]> git.saurik.com Git - apple/xnu.git/blob - bsd/netinet6/esp_input.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-3247.10.11.tar.gz
[apple/xnu.git] / bsd / netinet6 / esp_input.c
1 /*
2 * Copyright (c) 2008-2013 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $FreeBSD: src/sys/netinet6/esp_input.c,v 1.1.2.3 2001/07/03 11:01:50 ume Exp $ */
30 /* $KAME: esp_input.c,v 1.55 2001/03/23 08:08:47 itojun Exp $ */
31
32 /*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61 /*
62 * RFC1827/2406 Encapsulated Security Payload.
63 */
64
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #include <sys/malloc.h>
68 #include <sys/mbuf.h>
69 #include <sys/mcache.h>
70 #include <sys/domain.h>
71 #include <sys/protosw.h>
72 #include <sys/socket.h>
73 #include <sys/errno.h>
74 #include <sys/time.h>
75 #include <sys/kernel.h>
76 #include <sys/syslog.h>
77
78 #include <net/if.h>
79 #include <net/if_ipsec.h>
80 #include <net/route.h>
81 #include <kern/cpu_number.h>
82 #include <kern/locks.h>
83
84 #include <netinet/in.h>
85 #include <netinet/in_systm.h>
86 #include <netinet/ip.h>
87 #include <netinet/ip_var.h>
88 #include <netinet/in_var.h>
89 #include <netinet/ip_ecn.h>
90 #include <netinet/in_pcb.h>
91 #include <netinet/udp.h>
92 #if INET6
93 #include <netinet6/ip6_ecn.h>
94 #endif
95
96 #if INET6
97 #include <netinet/ip6.h>
98 #include <netinet6/in6_pcb.h>
99 #include <netinet6/ip6_var.h>
100 #include <netinet/icmp6.h>
101 #include <netinet6/ip6protosw.h>
102 #endif
103
104 #include <netinet6/ipsec.h>
105 #if INET6
106 #include <netinet6/ipsec6.h>
107 #endif
108 #include <netinet6/ah.h>
109 #if INET6
110 #include <netinet6/ah6.h>
111 #endif
112 #include <netinet6/esp.h>
113 #if INET6
114 #include <netinet6/esp6.h>
115 #endif
116 #include <netkey/key.h>
117 #include <netkey/keydb.h>
118 #include <netkey/key_debug.h>
119
120 #include <net/kpi_protocol.h>
121 #include <netinet/kpi_ipfilter_var.h>
122
123 #include <net/net_osdep.h>
124 #include <mach/sdt.h>
125
126 #include <sys/kdebug.h>
127 #define DBG_LAYER_BEG NETDBG_CODE(DBG_NETIPSEC, 1)
128 #define DBG_LAYER_END NETDBG_CODE(DBG_NETIPSEC, 3)
129 #define DBG_FNC_ESPIN NETDBG_CODE(DBG_NETIPSEC, (6 << 8))
130 #define DBG_FNC_DECRYPT NETDBG_CODE(DBG_NETIPSEC, (7 << 8))
131 #define IPLEN_FLIPPED
132
133 extern lck_mtx_t *sadb_mutex;
134
135 #if INET
136 #define ESPMAXLEN \
137 (sizeof(struct esp) < sizeof(struct newesp) \
138 ? sizeof(struct newesp) : sizeof(struct esp))
139
140 static struct ip *
141 esp4_input_strip_udp_encap (struct mbuf *m, int iphlen)
142 {
143 // strip the udp header that's encapsulating ESP
144 struct ip *ip;
145 size_t stripsiz = sizeof(struct udphdr);
146
147 ip = mtod(m, __typeof__(ip));
148 ovbcopy((caddr_t)ip, (caddr_t)(((u_char *)ip) + stripsiz), iphlen);
149 m->m_data += stripsiz;
150 m->m_len -= stripsiz;
151 m->m_pkthdr.len -= stripsiz;
152 ip = mtod(m, __typeof__(ip));
153 ip->ip_len = ip->ip_len - stripsiz;
154 ip->ip_p = IPPROTO_ESP;
155 return ip;
156 }
157
158 static struct ip6_hdr *
159 esp6_input_strip_udp_encap (struct mbuf *m, int ip6hlen)
160 {
161 // strip the udp header that's encapsulating ESP
162 struct ip6_hdr *ip6;
163 size_t stripsiz = sizeof(struct udphdr);
164
165 ip6 = mtod(m, __typeof__(ip6));
166 ovbcopy((caddr_t)ip6, (caddr_t)(((u_char *)ip6) + stripsiz), ip6hlen);
167 m->m_data += stripsiz;
168 m->m_len -= stripsiz;
169 m->m_pkthdr.len -= stripsiz;
170 ip6 = mtod(m, __typeof__(ip6));
171 ip6->ip6_plen = ip6->ip6_plen - stripsiz;
172 ip6->ip6_nxt = IPPROTO_ESP;
173 return ip6;
174 }
175
176 void
177 esp4_input(m, off)
178 struct mbuf *m;
179 int off;
180 {
181 struct ip *ip;
182 #if INET6
183 struct ip6_hdr *ip6;
184 #endif /* INET6 */
185 struct esp *esp;
186 struct esptail esptail;
187 u_int32_t spi;
188 u_int32_t seq;
189 struct secasvar *sav = NULL;
190 size_t taillen;
191 u_int16_t nxt;
192 const struct esp_algorithm *algo;
193 int ivlen;
194 size_t hlen;
195 size_t esplen;
196 sa_family_t ifamily;
197
198 KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_START, 0,0,0,0,0);
199 /* sanity check for alignment. */
200 if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) {
201 ipseclog((LOG_ERR, "IPv4 ESP input: packet alignment problem "
202 "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len));
203 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
204 goto bad;
205 }
206
207 if (m->m_len < off + ESPMAXLEN) {
208 m = m_pullup(m, off + ESPMAXLEN);
209 if (!m) {
210 ipseclog((LOG_DEBUG,
211 "IPv4 ESP input: can't pullup in esp4_input\n"));
212 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
213 goto bad;
214 }
215 }
216
217 /* Expect 32-bit aligned data pointer on strict-align platforms */
218 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
219
220 ip = mtod(m, struct ip *);
221 // expect udp-encap and esp packets only
222 if (ip->ip_p != IPPROTO_ESP &&
223 !(ip->ip_p == IPPROTO_UDP && off >= sizeof(struct udphdr))) {
224 ipseclog((LOG_DEBUG,
225 "IPv4 ESP input: invalid protocol type\n"));
226 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
227 goto bad;
228 }
229 esp = (struct esp *)(void *)(((u_int8_t *)ip) + off);
230 #ifdef _IP_VHL
231 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
232 #else
233 hlen = ip->ip_hl << 2;
234 #endif
235
236 /* find the sassoc. */
237 spi = esp->esp_spi;
238
239 if ((sav = key_allocsa(AF_INET,
240 (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst,
241 IPPROTO_ESP, spi)) == 0) {
242 ipseclog((LOG_WARNING,
243 "IPv4 ESP input: no key association found for spi %u\n",
244 (u_int32_t)ntohl(spi)));
245 IPSEC_STAT_INCREMENT(ipsecstat.in_nosa);
246 goto bad;
247 }
248 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
249 printf("DP esp4_input called to allocate SA:0x%llx\n",
250 (uint64_t)VM_KERNEL_ADDRPERM(sav)));
251 if (sav->state != SADB_SASTATE_MATURE
252 && sav->state != SADB_SASTATE_DYING) {
253 ipseclog((LOG_DEBUG,
254 "IPv4 ESP input: non-mature/dying SA found for spi %u\n",
255 (u_int32_t)ntohl(spi)));
256 IPSEC_STAT_INCREMENT(ipsecstat.in_badspi);
257 goto bad;
258 }
259 algo = esp_algorithm_lookup(sav->alg_enc);
260 if (!algo) {
261 ipseclog((LOG_DEBUG, "IPv4 ESP input: "
262 "unsupported encryption algorithm for spi %u\n",
263 (u_int32_t)ntohl(spi)));
264 IPSEC_STAT_INCREMENT(ipsecstat.in_badspi);
265 goto bad;
266 }
267
268 /* check if we have proper ivlen information */
269 ivlen = sav->ivlen;
270 if (ivlen < 0) {
271 ipseclog((LOG_ERR, "inproper ivlen in IPv4 ESP input: %s %s\n",
272 ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
273 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
274 goto bad;
275 }
276
277 seq = ntohl(((struct newesp *)esp)->esp_seq);
278
279 /* Save ICV from packet for verification later */
280 size_t siz = 0;
281 unsigned char saved_icv[AH_MAXSUMSIZE];
282 if (algo->finalizedecrypt) {
283 siz = algo->icvlen;
284 m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) saved_icv);
285 goto delay_icv;
286 }
287
288 if (!((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay
289 && (sav->alg_auth && sav->key_auth)))
290 goto noreplaycheck;
291
292 if (sav->alg_auth == SADB_X_AALG_NULL ||
293 sav->alg_auth == SADB_AALG_NONE)
294 goto noreplaycheck;
295
296 /*
297 * check for sequence number.
298 */
299 if (ipsec_chkreplay(seq, sav))
300 ; /*okey*/
301 else {
302 IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay);
303 ipseclog((LOG_WARNING,
304 "replay packet in IPv4 ESP input: %s %s\n",
305 ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
306 goto bad;
307 }
308
309 /* check ICV */
310 {
311 u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4)));
312 u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4)));
313 const struct ah_algorithm *sumalgo;
314
315 sumalgo = ah_algorithm_lookup(sav->alg_auth);
316 if (!sumalgo)
317 goto noreplaycheck;
318 siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
319 if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
320 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
321 goto bad;
322 }
323 if (AH_MAXSUMSIZE < siz) {
324 ipseclog((LOG_DEBUG,
325 "internal error: AH_MAXSUMSIZE must be larger than %lu\n",
326 (u_int32_t)siz));
327 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
328 goto bad;
329 }
330
331 m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) &sum0[0]);
332
333 if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) {
334 ipseclog((LOG_WARNING, "auth fail in IPv4 ESP input: %s %s\n",
335 ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
336 IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail);
337 goto bad;
338 }
339
340 if (bcmp(sum0, sum, siz) != 0) {
341 ipseclog((LOG_WARNING, "auth fail in IPv4 ESP input: %s %s\n",
342 ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
343 IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail);
344 goto bad;
345 }
346
347 delay_icv:
348
349 /* strip off the authentication data */
350 m_adj(m, -siz);
351 ip = mtod(m, struct ip *);
352 #ifdef IPLEN_FLIPPED
353 ip->ip_len = ip->ip_len - siz;
354 #else
355 ip->ip_len = htons(ntohs(ip->ip_len) - siz);
356 #endif
357 m->m_flags |= M_AUTHIPDGM;
358 IPSEC_STAT_INCREMENT(ipsecstat.in_espauthsucc);
359 }
360
361 /*
362 * update sequence number.
363 */
364 if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay) {
365 if (ipsec_updatereplay(seq, sav)) {
366 IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay);
367 goto bad;
368 }
369 }
370
371 noreplaycheck:
372
373 /* process main esp header. */
374 if (sav->flags & SADB_X_EXT_OLD) {
375 /* RFC 1827 */
376 esplen = sizeof(struct esp);
377 } else {
378 /* RFC 2406 */
379 if (sav->flags & SADB_X_EXT_DERIV)
380 esplen = sizeof(struct esp);
381 else
382 esplen = sizeof(struct newesp);
383 }
384
385 if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) {
386 ipseclog((LOG_WARNING,
387 "IPv4 ESP input: packet too short\n"));
388 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
389 goto bad;
390 }
391
392 if (m->m_len < off + esplen + ivlen) {
393 m = m_pullup(m, off + esplen + ivlen);
394 if (!m) {
395 ipseclog((LOG_DEBUG,
396 "IPv4 ESP input: can't pullup in esp4_input\n"));
397 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
398 goto bad;
399 }
400 }
401
402 /*
403 * pre-compute and cache intermediate key
404 */
405 if (esp_schedule(algo, sav) != 0) {
406 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
407 goto bad;
408 }
409
410 /*
411 * decrypt the packet.
412 */
413 if (!algo->decrypt)
414 panic("internal error: no decrypt function");
415 KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_START, 0,0,0,0,0);
416 if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
417 /* m is already freed */
418 m = NULL;
419 ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s\n",
420 ipsec_logsastr(sav)));
421 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
422 KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
423 goto bad;
424 }
425 KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 2,0,0,0,0);
426 IPSEC_STAT_INCREMENT(ipsecstat.in_esphist[sav->alg_enc]);
427
428 m->m_flags |= M_DECRYPTED;
429
430 if (algo->finalizedecrypt)
431 {
432 unsigned char tag[algo->icvlen];
433 if ((*algo->finalizedecrypt)(sav, tag, algo->icvlen)) {
434 ipseclog((LOG_ERR, "packet decryption ICV failure\n"));
435 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
436 KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
437 goto bad;
438 }
439 if (memcmp(saved_icv, tag, algo->icvlen)) {
440 ipseclog((LOG_ERR, "packet decryption ICV mismatch\n"));
441 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
442 KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
443 goto bad;
444 }
445 }
446
447 /*
448 * find the trailer of the ESP.
449 */
450 m_copydata(m, m->m_pkthdr.len - sizeof(esptail), sizeof(esptail),
451 (caddr_t)&esptail);
452 nxt = esptail.esp_nxt;
453 taillen = esptail.esp_padlen + sizeof(esptail);
454
455 if (m->m_pkthdr.len < taillen
456 || m->m_pkthdr.len - taillen < hlen) { /*?*/
457 ipseclog((LOG_WARNING,
458 "bad pad length in IPv4 ESP input: %s %s\n",
459 ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
460 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
461 goto bad;
462 }
463
464 /* strip off the trailing pad area. */
465 m_adj(m, -taillen);
466 ip = mtod(m, struct ip *);
467 #ifdef IPLEN_FLIPPED
468 ip->ip_len = ip->ip_len - taillen;
469 #else
470 ip->ip_len = htons(ntohs(ip->ip_len) - taillen);
471 #endif
472 if (ip->ip_p == IPPROTO_UDP) {
473 // offset includes the outer ip and udp header lengths.
474 if (m->m_len < off) {
475 m = m_pullup(m, off);
476 if (!m) {
477 ipseclog((LOG_DEBUG,
478 "IPv4 ESP input: invalid udp encapsulated ESP packet length \n"));
479 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
480 goto bad;
481 }
482 }
483
484 // check the UDP encap header to detect changes in the source port, and then strip the header
485 off -= sizeof(struct udphdr); // off no longer includes the udphdr's size
486 // if peer is behind nat and this is the latest esp packet
487 if ((sav->flags & SADB_X_EXT_NATT_DETECTED_PEER) != 0 &&
488 (sav->flags & SADB_X_EXT_OLD) == 0 &&
489 seq && sav->replay &&
490 seq >= sav->replay->lastseq) {
491 struct udphdr *encap_uh = (__typeof__(encap_uh))(void *)((caddr_t)ip + off);
492 if (encap_uh->uh_sport &&
493 ntohs(encap_uh->uh_sport) != sav->remote_ike_port) {
494 sav->remote_ike_port = ntohs(encap_uh->uh_sport);
495 }
496 }
497 ip = esp4_input_strip_udp_encap(m, off);
498 esp = (struct esp *)(void *)(((u_int8_t *)ip) + off);
499 }
500
501 if (sav->utun_is_keepalive_fn) {
502 if (sav->utun_is_keepalive_fn(sav->utun_pcb, &m, nxt, sav->flags, (off + esplen + ivlen))) {
503 if (m) {
504 // not really bad, we just wanna exit
505 IPSEC_STAT_INCREMENT(ipsecstat.in_success);
506 m = NULL;
507 }
508 goto bad;
509 }
510 }
511
512 /* was it transmitted over the IPsec tunnel SA? */
513 if (ipsec4_tunnel_validate(m, off + esplen + ivlen, nxt, sav, &ifamily)) {
514 ifaddr_t ifa;
515 struct sockaddr_storage addr;
516
517 /*
518 * strip off all the headers that precedes ESP header.
519 * IP4 xx ESP IP4' payload -> IP4' payload
520 *
521 * XXX more sanity checks
522 * XXX relationship with gif?
523 */
524 u_int8_t tos;
525
526 tos = ip->ip_tos;
527 m_adj(m, off + esplen + ivlen);
528 if (ifamily == AF_INET) {
529 struct sockaddr_in *ipaddr;
530
531 if (m->m_len < sizeof(*ip)) {
532 m = m_pullup(m, sizeof(*ip));
533 if (!m) {
534 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
535 goto bad;
536 }
537 }
538 ip = mtod(m, struct ip *);
539 /* ECN consideration. */
540 if (ip_ecn_egress(ip4_ipsec_ecn, &tos, &ip->ip_tos) == 0) {
541 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
542 goto bad;
543 }
544 if (!key_checktunnelsanity(sav, AF_INET,
545 (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst)) {
546 ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
547 "in ESP input: %s %s\n",
548 ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
549 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
550 goto bad;
551 }
552
553 if (ip_doscopedroute) {
554 bzero(&addr, sizeof(addr));
555 ipaddr = (__typeof__(ipaddr))&addr;
556 ipaddr->sin_family = AF_INET;
557 ipaddr->sin_len = sizeof(*ipaddr);
558 ipaddr->sin_addr = ip->ip_dst;
559 }
560 #if INET6
561 } else if (ifamily == AF_INET6) {
562 struct sockaddr_in6 *ip6addr;
563
564 /*
565 * m_pullup is prohibited in KAME IPv6 input processing
566 * but there's no other way!
567 */
568 if (m->m_len < sizeof(*ip6)) {
569 m = m_pullup(m, sizeof(*ip6));
570 if (!m) {
571 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
572 goto bad;
573 }
574 }
575
576 /*
577 * Expect 32-bit aligned data pointer on strict-align
578 * platforms.
579 */
580 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
581
582 ip6 = mtod(m, struct ip6_hdr *);
583
584 /* ECN consideration. */
585 if (ip64_ecn_egress(ip4_ipsec_ecn, &tos, &ip6->ip6_flow) == 0) {
586 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
587 goto bad;
588 }
589
590 if (!key_checktunnelsanity(sav, AF_INET6,
591 (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst)) {
592 ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
593 "in ESP input: %s %s\n",
594 ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
595 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
596 goto bad;
597 }
598
599 if (ip6_doscopedroute) {
600 bzero(&addr, sizeof(addr));
601 ip6addr = (__typeof__(ip6addr))&addr;
602 ip6addr->sin6_family = AF_INET6;
603 ip6addr->sin6_len = sizeof(*ip6addr);
604 ip6addr->sin6_addr = ip6->ip6_dst;
605 }
606 #endif /* INET6 */
607 } else {
608 ipseclog((LOG_ERR, "ipsec tunnel unsupported address family "
609 "in ESP input\n"));
610 goto bad;
611 }
612
613 key_sa_recordxfer(sav, m);
614 if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0 ||
615 ipsec_addhist(m, IPPROTO_IPV4, 0) != 0) {
616 IPSEC_STAT_INCREMENT(ipsecstat.in_nomem);
617 goto bad;
618 }
619
620 if (ip_doscopedroute || ip6_doscopedroute) {
621 // update the receiving interface address based on the inner address
622 ifa = ifa_ifwithaddr((struct sockaddr *)&addr);
623 if (ifa) {
624 m->m_pkthdr.rcvif = ifa->ifa_ifp;
625 IFA_REMREF(ifa);
626 }
627 }
628
629 /* Clear the csum flags, they can't be valid for the inner headers */
630 m->m_pkthdr.csum_flags = 0;
631
632 // Input via IPSec interface
633 if (sav->sah->ipsec_if != NULL) {
634 if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
635 m = NULL;
636 goto done;
637 } else {
638 goto bad;
639 }
640 }
641
642 if (sav->utun_in_fn) {
643 if (!(sav->utun_in_fn(sav->utun_pcb, &m, ifamily == AF_INET ? PF_INET : PF_INET6))) {
644 m = NULL;
645 // we just wanna exit since packet has been completely processed
646 goto bad;
647 }
648 }
649
650 if (proto_input(ifamily == AF_INET ? PF_INET : PF_INET6, m) != 0)
651 goto bad;
652
653 nxt = IPPROTO_DONE;
654 KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 2,0,0,0,0);
655 } else {
656 /*
657 * strip off ESP header and IV.
658 * even in m_pulldown case, we need to strip off ESP so that
659 * we can always compute checksum for AH correctly.
660 */
661 size_t stripsiz;
662
663 stripsiz = esplen + ivlen;
664
665 ip = mtod(m, struct ip *);
666 ovbcopy((caddr_t)ip, (caddr_t)(((u_char *)ip) + stripsiz), off);
667 m->m_data += stripsiz;
668 m->m_len -= stripsiz;
669 m->m_pkthdr.len -= stripsiz;
670
671 ip = mtod(m, struct ip *);
672 #ifdef IPLEN_FLIPPED
673 ip->ip_len = ip->ip_len - stripsiz;
674 #else
675 ip->ip_len = htons(ntohs(ip->ip_len) - stripsiz);
676 #endif
677 ip->ip_p = nxt;
678
679 key_sa_recordxfer(sav, m);
680 if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0) {
681 IPSEC_STAT_INCREMENT(ipsecstat.in_nomem);
682 goto bad;
683 }
684
685 /*
686 * Set the csum valid flag, if we authenticated the
687 * packet, the payload shouldn't be corrupt unless
688 * it was corrupted before being signed on the other
689 * side.
690 */
691 if (nxt == IPPROTO_TCP || nxt == IPPROTO_UDP) {
692 m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
693 m->m_pkthdr.csum_data = 0xFFFF;
694 }
695
696 if (nxt != IPPROTO_DONE) {
697 if ((ip_protox[nxt]->pr_flags & PR_LASTHDR) != 0 &&
698 ipsec4_in_reject(m, NULL)) {
699 IPSEC_STAT_INCREMENT(ipsecstat.in_polvio);
700 goto bad;
701 }
702 KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 3,0,0,0,0);
703
704 /* translate encapsulated UDP port ? */
705 if ((sav->flags & SADB_X_EXT_NATT_MULTIPLEUSERS) != 0) {
706 struct udphdr *udp;
707
708 if (nxt != IPPROTO_UDP) { /* not UPD packet - drop it */
709 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
710 goto bad;
711 }
712
713 if (m->m_len < off + sizeof(struct udphdr)) {
714 m = m_pullup(m, off + sizeof(struct udphdr));
715 if (!m) {
716 ipseclog((LOG_DEBUG,
717 "IPv4 ESP input: can't pullup UDP header in esp4_input\n"));
718 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
719 goto bad;
720 }
721 ip = mtod(m, struct ip *);
722 }
723 udp = (struct udphdr *)(void *)(((u_int8_t *)ip) + off);
724
725 lck_mtx_lock(sadb_mutex);
726 if (sav->natt_encapsulated_src_port == 0) {
727 sav->natt_encapsulated_src_port = udp->uh_sport;
728 } else if (sav->natt_encapsulated_src_port != udp->uh_sport) { /* something wrong */
729 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
730 lck_mtx_unlock(sadb_mutex);
731 goto bad;
732 }
733 lck_mtx_unlock(sadb_mutex);
734 udp->uh_sport = htons(sav->remote_ike_port);
735 udp->uh_sum = 0;
736 }
737
738 DTRACE_IP6(receive, struct mbuf *, m, struct inpcb *, NULL,
739 struct ip *, ip, struct ifnet *, m->m_pkthdr.rcvif,
740 struct ip *, ip, struct ip6_hdr *, NULL);
741
742 // Input via IPSec interface
743 if (sav->sah->ipsec_if != NULL) {
744 ip->ip_len = htons(ip->ip_len + hlen);
745 ip->ip_off = htons(ip->ip_off);
746 ip->ip_sum = 0;
747 ip->ip_sum = ip_cksum_hdr_in(m, hlen);
748 if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
749 m = NULL;
750 goto done;
751 } else {
752 goto bad;
753 }
754 }
755
756 if (sav->utun_in_fn) {
757 if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET))) {
758 m = NULL;
759 // we just wanna exit since packet has been completely processed
760 goto bad;
761 }
762 }
763
764 ip_proto_dispatch_in(m, off, nxt, 0);
765 } else
766 m_freem(m);
767 m = NULL;
768 }
769
770 done:
771 if (sav) {
772 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
773 printf("DP esp4_input call free SA:0x%llx\n",
774 (uint64_t)VM_KERNEL_ADDRPERM(sav)));
775 key_freesav(sav, KEY_SADB_UNLOCKED);
776 }
777 IPSEC_STAT_INCREMENT(ipsecstat.in_success);
778 return;
779
780 bad:
781 if (sav) {
782 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
783 printf("DP esp4_input call free SA:0x%llx\n",
784 (uint64_t)VM_KERNEL_ADDRPERM(sav)));
785 key_freesav(sav, KEY_SADB_UNLOCKED);
786 }
787 if (m)
788 m_freem(m);
789 KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 4,0,0,0,0);
790 return;
791 }
792 #endif /* INET */
793
794 #if INET6
795 int
796 esp6_input(struct mbuf **mp, int *offp, int proto)
797 {
798 #pragma unused(proto)
799 struct mbuf *m = *mp;
800 int off = *offp;
801 struct ip *ip;
802 struct ip6_hdr *ip6;
803 struct esp *esp;
804 struct esptail esptail;
805 u_int32_t spi;
806 u_int32_t seq;
807 struct secasvar *sav = NULL;
808 size_t taillen;
809 u_int16_t nxt;
810 char *nproto;
811 const struct esp_algorithm *algo;
812 int ivlen;
813 size_t esplen;
814 sa_family_t ifamily;
815
816 /* sanity check for alignment. */
817 if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) {
818 ipseclog((LOG_ERR, "IPv6 ESP input: packet alignment problem "
819 "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len));
820 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
821 goto bad;
822 }
823
824 #ifndef PULLDOWN_TEST
825 IP6_EXTHDR_CHECK(m, off, ESPMAXLEN, {return IPPROTO_DONE;});
826 esp = (struct esp *)(void *)(mtod(m, caddr_t) + off);
827 #else
828 IP6_EXTHDR_GET(esp, struct esp *, m, off, ESPMAXLEN);
829 if (esp == NULL) {
830 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
831 return IPPROTO_DONE;
832 }
833 #endif
834 /* Expect 32-bit data aligned pointer on strict-align platforms */
835 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
836
837 ip6 = mtod(m, struct ip6_hdr *);
838
839 if (ntohs(ip6->ip6_plen) == 0) {
840 ipseclog((LOG_ERR, "IPv6 ESP input: "
841 "ESP with IPv6 jumbogram is not supported.\n"));
842 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
843 goto bad;
844 }
845
846 nproto = ip6_get_prevhdr(m, off);
847 if (nproto == NULL || (*nproto != IPPROTO_ESP &&
848 !(*nproto == IPPROTO_UDP && off >= sizeof(struct udphdr)))) {
849 ipseclog((LOG_DEBUG, "IPv6 ESP input: invalid protocol type\n"));
850 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
851 goto bad;
852 }
853
854 /* find the sassoc. */
855 spi = esp->esp_spi;
856
857 if ((sav = key_allocsa(AF_INET6,
858 (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst,
859 IPPROTO_ESP, spi)) == 0) {
860 ipseclog((LOG_WARNING,
861 "IPv6 ESP input: no key association found for spi %u\n",
862 (u_int32_t)ntohl(spi)));
863 IPSEC_STAT_INCREMENT(ipsec6stat.in_nosa);
864 goto bad;
865 }
866 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
867 printf("DP esp6_input called to allocate SA:0x%llx\n",
868 (uint64_t)VM_KERNEL_ADDRPERM(sav)));
869 if (sav->state != SADB_SASTATE_MATURE
870 && sav->state != SADB_SASTATE_DYING) {
871 ipseclog((LOG_DEBUG,
872 "IPv6 ESP input: non-mature/dying SA found for spi %u\n",
873 (u_int32_t)ntohl(spi)));
874 IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi);
875 goto bad;
876 }
877 algo = esp_algorithm_lookup(sav->alg_enc);
878 if (!algo) {
879 ipseclog((LOG_DEBUG, "IPv6 ESP input: "
880 "unsupported encryption algorithm for spi %u\n",
881 (u_int32_t)ntohl(spi)));
882 IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi);
883 goto bad;
884 }
885
886 /* check if we have proper ivlen information */
887 ivlen = sav->ivlen;
888 if (ivlen < 0) {
889 ipseclog((LOG_ERR, "inproper ivlen in IPv6 ESP input: %s %s\n",
890 ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
891 IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi);
892 goto bad;
893 }
894
895 seq = ntohl(((struct newesp *)esp)->esp_seq);
896
897 /* Save ICV from packet for verification later */
898 size_t siz = 0;
899 unsigned char saved_icv[AH_MAXSUMSIZE];
900 if (algo->finalizedecrypt) {
901 siz = algo->icvlen;
902 m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) saved_icv);
903 goto delay_icv;
904 }
905
906 if (!((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay
907 && (sav->alg_auth && sav->key_auth)))
908 goto noreplaycheck;
909
910 if (sav->alg_auth == SADB_X_AALG_NULL ||
911 sav->alg_auth == SADB_AALG_NONE)
912 goto noreplaycheck;
913
914 /*
915 * check for sequence number.
916 */
917 if (ipsec_chkreplay(seq, sav))
918 ; /*okey*/
919 else {
920 IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay);
921 ipseclog((LOG_WARNING,
922 "replay packet in IPv6 ESP input: %s %s\n",
923 ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
924 goto bad;
925 }
926
927 /* check ICV */
928 {
929 u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4)));
930 u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4)));
931 const struct ah_algorithm *sumalgo;
932
933 sumalgo = ah_algorithm_lookup(sav->alg_auth);
934 if (!sumalgo)
935 goto noreplaycheck;
936 siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
937 if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
938 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
939 goto bad;
940 }
941 if (AH_MAXSUMSIZE < siz) {
942 ipseclog((LOG_DEBUG,
943 "internal error: AH_MAXSUMSIZE must be larger than %lu\n",
944 (u_int32_t)siz));
945 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
946 goto bad;
947 }
948
949 m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) &sum0[0]);
950
951 if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) {
952 ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n",
953 ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
954 IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail);
955 goto bad;
956 }
957
958 if (bcmp(sum0, sum, siz) != 0) {
959 ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n",
960 ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
961 IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail);
962 goto bad;
963 }
964
965 delay_icv:
966
967 /* strip off the authentication data */
968 m_adj(m, -siz);
969 ip6 = mtod(m, struct ip6_hdr *);
970 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - siz);
971
972 m->m_flags |= M_AUTHIPDGM;
973 IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthsucc);
974 }
975
976 /*
977 * update sequence number.
978 */
979 if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay) {
980 if (ipsec_updatereplay(seq, sav)) {
981 IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay);
982 goto bad;
983 }
984 }
985
986 noreplaycheck:
987
988 /* process main esp header. */
989 if (sav->flags & SADB_X_EXT_OLD) {
990 /* RFC 1827 */
991 esplen = sizeof(struct esp);
992 } else {
993 /* RFC 2406 */
994 if (sav->flags & SADB_X_EXT_DERIV)
995 esplen = sizeof(struct esp);
996 else
997 esplen = sizeof(struct newesp);
998 }
999
1000 if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) {
1001 ipseclog((LOG_WARNING,
1002 "IPv6 ESP input: packet too short\n"));
1003 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1004 goto bad;
1005 }
1006
1007 #ifndef PULLDOWN_TEST
1008 IP6_EXTHDR_CHECK(m, off, esplen + ivlen, return IPPROTO_DONE); /*XXX*/
1009 #else
1010 IP6_EXTHDR_GET(esp, struct esp *, m, off, esplen + ivlen);
1011 if (esp == NULL) {
1012 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1013 m = NULL;
1014 goto bad;
1015 }
1016 #endif
1017 ip6 = mtod(m, struct ip6_hdr *); /*set it again just in case*/
1018
1019 /*
1020 * pre-compute and cache intermediate key
1021 */
1022 if (esp_schedule(algo, sav) != 0) {
1023 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1024 goto bad;
1025 }
1026
1027 /*
1028 * decrypt the packet.
1029 */
1030 if (!algo->decrypt)
1031 panic("internal error: no decrypt function");
1032 if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
1033 /* m is already freed */
1034 m = NULL;
1035 ipseclog((LOG_ERR, "decrypt fail in IPv6 ESP input: %s\n",
1036 ipsec_logsastr(sav)));
1037 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1038 goto bad;
1039 }
1040 IPSEC_STAT_INCREMENT(ipsec6stat.in_esphist[sav->alg_enc]);
1041
1042 m->m_flags |= M_DECRYPTED;
1043
1044 if (algo->finalizedecrypt)
1045 {
1046 unsigned char tag[algo->icvlen];
1047 if ((*algo->finalizedecrypt)(sav, tag, algo->icvlen)) {
1048 ipseclog((LOG_ERR, "packet decryption ICV failure\n"));
1049 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
1050 KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
1051 goto bad;
1052 }
1053 if (memcmp(saved_icv, tag, algo->icvlen)) {
1054 ipseclog((LOG_ERR, "packet decryption ICV mismatch\n"));
1055 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
1056 KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
1057 goto bad;
1058 }
1059 }
1060
1061 /*
1062 * find the trailer of the ESP.
1063 */
1064 m_copydata(m, m->m_pkthdr.len - sizeof(esptail), sizeof(esptail),
1065 (caddr_t)&esptail);
1066 nxt = esptail.esp_nxt;
1067 taillen = esptail.esp_padlen + sizeof(esptail);
1068
1069 if (m->m_pkthdr.len < taillen
1070 || m->m_pkthdr.len - taillen < sizeof(struct ip6_hdr)) { /*?*/
1071 ipseclog((LOG_WARNING,
1072 "bad pad length in IPv6 ESP input: %s %s\n",
1073 ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
1074 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1075 goto bad;
1076 }
1077
1078 /* strip off the trailing pad area. */
1079 m_adj(m, -taillen);
1080 ip6 = mtod(m, struct ip6_hdr *);
1081 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - taillen);
1082
1083 if (sav->utun_is_keepalive_fn) {
1084 if (sav->utun_is_keepalive_fn(sav->utun_pcb, &m, nxt, sav->flags, (off + esplen + ivlen))) {
1085 if (m) {
1086 // not really bad, we just wanna exit
1087 IPSEC_STAT_INCREMENT(ipsec6stat.in_success);
1088 m = NULL;
1089 }
1090 goto bad;
1091 }
1092 }
1093
1094 if (*nproto == IPPROTO_UDP) {
1095 // offset includes the outer ip and udp header lengths.
1096 if (m->m_len < off) {
1097 m = m_pullup(m, off);
1098 if (!m) {
1099 ipseclog((LOG_DEBUG,
1100 "IPv6 ESP input: invalid udp encapsulated ESP packet length\n"));
1101 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1102 goto bad;
1103 }
1104 }
1105
1106 // check the UDP encap header to detect changes in the source port, and then strip the header
1107 off -= sizeof(struct udphdr); // off no longer includes the udphdr's size
1108 // if peer is behind nat and this is the latest esp packet
1109 if ((sav->flags & SADB_X_EXT_NATT_DETECTED_PEER) != 0 &&
1110 (sav->flags & SADB_X_EXT_OLD) == 0 &&
1111 seq && sav->replay &&
1112 seq >= sav->replay->lastseq) {
1113 struct udphdr *encap_uh = (__typeof__(encap_uh))(void *)((caddr_t)ip6 + off);
1114 if (encap_uh->uh_sport &&
1115 ntohs(encap_uh->uh_sport) != sav->remote_ike_port) {
1116 sav->remote_ike_port = ntohs(encap_uh->uh_sport);
1117 }
1118 }
1119 ip6 = esp6_input_strip_udp_encap(m, off);
1120 esp = (struct esp *)(void *)(((u_int8_t *)ip6) + off);
1121 }
1122
1123
1124 /* was it transmitted over the IPsec tunnel SA? */
1125 if (ipsec6_tunnel_validate(m, off + esplen + ivlen, nxt, sav, &ifamily)) {
1126 ifaddr_t ifa;
1127 struct sockaddr_storage addr;
1128
1129 /*
1130 * strip off all the headers that precedes ESP header.
1131 * IP6 xx ESP IP6' payload -> IP6' payload
1132 *
1133 * XXX more sanity checks
1134 * XXX relationship with gif?
1135 */
1136 u_int32_t flowinfo; /*net endian*/
1137 flowinfo = ip6->ip6_flow;
1138 m_adj(m, off + esplen + ivlen);
1139 if (ifamily == AF_INET6) {
1140 if (m->m_len < sizeof(*ip6)) {
1141 #ifndef PULLDOWN_TEST
1142 /*
1143 * m_pullup is prohibited in KAME IPv6 input processing
1144 * but there's no other way!
1145 */
1146 #else
1147 /* okay to pullup in m_pulldown style */
1148 #endif
1149 m = m_pullup(m, sizeof(*ip6));
1150 if (!m) {
1151 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1152 goto bad;
1153 }
1154 }
1155 ip6 = mtod(m, struct ip6_hdr *);
1156 /* ECN consideration. */
1157 if (ip6_ecn_egress(ip6_ipsec_ecn, &flowinfo, &ip6->ip6_flow) == 0) {
1158 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1159 goto bad;
1160 }
1161 if (!key_checktunnelsanity(sav, AF_INET6,
1162 (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst)) {
1163 ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
1164 "in IPv6 ESP input: %s %s\n",
1165 ipsec6_logpacketstr(ip6, spi),
1166 ipsec_logsastr(sav)));
1167 IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
1168 goto bad;
1169 }
1170
1171 if (ip6_doscopedroute) {
1172 struct sockaddr_in6 *ip6addr;
1173
1174 bzero(&addr, sizeof(addr));
1175 ip6addr = (__typeof__(ip6addr))&addr;
1176 ip6addr->sin6_family = AF_INET6;
1177 ip6addr->sin6_len = sizeof(*ip6addr);
1178 ip6addr->sin6_addr = ip6->ip6_dst;
1179 }
1180 } else if (ifamily == AF_INET) {
1181 struct sockaddr_in *ipaddr;
1182
1183 if (m->m_len < sizeof(*ip)) {
1184 m = m_pullup(m, sizeof(*ip));
1185 if (!m) {
1186 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
1187 goto bad;
1188 }
1189 }
1190 ip = mtod(m, struct ip *);
1191 /* ECN consideration. */
1192 if (ip46_ecn_egress(ip6_ipsec_ecn, &flowinfo, &ip->ip_tos) == 0) {
1193 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
1194 goto bad;
1195 }
1196 if (!key_checktunnelsanity(sav, AF_INET,
1197 (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst)) {
1198 ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
1199 "in ESP input: %s %s\n",
1200 ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
1201 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
1202 goto bad;
1203 }
1204
1205 if (ip_doscopedroute) {
1206 bzero(&addr, sizeof(addr));
1207 ipaddr = (__typeof__(ipaddr))&addr;
1208 ipaddr->sin_family = AF_INET;
1209 ipaddr->sin_len = sizeof(*ipaddr);
1210 ipaddr->sin_addr = ip->ip_dst;
1211 }
1212 }
1213
1214 key_sa_recordxfer(sav, m);
1215 if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0 ||
1216 ipsec_addhist(m, IPPROTO_IPV6, 0) != 0) {
1217 IPSEC_STAT_INCREMENT(ipsec6stat.in_nomem);
1218 goto bad;
1219 }
1220
1221 if (ip_doscopedroute || ip6_doscopedroute) {
1222 // update the receiving interface address based on the inner address
1223 ifa = ifa_ifwithaddr((struct sockaddr *)&addr);
1224 if (ifa) {
1225 m->m_pkthdr.rcvif = ifa->ifa_ifp;
1226 IFA_REMREF(ifa);
1227 }
1228 }
1229
1230 // Input via IPSec interface
1231 if (sav->sah->ipsec_if != NULL) {
1232 if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
1233 m = NULL;
1234 nxt = IPPROTO_DONE;
1235 goto done;
1236 } else {
1237 goto bad;
1238 }
1239 }
1240
1241 if (sav->utun_in_fn) {
1242 if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET6))) {
1243 m = NULL;
1244 // we just wanna exit since packet has been completely processed
1245 goto bad;
1246 }
1247 }
1248
1249 if (proto_input(PF_INET6, m) != 0)
1250 goto bad;
1251 nxt = IPPROTO_DONE;
1252 } else {
1253 /*
1254 * strip off ESP header and IV.
1255 * even in m_pulldown case, we need to strip off ESP so that
1256 * we can always compute checksum for AH correctly.
1257 */
1258 size_t stripsiz;
1259 char *prvnxtp;
1260
1261 /*
1262 * Set the next header field of the previous header correctly.
1263 */
1264 prvnxtp = ip6_get_prevhdr(m, off); /* XXX */
1265 *prvnxtp = nxt;
1266
1267 stripsiz = esplen + ivlen;
1268
1269 ip6 = mtod(m, struct ip6_hdr *);
1270 if (m->m_len >= stripsiz + off) {
1271 ovbcopy((caddr_t)ip6, ((caddr_t)ip6) + stripsiz, off);
1272 m->m_data += stripsiz;
1273 m->m_len -= stripsiz;
1274 m->m_pkthdr.len -= stripsiz;
1275 } else {
1276 /*
1277 * this comes with no copy if the boundary is on
1278 * cluster
1279 */
1280 struct mbuf *n;
1281
1282 n = m_split(m, off, M_DONTWAIT);
1283 if (n == NULL) {
1284 /* m is retained by m_split */
1285 goto bad;
1286 }
1287 m_adj(n, stripsiz);
1288 /* m_cat does not update m_pkthdr.len */
1289 m->m_pkthdr.len += n->m_pkthdr.len;
1290 m_cat(m, n);
1291 }
1292
1293 #ifndef PULLDOWN_TEST
1294 /*
1295 * KAME requires that the packet to be contiguous on the
1296 * mbuf. We need to make that sure.
1297 * this kind of code should be avoided.
1298 * XXX other conditions to avoid running this part?
1299 */
1300 if (m->m_len != m->m_pkthdr.len) {
1301 struct mbuf *n = NULL;
1302 int maxlen;
1303
1304 MGETHDR(n, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1305 maxlen = MHLEN;
1306 if (n)
1307 M_COPY_PKTHDR(n, m);
1308 if (n && m->m_pkthdr.len > maxlen) {
1309 MCLGET(n, M_DONTWAIT);
1310 maxlen = MCLBYTES;
1311 if ((n->m_flags & M_EXT) == 0) {
1312 m_free(n);
1313 n = NULL;
1314 }
1315 }
1316 if (!n) {
1317 printf("esp6_input: mbuf allocation failed\n");
1318 goto bad;
1319 }
1320
1321 if (m->m_pkthdr.len <= maxlen) {
1322 m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t));
1323 n->m_len = m->m_pkthdr.len;
1324 n->m_pkthdr.len = m->m_pkthdr.len;
1325 n->m_next = NULL;
1326 m_freem(m);
1327 } else {
1328 m_copydata(m, 0, maxlen, mtod(n, caddr_t));
1329 n->m_len = maxlen;
1330 n->m_pkthdr.len = m->m_pkthdr.len;
1331 n->m_next = m;
1332 m_adj(m, maxlen);
1333 m->m_flags &= ~M_PKTHDR;
1334 }
1335 m = n;
1336 }
1337 #endif
1338
1339 ip6 = mtod(m, struct ip6_hdr *);
1340 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - stripsiz);
1341
1342 key_sa_recordxfer(sav, m);
1343 if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0) {
1344 IPSEC_STAT_INCREMENT(ipsec6stat.in_nomem);
1345 goto bad;
1346 }
1347
1348 // Input via IPSec interface
1349 if (sav->sah->ipsec_if != NULL) {
1350 if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
1351 m = NULL;
1352 nxt = IPPROTO_DONE;
1353 goto done;
1354 } else {
1355 goto bad;
1356 }
1357 }
1358
1359 if (sav->utun_in_fn) {
1360 if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET6))) {
1361 m = NULL;
1362 // we just wanna exit since packet has been completely processed
1363 goto bad;
1364 }
1365 }
1366 }
1367
1368 done:
1369 *offp = off;
1370 *mp = m;
1371 if (sav) {
1372 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1373 printf("DP esp6_input call free SA:0x%llx\n",
1374 (uint64_t)VM_KERNEL_ADDRPERM(sav)));
1375 key_freesav(sav, KEY_SADB_UNLOCKED);
1376 }
1377 IPSEC_STAT_INCREMENT(ipsec6stat.in_success);
1378 return nxt;
1379
1380 bad:
1381 if (sav) {
1382 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1383 printf("DP esp6_input call free SA:0x%llx\n",
1384 (uint64_t)VM_KERNEL_ADDRPERM(sav)));
1385 key_freesav(sav, KEY_SADB_UNLOCKED);
1386 }
1387 if (m)
1388 m_freem(m);
1389 return IPPROTO_DONE;
1390 }
1391
1392 void
1393 esp6_ctlinput(cmd, sa, d)
1394 int cmd;
1395 struct sockaddr *sa;
1396 void *d;
1397 {
1398 const struct newesp *espp;
1399 struct newesp esp;
1400 struct ip6ctlparam *ip6cp = NULL, ip6cp1;
1401 struct secasvar *sav;
1402 struct ip6_hdr *ip6;
1403 struct mbuf *m;
1404 int off;
1405 struct sockaddr_in6 *sa6_src, *sa6_dst;
1406
1407 if (sa->sa_family != AF_INET6 ||
1408 sa->sa_len != sizeof(struct sockaddr_in6))
1409 return;
1410 if ((unsigned)cmd >= PRC_NCMDS)
1411 return;
1412
1413 /* if the parameter is from icmp6, decode it. */
1414 if (d != NULL) {
1415 ip6cp = (struct ip6ctlparam *)d;
1416 m = ip6cp->ip6c_m;
1417 ip6 = ip6cp->ip6c_ip6;
1418 off = ip6cp->ip6c_off;
1419 } else {
1420 m = NULL;
1421 ip6 = NULL;
1422 }
1423
1424 if (ip6) {
1425 /*
1426 * Notify the error to all possible sockets via pfctlinput2.
1427 * Since the upper layer information (such as protocol type,
1428 * source and destination ports) is embedded in the encrypted
1429 * data and might have been cut, we can't directly call
1430 * an upper layer ctlinput function. However, the pcbnotify
1431 * function will consider source and destination addresses
1432 * as well as the flow info value, and may be able to find
1433 * some PCB that should be notified.
1434 * Although pfctlinput2 will call esp6_ctlinput(), there is
1435 * no possibility of an infinite loop of function calls,
1436 * because we don't pass the inner IPv6 header.
1437 */
1438 bzero(&ip6cp1, sizeof(ip6cp1));
1439 ip6cp1.ip6c_src = ip6cp->ip6c_src;
1440 pfctlinput2(cmd, sa, (void *)&ip6cp1);
1441
1442 /*
1443 * Then go to special cases that need ESP header information.
1444 * XXX: We assume that when ip6 is non NULL,
1445 * M and OFF are valid.
1446 */
1447
1448 /* check if we can safely examine src and dst ports */
1449 if (m->m_pkthdr.len < off + sizeof(esp))
1450 return;
1451
1452 if (m->m_len < off + sizeof(esp)) {
1453 /*
1454 * this should be rare case,
1455 * so we compromise on this copy...
1456 */
1457 m_copydata(m, off, sizeof(esp), (caddr_t)&esp);
1458 espp = &esp;
1459 } else
1460 espp = (struct newesp*)(void *)(mtod(m, caddr_t) + off);
1461
1462 if (cmd == PRC_MSGSIZE) {
1463 int valid = 0;
1464
1465 /*
1466 * Check to see if we have a valid SA corresponding to
1467 * the address in the ICMP message payload.
1468 */
1469 sa6_src = ip6cp->ip6c_src;
1470 sa6_dst = (struct sockaddr_in6 *)(void *)sa;
1471 sav = key_allocsa(AF_INET6,
1472 (caddr_t)&sa6_src->sin6_addr,
1473 (caddr_t)&sa6_dst->sin6_addr,
1474 IPPROTO_ESP, espp->esp_spi);
1475 if (sav) {
1476 if (sav->state == SADB_SASTATE_MATURE ||
1477 sav->state == SADB_SASTATE_DYING)
1478 valid++;
1479 key_freesav(sav, KEY_SADB_UNLOCKED);
1480 }
1481
1482 /* XXX Further validation? */
1483
1484 /*
1485 * Depending on the value of "valid" and routing table
1486 * size (mtudisc_{hi,lo}wat), we will:
1487 * - recalcurate the new MTU and create the
1488 * corresponding routing entry, or
1489 * - ignore the MTU change notification.
1490 */
1491 icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
1492 }
1493 } else {
1494 /* we normally notify any pcb here */
1495 }
1496 }
1497 #endif /* INET6 */
mirror of XNU