* Check security policy requirements against the actual * packet contents. Return one if the packet should be * reject as "invalid"; otherwiser return zero to have the * packet treated as "valid". * * OUT: * 0: valid * 1: invalid */
| 1021 | * 1: invalid |
| 1022 | */ |
| 1023 | static int |
| 1024 | ipsec_in_reject(struct secpolicy *sp, struct inpcb *inp, const struct mbuf *m) |
| 1025 | { |
| 1026 | int i; |
| 1027 | |
| 1028 | KEYDBG(IPSEC_STAMP, |
| 1029 | printf("%s: PCB(%p): using SP(%p)\n", __func__, inp, sp)); |
| 1030 | KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); |
| 1031 | |
| 1032 | if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_in == NULL) |
| 1033 | ipsec_cachepolicy(inp, sp, IPSEC_DIR_INBOUND); |
| 1034 | |
| 1035 | /* Check policy. */ |
| 1036 | switch (sp->policy) { |
| 1037 | case IPSEC_POLICY_DISCARD: |
| 1038 | return (1); |
| 1039 | case IPSEC_POLICY_BYPASS: |
| 1040 | case IPSEC_POLICY_NONE: |
| 1041 | return (0); |
| 1042 | } |
| 1043 | |
| 1044 | IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, |
| 1045 | ("invalid policy %u", sp->policy)); |
| 1046 | |
| 1047 | /* |
| 1048 | * ipsec[46]_common_input_cb after each transform adds |
| 1049 | * PACKET_TAG_IPSEC_IN_DONE mbuf tag. It contains SPI, proto, mode |
| 1050 | * and destination address from saidx. We can compare info from |
| 1051 | * these tags with requirements in SP. |
| 1052 | */ |
| 1053 | for (i = 0; i < sp->tcount; i++) { |
| 1054 | /* |
| 1055 | * Do not check IPcomp, since IPcomp document |
| 1056 | * says that we shouldn't compress small packets. |
| 1057 | * IPComp policy should always be treated as being |
| 1058 | * in "use" level. |
| 1059 | */ |
| 1060 | if (sp->req[i]->saidx.proto == IPPROTO_IPCOMP || |
| 1061 | ipsec_get_reqlevel(sp, i) != IPSEC_LEVEL_REQUIRE) |
| 1062 | continue; |
| 1063 | if (V_check_policy_history != 0 && |
| 1064 | ipsec_check_history(m, sp, i) != 0) |
| 1065 | return (1); |
| 1066 | else switch (sp->req[i]->saidx.proto) { |
| 1067 | case IPPROTO_ESP: |
| 1068 | if ((m->m_flags & M_DECRYPTED) == 0) { |
| 1069 | KEYDBG(IPSEC_DUMP, |
| 1070 | printf("%s: ESP m_flags:%x\n", __func__, |
| 1071 | m->m_flags)); |
| 1072 | return (1); |
| 1073 | } |
| 1074 | break; |
| 1075 | case IPPROTO_AH: |
| 1076 | if ((m->m_flags & M_AUTHIPHDR) == 0) { |
| 1077 | KEYDBG(IPSEC_DUMP, |
| 1078 | printf("%s: AH m_flags:%x\n", __func__, |
| 1079 | m->m_flags)); |
| 1080 | return (1); |
no test coverage detected