X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/91447636331957f3d9b5ca5b508f07c526b0074d..39236c6e673c41db228275375ab7fdb0f837b292:/bsd/netinet6/esp_input.c diff --git a/bsd/netinet6/esp_input.c b/bsd/netinet6/esp_input.c index 4b080c6b4..9d0e549f8 100644 --- a/bsd/netinet6/esp_input.c +++ b/bsd/netinet6/esp_input.c @@ -1,3 +1,31 @@ +/* + * Copyright (c) 2008-2013 Apple Inc. All rights reserved. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ + * + * This file contains Original Code and/or Modifications of Original Code + * as defined in and that are subject to the Apple Public Source License + * Version 2.0 (the 'License'). You may not use this file except in + * compliance with the License. The rights granted to you under the License + * may not be used to create, or enable the creation or redistribution of, + * unlawful or unlicensed copies of an Apple operating system, or to + * circumvent, violate, or enable the circumvention or violation of, any + * terms of an Apple operating system software license agreement. + * + * Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this file. + * + * The Original Code and all software distributed under the License are + * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER + * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, + * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. + * Please see the License for the specific language governing rights and + * limitations under the License. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ + */ + /* $FreeBSD: src/sys/netinet6/esp_input.c,v 1.1.2.3 2001/07/03 11:01:50 ume Exp $ */ /* $KAME: esp_input.c,v 1.55 2001/03/23 08:08:47 itojun Exp $ */ @@ -38,6 +66,7 @@ #include #include #include +#include #include #include #include @@ -58,6 +87,7 @@ #include #include #include +#include #if INET6 #include #endif @@ -86,8 +116,11 @@ #include #include +#include +#include #include +#include #include #define DBG_LAYER_BEG NETDBG_CODE(DBG_NETIPSEC, 1) @@ -96,23 +129,44 @@ #define DBG_FNC_DECRYPT NETDBG_CODE(DBG_NETIPSEC, (7 << 8)) #define IPLEN_FLIPPED -extern lck_mtx_t *sadb_mutex; -#if INET -extern struct protosw inetsw[]; +extern lck_mtx_t *sadb_mutex; +#if INET #define ESPMAXLEN \ (sizeof(struct esp) < sizeof(struct newesp) \ ? sizeof(struct newesp) : sizeof(struct esp)) +static struct ip * +esp4_input_strip_UDP_encap (struct mbuf *m, int iphlen) +{ + // strip the udp header that's encapsulating ESP + struct ip *ip; + size_t stripsiz = sizeof(struct udphdr); + + ip = mtod(m, __typeof__(ip)); + ovbcopy((caddr_t)ip, (caddr_t)(((u_char *)ip) + stripsiz), iphlen); + m->m_data += stripsiz; + m->m_len -= stripsiz; + m->m_pkthdr.len -= stripsiz; + ip = mtod(m, __typeof__(ip)); + ip->ip_len = ip->ip_len - stripsiz; + ip->ip_p = IPPROTO_ESP; + return ip; +} + void esp4_input(m, off) struct mbuf *m; int off; { struct ip *ip; +#if INET6 + struct ip6_hdr *ip6; +#endif /* INET6 */ struct esp *esp; struct esptail esptail; u_int32_t spi; + u_int32_t seq; struct secasvar *sav = NULL; size_t taillen; u_int16_t nxt; @@ -120,16 +174,14 @@ esp4_input(m, off) int ivlen; size_t hlen; size_t esplen; - int s; - - lck_mtx_lock(sadb_mutex); + sa_family_t ifamily; KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_START, 0,0,0,0,0); /* sanity check for alignment. */ if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) { ipseclog((LOG_ERR, "IPv4 ESP input: packet alignment problem " "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len)); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } @@ -138,13 +190,24 @@ esp4_input(m, off) if (!m) { ipseclog((LOG_DEBUG, "IPv4 ESP input: can't pullup in esp4_input\n")); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } } + /* Expect 32-bit aligned data pointer on strict-align platforms */ + MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); + ip = mtod(m, struct ip *); - esp = (struct esp *)(((u_int8_t *)ip) + off); + // expect udp-encap and esp packets only + if (ip->ip_p != IPPROTO_ESP && + !(ip->ip_p == IPPROTO_UDP && off >= sizeof(struct udphdr))) { + ipseclog((LOG_DEBUG, + "IPv4 ESP input: invalid protocol type\n")); + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } + esp = (struct esp *)(void *)(((u_int8_t *)ip) + off); #ifdef _IP_VHL hlen = IP_VHL_HL(ip->ip_vhl) << 2; #else @@ -160,17 +223,18 @@ esp4_input(m, off) ipseclog((LOG_WARNING, "IPv4 ESP input: no key association found for spi %u\n", (u_int32_t)ntohl(spi))); - ipsecstat.in_nosa++; + IPSEC_STAT_INCREMENT(ipsecstat.in_nosa); goto bad; } KEYDEBUG(KEYDEBUG_IPSEC_STAMP, - printf("DP esp4_input called to allocate SA:%p\n", sav)); + printf("DP esp4_input called to allocate SA:0x%llx\n", + (uint64_t)VM_KERNEL_ADDRPERM(sav))); if (sav->state != SADB_SASTATE_MATURE && sav->state != SADB_SASTATE_DYING) { ipseclog((LOG_DEBUG, "IPv4 ESP input: non-mature/dying SA found for spi %u\n", (u_int32_t)ntohl(spi))); - ipsecstat.in_badspi++; + IPSEC_STAT_INCREMENT(ipsecstat.in_badspi); goto bad; } algo = esp_algorithm_lookup(sav->alg_enc); @@ -178,7 +242,7 @@ esp4_input(m, off) ipseclog((LOG_DEBUG, "IPv4 ESP input: " "unsupported encryption algorithm for spi %u\n", (u_int32_t)ntohl(spi))); - ipsecstat.in_badspi++; + IPSEC_STAT_INCREMENT(ipsecstat.in_badspi); goto bad; } @@ -187,10 +251,11 @@ esp4_input(m, off) if (ivlen < 0) { ipseclog((LOG_ERR, "inproper ivlen in IPv4 ESP input: %s %s\n", ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } + seq = ntohl(((struct newesp *)esp)->esp_seq); if (!((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay && (sav->alg_auth && sav->key_auth))) goto noreplaycheck; @@ -202,10 +267,10 @@ esp4_input(m, off) /* * check for sequence number. */ - if (ipsec_chkreplay(ntohl(((struct newesp *)esp)->esp_seq), sav)) + if (ipsec_chkreplay(seq, sav)) ; /*okey*/ else { - ipsecstat.in_espreplay++; + IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay); ipseclog((LOG_WARNING, "replay packet in IPv4 ESP input: %s %s\n", ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); @@ -214,8 +279,8 @@ esp4_input(m, off) /* check ICV */ { - u_char sum0[AH_MAXSUMSIZE]; - u_char sum[AH_MAXSUMSIZE]; + u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4))); + u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4))); const struct ah_algorithm *sumalgo; size_t siz; @@ -224,30 +289,30 @@ esp4_input(m, off) goto noreplaycheck; siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1)); if (m->m_pkthdr.len < off + ESPMAXLEN + siz) { - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } if (AH_MAXSUMSIZE < siz) { ipseclog((LOG_DEBUG, "internal error: AH_MAXSUMSIZE must be larger than %lu\n", - (u_long)siz)); - ipsecstat.in_inval++; + (u_int32_t)siz)); + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } - m_copydata(m, m->m_pkthdr.len - siz, siz, &sum0[0]); + m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) &sum0[0]); if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) { ipseclog((LOG_WARNING, "auth fail in IPv4 ESP input: %s %s\n", ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); - ipsecstat.in_espauthfail++; + IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail); goto bad; } if (bcmp(sum0, sum, siz) != 0) { ipseclog((LOG_WARNING, "auth fail in IPv4 ESP input: %s %s\n", ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); - ipsecstat.in_espauthfail++; + IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail); goto bad; } @@ -260,15 +325,15 @@ esp4_input(m, off) ip->ip_len = htons(ntohs(ip->ip_len) - siz); #endif m->m_flags |= M_AUTHIPDGM; - ipsecstat.in_espauthsucc++; + IPSEC_STAT_INCREMENT(ipsecstat.in_espauthsucc); } /* * update sequence number. */ if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay) { - if (ipsec_updatereplay(ntohl(((struct newesp *)esp)->esp_seq), sav)) { - ipsecstat.in_espreplay++; + if (ipsec_updatereplay(seq, sav)) { + IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay); goto bad; } } @@ -290,7 +355,7 @@ noreplaycheck: if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) { ipseclog((LOG_WARNING, "IPv4 ESP input: packet too short\n")); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } @@ -299,7 +364,7 @@ noreplaycheck: if (!m) { ipseclog((LOG_DEBUG, "IPv4 ESP input: can't pullup in esp4_input\n")); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } } @@ -308,7 +373,7 @@ noreplaycheck: * pre-compute and cache intermediate key */ if (esp_schedule(algo, sav) != 0) { - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } @@ -323,12 +388,12 @@ noreplaycheck: m = NULL; ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s\n", ipsec_logsastr(sav))); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0); goto bad; } KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 2,0,0,0,0); - ipsecstat.in_esphist[sav->alg_enc]++; + IPSEC_STAT_INCREMENT(ipsecstat.in_esphist[sav->alg_enc]); m->m_flags |= M_DECRYPTED; @@ -345,21 +410,63 @@ noreplaycheck: ipseclog((LOG_WARNING, "bad pad length in IPv4 ESP input: %s %s\n", ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } /* strip off the trailing pad area. */ m_adj(m, -taillen); - + ip = mtod(m, struct ip *); #ifdef IPLEN_FLIPPED ip->ip_len = ip->ip_len - taillen; #else ip->ip_len = htons(ntohs(ip->ip_len) - taillen); #endif + if (ip->ip_p == IPPROTO_UDP) { + // offset includes the outer ip and udp header lengths. + if (m->m_len < off) { + m = m_pullup(m, off); + if (!m) { + ipseclog((LOG_DEBUG, + "IPv4 ESP input: invalid udp encapsulated ESP packet length \n")); + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } + } + + // check the UDP encap header to detect changes in the source port, and then strip the header + off -= sizeof(struct udphdr); // off no longer includes the udphdr's size + // if peer is behind nat and this is the latest esp packet + if ((sav->flags & SADB_X_EXT_NATT_DETECTED_PEER) != 0 && + (sav->flags & SADB_X_EXT_OLD) == 0 && + seq && sav->replay && + seq >= sav->replay->lastseq) { + struct udphdr *encap_uh = (__typeof__(encap_uh))(void *)((caddr_t)ip + off); + if (encap_uh->uh_sport && + ntohs(encap_uh->uh_sport) != sav->remote_ike_port) { + sav->remote_ike_port = ntohs(encap_uh->uh_sport); + } + } + ip = esp4_input_strip_UDP_encap(m, off); + esp = (struct esp *)(void *)(((u_int8_t *)ip) + off); + } + + if (sav->utun_is_keepalive_fn) { + if (sav->utun_is_keepalive_fn(sav->utun_pcb, &m, nxt, sav->flags, (off + esplen + ivlen))) { + if (m) { + // not really bad, we just wanna exit + IPSEC_STAT_INCREMENT(ipsecstat.in_success); + m = NULL; + } + goto bad; + } + } /* was it transmitted over the IPsec tunnel SA? */ - if (ipsec4_tunnel_validate(m, off + esplen + ivlen, nxt, sav)) { + if (ipsec4_tunnel_validate(m, off + esplen + ivlen, nxt, sav, &ifamily)) { + ifaddr_t ifa; + struct sockaddr_storage addr; + /* * strip off all the headers that precedes ESP header. * IP4 xx ESP IP4' payload -> IP4' payload @@ -371,38 +478,120 @@ noreplaycheck: tos = ip->ip_tos; m_adj(m, off + esplen + ivlen); - if (m->m_len < sizeof(*ip)) { - m = m_pullup(m, sizeof(*ip)); - if (!m) { - ipsecstat.in_inval++; - goto bad; + if (ifamily == AF_INET) { + struct sockaddr_in *ipaddr; + + if (m->m_len < sizeof(*ip)) { + m = m_pullup(m, sizeof(*ip)); + if (!m) { + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } } - } - ip = mtod(m, struct ip *); - /* ECN consideration. */ - ip_ecn_egress(ip4_ipsec_ecn, &tos, &ip->ip_tos); - if (!key_checktunnelsanity(sav, AF_INET, + ip = mtod(m, struct ip *); + /* ECN consideration. */ + ip_ecn_egress(ip4_ipsec_ecn, &tos, &ip->ip_tos); + if (!key_checktunnelsanity(sav, AF_INET, (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst)) { - ipseclog((LOG_ERR, "ipsec tunnel address mismatch " - "in IPv4 ESP input: %s %s\n", + ipseclog((LOG_ERR, "ipsec tunnel address mismatch " + "in ESP input: %s %s\n", ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } + + if (ip_doscopedroute) { + bzero(&addr, sizeof(addr)); + ipaddr = (__typeof__(ipaddr))&addr; + ipaddr->sin_family = AF_INET; + ipaddr->sin_len = sizeof(*ipaddr); + ipaddr->sin_addr = ip->ip_dst; + } +#if INET6 + } else if (ifamily == AF_INET6) { + struct sockaddr_in6 *ip6addr; + +#ifndef PULLDOWN_TEST + /* + * m_pullup is prohibited in KAME IPv6 input processing + * but there's no other way! + */ +#else + /* okay to pullup in m_pulldown style */ +#endif + if (m->m_len < sizeof(*ip6)) { + m = m_pullup(m, sizeof(*ip6)); + if (!m) { + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } + } + + /* + * Expect 32-bit aligned data pointer on strict-align + * platforms. + */ + MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); + + ip6 = mtod(m, struct ip6_hdr *); + + /* ECN consideration. */ + /* XXX To be fixed later if needed */ + // ip_ecn_egress(ip4_ipsec_ecn, &tos, &ip->ip_tos); + + if (!key_checktunnelsanity(sav, AF_INET6, + (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst)) { + ipseclog((LOG_ERR, "ipsec tunnel address mismatch " + "in ESP input: %s %s\n", + ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } + + if (ip6_doscopedroute) { + bzero(&addr, sizeof(addr)); + ip6addr = (__typeof__(ip6addr))&addr; + ip6addr->sin6_family = AF_INET6; + ip6addr->sin6_len = sizeof(*ip6addr); + ip6addr->sin6_addr = ip6->ip6_dst; + } +#endif /* INET6 */ + } else { + ipseclog((LOG_ERR, "ipsec tunnel unsupported address family " + "in ESP input\n")); goto bad; } key_sa_recordxfer(sav, m); if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0 || ipsec_addhist(m, IPPROTO_IPV4, 0) != 0) { - ipsecstat.in_nomem++; + IPSEC_STAT_INCREMENT(ipsecstat.in_nomem); goto bad; } - + + if (ip_doscopedroute || ip6_doscopedroute) { + // update the receiving interface address based on the inner address + ifa = ifa_ifwithaddr((struct sockaddr *)&addr); + if (ifa) { + m->m_pkthdr.rcvif = ifa->ifa_ifp; + IFA_REMREF(ifa); + } + } + /* Clear the csum flags, they can't be valid for the inner headers */ m->m_pkthdr.csum_flags = 0; - lck_mtx_unlock(sadb_mutex); - proto_input(PF_INET, m); - lck_mtx_lock(sadb_mutex); + if (sav->utun_in_fn) { + if (!(sav->utun_in_fn(sav->utun_pcb, &m, ifamily == AF_INET ? PF_INET : PF_INET6))) { + m = NULL; + // we just wanna exit since packet has been completely processed + goto bad; + } + } + + if (proto_input(ifamily == AF_INET ? PF_INET : PF_INET6, m) != 0) + goto bad; + nxt = IPPROTO_DONE; KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 2,0,0,0,0); } else { @@ -431,7 +620,7 @@ noreplaycheck: key_sa_recordxfer(sav, m); if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0) { - ipsecstat.in_nomem++; + IPSEC_STAT_INCREMENT(ipsecstat.in_nomem); goto bad; } @@ -449,13 +638,58 @@ noreplaycheck: if (nxt != IPPROTO_DONE) { if ((ip_protox[nxt]->pr_flags & PR_LASTHDR) != 0 && ipsec4_in_reject(m, NULL)) { - ipsecstat.in_polvio++; + IPSEC_STAT_INCREMENT(ipsecstat.in_polvio); goto bad; } KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 3,0,0,0,0); - lck_mtx_unlock(sadb_mutex); + + /* translate encapsulated UDP port ? */ + if ((sav->flags & SADB_X_EXT_NATT_MULTIPLEUSERS) != 0) { + struct udphdr *udp; + + if (nxt != IPPROTO_UDP) { /* not UPD packet - drop it */ + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } + + if (m->m_len < off + sizeof(struct udphdr)) { + m = m_pullup(m, off + sizeof(struct udphdr)); + if (!m) { + ipseclog((LOG_DEBUG, + "IPv4 ESP input: can't pullup UDP header in esp4_input\n")); + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + goto bad; + } + ip = mtod(m, struct ip *); + } + udp = (struct udphdr *)(void *)(((u_int8_t *)ip) + off); + + lck_mtx_lock(sadb_mutex); + if (sav->natt_encapsulated_src_port == 0) { + sav->natt_encapsulated_src_port = udp->uh_sport; + } else if (sav->natt_encapsulated_src_port != udp->uh_sport) { /* something wrong */ + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); + lck_mtx_unlock(sadb_mutex); + goto bad; + } + lck_mtx_unlock(sadb_mutex); + udp->uh_sport = htons(sav->remote_ike_port); + udp->uh_sum = 0; + } + + DTRACE_IP6(receive, struct mbuf *, m, struct inpcb *, NULL, + struct ip *, ip, struct ifnet *, m->m_pkthdr.rcvif, + struct ip *, ip, struct ip6_hdr *, NULL); + + if (sav->utun_in_fn) { + if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET))) { + m = NULL; + // we just wanna exit since packet has been completely processed + goto bad; + } + } + ip_proto_dispatch_in(m, off, nxt, 0); - lck_mtx_lock(sadb_mutex); } else m_freem(m); m = NULL; @@ -463,20 +697,20 @@ noreplaycheck: if (sav) { KEYDEBUG(KEYDEBUG_IPSEC_STAMP, - printf("DP esp4_input call free SA:%p\n", sav)); - key_freesav(sav); + printf("DP esp4_input call free SA:0x%llx\n", + (uint64_t)VM_KERNEL_ADDRPERM(sav))); + key_freesav(sav, KEY_SADB_UNLOCKED); } - ipsecstat.in_success++; - lck_mtx_unlock(sadb_mutex); + IPSEC_STAT_INCREMENT(ipsecstat.in_success); return; bad: if (sav) { KEYDEBUG(KEYDEBUG_IPSEC_STAMP, - printf("DP esp4_input call free SA:%p\n", sav)); - key_freesav(sav); + printf("DP esp4_input call free SA:0x%llx\n", + (uint64_t)VM_KERNEL_ADDRPERM(sav))); + key_freesav(sav, KEY_SADB_UNLOCKED); } - lck_mtx_unlock(sadb_mutex); if (m) m_freem(m); KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 4,0,0,0,0); @@ -486,51 +720,50 @@ bad: #if INET6 int -esp6_input(mp, offp) - struct mbuf **mp; - int *offp; +esp6_input(struct mbuf **mp, int *offp, int proto) { +#pragma unused(proto) struct mbuf *m = *mp; int off = *offp; struct ip6_hdr *ip6; struct esp *esp; struct esptail esptail; u_int32_t spi; + u_int32_t seq; struct secasvar *sav = NULL; size_t taillen; u_int16_t nxt; const struct esp_algorithm *algo; int ivlen; size_t esplen; - int s; - - lck_mtx_lock(sadb_mutex); /* sanity check for alignment. */ if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) { ipseclog((LOG_ERR, "IPv6 ESP input: packet alignment problem " "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len)); - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } #ifndef PULLDOWN_TEST - IP6_EXTHDR_CHECK(m, off, ESPMAXLEN, {lck_mtx_unlock(sadb_mutex); return IPPROTO_DONE;}); - esp = (struct esp *)(mtod(m, caddr_t) + off); + IP6_EXTHDR_CHECK(m, off, ESPMAXLEN, {return IPPROTO_DONE;}); + esp = (struct esp *)(void *)(mtod(m, caddr_t) + off); #else IP6_EXTHDR_GET(esp, struct esp *, m, off, ESPMAXLEN); if (esp == NULL) { - ipsec6stat.in_inval++; - lck_mtx_unlock(sadb_mutex); + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); return IPPROTO_DONE; } #endif + /* Expect 32-bit data aligned pointer on strict-align platforms */ + MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); + ip6 = mtod(m, struct ip6_hdr *); if (ntohs(ip6->ip6_plen) == 0) { ipseclog((LOG_ERR, "IPv6 ESP input: " "ESP with IPv6 jumbogram is not supported.\n")); - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } @@ -543,17 +776,18 @@ esp6_input(mp, offp) ipseclog((LOG_WARNING, "IPv6 ESP input: no key association found for spi %u\n", (u_int32_t)ntohl(spi))); - ipsec6stat.in_nosa++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_nosa); goto bad; } KEYDEBUG(KEYDEBUG_IPSEC_STAMP, - printf("DP esp6_input called to allocate SA:%p\n", sav)); + printf("DP esp6_input called to allocate SA:0x%llx\n", + (uint64_t)VM_KERNEL_ADDRPERM(sav))); if (sav->state != SADB_SASTATE_MATURE && sav->state != SADB_SASTATE_DYING) { ipseclog((LOG_DEBUG, "IPv6 ESP input: non-mature/dying SA found for spi %u\n", (u_int32_t)ntohl(spi))); - ipsec6stat.in_badspi++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi); goto bad; } algo = esp_algorithm_lookup(sav->alg_enc); @@ -561,7 +795,7 @@ esp6_input(mp, offp) ipseclog((LOG_DEBUG, "IPv6 ESP input: " "unsupported encryption algorithm for spi %u\n", (u_int32_t)ntohl(spi))); - ipsec6stat.in_badspi++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi); goto bad; } @@ -570,10 +804,12 @@ esp6_input(mp, offp) if (ivlen < 0) { ipseclog((LOG_ERR, "inproper ivlen in IPv6 ESP input: %s %s\n", ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); - ipsec6stat.in_badspi++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi); goto bad; } + seq = ntohl(((struct newesp *)esp)->esp_seq); + if (!((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay && (sav->alg_auth && sav->key_auth))) goto noreplaycheck; @@ -585,10 +821,10 @@ esp6_input(mp, offp) /* * check for sequence number. */ - if (ipsec_chkreplay(ntohl(((struct newesp *)esp)->esp_seq), sav)) + if (ipsec_chkreplay(seq, sav)) ; /*okey*/ else { - ipsec6stat.in_espreplay++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay); ipseclog((LOG_WARNING, "replay packet in IPv6 ESP input: %s %s\n", ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); @@ -597,8 +833,8 @@ esp6_input(mp, offp) /* check ICV */ { - u_char sum0[AH_MAXSUMSIZE]; - u_char sum[AH_MAXSUMSIZE]; + u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4))); + u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4))); const struct ah_algorithm *sumalgo; size_t siz; @@ -607,30 +843,30 @@ esp6_input(mp, offp) goto noreplaycheck; siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1)); if (m->m_pkthdr.len < off + ESPMAXLEN + siz) { - ipsecstat.in_inval++; + IPSEC_STAT_INCREMENT(ipsecstat.in_inval); goto bad; } if (AH_MAXSUMSIZE < siz) { ipseclog((LOG_DEBUG, "internal error: AH_MAXSUMSIZE must be larger than %lu\n", - (u_long)siz)); - ipsec6stat.in_inval++; + (u_int32_t)siz)); + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } - m_copydata(m, m->m_pkthdr.len - siz, siz, &sum0[0]); + m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) &sum0[0]); if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) { ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n", ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); - ipsec6stat.in_espauthfail++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail); goto bad; } if (bcmp(sum0, sum, siz) != 0) { ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n", ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); - ipsec6stat.in_espauthfail++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail); goto bad; } @@ -640,15 +876,15 @@ esp6_input(mp, offp) ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - siz); m->m_flags |= M_AUTHIPDGM; - ipsec6stat.in_espauthsucc++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthsucc); } /* * update sequence number. */ if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay) { - if (ipsec_updatereplay(ntohl(((struct newesp *)esp)->esp_seq), sav)) { - ipsec6stat.in_espreplay++; + if (ipsec_updatereplay(seq, sav)) { + IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay); goto bad; } } @@ -670,7 +906,7 @@ noreplaycheck: if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) { ipseclog((LOG_WARNING, "IPv6 ESP input: packet too short\n")); - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } @@ -679,7 +915,7 @@ noreplaycheck: #else IP6_EXTHDR_GET(esp, struct esp *, m, off, esplen + ivlen); if (esp == NULL) { - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); m = NULL; goto bad; } @@ -690,7 +926,7 @@ noreplaycheck: * pre-compute and cache intermediate key */ if (esp_schedule(algo, sav) != 0) { - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } @@ -704,10 +940,10 @@ noreplaycheck: m = NULL; ipseclog((LOG_ERR, "decrypt fail in IPv6 ESP input: %s\n", ipsec_logsastr(sav))); - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } - ipsec6stat.in_esphist[sav->alg_enc]++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_esphist[sav->alg_enc]); m->m_flags |= M_DECRYPTED; @@ -724,17 +960,31 @@ noreplaycheck: ipseclog((LOG_WARNING, "bad pad length in IPv6 ESP input: %s %s\n", ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } /* strip off the trailing pad area. */ m_adj(m, -taillen); - + ip6 = mtod(m, struct ip6_hdr *); ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - taillen); + if (sav->utun_is_keepalive_fn) { + if (sav->utun_is_keepalive_fn(sav->utun_pcb, &m, nxt, sav->flags, (off + esplen + ivlen))) { + if (m) { + // not really bad, we just wanna exit + IPSEC_STAT_INCREMENT(ipsec6stat.in_success); + m = NULL; + } + goto bad; + } + } + /* was it transmitted over the IPsec tunnel SA? */ if (ipsec6_tunnel_validate(m, off + esplen + ivlen, nxt, sav)) { + ifaddr_t ifa; + struct sockaddr_storage addr; + /* * strip off all the headers that precedes ESP header. * IP6 xx ESP IP6' payload -> IP6' payload @@ -756,7 +1006,7 @@ noreplaycheck: #endif m = m_pullup(m, sizeof(*ip6)); if (!m) { - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } } @@ -769,19 +1019,44 @@ noreplaycheck: "in IPv6 ESP input: %s %s\n", ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav))); - ipsec6stat.in_inval++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_inval); goto bad; } key_sa_recordxfer(sav, m); if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0 || ipsec_addhist(m, IPPROTO_IPV6, 0) != 0) { - ipsec6stat.in_nomem++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_nomem); goto bad; } - lck_mtx_unlock(sadb_mutex); - proto_input(PF_INET6, m); - lck_mtx_lock(sadb_mutex); + + if (ip6_doscopedroute) { + struct sockaddr_in6 *ip6addr; + + bzero(&addr, sizeof(addr)); + ip6addr = (__typeof__(ip6addr))&addr; + ip6addr->sin6_family = AF_INET6; + ip6addr->sin6_len = sizeof(*ip6addr); + ip6addr->sin6_addr = ip6->ip6_dst; + + // update the receiving interface address based on the inner address + ifa = ifa_ifwithaddr((struct sockaddr *)&addr); + if (ifa) { + m->m_pkthdr.rcvif = ifa->ifa_ifp; + IFA_REMREF(ifa); + } + } + + if (sav->utun_in_fn) { + if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET6))) { + m = NULL; + // we just wanna exit since packet has been completely processed + goto bad; + } + } + + if (proto_input(PF_INET6, m) != 0) + goto bad; nxt = IPPROTO_DONE; } else { /* @@ -835,7 +1110,7 @@ noreplaycheck: struct mbuf *n = NULL; int maxlen; - MGETHDR(n, M_DONTWAIT, MT_HEADER); + MGETHDR(n, M_DONTWAIT, MT_HEADER); /* MAC-OK */ maxlen = MHLEN; if (n) M_COPY_PKTHDR(n, m); @@ -875,9 +1150,17 @@ noreplaycheck: key_sa_recordxfer(sav, m); if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0) { - ipsec6stat.in_nomem++; + IPSEC_STAT_INCREMENT(ipsec6stat.in_nomem); goto bad; } + + if (sav->utun_in_fn) { + if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET6))) { + m = NULL; + // we just wanna exit since packet has been completely processed + goto bad; + } + } } *offp = off; @@ -885,20 +1168,20 @@ noreplaycheck: if (sav) { KEYDEBUG(KEYDEBUG_IPSEC_STAMP, - printf("DP esp6_input call free SA:%p\n", sav)); - key_freesav(sav); + printf("DP esp6_input call free SA:0x%llx\n", + (uint64_t)VM_KERNEL_ADDRPERM(sav))); + key_freesav(sav, KEY_SADB_UNLOCKED); } - ipsec6stat.in_success++; - lck_mtx_unlock(sadb_mutex); + IPSEC_STAT_INCREMENT(ipsec6stat.in_success); return nxt; bad: if (sav) { KEYDEBUG(KEYDEBUG_IPSEC_STAMP, - printf("DP esp6_input call free SA:%p\n", sav)); - key_freesav(sav); + printf("DP esp6_input call free SA:0x%llx\n", + (uint64_t)VM_KERNEL_ADDRPERM(sav))); + key_freesav(sav, KEY_SADB_UNLOCKED); } - lck_mtx_unlock(sadb_mutex); if (m) m_freem(m); return IPPROTO_DONE; @@ -972,7 +1255,7 @@ esp6_ctlinput(cmd, sa, d) m_copydata(m, off, sizeof(esp), (caddr_t)&esp); espp = &esp; } else - espp = (struct newesp*)(mtod(m, caddr_t) + off); + espp = (struct newesp*)(void *)(mtod(m, caddr_t) + off); if (cmd == PRC_MSGSIZE) { int valid = 0; @@ -982,8 +1265,7 @@ esp6_ctlinput(cmd, sa, d) * the address in the ICMP message payload. */ sa6_src = ip6cp->ip6c_src; - sa6_dst = (struct sockaddr_in6 *)sa; - lck_mtx_lock(sadb_mutex); + sa6_dst = (struct sockaddr_in6 *)(void *)sa; sav = key_allocsa(AF_INET6, (caddr_t)&sa6_src->sin6_addr, (caddr_t)&sa6_dst->sin6_addr, @@ -992,9 +1274,8 @@ esp6_ctlinput(cmd, sa, d) if (sav->state == SADB_SASTATE_MATURE || sav->state == SADB_SASTATE_DYING) valid++; - key_freesav(sav); + key_freesav(sav, KEY_SADB_LOCKED); } - lck_mtx_unlock(sadb_mutex); /* XXX Further validation? */