Home | History | Annotate | Line # | Download | only in netipsec
ipsecif.c revision 1.1.2.10 
      1  1.1.2.10  martin /*	$NetBSD: ipsecif.c,v 1.1.2.10 2020/01/31 11:01:38 martin Exp $  */
      2   1.1.2.2     snj 
      3   1.1.2.2     snj /*
      4   1.1.2.2     snj  * Copyright (c) 2017 Internet Initiative Japan Inc.
      5   1.1.2.2     snj  * All rights reserved.
      6   1.1.2.2     snj  *
      7   1.1.2.2     snj  * Redistribution and use in source and binary forms, with or without
      8   1.1.2.2     snj  * modification, are permitted provided that the following conditions
      9   1.1.2.2     snj  * are met:
     10   1.1.2.2     snj  * 1. Redistributions of source code must retain the above copyright
     11   1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer.
     12   1.1.2.2     snj  * 2. Redistributions in binary form must reproduce the above copyright
     13   1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer in the
     14   1.1.2.2     snj  *    documentation and/or other materials provided with the distribution.
     15   1.1.2.2     snj  *
     16   1.1.2.2     snj  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17   1.1.2.2     snj  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18   1.1.2.2     snj  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19   1.1.2.2     snj  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20   1.1.2.2     snj  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21   1.1.2.2     snj  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22   1.1.2.2     snj  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23   1.1.2.2     snj  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24   1.1.2.2     snj  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25   1.1.2.2     snj  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26   1.1.2.2     snj  * POSSIBILITY OF SUCH DAMAGE.
     27   1.1.2.2     snj  */
     28   1.1.2.2     snj 
     29   1.1.2.2     snj #include <sys/cdefs.h>
     30  1.1.2.10  martin __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.1.2.10 2020/01/31 11:01:38 martin Exp $");
     31   1.1.2.2     snj 
     32   1.1.2.2     snj #ifdef _KERNEL_OPT
     33   1.1.2.2     snj #include "opt_inet.h"
     34   1.1.2.2     snj #include "opt_ipsec.h"
     35   1.1.2.2     snj #endif
     36   1.1.2.2     snj 
     37   1.1.2.2     snj #include <sys/param.h>
     38   1.1.2.2     snj #include <sys/systm.h>
     39   1.1.2.2     snj #include <sys/socket.h>
     40   1.1.2.2     snj #include <sys/sockio.h>
     41   1.1.2.2     snj #include <sys/mbuf.h>
     42   1.1.2.2     snj #include <sys/errno.h>
     43   1.1.2.2     snj #include <sys/ioctl.h>
     44   1.1.2.2     snj #include <sys/syslog.h>
     45   1.1.2.2     snj #include <sys/kernel.h>
     46   1.1.2.2     snj 
     47   1.1.2.2     snj #include <net/if.h>
     48   1.1.2.2     snj #include <net/route.h>
     49   1.1.2.2     snj 
     50   1.1.2.2     snj #include <netinet/in.h>
     51   1.1.2.2     snj #include <netinet/in_systm.h>
     52   1.1.2.2     snj #include <netinet/ip.h>
     53   1.1.2.2     snj #include <netinet/ip_var.h>
     54   1.1.2.2     snj #include <netinet/in_var.h>
     55   1.1.2.2     snj #include <netinet/ip_encap.h>
     56   1.1.2.2     snj #include <netinet/ip_ecn.h>
     57   1.1.2.2     snj #include <netinet/ip_private.h>
     58   1.1.2.2     snj #include <netinet/udp.h>
     59   1.1.2.2     snj 
     60   1.1.2.2     snj #ifdef INET6
     61   1.1.2.2     snj #include <netinet/ip6.h>
     62   1.1.2.2     snj #include <netinet6/ip6_var.h>
     63   1.1.2.2     snj #include <netinet6/ip6_private.h>
     64   1.1.2.2     snj #include <netinet6/in6_var.h>
     65   1.1.2.2     snj #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */
     66   1.1.2.2     snj #include <netinet/ip_ecn.h>
     67   1.1.2.2     snj #endif
     68   1.1.2.2     snj 
     69   1.1.2.2     snj #include <netipsec/key.h>
     70   1.1.2.2     snj #include <netipsec/ipsecif.h>
     71   1.1.2.2     snj 
     72   1.1.2.2     snj #include <net/if_ipsec.h>
     73   1.1.2.2     snj 
     74   1.1.2.9  martin static int ipsecif_set_natt_ports(struct ipsec_variant *, struct mbuf *);
     75   1.1.2.2     snj static void ipsecif4_input(struct mbuf *, int, int, void *);
     76   1.1.2.2     snj static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *);
     77   1.1.2.2     snj static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *,
     78   1.1.2.2     snj 	struct ifnet *);
     79   1.1.2.2     snj 
     80   1.1.2.2     snj #ifdef INET6
     81   1.1.2.2     snj static int ipsecif6_input(struct mbuf **, int *, int, void *);
     82   1.1.2.2     snj static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *);
     83   1.1.2.2     snj static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *,
     84   1.1.2.2     snj 	struct ifnet *);
     85   1.1.2.2     snj #endif
     86   1.1.2.2     snj 
     87   1.1.2.2     snj static int ip_ipsec_ttl = IPSEC_TTL;
     88   1.1.2.2     snj static int ip_ipsec_copy_tos = 0;
     89   1.1.2.2     snj #ifdef INET6
     90   1.1.2.2     snj static int ip6_ipsec_hlim = IPSEC_HLIM;
     91   1.1.2.2     snj static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */
     92   1.1.2.2     snj static int ip6_ipsec_copy_tos = 0;
     93   1.1.2.2     snj #endif
     94   1.1.2.2     snj 
     95   1.1.2.2     snj struct encapsw ipsecif4_encapsw = {
     96   1.1.2.2     snj 	.encapsw4 = {
     97   1.1.2.2     snj 		.pr_input = ipsecif4_input,
     98   1.1.2.2     snj 		.pr_ctlinput = NULL,
     99   1.1.2.2     snj 	}
    100   1.1.2.2     snj };
    101   1.1.2.2     snj 
    102   1.1.2.2     snj #ifdef INET6
    103   1.1.2.2     snj static const struct encapsw ipsecif6_encapsw;
    104   1.1.2.2     snj #endif
    105   1.1.2.2     snj 
    106   1.1.2.9  martin static int
    107   1.1.2.9  martin ipsecif_set_natt_ports(struct ipsec_variant *var, struct mbuf *m)
    108   1.1.2.9  martin {
    109   1.1.2.9  martin 
    110   1.1.2.9  martin 	KASSERT(if_ipsec_heldref_variant(var));
    111   1.1.2.9  martin 
    112   1.1.2.9  martin 	if (var->iv_sport || var->iv_dport) {
    113   1.1.2.9  martin 		struct m_tag *mtag;
    114   1.1.2.9  martin 
    115   1.1.2.9  martin 		mtag = m_tag_get(PACKET_TAG_IPSEC_NAT_T_PORTS,
    116   1.1.2.9  martin 		    sizeof(uint16_t) + sizeof(uint16_t), M_DONTWAIT);
    117   1.1.2.9  martin 		if (mtag) {
    118   1.1.2.9  martin 			uint16_t *natt_port;
    119   1.1.2.9  martin 
    120   1.1.2.9  martin 			natt_port = (uint16_t *)(mtag + 1);
    121   1.1.2.9  martin 			natt_port[0] = var->iv_dport;
    122   1.1.2.9  martin 			natt_port[1] = var->iv_sport;
    123   1.1.2.9  martin 			m_tag_prepend(m, mtag);
    124   1.1.2.9  martin 		} else {
    125   1.1.2.9  martin 			return ENOBUFS;
    126   1.1.2.9  martin 		}
    127   1.1.2.9  martin 	}
    128   1.1.2.9  martin 
    129   1.1.2.9  martin 	return 0;
    130   1.1.2.9  martin }
    131   1.1.2.9  martin 
    132   1.1.2.2     snj static struct mbuf *
    133   1.1.2.2     snj ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m,
    134   1.1.2.2     snj     uint8_t proto, uint8_t tos)
    135   1.1.2.2     snj {
    136   1.1.2.2     snj 	struct ip *ip;
    137   1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    138   1.1.2.2     snj 
    139   1.1.2.2     snj 	src = satosin(var->iv_psrc);
    140   1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    141   1.1.2.2     snj 
    142   1.1.2.2     snj 	if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) ||
    143   1.1.2.2     snj 	    src->sin_addr.s_addr == INADDR_BROADCAST ||
    144   1.1.2.2     snj 	    dst->sin_addr.s_addr == INADDR_BROADCAST) {
    145   1.1.2.2     snj 		m_freem(m);
    146   1.1.2.2     snj 		return NULL;
    147   1.1.2.2     snj 	}
    148   1.1.2.2     snj 	m->m_flags &= ~M_BCAST;
    149   1.1.2.2     snj 
    150   1.1.2.2     snj 	if (IN_MULTICAST(src->sin_addr.s_addr) ||
    151   1.1.2.2     snj 	   IN_MULTICAST(dst->sin_addr.s_addr)) {
    152   1.1.2.2     snj 		m_freem(m);
    153   1.1.2.2     snj 		return NULL;
    154   1.1.2.2     snj 	}
    155   1.1.2.2     snj 
    156   1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    157   1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip)))
    158   1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip));
    159   1.1.2.2     snj 	if (m == NULL)
    160   1.1.2.2     snj 		return NULL;
    161   1.1.2.2     snj 
    162   1.1.2.2     snj 	ip = mtod(m, struct ip *);
    163   1.1.2.2     snj 	ip->ip_v = IPVERSION;
    164   1.1.2.2     snj 	ip->ip_off = htons(0);
    165   1.1.2.6  martin 	if (m->m_pkthdr.len < IP_MINFRAGSIZE)
    166   1.1.2.6  martin 		ip->ip_id = 0;
    167   1.1.2.6  martin 	else
    168   1.1.2.6  martin 		ip->ip_id = ip_newid(NULL);
    169   1.1.2.2     snj 	ip->ip_hl = sizeof(*ip) >> 2;
    170   1.1.2.2     snj 	if (ip_ipsec_copy_tos)
    171   1.1.2.2     snj 		ip->ip_tos = tos;
    172   1.1.2.2     snj 	else
    173   1.1.2.2     snj 		ip->ip_tos = 0;
    174   1.1.2.2     snj 	ip->ip_sum = 0;
    175   1.1.2.2     snj 	ip->ip_src = src->sin_addr;
    176   1.1.2.2     snj 	ip->ip_dst = dst->sin_addr;
    177   1.1.2.2     snj 	ip->ip_p = proto;
    178   1.1.2.2     snj 	ip->ip_ttl = ip_ipsec_ttl;
    179   1.1.2.2     snj 	ip->ip_len = htons(m->m_pkthdr.len);
    180   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    181   1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    182   1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    183   1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
    184   1.1.2.2     snj 	else
    185   1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
    186   1.1.2.2     snj #endif
    187   1.1.2.2     snj 
    188   1.1.2.2     snj 	return m;
    189   1.1.2.2     snj }
    190   1.1.2.2     snj 
    191   1.1.2.2     snj static int
    192   1.1.2.2     snj ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr)
    193   1.1.2.2     snj {
    194   1.1.2.2     snj 	struct ip ip0;
    195   1.1.2.2     snj 	struct ip *ip;
    196   1.1.2.2     snj 	int mtu;
    197   1.1.2.2     snj 	struct secasvar *sav;
    198   1.1.2.2     snj 
    199   1.1.2.2     snj 	sav = key_lookup_sa_bysaidx(&isr->saidx);
    200   1.1.2.2     snj 	if (sav == NULL)
    201   1.1.2.2     snj 		return 0;
    202   1.1.2.2     snj 
    203   1.1.2.2     snj 	if (!(sav->natt_type & UDP_ENCAP_ESPINUDP) &&
    204   1.1.2.2     snj 	    !(sav->natt_type & UDP_ENCAP_ESPINUDP_NON_IKE)) {
    205   1.1.2.2     snj 		mtu = 0;
    206   1.1.2.2     snj 		goto out;
    207   1.1.2.2     snj 	}
    208   1.1.2.2     snj 
    209   1.1.2.2     snj 	if (m->m_len < sizeof(struct ip)) {
    210   1.1.2.2     snj 		m_copydata(m, 0, sizeof(ip0), &ip0);
    211   1.1.2.2     snj 		ip = &ip0;
    212   1.1.2.2     snj 
    213   1.1.2.2     snj 	} else {
    214   1.1.2.2     snj 		ip = mtod(m, struct ip *);
    215   1.1.2.2     snj 	}
    216   1.1.2.2     snj 	mtu = sav->esp_frag;
    217   1.1.2.2     snj 	if (ntohs(ip->ip_len) <= mtu)
    218   1.1.2.2     snj 		mtu = 0;
    219   1.1.2.2     snj 
    220   1.1.2.2     snj out:
    221   1.1.2.2     snj 	KEY_SA_UNREF(&sav);
    222   1.1.2.2     snj 	return mtu;
    223   1.1.2.2     snj }
    224   1.1.2.2     snj 
    225   1.1.2.2     snj static struct mbuf *
    226   1.1.2.2     snj ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0)
    227   1.1.2.2     snj {
    228   1.1.2.2     snj 	const struct ip *ip;
    229   1.1.2.2     snj 	int proto;
    230   1.1.2.2     snj 	int tos;
    231   1.1.2.2     snj 
    232   1.1.2.2     snj 	KASSERT(proto0 != NULL);
    233   1.1.2.2     snj 	KASSERT(tos0 != NULL);
    234   1.1.2.2     snj 
    235   1.1.2.2     snj 	switch (family) {
    236   1.1.2.2     snj 	case AF_INET:
    237   1.1.2.2     snj 		proto = IPPROTO_IPV4;
    238   1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    239   1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    240   1.1.2.2     snj 			if (!m) {
    241   1.1.2.2     snj 				*tos0 = 0;
    242   1.1.2.2     snj 				*proto0 = 0;
    243   1.1.2.2     snj 				return  NULL;
    244   1.1.2.2     snj 			}
    245   1.1.2.2     snj 		}
    246   1.1.2.2     snj 		ip = mtod(m, const struct ip *);
    247   1.1.2.2     snj 		tos = ip->ip_tos;
    248   1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    249   1.1.2.2     snj 		break;
    250   1.1.2.2     snj #ifdef INET6
    251   1.1.2.2     snj 	case AF_INET6: {
    252   1.1.2.2     snj 		const struct ip6_hdr *ip6;
    253   1.1.2.2     snj 		proto = IPPROTO_IPV6;
    254   1.1.2.2     snj 		if (m->m_len < sizeof(*ip6)) {
    255   1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    256   1.1.2.2     snj 			if (!m) {
    257   1.1.2.2     snj 				*tos0 = 0;
    258   1.1.2.2     snj 				*proto0 = 0;
    259   1.1.2.2     snj 				return NULL;
    260   1.1.2.2     snj 			}
    261   1.1.2.2     snj 		}
    262   1.1.2.2     snj 		ip6 = mtod(m, const struct ip6_hdr *);
    263   1.1.2.2     snj 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    264   1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    265   1.1.2.2     snj 		break;
    266   1.1.2.2     snj 	}
    267   1.1.2.2     snj #endif /* INET6 */
    268   1.1.2.2     snj 	default:
    269   1.1.2.2     snj 		*tos0 = 0;
    270   1.1.2.2     snj 		*proto0 = 0;
    271   1.1.2.2     snj 		return NULL;
    272   1.1.2.2     snj 	}
    273   1.1.2.2     snj 
    274   1.1.2.2     snj 	*proto0 = proto;
    275   1.1.2.2     snj 	*tos0 = tos;
    276   1.1.2.2     snj 	return m;
    277   1.1.2.2     snj }
    278   1.1.2.2     snj 
    279   1.1.2.2     snj static int
    280   1.1.2.2     snj ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu)
    281   1.1.2.2     snj {
    282   1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    283   1.1.2.2     snj 	struct mbuf *next;
    284   1.1.2.2     snj 	struct m_tag *mtag;
    285   1.1.2.2     snj 	int error;
    286   1.1.2.2     snj 
    287   1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    288   1.1.2.2     snj 
    289   1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    290   1.1.2.2     snj 	if (mtag)
    291   1.1.2.2     snj 		m_tag_delete(m, mtag);
    292   1.1.2.2     snj 
    293   1.1.2.4  martin 	/* consider new IP header prepended in ipsecif4_output() */
    294   1.1.2.4  martin 	if (mtu <= sizeof(struct ip)) {
    295   1.1.2.4  martin 		m_freem(m);
    296   1.1.2.4  martin 		return ENETUNREACH;
    297   1.1.2.4  martin 	}
    298   1.1.2.4  martin 	m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
    299   1.1.2.4  martin 	error = ip_fragment(m, ifp, mtu - sizeof(struct ip));
    300   1.1.2.2     snj 	if (error)
    301   1.1.2.2     snj 		return error;
    302   1.1.2.2     snj 
    303   1.1.2.2     snj 	for (error = 0; m; m = next) {
    304   1.1.2.2     snj 		next = m->m_nextpkt;
    305   1.1.2.3  martin 		m->m_nextpkt = NULL;
    306   1.1.2.2     snj 		if (error) {
    307   1.1.2.2     snj 			m_freem(m);
    308   1.1.2.2     snj 			continue;
    309   1.1.2.2     snj 		}
    310   1.1.2.2     snj 
    311   1.1.2.2     snj 		error = ipsecif4_output(var, family, m);
    312   1.1.2.2     snj 	}
    313   1.1.2.2     snj 	if (error == 0)
    314   1.1.2.2     snj 		IP_STATINC(IP_STAT_FRAGMENTED);
    315   1.1.2.2     snj 
    316   1.1.2.2     snj 	return error;
    317   1.1.2.2     snj }
    318   1.1.2.2     snj 
    319   1.1.2.2     snj int
    320   1.1.2.2     snj ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var)
    321   1.1.2.2     snj {
    322   1.1.2.2     snj 	struct m_tag *mtag;
    323   1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    324   1.1.2.2     snj 	u_int16_t src_port = 0;
    325   1.1.2.2     snj 	u_int16_t dst_port = 0;
    326   1.1.2.2     snj 
    327   1.1.2.2     snj 	KASSERT(var != NULL);
    328   1.1.2.2     snj 
    329   1.1.2.2     snj 	src = satosin(var->iv_psrc);
    330   1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    331   1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    332   1.1.2.2     snj 	if (mtag) {
    333   1.1.2.2     snj 		u_int16_t *ports;
    334   1.1.2.2     snj 
    335   1.1.2.2     snj 		ports = (u_int16_t *)(mtag + 1);
    336   1.1.2.2     snj 		src_port = ports[0];
    337   1.1.2.2     snj 		dst_port = ports[1];
    338   1.1.2.2     snj 	}
    339   1.1.2.2     snj 
    340   1.1.2.2     snj 	/* address match */
    341   1.1.2.2     snj 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
    342   1.1.2.2     snj 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
    343   1.1.2.2     snj 		return 0;
    344   1.1.2.2     snj 
    345   1.1.2.2     snj 	/* UDP encap? */
    346   1.1.2.2     snj 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    347   1.1.2.2     snj 		goto match;
    348   1.1.2.2     snj 
    349   1.1.2.2     snj 	/* port match */
    350   1.1.2.2     snj 	if (src_port != var->iv_dport ||
    351   1.1.2.2     snj 	    dst_port != var->iv_sport) {
    352   1.1.2.2     snj #ifdef DEBUG
    353   1.1.2.2     snj 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    354   1.1.2.2     snj 		    __func__, ntohs(src_port), ntohs(dst_port),
    355   1.1.2.2     snj 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    356   1.1.2.2     snj #endif
    357   1.1.2.2     snj 		return 0;
    358   1.1.2.2     snj 	}
    359   1.1.2.2     snj 
    360   1.1.2.2     snj match:
    361   1.1.2.2     snj 	/*
    362   1.1.2.2     snj 	 * hide NAT-T information from encapsulated traffics.
    363   1.1.2.2     snj 	 * they don't know about IPsec.
    364   1.1.2.2     snj 	 */
    365   1.1.2.2     snj 	if (mtag)
    366   1.1.2.2     snj 		m_tag_delete(m, mtag);
    367   1.1.2.2     snj 	return sizeof(src->sin_addr) + sizeof(dst->sin_addr);
    368   1.1.2.2     snj }
    369   1.1.2.2     snj 
    370   1.1.2.2     snj static int
    371   1.1.2.2     snj ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m)
    372   1.1.2.2     snj {
    373   1.1.2.2     snj 	struct secpolicy *sp = NULL;
    374   1.1.2.2     snj 	u_int8_t tos;
    375   1.1.2.2     snj 	int proto;
    376   1.1.2.2     snj 	int error;
    377   1.1.2.2     snj 	int mtu;
    378   1.1.2.2     snj 	u_long sa_mtu = 0;
    379   1.1.2.2     snj 
    380   1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    381   1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    382   1.1.2.2     snj 	KASSERT(var->iv_psrc->sa_family == AF_INET);
    383   1.1.2.2     snj 	KASSERT(var->iv_pdst->sa_family == AF_INET);
    384   1.1.2.2     snj 
    385  1.1.2.10  martin 	switch (family) {
    386  1.1.2.10  martin 	case AF_INET:
    387  1.1.2.10  martin 		sp = IV_SP_OUT(var);
    388  1.1.2.10  martin 		break;
    389  1.1.2.10  martin 	case AF_INET6:
    390  1.1.2.10  martin 		sp = IV_SP_OUT6(var);
    391  1.1.2.10  martin 		break;
    392  1.1.2.10  martin 	default:
    393  1.1.2.10  martin 		m_freem(m);
    394  1.1.2.10  martin 		return EAFNOSUPPORT;
    395  1.1.2.10  martin 	}
    396   1.1.2.2     snj 	KASSERT(sp != NULL);
    397   1.1.2.2     snj 	/*
    398   1.1.2.2     snj 	 * The SPs in ipsec_variant are prevented from freed by
    399   1.1.2.2     snj 	 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here.
    400   1.1.2.2     snj 	 */
    401   1.1.2.2     snj 
    402   1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_NONE);
    403   1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_ENTRUST);
    404   1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_BYPASS);
    405   1.1.2.2     snj 	if(sp->policy != IPSEC_POLICY_IPSEC) {
    406   1.1.2.2     snj 		m_freem(m);
    407   1.1.2.9  martin 		error = ENETUNREACH;
    408   1.1.2.9  martin 		goto done;
    409   1.1.2.2     snj 	}
    410   1.1.2.2     snj 
    411   1.1.2.2     snj 	/* get flowinfo */
    412   1.1.2.2     snj 	m = ipsecif4_flowinfo(m, family, &proto, &tos);
    413   1.1.2.2     snj 	if (m == NULL) {
    414   1.1.2.2     snj 		error = ENETUNREACH;
    415   1.1.2.2     snj 		goto done;
    416   1.1.2.2     snj 	}
    417   1.1.2.2     snj 
    418   1.1.2.2     snj 	/* prepend new IP header */
    419   1.1.2.2     snj 	m = ipsecif4_prepend_hdr(var, m, proto, tos);
    420   1.1.2.2     snj 	if (m == NULL) {
    421   1.1.2.2     snj 		error = ENETUNREACH;
    422   1.1.2.2     snj 		goto done;
    423   1.1.2.2     snj 	}
    424   1.1.2.2     snj 
    425   1.1.2.2     snj 	/*
    426   1.1.2.2     snj 	 * Normal netipsec's NAT-T fragmentation is done in ip_output().
    427   1.1.2.2     snj 	 * See "natt_frag" processing.
    428   1.1.2.2     snj 	 * However, ipsec(4) interface's one is not done in the same way,
    429   1.1.2.2     snj 	 * so we must do NAT-T fragmentation by own code.
    430   1.1.2.2     snj 	 */
    431   1.1.2.2     snj 	/* NAT-T ESP fragmentation */
    432   1.1.2.2     snj 	mtu = ipsecif4_needfrag(m, sp->req);
    433   1.1.2.2     snj 	if (mtu > 0)
    434   1.1.2.2     snj 		return ipsecif4_fragout(var, family, m, mtu);
    435   1.1.2.2     snj 
    436   1.1.2.9  martin 	/* set NAT-T ports */
    437   1.1.2.9  martin 	error = ipsecif_set_natt_ports(var, m);
    438   1.1.2.9  martin 	if (error) {
    439   1.1.2.9  martin 		m_freem(m);
    440   1.1.2.9  martin 		goto done;
    441   1.1.2.9  martin 	}
    442   1.1.2.9  martin 
    443   1.1.2.2     snj 	/* IPsec output */
    444   1.1.2.2     snj 	IP_STATINC(IP_STAT_LOCALOUT);
    445   1.1.2.2     snj 	error = ipsec4_process_packet(m, sp->req, &sa_mtu);
    446   1.1.2.2     snj 	if (error == ENOENT)
    447   1.1.2.2     snj 		error = 0;
    448   1.1.2.2     snj 	/*
    449   1.1.2.2     snj 	 * frangmentation is already done in ipsecif4_fragout(),
    450   1.1.2.2     snj 	 * so ipsec4_process_packet() must not do fragmentation here.
    451   1.1.2.2     snj 	 */
    452   1.1.2.4  martin 	KASSERT(sa_mtu == 0);
    453   1.1.2.2     snj 
    454   1.1.2.2     snj done:
    455   1.1.2.2     snj 	return error;
    456   1.1.2.2     snj }
    457   1.1.2.2     snj 
    458   1.1.2.2     snj #ifdef INET6
    459   1.1.2.6  martin int
    460   1.1.2.6  martin ipsecif6_encap_func(struct mbuf *m, struct ip6_hdr *ip6, struct ipsec_variant *var)
    461   1.1.2.6  martin {
    462   1.1.2.6  martin 	struct m_tag *mtag;
    463   1.1.2.6  martin 	struct sockaddr_in6 *src, *dst;
    464   1.1.2.6  martin 	u_int16_t src_port = 0;
    465   1.1.2.6  martin 	u_int16_t dst_port = 0;
    466   1.1.2.6  martin 
    467   1.1.2.6  martin 	KASSERT(var != NULL);
    468   1.1.2.6  martin 
    469   1.1.2.6  martin 	src = satosin6(var->iv_psrc);
    470   1.1.2.6  martin 	dst = satosin6(var->iv_pdst);
    471   1.1.2.6  martin 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    472   1.1.2.6  martin 	if (mtag) {
    473   1.1.2.6  martin 		u_int16_t *ports;
    474   1.1.2.6  martin 
    475   1.1.2.6  martin 		ports = (u_int16_t *)(mtag + 1);
    476   1.1.2.6  martin 		src_port = ports[0];
    477   1.1.2.6  martin 		dst_port = ports[1];
    478   1.1.2.6  martin 	}
    479   1.1.2.6  martin 
    480   1.1.2.6  martin 	/* address match */
    481   1.1.2.6  martin 	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
    482   1.1.2.6  martin 	    !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
    483   1.1.2.6  martin 		return 0;
    484   1.1.2.6  martin 
    485   1.1.2.6  martin 	/* UDP encap? */
    486   1.1.2.6  martin 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    487   1.1.2.6  martin 		goto match;
    488   1.1.2.6  martin 
    489   1.1.2.6  martin 	/* port match */
    490   1.1.2.6  martin 	if (src_port != var->iv_dport ||
    491   1.1.2.6  martin 	    dst_port != var->iv_sport) {
    492   1.1.2.6  martin #ifdef DEBUG
    493   1.1.2.6  martin 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    494   1.1.2.6  martin 		    __func__, ntohs(src_port), ntohs(dst_port),
    495   1.1.2.6  martin 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    496   1.1.2.6  martin #endif
    497   1.1.2.6  martin 		return 0;
    498   1.1.2.6  martin 	}
    499   1.1.2.6  martin 
    500   1.1.2.6  martin match:
    501   1.1.2.6  martin 	/*
    502   1.1.2.6  martin 	 * hide NAT-T information from encapsulated traffics.
    503   1.1.2.6  martin 	 * they don't know about IPsec.
    504   1.1.2.6  martin 	 */
    505   1.1.2.6  martin 	if (mtag)
    506   1.1.2.6  martin 		m_tag_delete(m, mtag);
    507   1.1.2.6  martin 	return sizeof(src->sin6_addr) + sizeof(dst->sin6_addr);
    508   1.1.2.6  martin }
    509   1.1.2.6  martin 
    510   1.1.2.2     snj static int
    511   1.1.2.2     snj ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m)
    512   1.1.2.2     snj {
    513   1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    514   1.1.2.2     snj 	struct ipsec_softc *sc = ifp->if_softc;
    515   1.1.2.9  martin 	struct route *ro_pc;
    516   1.1.2.9  martin 	kmutex_t *lock_pc;
    517   1.1.2.2     snj 	struct rtentry *rt;
    518   1.1.2.2     snj 	struct sockaddr_in6 *sin6_src;
    519   1.1.2.2     snj 	struct sockaddr_in6 *sin6_dst;
    520   1.1.2.2     snj 	struct ip6_hdr *ip6;
    521   1.1.2.2     snj 	int proto, error;
    522   1.1.2.2     snj 	u_int8_t itos, otos;
    523   1.1.2.2     snj 	union {
    524   1.1.2.2     snj 		struct sockaddr		dst;
    525   1.1.2.2     snj 		struct sockaddr_in6	dst6;
    526   1.1.2.2     snj 	} u;
    527   1.1.2.2     snj 
    528   1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    529   1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    530   1.1.2.2     snj 
    531   1.1.2.2     snj 	sin6_src = satosin6(var->iv_psrc);
    532   1.1.2.2     snj 	sin6_dst = satosin6(var->iv_pdst);
    533   1.1.2.2     snj 
    534   1.1.2.2     snj 	KASSERT(sin6_src->sin6_family == AF_INET6);
    535   1.1.2.2     snj 	KASSERT(sin6_dst->sin6_family == AF_INET6);
    536   1.1.2.2     snj 
    537   1.1.2.2     snj 	switch (family) {
    538   1.1.2.2     snj #ifdef INET
    539   1.1.2.2     snj 	case AF_INET:
    540   1.1.2.2     snj 	    {
    541   1.1.2.2     snj 		struct ip *ip;
    542   1.1.2.2     snj 
    543   1.1.2.2     snj 		proto = IPPROTO_IPV4;
    544   1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    545   1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    546   1.1.2.2     snj 			if (!m)
    547   1.1.2.2     snj 				return ENOBUFS;
    548   1.1.2.2     snj 		}
    549   1.1.2.2     snj 		ip = mtod(m, struct ip *);
    550   1.1.2.2     snj 		itos = ip->ip_tos;
    551   1.1.2.2     snj 		/*
    552   1.1.2.2     snj 		 * TODO:
    553   1.1.2.2     snj 		 *support ALTQ for innner packet
    554   1.1.2.2     snj 		 */
    555   1.1.2.2     snj 		break;
    556   1.1.2.2     snj 	    }
    557   1.1.2.2     snj #endif /* INET */
    558   1.1.2.2     snj 	case AF_INET6:
    559   1.1.2.2     snj 	    {
    560   1.1.2.2     snj 		struct ip6_hdr *xip6;
    561   1.1.2.2     snj 		proto = IPPROTO_IPV6;
    562   1.1.2.2     snj 		if (m->m_len < sizeof(*xip6)) {
    563   1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    564   1.1.2.2     snj 			if (!m)
    565   1.1.2.2     snj 				return ENOBUFS;
    566   1.1.2.2     snj 		}
    567   1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    568   1.1.2.2     snj 		itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff;
    569   1.1.2.2     snj 		/* TODO:
    570   1.1.2.2     snj 		 * support ALTQ for innner packet
    571   1.1.2.2     snj 		 */
    572   1.1.2.2     snj 		break;
    573   1.1.2.2     snj 	    }
    574   1.1.2.2     snj 	default:
    575   1.1.2.2     snj 		m_freem(m);
    576   1.1.2.2     snj 		return EAFNOSUPPORT;
    577   1.1.2.2     snj 	}
    578   1.1.2.2     snj 
    579   1.1.2.2     snj 	/* prepend new IP header */
    580   1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
    581   1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr)))
    582   1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip6_hdr));
    583   1.1.2.2     snj 	if (m == NULL)
    584   1.1.2.2     snj 		return ENOBUFS;
    585   1.1.2.2     snj 
    586   1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    587   1.1.2.2     snj 	ip6->ip6_flow	= 0;
    588   1.1.2.2     snj 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
    589   1.1.2.2     snj 	ip6->ip6_vfc	|= IPV6_VERSION;
    590   1.1.2.5  martin #if 0	/* ip6->ip6_plen will be filled by ip6_output */
    591   1.1.2.5  martin 	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len - sizeof(*ip6));
    592   1.1.2.5  martin #endif
    593   1.1.2.2     snj 	ip6->ip6_nxt	= proto;
    594   1.1.2.2     snj 	ip6->ip6_hlim	= ip6_ipsec_hlim;
    595   1.1.2.2     snj 	ip6->ip6_src	= sin6_src->sin6_addr;
    596   1.1.2.2     snj 	/* bidirectional configured tunnel mode */
    597   1.1.2.2     snj 	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
    598   1.1.2.2     snj 		ip6->ip6_dst = sin6_dst->sin6_addr;
    599   1.1.2.2     snj 	} else  {
    600   1.1.2.2     snj 		m_freem(m);
    601   1.1.2.2     snj 		return ENETUNREACH;
    602   1.1.2.2     snj 	}
    603   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    604   1.1.2.8  martin 	if (!ip6_ipsec_copy_tos)
    605   1.1.2.8  martin 		otos = 0;
    606   1.1.2.8  martin 
    607   1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    608   1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    609   1.1.2.2     snj 	else
    610   1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
    611   1.1.2.2     snj #else
    612   1.1.2.2     snj 	if (ip6_ipsec_copy_tos)
    613   1.1.2.2     snj 		otos = itos;
    614   1.1.2.2     snj 	else
    615   1.1.2.2     snj 		otos = 0;
    616   1.1.2.2     snj #endif
    617   1.1.2.2     snj 	ip6->ip6_flow &= ~ntohl(0xff00000);
    618   1.1.2.2     snj 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
    619   1.1.2.2     snj 
    620   1.1.2.2     snj 	sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
    621   1.1.2.2     snj 
    622   1.1.2.9  martin 	if_tunnel_get_ro(sc->ipsec_ro_percpu, &ro_pc, &lock_pc);
    623   1.1.2.9  martin 	if ((rt = rtcache_lookup(ro_pc, &u.dst)) == NULL) {
    624   1.1.2.9  martin 		if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
    625   1.1.2.2     snj 		m_freem(m);
    626   1.1.2.2     snj 		return ENETUNREACH;
    627   1.1.2.2     snj 	}
    628   1.1.2.2     snj 
    629   1.1.2.2     snj 	if (rt->rt_ifp == ifp) {
    630   1.1.2.9  martin 		rtcache_unref(rt, ro_pc);
    631   1.1.2.9  martin 		rtcache_free(ro_pc);
    632   1.1.2.9  martin 		if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
    633   1.1.2.2     snj 		m_freem(m);
    634   1.1.2.2     snj 		return ENETUNREACH;
    635   1.1.2.2     snj 	}
    636   1.1.2.9  martin 	rtcache_unref(rt, ro_pc);
    637   1.1.2.9  martin 
    638   1.1.2.9  martin 	/* set NAT-T ports */
    639   1.1.2.9  martin 	error = ipsecif_set_natt_ports(var, m);
    640   1.1.2.9  martin 	if (error) {
    641   1.1.2.9  martin 		m_freem(m);
    642   1.1.2.9  martin 		goto out;
    643   1.1.2.9  martin 	}
    644   1.1.2.2     snj 
    645   1.1.2.2     snj 	/*
    646   1.1.2.2     snj 	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
    647   1.1.2.2     snj 	 * it is too painful to ask for resend of inner packet, to achieve
    648   1.1.2.2     snj 	 * path MTU discovery for encapsulated packets.
    649   1.1.2.2     snj 	 */
    650   1.1.2.9  martin 	error = ip6_output(m, 0, ro_pc,
    651   1.1.2.2     snj 	    ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL);
    652   1.1.2.2     snj 
    653   1.1.2.9  martin out:
    654   1.1.2.9  martin 	if (error)
    655   1.1.2.9  martin 		rtcache_free(ro_pc);
    656   1.1.2.9  martin 	if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
    657   1.1.2.2     snj 
    658   1.1.2.2     snj 	return error;
    659   1.1.2.2     snj }
    660   1.1.2.2     snj #endif /* INET6 */
    661   1.1.2.2     snj 
    662   1.1.2.2     snj static void
    663   1.1.2.2     snj ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg)
    664   1.1.2.2     snj {
    665   1.1.2.2     snj 	struct ifnet *ipsecp;
    666   1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    667   1.1.2.2     snj 	struct ipsec_variant *var;
    668   1.1.2.2     snj 	const struct ip *ip;
    669   1.1.2.2     snj 	int af;
    670   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    671   1.1.2.2     snj 	u_int8_t otos;
    672   1.1.2.2     snj #endif
    673   1.1.2.2     snj 	struct psref psref_rcvif;
    674   1.1.2.2     snj 	struct psref psref_var;
    675   1.1.2.2     snj 	struct ifnet *rcvif;
    676   1.1.2.2     snj 
    677   1.1.2.2     snj 	KASSERT(sc != NULL);
    678   1.1.2.2     snj 
    679   1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    680   1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    681   1.1.2.2     snj 		m_freem(m);
    682   1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    683   1.1.2.2     snj 		return;
    684   1.1.2.2     snj 	}
    685   1.1.2.2     snj 
    686   1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    687   1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    688   1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    689   1.1.2.2     snj 		m_freem(m);
    690   1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    691   1.1.2.2     snj 		return;
    692   1.1.2.2     snj 	}
    693   1.1.2.2     snj 
    694   1.1.2.2     snj 	ip = mtod(m, const struct ip *);
    695   1.1.2.2     snj 
    696   1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    697   1.1.2.2     snj 	if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) {
    698   1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    699   1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    700   1.1.2.2     snj 		m_freem(m);
    701   1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    702   1.1.2.2     snj 		return;
    703   1.1.2.2     snj 	}
    704   1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    705   1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    706   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    707   1.1.2.2     snj 	otos = ip->ip_tos;
    708   1.1.2.2     snj #endif
    709   1.1.2.2     snj 	m_adj(m, off);
    710   1.1.2.2     snj 
    711   1.1.2.2     snj 	switch (proto) {
    712   1.1.2.2     snj 	case IPPROTO_IPV4:
    713   1.1.2.2     snj 	    {
    714   1.1.2.2     snj 		struct ip *xip;
    715   1.1.2.2     snj 		af = AF_INET;
    716   1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip))) {
    717   1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip));
    718   1.1.2.2     snj 			if (!m)
    719   1.1.2.2     snj 				return;
    720   1.1.2.2     snj 		}
    721   1.1.2.2     snj 		xip = mtod(m, struct ip *);
    722   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    723   1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    724   1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
    725   1.1.2.2     snj 		else
    726   1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
    727   1.1.2.2     snj #endif
    728   1.1.2.2     snj 		break;
    729   1.1.2.2     snj 	    }
    730   1.1.2.2     snj #ifdef INET6
    731   1.1.2.2     snj 	case IPPROTO_IPV6:
    732   1.1.2.2     snj 	    {
    733   1.1.2.2     snj 		struct ip6_hdr *ip6;
    734   1.1.2.2     snj 		u_int8_t itos;
    735   1.1.2.2     snj 		af = AF_INET6;
    736   1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
    737   1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    738   1.1.2.2     snj 			if (!m)
    739   1.1.2.2     snj 				return;
    740   1.1.2.2     snj 		}
    741   1.1.2.2     snj 		ip6 = mtod(m, struct ip6_hdr *);
    742   1.1.2.2     snj 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    743   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    744   1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    745   1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
    746   1.1.2.2     snj 		else
    747   1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
    748   1.1.2.2     snj #endif
    749   1.1.2.2     snj 		ip6->ip6_flow &= ~htonl(0xff << 20);
    750   1.1.2.2     snj 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
    751   1.1.2.2     snj 		break;
    752   1.1.2.2     snj 	    }
    753   1.1.2.2     snj #endif /* INET6 */
    754   1.1.2.2     snj 	default:
    755   1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    756   1.1.2.2     snj 		m_freem(m);
    757   1.1.2.2     snj 		return;
    758   1.1.2.2     snj 	}
    759   1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    760   1.1.2.2     snj 
    761   1.1.2.2     snj 	return;
    762   1.1.2.2     snj }
    763   1.1.2.2     snj 
    764   1.1.2.2     snj /*
    765   1.1.2.2     snj  * validate and filter the pakcet
    766   1.1.2.2     snj  */
    767   1.1.2.2     snj static int
    768   1.1.2.2     snj ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var,
    769   1.1.2.2     snj     struct ifnet *ifp)
    770   1.1.2.2     snj {
    771   1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    772   1.1.2.2     snj 
    773   1.1.2.2     snj 	src = satosin(var->iv_psrc);
    774   1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    775   1.1.2.2     snj 
    776   1.1.2.2     snj 	return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr);
    777   1.1.2.2     snj }
    778   1.1.2.2     snj 
    779   1.1.2.2     snj #ifdef INET6
    780   1.1.2.2     snj static int
    781   1.1.2.2     snj ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg)
    782   1.1.2.2     snj {
    783   1.1.2.2     snj 	struct mbuf *m = *mp;
    784   1.1.2.2     snj 	struct ifnet *ipsecp;
    785   1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    786   1.1.2.2     snj 	struct ipsec_variant *var;
    787   1.1.2.2     snj 	struct ip6_hdr *ip6;
    788   1.1.2.2     snj 	int af = 0;
    789   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    790   1.1.2.2     snj 	u_int32_t otos;
    791   1.1.2.2     snj #endif
    792   1.1.2.2     snj 	struct psref psref_rcvif;
    793   1.1.2.2     snj 	struct psref psref_var;
    794   1.1.2.2     snj 	struct ifnet *rcvif;
    795   1.1.2.2     snj 
    796   1.1.2.2     snj 	KASSERT(eparg != NULL);
    797   1.1.2.2     snj 
    798   1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    799   1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    800   1.1.2.2     snj 		m_freem(m);
    801   1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    802   1.1.2.2     snj 		return IPPROTO_DONE;
    803   1.1.2.2     snj 	}
    804   1.1.2.2     snj 
    805   1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    806   1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    807   1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    808   1.1.2.2     snj 		m_freem(m);
    809   1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    810   1.1.2.2     snj 		return IPPROTO_DONE;
    811   1.1.2.2     snj 	}
    812   1.1.2.2     snj 
    813   1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    814   1.1.2.2     snj 
    815   1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    816   1.1.2.2     snj 	if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) {
    817   1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    818   1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    819   1.1.2.2     snj 		m_freem(m);
    820   1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    821   1.1.2.2     snj 		return IPPROTO_DONE;
    822   1.1.2.2     snj 	}
    823   1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    824   1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    825   1.1.2.2     snj 
    826   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    827   1.1.2.2     snj 	otos = ip6->ip6_flow;
    828   1.1.2.2     snj #endif
    829   1.1.2.2     snj 	m_adj(m, *offp);
    830   1.1.2.2     snj 
    831   1.1.2.2     snj 	switch (proto) {
    832   1.1.2.2     snj #ifdef INET
    833   1.1.2.2     snj 	case IPPROTO_IPV4:
    834   1.1.2.2     snj 	    {
    835   1.1.2.2     snj 		af = AF_INET;
    836   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    837   1.1.2.2     snj 		struct ip *ip;
    838   1.1.2.2     snj 		u_int8_t otos8;
    839   1.1.2.2     snj 		otos8 = (ntohl(otos) >> 20) & 0xff;
    840   1.1.2.2     snj 
    841   1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip))) {
    842   1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    843   1.1.2.2     snj 			if (!m)
    844   1.1.2.2     snj 				return IPPROTO_DONE;
    845   1.1.2.2     snj 		}
    846   1.1.2.2     snj 		ip = mtod(m, struct ip *);
    847   1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    848   1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
    849   1.1.2.2     snj 		else
    850   1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
    851   1.1.2.2     snj #endif
    852   1.1.2.2     snj 		break;
    853   1.1.2.2     snj 	    }
    854   1.1.2.2     snj #endif /* INET */
    855   1.1.2.2     snj 	case IPPROTO_IPV6:
    856   1.1.2.2     snj 	    {
    857   1.1.2.2     snj 		af = AF_INET6;
    858   1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    859   1.1.2.2     snj 		struct ip6_hdr *xip6;
    860   1.1.2.2     snj 
    861   1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip6))) {
    862   1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    863   1.1.2.2     snj 			if (!m)
    864   1.1.2.2     snj 				return IPPROTO_DONE;
    865   1.1.2.2     snj 		}
    866   1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    867   1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    868   1.1.2.2     snj 			ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow);
    869   1.1.2.2     snj 		else
    870   1.1.2.2     snj 			ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow);
    871   1.1.2.2     snj 		break;
    872   1.1.2.2     snj #endif
    873   1.1.2.2     snj 	    }
    874   1.1.2.2     snj 	default:
    875   1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    876   1.1.2.2     snj 		m_freem(m);
    877   1.1.2.2     snj 		return IPPROTO_DONE;
    878   1.1.2.2     snj 	}
    879   1.1.2.2     snj 
    880   1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    881   1.1.2.2     snj 	return IPPROTO_DONE;
    882   1.1.2.2     snj }
    883   1.1.2.2     snj 
    884   1.1.2.2     snj /*
    885   1.1.2.2     snj  * validate and filter the packet.
    886   1.1.2.2     snj  */
    887   1.1.2.2     snj static int
    888   1.1.2.2     snj ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var,
    889   1.1.2.2     snj     struct ifnet *ifp)
    890   1.1.2.2     snj {
    891   1.1.2.2     snj 	struct sockaddr_in6 *src, *dst;
    892   1.1.2.2     snj 
    893   1.1.2.2     snj 	src = satosin6(var->iv_psrc);
    894   1.1.2.2     snj 	dst = satosin6(var->iv_pdst);
    895   1.1.2.2     snj 
    896   1.1.2.2     snj 	return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr);
    897   1.1.2.2     snj }
    898   1.1.2.2     snj #endif /* INET6 */
    899   1.1.2.2     snj 
    900   1.1.2.2     snj int
    901   1.1.2.2     snj ipsecif4_attach(struct ipsec_variant *var)
    902   1.1.2.2     snj {
    903   1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    904   1.1.2.2     snj 
    905   1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    906   1.1.2.2     snj 
    907   1.1.2.2     snj 	if (var->iv_encap_cookie4 != NULL)
    908   1.1.2.2     snj 		return EALREADY;
    909   1.1.2.2     snj 	var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func,
    910   1.1.2.2     snj 	    &ipsecif4_encapsw, sc);
    911   1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    912   1.1.2.2     snj 		return EEXIST;
    913   1.1.2.2     snj 
    914   1.1.2.2     snj 	var->iv_output = ipsecif4_output;
    915   1.1.2.2     snj 	return 0;
    916   1.1.2.2     snj }
    917   1.1.2.2     snj 
    918   1.1.2.2     snj int
    919   1.1.2.2     snj ipsecif4_detach(struct ipsec_variant *var)
    920   1.1.2.2     snj {
    921   1.1.2.2     snj 	int error;
    922   1.1.2.2     snj 
    923   1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    924   1.1.2.2     snj 		return 0;
    925   1.1.2.2     snj 
    926   1.1.2.2     snj 	var->iv_output = NULL;
    927   1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie4);
    928   1.1.2.2     snj 	if (error == 0)
    929   1.1.2.2     snj 		var->iv_encap_cookie4 = NULL;
    930   1.1.2.2     snj 
    931   1.1.2.2     snj 	return error;
    932   1.1.2.2     snj }
    933   1.1.2.2     snj 
    934   1.1.2.2     snj #ifdef INET6
    935   1.1.2.2     snj int
    936   1.1.2.2     snj ipsecif6_attach(struct ipsec_variant *var)
    937   1.1.2.2     snj {
    938   1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    939   1.1.2.2     snj 
    940   1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    941   1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 == NULL);
    942   1.1.2.2     snj 
    943   1.1.2.6  martin 	var->iv_encap_cookie6 = encap_attach_func(AF_INET6, -1, if_ipsec_encap_func,
    944   1.1.2.2     snj 	    &ipsecif6_encapsw, sc);
    945   1.1.2.2     snj 	if (var->iv_encap_cookie6 == NULL)
    946   1.1.2.2     snj 		return EEXIST;
    947   1.1.2.2     snj 
    948   1.1.2.2     snj 	var->iv_output = ipsecif6_output;
    949   1.1.2.2     snj 	return 0;
    950   1.1.2.2     snj }
    951   1.1.2.2     snj 
    952   1.1.2.2     snj int
    953   1.1.2.2     snj ipsecif6_detach(struct ipsec_variant *var)
    954   1.1.2.2     snj {
    955   1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    956   1.1.2.2     snj 	int error;
    957   1.1.2.2     snj 
    958   1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 != NULL);
    959   1.1.2.2     snj 
    960   1.1.2.9  martin 	if_tunnel_ro_percpu_rtcache_free(sc->ipsec_ro_percpu);
    961   1.1.2.2     snj 
    962   1.1.2.2     snj 	var->iv_output = NULL;
    963   1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie6);
    964   1.1.2.2     snj 	if (error == 0)
    965   1.1.2.2     snj 		var->iv_encap_cookie6 = NULL;
    966   1.1.2.2     snj 	return error;
    967   1.1.2.2     snj }
    968   1.1.2.2     snj 
    969   1.1.2.2     snj void *
    970   1.1.2.2     snj ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg)
    971   1.1.2.2     snj {
    972   1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    973   1.1.2.2     snj 	struct ip6ctlparam *ip6cp = NULL;
    974   1.1.2.2     snj 	struct ip6_hdr *ip6;
    975   1.1.2.2     snj 	const struct sockaddr_in6 *dst6;
    976   1.1.2.9  martin 	struct route *ro_pc;
    977   1.1.2.9  martin 	kmutex_t *lock_pc;
    978   1.1.2.2     snj 
    979   1.1.2.2     snj 	if (sa->sa_family != AF_INET6 ||
    980   1.1.2.2     snj 	    sa->sa_len != sizeof(struct sockaddr_in6))
    981   1.1.2.2     snj 		return NULL;
    982   1.1.2.2     snj 
    983   1.1.2.2     snj 	if ((unsigned)cmd >= PRC_NCMDS)
    984   1.1.2.2     snj 		return NULL;
    985   1.1.2.2     snj 	if (cmd == PRC_HOSTDEAD)
    986   1.1.2.2     snj 		d = NULL;
    987   1.1.2.2     snj 	else if (inet6ctlerrmap[cmd] == 0)
    988   1.1.2.2     snj 		return NULL;
    989   1.1.2.2     snj 
    990   1.1.2.2     snj 	/* if the parameter is from icmp6, decode it. */
    991   1.1.2.2     snj 	if (d != NULL) {
    992   1.1.2.2     snj 		ip6cp = (struct ip6ctlparam *)d;
    993   1.1.2.2     snj 		ip6 = ip6cp->ip6c_ip6;
    994   1.1.2.2     snj 	} else {
    995   1.1.2.2     snj 		ip6 = NULL;
    996   1.1.2.2     snj 	}
    997   1.1.2.2     snj 
    998   1.1.2.2     snj 	if (!ip6)
    999   1.1.2.2     snj 		return NULL;
   1000   1.1.2.2     snj 
   1001   1.1.2.9  martin 	if_tunnel_get_ro(sc->ipsec_ro_percpu, &ro_pc, &lock_pc);
   1002   1.1.2.9  martin 	dst6 = satocsin6(rtcache_getdst(ro_pc));
   1003   1.1.2.2     snj 	/* XXX scope */
   1004   1.1.2.2     snj 	if (dst6 == NULL)
   1005   1.1.2.2     snj 		;
   1006   1.1.2.2     snj 	else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
   1007   1.1.2.2     snj 		/* flush route cache */
   1008   1.1.2.9  martin 		rtcache_free(ro_pc);
   1009   1.1.2.2     snj 
   1010   1.1.2.9  martin 	if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
   1011   1.1.2.2     snj 
   1012   1.1.2.2     snj 	return NULL;
   1013   1.1.2.2     snj }
   1014   1.1.2.2     snj 
   1015   1.1.2.2     snj ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput)
   1016   1.1.2.2     snj #define	ipsecif6_ctlinput	ipsecif6_ctlinput_wrapper
   1017   1.1.2.2     snj 
   1018   1.1.2.2     snj static const struct encapsw ipsecif6_encapsw = {
   1019   1.1.2.2     snj 	.encapsw6 = {
   1020   1.1.2.2     snj 		.pr_input = ipsecif6_input,
   1021   1.1.2.2     snj 		.pr_ctlinput = ipsecif6_ctlinput,
   1022   1.1.2.2     snj 	}
   1023   1.1.2.2     snj };
   1024   1.1.2.2     snj #endif /* INET6 */
   1025