomp);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
|
|
|
|
switch (isr->saidx.dst.sa.sa_family) {
|
|
|
|
case AF_INET:
|
|
|
|
clen += sizeof(struct ip);
|
|
|
|
break;
|
|
|
|
#ifdef INET6
|
|
|
|
case AF_INET6:
|
|
|
|
clen += sizeof(struct ip6_hdr);
|
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
default:
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_ERR, "%s: unknown AF %d in "
|
|
|
|
"IPsec tunnel SA\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
((struct sockaddr *)&isr->saidx.dst)->sa_family));
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2008-12-27 23:24:59 +00:00
|
|
|
size += clen;
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2008-12-27 23:24:59 +00:00
|
|
|
return (size);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
/*
|
|
|
|
* This function is called from ipsec_hdrsiz_tcp(), ip_ipsec_mtu(),
|
|
|
|
* disabled ip6_ipsec_mtu() and ip6_forward().
|
|
|
|
*/
|
2002-10-16 02:10:08 +00:00
|
|
|
size_t
|
2009-02-08 09:27:07 +00:00
|
|
|
ipsec_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
struct secpolicy *sp;
|
|
|
|
int error;
|
|
|
|
size_t size;
|
|
|
|
|
2015-10-27 00:42:15 +00:00
|
|
|
if (!key_havesp(dir))
|
|
|
|
return 0;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2014-12-11 18:35:34 +00:00
|
|
|
/* Get SP for this packet. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (inp == NULL)
|
2014-12-11 18:35:34 +00:00
|
|
|
sp = ipsec_getpolicybyaddr(m, dir, &error);
|
2002-10-16 02:10:08 +00:00
|
|
|
else
|
|
|
|
sp = ipsec_getpolicybysock(m, dir, inp, &error);
|
|
|
|
|
|
|
|
if (sp != NULL) {
|
2009-02-08 09:27:07 +00:00
|
|
|
size = ipsec_hdrsiz_internal(sp);
|
2002-10-16 02:10:08 +00:00
|
|
|
KEYDEBUG(KEYDEBUG_IPSEC_DATA,
|
2003-09-29 22:57:43 +00:00
|
|
|
printf("%s: size:%lu.\n", __func__,
|
2002-10-16 02:10:08 +00:00
|
|
|
(unsigned long)size));
|
|
|
|
|
|
|
|
KEY_FREESP(&sp);
|
|
|
|
} else {
|
2008-12-27 22:58:16 +00:00
|
|
|
size = 0; /* XXX Should be panic?
|
2007-11-28 21:48:21 +00:00
|
|
|
* -> No, we are called w/o knowing if
|
|
|
|
* IPsec processing is needed. */
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
2008-12-27 22:58:16 +00:00
|
|
|
return (size);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check the variable replay window.
|
|
|
|
* ipsec_chkreplay() performs replay check before ICV verification.
|
|
|
|
* ipsec_updatereplay() updates replay bitmap. This must be called after
|
|
|
|
* ICV verification (it also performs replay check, which is usually done
|
|
|
|
* beforehand).
|
|
|
|
* 0 (zero) is returned if packet disallowed, 1 if packet permitted.
|
|
|
|
*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Based on RFC 2401.
|
2002-10-16 02:10:08 +00:00
|
|
|
*/
|
|
|
|
int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_chkreplay(u_int32_t seq, struct secasvar *sav)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
const struct secreplay *replay;
|
|
|
|
u_int32_t diff;
|
|
|
|
int fr;
|
2008-12-27 22:58:16 +00:00
|
|
|
u_int32_t wsizeb; /* Constant: bits of window size. */
|
|
|
|
int frlast; /* Constant: last frame. */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(sav != NULL, ("Null SA"));
|
|
|
|
IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
replay = sav->replay;
|
|
|
|
|
|
|
|
if (replay->wsize == 0)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1); /* No need to check replay. */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Constant. */
|
2002-10-16 02:10:08 +00:00
|
|
|
frlast = replay->wsize - 1;
|
|
|
|
wsizeb = replay->wsize << 3;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sequence number of 0 is invalid. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (seq == 0)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* First time is always okay. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (replay->count == 0)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
if (seq > replay->lastseq) {
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Larger sequences are okay. */
|
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
} else {
|
|
|
|
/* seq is equal or less than lastseq. */
|
|
|
|
diff = replay->lastseq - seq;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Over range to check, i.e. too old or wrapped. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (diff >= wsizeb)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
fr = frlast - diff / 8;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* This packet already seen? */
|
2002-10-16 02:10:08 +00:00
|
|
|
if ((replay->bitmap)[fr] & (1 << (diff % 8)))
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Out of order but good. */
|
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Check replay counter whether to update or not.
|
2002-10-16 02:10:08 +00:00
|
|
|
* OUT: 0: OK
|
|
|
|
* 1: NG
|
|
|
|
*/
|
|
|
|
int
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_updatereplay(u_int32_t seq, struct secasvar *sav)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
2015-04-18 16:58:33 +00:00
|
|
|
char buf[128];
|
2002-10-16 02:10:08 +00:00
|
|
|
struct secreplay *replay;
|
|
|
|
u_int32_t diff;
|
|
|
|
int fr;
|
2008-12-27 22:58:16 +00:00
|
|
|
u_int32_t wsizeb; /* Constant: bits of window size. */
|
|
|
|
int frlast; /* Constant: last frame. */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
IPSEC_ASSERT(sav != NULL, ("Null SA"));
|
|
|
|
IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
replay = sav->replay;
|
|
|
|
|
|
|
|
if (replay->wsize == 0)
|
2008-12-27 22:58:16 +00:00
|
|
|
goto ok; /* No need to check replay. */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Constant. */
|
2002-10-16 02:10:08 +00:00
|
|
|
frlast = replay->wsize - 1;
|
|
|
|
wsizeb = replay->wsize << 3;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Sequence number of 0 is invalid. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (seq == 0)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* First time. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (replay->count == 0) {
|
|
|
|
replay->lastseq = seq;
|
|
|
|
bzero(replay->bitmap, replay->wsize);
|
|
|
|
(replay->bitmap)[frlast] = 1;
|
|
|
|
goto ok;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (seq > replay->lastseq) {
|
|
|
|
/* seq is larger than lastseq. */
|
|
|
|
diff = seq - replay->lastseq;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* New larger sequence number. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (diff < wsizeb) {
|
2008-12-27 22:58:16 +00:00
|
|
|
/* In window. */
|
|
|
|
/* Set bit for this packet. */
|
2002-10-16 02:10:08 +00:00
|
|
|
vshiftl(replay->bitmap, diff, replay->wsize);
|
|
|
|
(replay->bitmap)[frlast] |= 1;
|
|
|
|
} else {
|
2008-12-27 22:58:16 +00:00
|
|
|
/* This packet has a "way larger". */
|
2002-10-16 02:10:08 +00:00
|
|
|
bzero(replay->bitmap, replay->wsize);
|
|
|
|
(replay->bitmap)[frlast] = 1;
|
|
|
|
}
|
|
|
|
replay->lastseq = seq;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Larger is good. */
|
2002-10-16 02:10:08 +00:00
|
|
|
} else {
|
|
|
|
/* seq is equal or less than lastseq. */
|
|
|
|
diff = replay->lastseq - seq;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Over range to check, i.e. too old or wrapped. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if (diff >= wsizeb)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
fr = frlast - diff / 8;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* This packet already seen? */
|
2002-10-16 02:10:08 +00:00
|
|
|
if ((replay->bitmap)[fr] & (1 << (diff % 8)))
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Mark as seen. */
|
2002-10-16 02:10:08 +00:00
|
|
|
(replay->bitmap)[fr] |= (1 << (diff % 8));
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Out of order but good. */
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
ok:
|
|
|
|
if (replay->count == ~0) {
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Set overflow flag. */
|
2002-10-16 02:10:08 +00:00
|
|
|
replay->overflow++;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* Don't increment, no more packets accepted. */
|
2002-10-16 02:10:08 +00:00
|
|
|
if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0)
|
2008-12-27 22:58:16 +00:00
|
|
|
return (1);
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n",
|
2015-04-18 16:58:33 +00:00
|
|
|
__func__, replay->overflow,
|
|
|
|
ipsec_logsastr(sav, buf, sizeof(buf))));
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
replay->count++;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2008-12-27 22:58:16 +00:00
|
|
|
* Shift variable length buffer to left.
|
2002-10-16 02:10:08 +00:00
|
|
|
* IN: bitmap: pointer to the buffer
|
|
|
|
* nbit: the number of to shift.
|
|
|
|
* wsize: buffer size (bytes).
|
|
|
|
*/
|
|
|
|
static void
|
2008-12-27 21:20:34 +00:00
|
|
|
vshiftl(unsigned char *bitmap, int nbit, int wsize)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
int s, j, i;
|
|
|
|
unsigned char over;
|
|
|
|
|
|
|
|
for (j = 0; j < nbit; j += 8) {
|
|
|
|
s = (nbit - j < 8) ? (nbit - j): 8;
|
|
|
|
bitmap[0] <<= s;
|
|
|
|
for (i = 1; i < wsize; i++) {
|
|
|
|
over = (bitmap[i] >> (8 - s));
|
|
|
|
bitmap[i] <<= s;
|
|
|
|
bitmap[i-1] |= over;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Return a printable string for the address. */
|
2015-04-18 16:58:33 +00:00
|
|
|
char*
|
|
|
|
ipsec_address(union sockaddr_union* sa, char *buf, socklen_t size)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
2008-12-27 22:58:16 +00:00
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
switch (sa->sa.sa_family) {
|
2006-06-04 19:32:32 +00:00
|
|
|
#ifdef INET
|
2002-10-16 02:10:08 +00:00
|
|
|
case AF_INET:
|
2015-04-18 16:58:33 +00:00
|
|
|
return (inet_ntop(AF_INET, &sa->sin.sin_addr, buf, size));
|
2002-10-16 02:10:08 +00:00
|
|
|
#endif /* INET */
|
2006-06-04 19:32:32 +00:00
|
|
|
#ifdef INET6
|
2002-10-16 02:10:08 +00:00
|
|
|
case AF_INET6:
|
2015-04-18 16:58:33 +00:00
|
|
|
return (inet_ntop(AF_INET6, &sa->sin6.sin6_addr, buf, size));
|
2002-10-16 02:10:08 +00:00
|
|
|
#endif /* INET6 */
|
|
|
|
default:
|
2008-12-27 22:58:16 +00:00
|
|
|
return ("(unknown address family)");
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-04-18 16:58:33 +00:00
|
|
|
char *
|
|
|
|
ipsec_logsastr(struct secasvar *sav, char *buf, size_t size)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
2015-04-18 16:58:33 +00:00
|
|
|
char sbuf[INET6_ADDRSTRLEN], dbuf[INET6_ADDRSTRLEN];
|
|
|
|
|
|
|
|
IPSEC_ASSERT(sav->sah->saidx.src.sa.sa_family ==
|
|
|
|
sav->sah->saidx.dst.sa.sa_family, ("address family mismatch"));
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2015-04-18 16:58:33 +00:00
|
|
|
snprintf(buf, size, "SA(SPI=%08lx src=%s dst=%s)",
|
|
|
|
(u_long)ntohl(sav->spi),
|
|
|
|
ipsec_address(&sav->sah->saidx.src, sbuf, sizeof(sbuf)),
|
|
|
|
ipsec_address(&sav->sah->saidx.dst, dbuf, sizeof(dbuf)));
|
2008-12-27 22:58:16 +00:00
|
|
|
return (buf);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2008-12-27 21:20:34 +00:00
|
|
|
ipsec_dumpmbuf(struct mbuf *m)
|
2002-10-16 02:10:08 +00:00
|
|
|
{
|
|
|
|
int totlen;
|
|
|
|
int i;
|
|
|
|
u_char *p;
|
|
|
|
|
|
|
|
totlen = 0;
|
|
|
|
printf("---\n");
|
|
|
|
while (m) {
|
|
|
|
p = mtod(m, u_char *);
|
|
|
|
for (i = 0; i < m->m_len; i++) {
|
|
|
|
printf("%02x ", p[i]);
|
|
|
|
totlen++;
|
|
|
|
if (totlen % 16 == 0)
|
|
|
|
printf("\n");
|
|
|
|
}
|
|
|
|
m = m->m_next;
|
|
|
|
}
|
|
|
|
if (totlen % 16 != 0)
|
|
|
|
printf("\n");
|
|
|
|
printf("---\n");
|
|
|
|
}
|
|
|
|
|
2004-01-27 17:45:28 +00:00
|
|
|
static void
|
2014-12-24 18:34:56 +00:00
|
|
|
def_policy_init(const void *unused __unused)
|
First pass at separating per-vnet initializer functions
from existing functions for initializing global state.
At this stage, the new per-vnet initializer functions are
directly called from the existing global initialization code,
which should in most cases result in compiler inlining those
new functions, hence yielding a near-zero functional change.
Modify the existing initializer functions which are invoked via
protosw, like ip_init() et. al., to allow them to be invoked
multiple times, i.e. per each vnet. Global state, if any,
is initialized only if such functions are called within the
context of vnet0, which will be determined via the
IS_DEFAULT_VNET(curvnet) check (currently always true).
While here, V_irtualize a few remaining global UMA zones
used by net/netinet/netipsec networking code. While it is
not yet clear to me or anybody else whether this is the right
thing to do, at this stage this makes the code more readable,
and makes it easier to track uncollected UMA-zone-backed
objects on vnet removal. In the long run, it's quite possible
that some form of shared use of UMA zone pools among multiple
vnets should be considered.
Bump __FreeBSD_version due to changes in layout of structs
vnet_ipfw, vnet_inet and vnet_net.
Approved by: julian (mentor)
2009-04-06 22:29:41 +00:00
|
|
|
{
|
|
|
|
|
2014-12-24 18:34:56 +00:00
|
|
|
bzero(&V_def_policy, sizeof(struct secpolicy));
|
|
|
|
V_def_policy.policy = IPSEC_POLICY_NONE;
|
|
|
|
V_def_policy.refcnt = 1;
|
2004-01-27 17:45:28 +00:00
|
|
|
}
|
2014-12-24 18:34:56 +00:00
|
|
|
VNET_SYSINIT(def_policy_init, SI_SUB_PROTO_DOMAININIT, SI_ORDER_ANY,
|
|
|
|
def_policy_init, NULL);
|
2004-01-27 17:45:28 +00:00
|
|
|
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
/* XXX This stuff doesn't belong here... */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
static struct xformsw* xforms = NULL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Register a transform; typically at system startup.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
xform_register(struct xformsw* xsp)
|
|
|
|
{
|
2008-12-27 22:58:16 +00:00
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
xsp->xf_next = xforms;
|
|
|
|
xforms = xsp;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize transform support in an sav.
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
xform_init(struct secasvar *sav, int xftype)
|
|
|
|
{
|
|
|
|
struct xformsw *xsp;
|
|
|
|
|
2008-12-27 22:58:16 +00:00
|
|
|
if (sav->tdb_xform != NULL) /* Previously initialized. */
|
|
|
|
return (0);
|
2002-10-16 02:10:08 +00:00
|
|
|
for (xsp = xforms; xsp; xsp = xsp->xf_next)
|
|
|
|
if (xsp->xf_type == xftype)
|
2008-12-27 22:58:16 +00:00
|
|
|
return ((*xsp->xf_init)(sav, xsp));
|
|
|
|
return (EINVAL);
|
2002-10-16 02:10:08 +00:00
|
|
|
}
|