if_ipsec.c revision ef5ae8bd0d8afafbd0bb851a6d839eecd7211f98
1/*-
2 * Copyright (c) 2016-2018 Yandex LLC
3 * Copyright (c) 2016-2018 Andrey V. Elsukov <ae@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#include <sys/cdefs.h>
29__FBSDID("$FreeBSD$");
30
31#include "opt_inet.h"
32#include "opt_inet6.h"
33
34#include <sys/param.h>
35#include <sys/systm.h>
36#include <sys/kernel.h>
37#include <sys/fnv_hash.h>
38#include <sys/jail.h>
39#include <sys/lock.h>
40#include <sys/malloc.h>
41#include <sys/mbuf.h>
42#include <sys/module.h>
43#include <sys/socket.h>
44#include <sys/sockio.h>
45#include <sys/sx.h>
46#include <sys/errno.h>
47#include <sys/sysctl.h>
48#include <sys/priv.h>
49#include <sys/proc.h>
50#include <sys/conf.h>
51
52#include <net/if.h>
53#include <net/if_var.h>
54#include <net/if_clone.h>
55#include <net/if_types.h>
56#include <net/bpf.h>
57#include <net/route.h>
58#include <net/vnet.h>
59
60#include <netinet/in.h>
61#include <netinet/in_var.h>
62#include <netinet/ip.h>
63#include <netinet/ip_encap.h>
64
65#include <netinet/ip6.h>
66#include <netinet6/in6_var.h>
67#include <netinet6/scope6_var.h>
68
69#include <netipsec/ipsec.h>
70#ifdef INET6
71#include <netipsec/ipsec6.h>
72#endif
73
74#include <net/if_ipsec.h>
75#include <netipsec/key.h>
76
77#include <security/mac/mac_framework.h>
78
79static MALLOC_DEFINE(M_IPSEC, "ipsec", "IPsec Virtual Tunnel Interface");
80static const char ipsecname[] = "ipsec";
81
82#if defined(INET) && defined(INET6)
83#define	IPSEC_SPCOUNT		4
84#else
85#define	IPSEC_SPCOUNT		2
86#endif
87
88struct ipsec_softc {
89	struct ifnet		*ifp;
90	struct secpolicy	*sp[IPSEC_SPCOUNT];
91	uint32_t		reqid;
92	u_int			family;
93	u_int			fibnum;
94
95	CK_LIST_ENTRY(ipsec_softc) idhash;
96	CK_LIST_ENTRY(ipsec_softc) srchash;
97};
98
99#define	IPSEC_RLOCK_TRACKER	struct epoch_tracker ipsec_et
100#define	IPSEC_RLOCK()	epoch_enter_preempt(net_epoch_preempt, &ipsec_et)
101#define	IPSEC_RUNLOCK()	epoch_exit_preempt(net_epoch_preempt, &ipsec_et)
102#define	IPSEC_WAIT()	epoch_wait_preempt(net_epoch_preempt)
103
104#ifndef IPSEC_HASH_SIZE
105#define	IPSEC_HASH_SIZE	(1 << 5)
106#endif
107
108CK_LIST_HEAD(ipsec_iflist, ipsec_softc);
109VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec_idhtbl) = NULL;
110#define	V_ipsec_idhtbl		VNET(ipsec_idhtbl)
111
112#ifdef INET
113VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec4_srchtbl) = NULL;
114#define	V_ipsec4_srchtbl	VNET(ipsec4_srchtbl)
115static const struct srcaddrtab *ipsec4_srctab = NULL;
116#endif
117
118#ifdef INET6
119VNET_DEFINE_STATIC(struct ipsec_iflist *, ipsec6_srchtbl) = NULL;
120#define	V_ipsec6_srchtbl	VNET(ipsec6_srchtbl)
121static const struct srcaddrtab *ipsec6_srctab = NULL;
122#endif
123
124static struct ipsec_iflist *
125ipsec_idhash(uint32_t id)
126{
127
128	return (&V_ipsec_idhtbl[fnv_32_buf(&id, sizeof(id),
129	    FNV1_32_INIT) & (IPSEC_HASH_SIZE - 1)]);
130}
131
132static struct ipsec_iflist *
133ipsec_srchash(const struct sockaddr *sa)
134{
135	uint32_t hval;
136
137	switch (sa->sa_family) {
138#ifdef INET
139	case AF_INET:
140		hval = fnv_32_buf(
141		    &((const struct sockaddr_in *)sa)->sin_addr.s_addr,
142		    sizeof(in_addr_t), FNV1_32_INIT);
143		return (&V_ipsec4_srchtbl[hval & (IPSEC_HASH_SIZE - 1)]);
144#endif
145#ifdef INET6
146	case AF_INET6:
147		hval = fnv_32_buf(
148		    &((const struct sockaddr_in6 *)sa)->sin6_addr,
149		    sizeof(struct in6_addr), FNV1_32_INIT);
150		return (&V_ipsec6_srchtbl[hval & (IPSEC_HASH_SIZE - 1)]);
151#endif
152	}
153	return (NULL);
154}
155
156/*
157 * ipsec_ioctl_sx protects from concurrent ioctls.
158 */
159static struct sx ipsec_ioctl_sx;
160SX_SYSINIT(ipsec_ioctl_sx, &ipsec_ioctl_sx, "ipsec_ioctl");
161
162static int	ipsec_init_reqid(struct ipsec_softc *);
163static int	ipsec_set_tunnel(struct ipsec_softc *, struct sockaddr *,
164    struct sockaddr *, uint32_t);
165static void	ipsec_delete_tunnel(struct ipsec_softc *);
166
167static int	ipsec_set_addresses(struct ifnet *, struct sockaddr *,
168    struct sockaddr *);
169static int	ipsec_set_reqid(struct ipsec_softc *, uint32_t);
170static void	ipsec_set_running(struct ipsec_softc *);
171
172static void	ipsec_srcaddr(void *, const struct sockaddr *, int);
173static int	ipsec_ioctl(struct ifnet *, u_long, caddr_t);
174static int	ipsec_transmit(struct ifnet *, struct mbuf *);
175static int	ipsec_output(struct ifnet *, struct mbuf *,
176    const struct sockaddr *, struct route *);
177static void	ipsec_qflush(struct ifnet *);
178static int	ipsec_clone_create(struct if_clone *, int, caddr_t);
179static void	ipsec_clone_destroy(struct ifnet *);
180
181VNET_DEFINE_STATIC(struct if_clone *, ipsec_cloner);
182#define	V_ipsec_cloner		VNET(ipsec_cloner)
183
184static int
185ipsec_clone_create(struct if_clone *ifc, int unit, caddr_t params)
186{
187	struct ipsec_softc *sc;
188	struct ifnet *ifp;
189
190	sc = malloc(sizeof(*sc), M_IPSEC, M_WAITOK | M_ZERO);
191	sc->fibnum = curthread->td_proc->p_fibnum;
192	sc->ifp = ifp = if_alloc(IFT_TUNNEL);
193	ifp->if_softc = sc;
194	if_initname(ifp, ipsecname, unit);
195
196	ifp->if_addrlen = 0;
197	ifp->if_mtu = IPSEC_MTU;
198	ifp->if_flags  = IFF_POINTOPOINT | IFF_MULTICAST;
199	ifp->if_ioctl  = ipsec_ioctl;
200	ifp->if_transmit  = ipsec_transmit;
201	ifp->if_qflush  = ipsec_qflush;
202	ifp->if_output = ipsec_output;
203	if_attach(ifp);
204	bpfattach(ifp, DLT_NULL, sizeof(uint32_t));
205
206	return (0);
207}
208
209static void
210ipsec_clone_destroy(struct ifnet *ifp)
211{
212	struct ipsec_softc *sc;
213
214	sx_xlock(&ipsec_ioctl_sx);
215	sc = ifp->if_softc;
216	ipsec_delete_tunnel(sc);
217	/*
218	 * Delete softc from idhash on interface destroy, since
219	 * ipsec_delete_tunnel() keeps reqid unchanged.
220	 */
221	if (sc->reqid != 0)
222		CK_LIST_REMOVE(sc, idhash);
223	bpfdetach(ifp);
224	if_detach(ifp);
225	ifp->if_softc = NULL;
226	sx_xunlock(&ipsec_ioctl_sx);
227
228	IPSEC_WAIT();
229	if_free(ifp);
230	free(sc, M_IPSEC);
231}
232
233static struct ipsec_iflist *
234ipsec_hashinit(void)
235{
236	struct ipsec_iflist *hash;
237	int i;
238
239	hash = malloc(sizeof(struct ipsec_iflist) * IPSEC_HASH_SIZE,
240	    M_IPSEC, M_WAITOK);
241	for (i = 0; i < IPSEC_HASH_SIZE; i++)
242		CK_LIST_INIT(&hash[i]);
243
244	return (hash);
245}
246
247static void
248vnet_ipsec_init(const void *unused __unused)
249{
250
251	V_ipsec_idhtbl = ipsec_hashinit();
252#ifdef INET
253	V_ipsec4_srchtbl = ipsec_hashinit();
254	if (IS_DEFAULT_VNET(curvnet))
255		ipsec4_srctab = ip_encap_register_srcaddr(ipsec_srcaddr,
256		    NULL, M_WAITOK);
257#endif
258#ifdef INET6
259	V_ipsec6_srchtbl = ipsec_hashinit();
260	if (IS_DEFAULT_VNET(curvnet))
261		ipsec6_srctab = ip6_encap_register_srcaddr(ipsec_srcaddr,
262		    NULL, M_WAITOK);
263#endif
264	V_ipsec_cloner = if_clone_simple(ipsecname, ipsec_clone_create,
265	    ipsec_clone_destroy, 0);
266}
267VNET_SYSINIT(vnet_ipsec_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
268    vnet_ipsec_init, NULL);
269
270static void
271vnet_ipsec_uninit(const void *unused __unused)
272{
273
274	if_clone_detach(V_ipsec_cloner);
275	free(V_ipsec_idhtbl, M_IPSEC);
276#ifdef INET
277	if (IS_DEFAULT_VNET(curvnet))
278		ip_encap_unregister_srcaddr(ipsec4_srctab);
279	free(V_ipsec4_srchtbl, M_IPSEC);
280#endif
281#ifdef INET6
282	if (IS_DEFAULT_VNET(curvnet))
283		ip6_encap_unregister_srcaddr(ipsec6_srctab);
284	free(V_ipsec6_srchtbl, M_IPSEC);
285#endif
286}
287VNET_SYSUNINIT(vnet_ipsec_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
288    vnet_ipsec_uninit, NULL);
289
290static struct secpolicy *
291ipsec_getpolicy(struct ipsec_softc *sc, int dir, sa_family_t af)
292{
293
294	switch (af) {
295#ifdef INET
296	case AF_INET:
297		return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1)]);
298#endif
299#ifdef INET6
300	case AF_INET6:
301		return (sc->sp[(dir == IPSEC_DIR_INBOUND ? 0: 1)
302#ifdef INET
303			+ 2
304#endif
305		]);
306#endif
307	}
308	return (NULL);
309}
310
311static struct secasindex *
312ipsec_getsaidx(struct ipsec_softc *sc, int dir, sa_family_t af)
313{
314	struct secpolicy *sp;
315
316	sp = ipsec_getpolicy(sc, dir, af);
317	if (sp == NULL)
318		return (NULL);
319	return (&sp->req[0]->saidx);
320}
321
322static int
323ipsec_transmit(struct ifnet *ifp, struct mbuf *m)
324{
325	IPSEC_RLOCK_TRACKER;
326	struct ipsec_softc *sc;
327	struct secpolicy *sp;
328	struct ip *ip;
329	uint32_t af;
330	int error;
331
332	IPSEC_RLOCK();
333#ifdef MAC
334	error = mac_ifnet_check_transmit(ifp, m);
335	if (error) {
336		m_freem(m);
337		goto err;
338	}
339#endif
340	error = ENETDOWN;
341	sc = ifp->if_softc;
342	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
343	    (ifp->if_flags & IFF_MONITOR) != 0 ||
344	    (ifp->if_flags & IFF_UP) == 0 || sc->family == 0) {
345		m_freem(m);
346		goto err;
347	}
348
349	/* Determine address family to correctly handle packet in BPF */
350	ip = mtod(m, struct ip *);
351	switch (ip->ip_v) {
352#ifdef INET
353	case IPVERSION:
354		af = AF_INET;
355		break;
356#endif
357#ifdef INET6
358	case (IPV6_VERSION >> 4):
359		af = AF_INET6;
360		break;
361#endif
362	default:
363		error = EAFNOSUPPORT;
364		m_freem(m);
365		goto err;
366	}
367
368	/*
369	 * Loop prevention.
370	 * XXX: for now just check presence of IPSEC_OUT_DONE mbuf tag.
371	 *      We can read full chain and compare destination address,
372	 *      proto and mode from xform_history with values from softc.
373	 */
374	if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL) {
375		m_freem(m);
376		goto err;
377	}
378
379	sp = ipsec_getpolicy(sc, IPSEC_DIR_OUTBOUND, af);
380	key_addref(sp);
381	M_SETFIB(m, sc->fibnum);
382
383	BPF_MTAP2(ifp, &af, sizeof(af), m);
384	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
385	if_inc_counter(ifp, IFCOUNTER_OBYTES, m->m_pkthdr.len);
386
387	switch (af) {
388#ifdef INET
389	case AF_INET:
390		error = ipsec4_process_packet(m, sp, NULL);
391		break;
392#endif
393#ifdef INET6
394	case AF_INET6:
395		error = ipsec6_process_packet(m, sp, NULL);
396		break;
397#endif
398	default:
399		panic("%s: unknown address family\n", __func__);
400	}
401err:
402	if (error != 0)
403		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
404	IPSEC_RUNLOCK();
405	return (error);
406}
407
408static void
409ipsec_qflush(struct ifnet *ifp __unused)
410{
411
412}
413
414static int
415ipsec_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
416	struct route *ro)
417{
418
419	return (ifp->if_transmit(ifp, m));
420}
421
422int
423ipsec_if_input(struct mbuf *m, struct secasvar *sav, uint32_t af)
424{
425	IPSEC_RLOCK_TRACKER;
426	struct secasindex *saidx;
427	struct ipsec_softc *sc;
428	struct ifnet *ifp;
429
430	if (sav->state != SADB_SASTATE_MATURE &&
431	    sav->state != SADB_SASTATE_DYING) {
432		m_freem(m);
433		return (ENETDOWN);
434	}
435
436	if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL ||
437	    sav->sah->saidx.proto != IPPROTO_ESP)
438		return (0);
439
440	IPSEC_RLOCK();
441	CK_LIST_FOREACH(sc, ipsec_idhash(sav->sah->saidx.reqid), idhash) {
442		if (sc->family == 0)
443			continue;
444		saidx = ipsec_getsaidx(sc, IPSEC_DIR_INBOUND,
445		    sav->sah->saidx.src.sa.sa_family);
446		/* SA's reqid should match reqid in SP */
447		if (saidx == NULL ||
448		    sav->sah->saidx.reqid != saidx->reqid)
449			continue;
450		/* SAH's addresses should match tunnel endpoints. */
451		if (key_sockaddrcmp(&sav->sah->saidx.dst.sa,
452		    &saidx->dst.sa, 0) != 0)
453			continue;
454		if (key_sockaddrcmp(&sav->sah->saidx.src.sa,
455		    &saidx->src.sa, 0) == 0)
456			break;
457	}
458	if (sc == NULL) {
459		IPSEC_RUNLOCK();
460		/* Tunnel was not found. Nothing to do. */
461		return (0);
462	}
463	ifp = sc->ifp;
464	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
465	    (ifp->if_flags & IFF_UP) == 0) {
466		IPSEC_RUNLOCK();
467		m_freem(m);
468		return (ENETDOWN);
469	}
470	/*
471	 * We found matching and working tunnel.
472	 * Set its ifnet as receiving interface.
473	 */
474	m->m_pkthdr.rcvif = ifp;
475
476	m_clrprotoflags(m);
477	M_SETFIB(m, ifp->if_fib);
478	BPF_MTAP2(ifp, &af, sizeof(af), m);
479	if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
480	if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
481	if ((ifp->if_flags & IFF_MONITOR) != 0) {
482		IPSEC_RUNLOCK();
483		m_freem(m);
484		return (ENETDOWN);
485	}
486	IPSEC_RUNLOCK();
487	return (0);
488}
489
490static int
491ipsec_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
492{
493	struct ifreq *ifr = (struct ifreq*)data;
494	struct sockaddr *dst, *src;
495	struct ipsec_softc *sc;
496	struct secasindex *saidx;
497#ifdef INET
498	struct sockaddr_in *sin = NULL;
499#endif
500#ifdef INET6
501	struct sockaddr_in6 *sin6 = NULL;
502#endif
503	uint32_t reqid;
504	int error;
505
506	switch (cmd) {
507	case SIOCSIFADDR:
508		ifp->if_flags |= IFF_UP;
509	case SIOCADDMULTI:
510	case SIOCDELMULTI:
511	case SIOCGIFMTU:
512	case SIOCSIFFLAGS:
513		return (0);
514	case SIOCSIFMTU:
515		if (ifr->ifr_mtu < IPSEC_MTU_MIN ||
516		    ifr->ifr_mtu > IPSEC_MTU_MAX)
517			return (EINVAL);
518		else
519			ifp->if_mtu = ifr->ifr_mtu;
520		return (0);
521	}
522	sx_xlock(&ipsec_ioctl_sx);
523	sc = ifp->if_softc;
524	/* Check that softc is still here */
525	if (sc == NULL) {
526		error = ENXIO;
527		goto bad;
528	}
529	error = 0;
530	switch (cmd) {
531	case SIOCSIFPHYADDR:
532#ifdef INET6
533	case SIOCSIFPHYADDR_IN6:
534#endif
535		error = EINVAL;
536		switch (cmd) {
537#ifdef INET
538		case SIOCSIFPHYADDR:
539			src = (struct sockaddr *)
540				&(((struct in_aliasreq *)data)->ifra_addr);
541			dst = (struct sockaddr *)
542				&(((struct in_aliasreq *)data)->ifra_dstaddr);
543			break;
544#endif
545#ifdef INET6
546		case SIOCSIFPHYADDR_IN6:
547			src = (struct sockaddr *)
548				&(((struct in6_aliasreq *)data)->ifra_addr);
549			dst = (struct sockaddr *)
550				&(((struct in6_aliasreq *)data)->ifra_dstaddr);
551			break;
552#endif
553		default:
554			goto bad;
555		}
556		/* sa_family must be equal */
557		if (src->sa_family != dst->sa_family ||
558		    src->sa_len != dst->sa_len)
559			goto bad;
560
561		/* validate sa_len */
562		switch (src->sa_family) {
563#ifdef INET
564		case AF_INET:
565			if (src->sa_len != sizeof(struct sockaddr_in))
566				goto bad;
567			break;
568#endif
569#ifdef INET6
570		case AF_INET6:
571			if (src->sa_len != sizeof(struct sockaddr_in6))
572				goto bad;
573			break;
574#endif
575		default:
576			error = EAFNOSUPPORT;
577			goto bad;
578		}
579		/* check sa_family looks sane for the cmd */
580		error = EAFNOSUPPORT;
581		switch (cmd) {
582#ifdef INET
583		case SIOCSIFPHYADDR:
584			if (src->sa_family == AF_INET)
585				break;
586			goto bad;
587#endif
588#ifdef INET6
589		case SIOCSIFPHYADDR_IN6:
590			if (src->sa_family == AF_INET6)
591				break;
592			goto bad;
593#endif
594		}
595		error = EADDRNOTAVAIL;
596		switch (src->sa_family) {
597#ifdef INET
598		case AF_INET:
599			if (satosin(src)->sin_addr.s_addr == INADDR_ANY ||
600			    satosin(dst)->sin_addr.s_addr == INADDR_ANY)
601				goto bad;
602			break;
603#endif
604#ifdef INET6
605		case AF_INET6:
606			if (IN6_IS_ADDR_UNSPECIFIED(
607			    &satosin6(src)->sin6_addr) ||
608			    IN6_IS_ADDR_UNSPECIFIED(
609			    &satosin6(dst)->sin6_addr))
610				goto bad;
611			/*
612			 * Check validity of the scope zone ID of the
613			 * addresses, and convert it into the kernel
614			 * internal form if necessary.
615			 */
616			error = sa6_embedscope(satosin6(src), 0);
617			if (error != 0)
618				goto bad;
619			error = sa6_embedscope(satosin6(dst), 0);
620			if (error != 0)
621				goto bad;
622#endif
623		};
624		error = ipsec_set_addresses(ifp, src, dst);
625		break;
626	case SIOCDIFPHYADDR:
627		ipsec_delete_tunnel(sc);
628		break;
629	case SIOCGIFPSRCADDR:
630	case SIOCGIFPDSTADDR:
631#ifdef INET6
632	case SIOCGIFPSRCADDR_IN6:
633	case SIOCGIFPDSTADDR_IN6:
634#endif
635		if (sc->family == 0) {
636			error = EADDRNOTAVAIL;
637			break;
638		}
639		saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family);
640		switch (cmd) {
641#ifdef INET
642		case SIOCGIFPSRCADDR:
643		case SIOCGIFPDSTADDR:
644			if (saidx->src.sa.sa_family != AF_INET) {
645				error = EADDRNOTAVAIL;
646				break;
647			}
648			sin = (struct sockaddr_in *)&ifr->ifr_addr;
649			memset(sin, 0, sizeof(*sin));
650			sin->sin_family = AF_INET;
651			sin->sin_len = sizeof(*sin);
652			break;
653#endif
654#ifdef INET6
655		case SIOCGIFPSRCADDR_IN6:
656		case SIOCGIFPDSTADDR_IN6:
657			if (saidx->src.sa.sa_family != AF_INET6) {
658				error = EADDRNOTAVAIL;
659				break;
660			}
661			sin6 = (struct sockaddr_in6 *)
662				&(((struct in6_ifreq *)data)->ifr_addr);
663			memset(sin6, 0, sizeof(*sin6));
664			sin6->sin6_family = AF_INET6;
665			sin6->sin6_len = sizeof(*sin6);
666			break;
667#endif
668		default:
669			error = EAFNOSUPPORT;
670		}
671		if (error == 0) {
672			switch (cmd) {
673#ifdef INET
674			case SIOCGIFPSRCADDR:
675				sin->sin_addr = saidx->src.sin.sin_addr;
676				break;
677			case SIOCGIFPDSTADDR:
678				sin->sin_addr = saidx->dst.sin.sin_addr;
679				break;
680#endif
681#ifdef INET6
682			case SIOCGIFPSRCADDR_IN6:
683				sin6->sin6_addr = saidx->src.sin6.sin6_addr;
684				break;
685			case SIOCGIFPDSTADDR_IN6:
686				sin6->sin6_addr = saidx->dst.sin6.sin6_addr;
687				break;
688#endif
689			}
690		}
691		if (error != 0)
692			break;
693		switch (cmd) {
694#ifdef INET
695		case SIOCGIFPSRCADDR:
696		case SIOCGIFPDSTADDR:
697			error = prison_if(curthread->td_ucred,
698			    (struct sockaddr *)sin);
699			if (error != 0)
700				memset(sin, 0, sizeof(*sin));
701			break;
702#endif
703#ifdef INET6
704		case SIOCGIFPSRCADDR_IN6:
705		case SIOCGIFPDSTADDR_IN6:
706			error = prison_if(curthread->td_ucred,
707			    (struct sockaddr *)sin6);
708			if (error == 0)
709				error = sa6_recoverscope(sin6);
710			if (error != 0)
711				memset(sin6, 0, sizeof(*sin6));
712#endif
713		}
714		break;
715	case SIOCGTUNFIB:
716		ifr->ifr_fib = sc->fibnum;
717		break;
718	case SIOCSTUNFIB:
719		if ((error = priv_check(curthread, PRIV_NET_SETIFFIB)) != 0)
720			break;
721		if (ifr->ifr_fib >= rt_numfibs)
722			error = EINVAL;
723		else
724			sc->fibnum = ifr->ifr_fib;
725		break;
726	case IPSECGREQID:
727		reqid = sc->reqid;
728		error = copyout(&reqid, ifr_data_get_ptr(ifr), sizeof(reqid));
729		break;
730	case IPSECSREQID:
731		if ((error = priv_check(curthread, PRIV_NET_SETIFCAP)) != 0)
732			break;
733		error = copyin(ifr_data_get_ptr(ifr), &reqid, sizeof(reqid));
734		if (error != 0)
735			break;
736		error = ipsec_set_reqid(sc, reqid);
737		break;
738	default:
739		error = EINVAL;
740		break;
741	}
742bad:
743	sx_xunlock(&ipsec_ioctl_sx);
744	return (error);
745}
746
747/*
748 * Check that ingress address belongs to local host.
749 */
750static void
751ipsec_set_running(struct ipsec_softc *sc)
752{
753	struct secasindex *saidx;
754	int localip;
755
756	saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family);
757	localip = 0;
758	switch (sc->family) {
759#ifdef INET
760	case AF_INET:
761		localip = in_localip(saidx->src.sin.sin_addr);
762		break;
763#endif
764#ifdef INET6
765	case AF_INET6:
766		localip = in6_localip(&saidx->src.sin6.sin6_addr);
767		break;
768#endif
769	}
770	if (localip != 0)
771		sc->ifp->if_drv_flags |= IFF_DRV_RUNNING;
772	else
773		sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
774}
775
776/*
777 * ifaddr_event handler.
778 * Clear IFF_DRV_RUNNING flag when ingress address disappears to prevent
779 * source address spoofing.
780 */
781static void
782ipsec_srcaddr(void *arg __unused, const struct sockaddr *sa,
783    int event __unused)
784{
785	struct ipsec_softc *sc;
786	struct secasindex *saidx;
787
788	MPASS(in_epoch(net_epoch_preempt));
789	CK_LIST_FOREACH(sc, ipsec_srchash(sa), srchash) {
790		if (sc->family == 0)
791			continue;
792		saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sa->sa_family);
793		if (saidx == NULL ||
794		    key_sockaddrcmp(&saidx->src.sa, sa, 0) != 0)
795			continue;
796		ipsec_set_running(sc);
797	}
798}
799
800/*
801 * Allocate new private security policies for tunneling interface.
802 * Each tunneling interface has following security policies for
803 * both AF:
804 *   0.0.0.0/0[any] 0.0.0.0/0[any] -P in \
805 *	ipsec esp/tunnel/RemoteIP-LocalIP/unique:reqid
806 *   0.0.0.0/0[any] 0.0.0.0/0[any] -P out \
807 *	ipsec esp/tunnel/LocalIP-RemoteIP/unique:reqid
808 */
809static int
810ipsec_newpolicies(struct ipsec_softc *sc, struct secpolicy *sp[IPSEC_SPCOUNT],
811    const struct sockaddr *src, const struct sockaddr *dst, uint32_t reqid)
812{
813	struct ipsecrequest *isr;
814	int i;
815
816	memset(sp, 0, sizeof(struct secpolicy *) * IPSEC_SPCOUNT);
817	for (i = 0; i < IPSEC_SPCOUNT; i++) {
818		if ((sp[i] = key_newsp()) == NULL)
819			goto fail;
820		if ((isr = ipsec_newisr()) == NULL)
821			goto fail;
822
823		sp[i]->policy = IPSEC_POLICY_IPSEC;
824		sp[i]->state = IPSEC_SPSTATE_DEAD;
825		sp[i]->req[sp[i]->tcount++] = isr;
826		sp[i]->created = time_second;
827		/* Use priority field to store if_index */
828		sp[i]->priority = sc->ifp->if_index;
829		isr->level = IPSEC_LEVEL_UNIQUE;
830		isr->saidx.proto = IPPROTO_ESP;
831		isr->saidx.mode = IPSEC_MODE_TUNNEL;
832		isr->saidx.reqid = reqid;
833		if (i % 2 == 0) {
834			sp[i]->spidx.dir = IPSEC_DIR_INBOUND;
835			bcopy(src, &isr->saidx.dst, src->sa_len);
836			bcopy(dst, &isr->saidx.src, dst->sa_len);
837		} else {
838			sp[i]->spidx.dir = IPSEC_DIR_OUTBOUND;
839			bcopy(src, &isr->saidx.src, src->sa_len);
840			bcopy(dst, &isr->saidx.dst, dst->sa_len);
841		}
842		sp[i]->spidx.ul_proto = IPSEC_ULPROTO_ANY;
843#ifdef INET
844		if (i < 2) {
845			sp[i]->spidx.src.sa.sa_family =
846			    sp[i]->spidx.dst.sa.sa_family = AF_INET;
847			sp[i]->spidx.src.sa.sa_len =
848			    sp[i]->spidx.dst.sa.sa_len =
849			    sizeof(struct sockaddr_in);
850			continue;
851		}
852#endif
853#ifdef INET6
854		sp[i]->spidx.src.sa.sa_family =
855		    sp[i]->spidx.dst.sa.sa_family = AF_INET6;
856		sp[i]->spidx.src.sa.sa_len =
857		    sp[i]->spidx.dst.sa.sa_len = sizeof(struct sockaddr_in6);
858#endif
859	}
860	return (0);
861fail:
862	for (i = 0; i < IPSEC_SPCOUNT; i++)
863		key_freesp(&sp[i]);
864	return (ENOMEM);
865}
866
867static int
868ipsec_check_reqid(uint32_t reqid)
869{
870	struct ipsec_softc *sc;
871
872	sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
873	CK_LIST_FOREACH(sc, ipsec_idhash(reqid), idhash) {
874		if (sc->reqid == reqid)
875			return (EEXIST);
876	}
877	return (0);
878}
879
880/*
881 * We use key_newreqid() to automatically obtain unique reqid.
882 * Then we check that given id is unique, i.e. it is not used by
883 * another if_ipsec(4) interface. This macro limits the number of
884 * tries to get unique id.
885 */
886#define	IPSEC_REQID_TRYCNT	64
887static int
888ipsec_init_reqid(struct ipsec_softc *sc)
889{
890	uint32_t reqid;
891	int trycount;
892
893	sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
894	if (sc->reqid != 0) /* already initialized */
895		return (0);
896
897	trycount = IPSEC_REQID_TRYCNT;
898	while (--trycount > 0) {
899		reqid = key_newreqid();
900		if (ipsec_check_reqid(reqid) == 0)
901			break;
902	}
903	if (trycount == 0)
904		return (EEXIST);
905	sc->reqid = reqid;
906	CK_LIST_INSERT_HEAD(ipsec_idhash(reqid), sc, idhash);
907	return (0);
908}
909
910/*
911 * Set or update reqid for given tunneling interface.
912 * When specified reqid is zero, generate new one.
913 * We are protected by ioctl_sx lock from concurrent id generation.
914 * Also softc would not disappear while we hold ioctl_sx lock.
915 */
916static int
917ipsec_set_reqid(struct ipsec_softc *sc, uint32_t reqid)
918{
919	struct secasindex *saidx;
920
921	sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
922
923	if (sc->reqid == reqid && reqid != 0)
924		return (0);
925
926	if (reqid != 0) {
927		/* Check that specified reqid doesn't exist */
928		if (ipsec_check_reqid(reqid) != 0)
929			return (EEXIST);
930		if (sc->reqid != 0) {
931			CK_LIST_REMOVE(sc, idhash);
932			IPSEC_WAIT();
933		}
934		sc->reqid = reqid;
935		CK_LIST_INSERT_HEAD(ipsec_idhash(reqid), sc, idhash);
936	} else {
937		/* Generate new reqid */
938		if (ipsec_init_reqid(sc) != 0)
939			return (EEXIST);
940	}
941
942	/* Tunnel isn't fully configured, just return. */
943	if (sc->family == 0)
944		return (0);
945
946	saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND, sc->family);
947	KASSERT(saidx != NULL,
948	    ("saidx is NULL, but family is %d", sc->family));
949	return (ipsec_set_tunnel(sc, &saidx->src.sa, &saidx->dst.sa,
950	    sc->reqid));
951}
952
953/*
954 * Set tunnel endpoints addresses.
955 */
956static int
957ipsec_set_addresses(struct ifnet *ifp, struct sockaddr *src,
958    struct sockaddr *dst)
959{
960	struct ipsec_softc *sc, *tsc;
961	struct secasindex *saidx;
962
963	sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
964
965	sc = ifp->if_softc;
966	if (sc->family != 0) {
967		saidx = ipsec_getsaidx(sc, IPSEC_DIR_OUTBOUND,
968		    src->sa_family);
969		if (saidx != NULL && saidx->reqid == sc->reqid &&
970		    key_sockaddrcmp(&saidx->src.sa, src, 0) == 0 &&
971		    key_sockaddrcmp(&saidx->dst.sa, dst, 0) == 0)
972			return (0); /* Nothing has been changed. */
973
974	}
975	/* Check that given addresses aren't already configured */
976	CK_LIST_FOREACH(tsc, ipsec_srchash(src), srchash) {
977		if (tsc == sc)
978			continue;
979		MPASS(tsc->family == src->sa_family);
980		saidx = ipsec_getsaidx(tsc, IPSEC_DIR_OUTBOUND, tsc->family);
981		if (key_sockaddrcmp(&saidx->src.sa, src, 0) == 0 &&
982		    key_sockaddrcmp(&saidx->dst.sa, dst, 0) == 0) {
983			/* We already have tunnel with such addresses */
984			return (EADDRNOTAVAIL);
985		}
986	}
987	/* If reqid is not set, generate new one. */
988	if (ipsec_init_reqid(sc) != 0)
989		return (EEXIST);
990	return (ipsec_set_tunnel(sc, src, dst, sc->reqid));
991}
992
993static int
994ipsec_set_tunnel(struct ipsec_softc *sc, struct sockaddr *src,
995    struct sockaddr *dst, uint32_t reqid)
996{
997	struct secpolicy *sp[IPSEC_SPCOUNT];
998	int i;
999
1000	sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
1001
1002	/* Allocate SP with new addresses. */
1003	if (ipsec_newpolicies(sc, sp, src, dst, reqid) == 0) {
1004		/* Add new policies to SPDB */
1005		if (key_register_ifnet(sp, IPSEC_SPCOUNT) != 0) {
1006			for (i = 0; i < IPSEC_SPCOUNT; i++)
1007				key_freesp(&sp[i]);
1008			return (EAGAIN);
1009		}
1010		if (sc->family != 0)
1011			ipsec_delete_tunnel(sc);
1012		for (i = 0; i < IPSEC_SPCOUNT; i++)
1013			sc->sp[i] = sp[i];
1014		sc->family = src->sa_family;
1015		CK_LIST_INSERT_HEAD(ipsec_srchash(src), sc, srchash);
1016	} else {
1017		sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1018		return (ENOMEM);
1019	}
1020	ipsec_set_running(sc);
1021	return (0);
1022}
1023
1024static void
1025ipsec_delete_tunnel(struct ipsec_softc *sc)
1026{
1027	int i;
1028
1029	sx_assert(&ipsec_ioctl_sx, SA_XLOCKED);
1030
1031	sc->ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1032	if (sc->family != 0) {
1033		CK_LIST_REMOVE(sc, srchash);
1034		sc->family = 0;
1035		/*
1036		 * Make sure that ipsec_if_input() will not do access
1037		 * to softc's policies.
1038		 */
1039		IPSEC_WAIT();
1040
1041		key_unregister_ifnet(sc->sp, IPSEC_SPCOUNT);
1042		for (i = 0; i < IPSEC_SPCOUNT; i++)
1043			key_freesp(&sc->sp[i]);
1044	}
1045}
1046