Home | History | Annotate | Line # | Download | only in netipsec
ipsecif.c revision 1.1.2.2 
      1  1.1.2.2  snj /*	$NetBSD: ipsecif.c,v 1.1.2.2 2018/02/11 21:17:34 snj Exp $  */
      2  1.1.2.2  snj 
      3  1.1.2.2  snj /*
      4  1.1.2.2  snj  * Copyright (c) 2017 Internet Initiative Japan Inc.
      5  1.1.2.2  snj  * All rights reserved.
      6  1.1.2.2  snj  *
      7  1.1.2.2  snj  * Redistribution and use in source and binary forms, with or without
      8  1.1.2.2  snj  * modification, are permitted provided that the following conditions
      9  1.1.2.2  snj  * are met:
     10  1.1.2.2  snj  * 1. Redistributions of source code must retain the above copyright
     11  1.1.2.2  snj  *    notice, this list of conditions and the following disclaimer.
     12  1.1.2.2  snj  * 2. Redistributions in binary form must reproduce the above copyright
     13  1.1.2.2  snj  *    notice, this list of conditions and the following disclaimer in the
     14  1.1.2.2  snj  *    documentation and/or other materials provided with the distribution.
     15  1.1.2.2  snj  *
     16  1.1.2.2  snj  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17  1.1.2.2  snj  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18  1.1.2.2  snj  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19  1.1.2.2  snj  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20  1.1.2.2  snj  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21  1.1.2.2  snj  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22  1.1.2.2  snj  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23  1.1.2.2  snj  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24  1.1.2.2  snj  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25  1.1.2.2  snj  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26  1.1.2.2  snj  * POSSIBILITY OF SUCH DAMAGE.
     27  1.1.2.2  snj  */
     28  1.1.2.2  snj 
     29  1.1.2.2  snj #include <sys/cdefs.h>
     30  1.1.2.2  snj __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.1.2.2 2018/02/11 21:17:34 snj Exp $");
     31  1.1.2.2  snj 
     32  1.1.2.2  snj #ifdef _KERNEL_OPT
     33  1.1.2.2  snj #include "opt_inet.h"
     34  1.1.2.2  snj #include "opt_ipsec.h"
     35  1.1.2.2  snj #endif
     36  1.1.2.2  snj 
     37  1.1.2.2  snj #include <sys/param.h>
     38  1.1.2.2  snj #include <sys/systm.h>
     39  1.1.2.2  snj #include <sys/socket.h>
     40  1.1.2.2  snj #include <sys/sockio.h>
     41  1.1.2.2  snj #include <sys/mbuf.h>
     42  1.1.2.2  snj #include <sys/errno.h>
     43  1.1.2.2  snj #include <sys/ioctl.h>
     44  1.1.2.2  snj #include <sys/syslog.h>
     45  1.1.2.2  snj #include <sys/kernel.h>
     46  1.1.2.2  snj 
     47  1.1.2.2  snj #include <net/if.h>
     48  1.1.2.2  snj #include <net/route.h>
     49  1.1.2.2  snj 
     50  1.1.2.2  snj #include <netinet/in.h>
     51  1.1.2.2  snj #include <netinet/in_systm.h>
     52  1.1.2.2  snj #include <netinet/ip.h>
     53  1.1.2.2  snj #include <netinet/ip_var.h>
     54  1.1.2.2  snj #include <netinet/in_var.h>
     55  1.1.2.2  snj #include <netinet/ip_encap.h>
     56  1.1.2.2  snj #include <netinet/ip_ecn.h>
     57  1.1.2.2  snj #include <netinet/ip_private.h>
     58  1.1.2.2  snj #include <netinet/udp.h>
     59  1.1.2.2  snj 
     60  1.1.2.2  snj #ifdef INET6
     61  1.1.2.2  snj #include <netinet/ip6.h>
     62  1.1.2.2  snj #include <netinet6/ip6_var.h>
     63  1.1.2.2  snj #include <netinet6/ip6_private.h>
     64  1.1.2.2  snj #include <netinet6/in6_var.h>
     65  1.1.2.2  snj #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */
     66  1.1.2.2  snj #include <netinet/ip_ecn.h>
     67  1.1.2.2  snj #endif
     68  1.1.2.2  snj 
     69  1.1.2.2  snj #include <netipsec/key.h>
     70  1.1.2.2  snj #include <netipsec/ipsecif.h>
     71  1.1.2.2  snj 
     72  1.1.2.2  snj #include <net/if_ipsec.h>
     73  1.1.2.2  snj 
     74  1.1.2.2  snj static void ipsecif4_input(struct mbuf *, int, int, void *);
     75  1.1.2.2  snj static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *);
     76  1.1.2.2  snj static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *,
     77  1.1.2.2  snj 	struct ifnet *);
     78  1.1.2.2  snj 
     79  1.1.2.2  snj #ifdef INET6
     80  1.1.2.2  snj static int ipsecif6_input(struct mbuf **, int *, int, void *);
     81  1.1.2.2  snj static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *);
     82  1.1.2.2  snj static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *,
     83  1.1.2.2  snj 	struct ifnet *);
     84  1.1.2.2  snj #endif
     85  1.1.2.2  snj 
     86  1.1.2.2  snj static int ip_ipsec_ttl = IPSEC_TTL;
     87  1.1.2.2  snj static int ip_ipsec_copy_tos = 0;
     88  1.1.2.2  snj #ifdef INET6
     89  1.1.2.2  snj static int ip6_ipsec_hlim = IPSEC_HLIM;
     90  1.1.2.2  snj static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */
     91  1.1.2.2  snj static int ip6_ipsec_copy_tos = 0;
     92  1.1.2.2  snj #endif
     93  1.1.2.2  snj 
     94  1.1.2.2  snj struct encapsw ipsecif4_encapsw = {
     95  1.1.2.2  snj 	.encapsw4 = {
     96  1.1.2.2  snj 		.pr_input = ipsecif4_input,
     97  1.1.2.2  snj 		.pr_ctlinput = NULL,
     98  1.1.2.2  snj 	}
     99  1.1.2.2  snj };
    100  1.1.2.2  snj 
    101  1.1.2.2  snj #ifdef INET6
    102  1.1.2.2  snj static const struct encapsw ipsecif6_encapsw;
    103  1.1.2.2  snj #endif
    104  1.1.2.2  snj 
    105  1.1.2.2  snj static struct mbuf *
    106  1.1.2.2  snj ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m,
    107  1.1.2.2  snj     uint8_t proto, uint8_t tos)
    108  1.1.2.2  snj {
    109  1.1.2.2  snj 	struct ip *ip;
    110  1.1.2.2  snj 	struct sockaddr_in *src, *dst;
    111  1.1.2.2  snj 
    112  1.1.2.2  snj 	src = satosin(var->iv_psrc);
    113  1.1.2.2  snj 	dst = satosin(var->iv_pdst);
    114  1.1.2.2  snj 
    115  1.1.2.2  snj 	if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) ||
    116  1.1.2.2  snj 	    src->sin_addr.s_addr == INADDR_BROADCAST ||
    117  1.1.2.2  snj 	    dst->sin_addr.s_addr == INADDR_BROADCAST) {
    118  1.1.2.2  snj 		m_freem(m);
    119  1.1.2.2  snj 		return NULL;
    120  1.1.2.2  snj 	}
    121  1.1.2.2  snj 	m->m_flags &= ~M_BCAST;
    122  1.1.2.2  snj 
    123  1.1.2.2  snj 	if (IN_MULTICAST(src->sin_addr.s_addr) ||
    124  1.1.2.2  snj 	   IN_MULTICAST(dst->sin_addr.s_addr)) {
    125  1.1.2.2  snj 		m_freem(m);
    126  1.1.2.2  snj 		return NULL;
    127  1.1.2.2  snj 	}
    128  1.1.2.2  snj 
    129  1.1.2.2  snj 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    130  1.1.2.2  snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip)))
    131  1.1.2.2  snj 		m = m_pullup(m, sizeof(struct ip));
    132  1.1.2.2  snj 	if (m == NULL)
    133  1.1.2.2  snj 		return NULL;
    134  1.1.2.2  snj 
    135  1.1.2.2  snj 	ip = mtod(m, struct ip *);
    136  1.1.2.2  snj 	ip->ip_v = IPVERSION;
    137  1.1.2.2  snj 	ip->ip_off = htons(0);
    138  1.1.2.2  snj 	ip->ip_id = 0;
    139  1.1.2.2  snj 	ip->ip_hl = sizeof(*ip) >> 2;
    140  1.1.2.2  snj 	if (ip_ipsec_copy_tos)
    141  1.1.2.2  snj 		ip->ip_tos = tos;
    142  1.1.2.2  snj 	else
    143  1.1.2.2  snj 		ip->ip_tos = 0;
    144  1.1.2.2  snj 	ip->ip_sum = 0;
    145  1.1.2.2  snj 	ip->ip_src = src->sin_addr;
    146  1.1.2.2  snj 	ip->ip_dst = dst->sin_addr;
    147  1.1.2.2  snj 	ip->ip_p = proto;
    148  1.1.2.2  snj 	ip->ip_ttl = ip_ipsec_ttl;
    149  1.1.2.2  snj 	ip->ip_len = htons(m->m_pkthdr.len);
    150  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    151  1.1.2.2  snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    152  1.1.2.2  snj 	if (ifp->if_flags & IFF_ECN)
    153  1.1.2.2  snj 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
    154  1.1.2.2  snj 	else
    155  1.1.2.2  snj 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
    156  1.1.2.2  snj #endif
    157  1.1.2.2  snj 
    158  1.1.2.2  snj 	return m;
    159  1.1.2.2  snj }
    160  1.1.2.2  snj 
    161  1.1.2.2  snj static int
    162  1.1.2.2  snj ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr)
    163  1.1.2.2  snj {
    164  1.1.2.2  snj 	struct ip ip0;
    165  1.1.2.2  snj 	struct ip *ip;
    166  1.1.2.2  snj 	int mtu;
    167  1.1.2.2  snj 	struct secasvar *sav;
    168  1.1.2.2  snj 
    169  1.1.2.2  snj 	sav = key_lookup_sa_bysaidx(&isr->saidx);
    170  1.1.2.2  snj 	if (sav == NULL)
    171  1.1.2.2  snj 		return 0;
    172  1.1.2.2  snj 
    173  1.1.2.2  snj 	if (!(sav->natt_type & UDP_ENCAP_ESPINUDP) &&
    174  1.1.2.2  snj 	    !(sav->natt_type & UDP_ENCAP_ESPINUDP_NON_IKE)) {
    175  1.1.2.2  snj 		mtu = 0;
    176  1.1.2.2  snj 		goto out;
    177  1.1.2.2  snj 	}
    178  1.1.2.2  snj 
    179  1.1.2.2  snj 	if (m->m_len < sizeof(struct ip)) {
    180  1.1.2.2  snj 		m_copydata(m, 0, sizeof(ip0), &ip0);
    181  1.1.2.2  snj 		ip = &ip0;
    182  1.1.2.2  snj 
    183  1.1.2.2  snj 	} else {
    184  1.1.2.2  snj 		ip = mtod(m, struct ip *);
    185  1.1.2.2  snj 	}
    186  1.1.2.2  snj 	mtu = sav->esp_frag;
    187  1.1.2.2  snj 	if (ntohs(ip->ip_len) <= mtu)
    188  1.1.2.2  snj 		mtu = 0;
    189  1.1.2.2  snj 
    190  1.1.2.2  snj out:
    191  1.1.2.2  snj 	KEY_SA_UNREF(&sav);
    192  1.1.2.2  snj 	return mtu;
    193  1.1.2.2  snj }
    194  1.1.2.2  snj 
    195  1.1.2.2  snj static struct mbuf *
    196  1.1.2.2  snj ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0)
    197  1.1.2.2  snj {
    198  1.1.2.2  snj 	const struct ip *ip;
    199  1.1.2.2  snj 	int proto;
    200  1.1.2.2  snj 	int tos;
    201  1.1.2.2  snj 
    202  1.1.2.2  snj 	KASSERT(proto0 != NULL);
    203  1.1.2.2  snj 	KASSERT(tos0 != NULL);
    204  1.1.2.2  snj 
    205  1.1.2.2  snj 	switch (family) {
    206  1.1.2.2  snj 	case AF_INET:
    207  1.1.2.2  snj 		proto = IPPROTO_IPV4;
    208  1.1.2.2  snj 		if (m->m_len < sizeof(*ip)) {
    209  1.1.2.2  snj 			m = m_pullup(m, sizeof(*ip));
    210  1.1.2.2  snj 			if (!m) {
    211  1.1.2.2  snj 				*tos0 = 0;
    212  1.1.2.2  snj 				*proto0 = 0;
    213  1.1.2.2  snj 				return  NULL;
    214  1.1.2.2  snj 			}
    215  1.1.2.2  snj 		}
    216  1.1.2.2  snj 		ip = mtod(m, const struct ip *);
    217  1.1.2.2  snj 		tos = ip->ip_tos;
    218  1.1.2.2  snj 		/* TODO: support ALTQ for innner packet */
    219  1.1.2.2  snj 		break;
    220  1.1.2.2  snj #ifdef INET6
    221  1.1.2.2  snj 	case AF_INET6: {
    222  1.1.2.2  snj 		const struct ip6_hdr *ip6;
    223  1.1.2.2  snj 		proto = IPPROTO_IPV6;
    224  1.1.2.2  snj 		if (m->m_len < sizeof(*ip6)) {
    225  1.1.2.2  snj 			m = m_pullup(m, sizeof(*ip6));
    226  1.1.2.2  snj 			if (!m) {
    227  1.1.2.2  snj 				*tos0 = 0;
    228  1.1.2.2  snj 				*proto0 = 0;
    229  1.1.2.2  snj 				return NULL;
    230  1.1.2.2  snj 			}
    231  1.1.2.2  snj 		}
    232  1.1.2.2  snj 		ip6 = mtod(m, const struct ip6_hdr *);
    233  1.1.2.2  snj 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    234  1.1.2.2  snj 		/* TODO: support ALTQ for innner packet */
    235  1.1.2.2  snj 		break;
    236  1.1.2.2  snj 	}
    237  1.1.2.2  snj #endif /* INET6 */
    238  1.1.2.2  snj 	default:
    239  1.1.2.2  snj 		*tos0 = 0;
    240  1.1.2.2  snj 		*proto0 = 0;
    241  1.1.2.2  snj 		return NULL;
    242  1.1.2.2  snj 	}
    243  1.1.2.2  snj 
    244  1.1.2.2  snj 	*proto0 = proto;
    245  1.1.2.2  snj 	*tos0 = tos;
    246  1.1.2.2  snj 	return m;
    247  1.1.2.2  snj }
    248  1.1.2.2  snj 
    249  1.1.2.2  snj static int
    250  1.1.2.2  snj ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu)
    251  1.1.2.2  snj {
    252  1.1.2.2  snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    253  1.1.2.2  snj 	struct mbuf *next;
    254  1.1.2.2  snj 	struct m_tag *mtag;
    255  1.1.2.2  snj 	int error;
    256  1.1.2.2  snj 
    257  1.1.2.2  snj 	KASSERT(if_ipsec_heldref_variant(var));
    258  1.1.2.2  snj 
    259  1.1.2.2  snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    260  1.1.2.2  snj 	if (mtag)
    261  1.1.2.2  snj 		m_tag_delete(m, mtag);
    262  1.1.2.2  snj 
    263  1.1.2.2  snj 	error = ip_fragment(m, ifp, mtu);
    264  1.1.2.2  snj 	if (error)
    265  1.1.2.2  snj 		return error;
    266  1.1.2.2  snj 
    267  1.1.2.2  snj 	for (error = 0; m; m = next) {
    268  1.1.2.2  snj 		next = m->m_nextpkt;
    269  1.1.2.2  snj 		m->m_next = NULL;
    270  1.1.2.2  snj 		if (error) {
    271  1.1.2.2  snj 			m_freem(m);
    272  1.1.2.2  snj 			continue;
    273  1.1.2.2  snj 		}
    274  1.1.2.2  snj 
    275  1.1.2.2  snj 		error = ipsecif4_output(var, family, m);
    276  1.1.2.2  snj 	}
    277  1.1.2.2  snj 	if (error == 0)
    278  1.1.2.2  snj 		IP_STATINC(IP_STAT_FRAGMENTED);
    279  1.1.2.2  snj 
    280  1.1.2.2  snj 	return error;
    281  1.1.2.2  snj }
    282  1.1.2.2  snj 
    283  1.1.2.2  snj int
    284  1.1.2.2  snj ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var)
    285  1.1.2.2  snj {
    286  1.1.2.2  snj 	struct m_tag *mtag;
    287  1.1.2.2  snj 	struct sockaddr_in *src, *dst;
    288  1.1.2.2  snj 	u_int16_t src_port = 0;
    289  1.1.2.2  snj 	u_int16_t dst_port = 0;
    290  1.1.2.2  snj 
    291  1.1.2.2  snj 	KASSERT(var != NULL);
    292  1.1.2.2  snj 
    293  1.1.2.2  snj 	src = satosin(var->iv_psrc);
    294  1.1.2.2  snj 	dst = satosin(var->iv_pdst);
    295  1.1.2.2  snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    296  1.1.2.2  snj 	if (mtag) {
    297  1.1.2.2  snj 		u_int16_t *ports;
    298  1.1.2.2  snj 
    299  1.1.2.2  snj 		ports = (u_int16_t *)(mtag + 1);
    300  1.1.2.2  snj 		src_port = ports[0];
    301  1.1.2.2  snj 		dst_port = ports[1];
    302  1.1.2.2  snj 	}
    303  1.1.2.2  snj 
    304  1.1.2.2  snj 	/* address match */
    305  1.1.2.2  snj 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
    306  1.1.2.2  snj 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
    307  1.1.2.2  snj 		return 0;
    308  1.1.2.2  snj 
    309  1.1.2.2  snj 	/* UDP encap? */
    310  1.1.2.2  snj 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    311  1.1.2.2  snj 		goto match;
    312  1.1.2.2  snj 
    313  1.1.2.2  snj 	/* port match */
    314  1.1.2.2  snj 	if (src_port != var->iv_dport ||
    315  1.1.2.2  snj 	    dst_port != var->iv_sport) {
    316  1.1.2.2  snj #ifdef DEBUG
    317  1.1.2.2  snj 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    318  1.1.2.2  snj 		    __func__, ntohs(src_port), ntohs(dst_port),
    319  1.1.2.2  snj 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    320  1.1.2.2  snj #endif
    321  1.1.2.2  snj 		return 0;
    322  1.1.2.2  snj 	}
    323  1.1.2.2  snj 
    324  1.1.2.2  snj match:
    325  1.1.2.2  snj 	/*
    326  1.1.2.2  snj 	 * hide NAT-T information from encapsulated traffics.
    327  1.1.2.2  snj 	 * they don't know about IPsec.
    328  1.1.2.2  snj 	 */
    329  1.1.2.2  snj 	if (mtag)
    330  1.1.2.2  snj 		m_tag_delete(m, mtag);
    331  1.1.2.2  snj 	return sizeof(src->sin_addr) + sizeof(dst->sin_addr);
    332  1.1.2.2  snj }
    333  1.1.2.2  snj 
    334  1.1.2.2  snj static int
    335  1.1.2.2  snj ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m)
    336  1.1.2.2  snj {
    337  1.1.2.2  snj 	struct secpolicy *sp = NULL;
    338  1.1.2.2  snj 	u_int8_t tos;
    339  1.1.2.2  snj 	int proto;
    340  1.1.2.2  snj 	int error;
    341  1.1.2.2  snj 	int mtu;
    342  1.1.2.2  snj 	u_long sa_mtu = 0;
    343  1.1.2.2  snj 
    344  1.1.2.2  snj 	KASSERT(if_ipsec_heldref_variant(var));
    345  1.1.2.2  snj 	KASSERT(if_ipsec_variant_is_configured(var));
    346  1.1.2.2  snj 	KASSERT(var->iv_psrc->sa_family == AF_INET);
    347  1.1.2.2  snj 	KASSERT(var->iv_pdst->sa_family == AF_INET);
    348  1.1.2.2  snj 
    349  1.1.2.2  snj 	sp = IV_SP_OUT(var);
    350  1.1.2.2  snj 	KASSERT(sp != NULL);
    351  1.1.2.2  snj 	/*
    352  1.1.2.2  snj 	 * The SPs in ipsec_variant are prevented from freed by
    353  1.1.2.2  snj 	 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here.
    354  1.1.2.2  snj 	 */
    355  1.1.2.2  snj 
    356  1.1.2.2  snj 	KASSERT(sp->policy != IPSEC_POLICY_NONE);
    357  1.1.2.2  snj 	KASSERT(sp->policy != IPSEC_POLICY_ENTRUST);
    358  1.1.2.2  snj 	KASSERT(sp->policy != IPSEC_POLICY_BYPASS);
    359  1.1.2.2  snj 	if(sp->policy != IPSEC_POLICY_IPSEC) {
    360  1.1.2.2  snj 		struct ifnet *ifp = &var->iv_softc->ipsec_if;
    361  1.1.2.2  snj 		m_freem(m);
    362  1.1.2.2  snj 		IF_DROP(&ifp->if_snd);
    363  1.1.2.2  snj 		return 0;
    364  1.1.2.2  snj 	}
    365  1.1.2.2  snj 
    366  1.1.2.2  snj 	/* get flowinfo */
    367  1.1.2.2  snj 	m = ipsecif4_flowinfo(m, family, &proto, &tos);
    368  1.1.2.2  snj 	if (m == NULL) {
    369  1.1.2.2  snj 		error = ENETUNREACH;
    370  1.1.2.2  snj 		goto done;
    371  1.1.2.2  snj 	}
    372  1.1.2.2  snj 
    373  1.1.2.2  snj 	/* prepend new IP header */
    374  1.1.2.2  snj 	m = ipsecif4_prepend_hdr(var, m, proto, tos);
    375  1.1.2.2  snj 	if (m == NULL) {
    376  1.1.2.2  snj 		error = ENETUNREACH;
    377  1.1.2.2  snj 		goto done;
    378  1.1.2.2  snj 	}
    379  1.1.2.2  snj 
    380  1.1.2.2  snj 	/*
    381  1.1.2.2  snj 	 * Normal netipsec's NAT-T fragmentation is done in ip_output().
    382  1.1.2.2  snj 	 * See "natt_frag" processing.
    383  1.1.2.2  snj 	 * However, ipsec(4) interface's one is not done in the same way,
    384  1.1.2.2  snj 	 * so we must do NAT-T fragmentation by own code.
    385  1.1.2.2  snj 	 */
    386  1.1.2.2  snj 	/* NAT-T ESP fragmentation */
    387  1.1.2.2  snj 	mtu = ipsecif4_needfrag(m, sp->req);
    388  1.1.2.2  snj 	if (mtu > 0)
    389  1.1.2.2  snj 		return ipsecif4_fragout(var, family, m, mtu);
    390  1.1.2.2  snj 
    391  1.1.2.2  snj 	/* IPsec output */
    392  1.1.2.2  snj 	IP_STATINC(IP_STAT_LOCALOUT);
    393  1.1.2.2  snj 	error = ipsec4_process_packet(m, sp->req, &sa_mtu);
    394  1.1.2.2  snj 	if (error == ENOENT)
    395  1.1.2.2  snj 		error = 0;
    396  1.1.2.2  snj 	/*
    397  1.1.2.2  snj 	 * frangmentation is already done in ipsecif4_fragout(),
    398  1.1.2.2  snj 	 * so ipsec4_process_packet() must not do fragmentation here.
    399  1.1.2.2  snj 	 */
    400  1.1.2.2  snj 	KASSERT(error != 0 || sa_mtu == 0);
    401  1.1.2.2  snj 
    402  1.1.2.2  snj done:
    403  1.1.2.2  snj 	return error;
    404  1.1.2.2  snj }
    405  1.1.2.2  snj 
    406  1.1.2.2  snj #ifdef INET6
    407  1.1.2.2  snj static int
    408  1.1.2.2  snj ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m)
    409  1.1.2.2  snj {
    410  1.1.2.2  snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    411  1.1.2.2  snj 	struct ipsec_softc *sc = ifp->if_softc;
    412  1.1.2.2  snj 	struct ipsec_ro *iro;
    413  1.1.2.2  snj 	struct rtentry *rt;
    414  1.1.2.2  snj 	struct sockaddr_in6 *sin6_src;
    415  1.1.2.2  snj 	struct sockaddr_in6 *sin6_dst;
    416  1.1.2.2  snj 	struct ip6_hdr *ip6;
    417  1.1.2.2  snj 	int proto, error;
    418  1.1.2.2  snj 	u_int8_t itos, otos;
    419  1.1.2.2  snj 	union {
    420  1.1.2.2  snj 		struct sockaddr		dst;
    421  1.1.2.2  snj 		struct sockaddr_in6	dst6;
    422  1.1.2.2  snj 	} u;
    423  1.1.2.2  snj 
    424  1.1.2.2  snj 	KASSERT(if_ipsec_heldref_variant(var));
    425  1.1.2.2  snj 	KASSERT(if_ipsec_variant_is_configured(var));
    426  1.1.2.2  snj 
    427  1.1.2.2  snj 	sin6_src = satosin6(var->iv_psrc);
    428  1.1.2.2  snj 	sin6_dst = satosin6(var->iv_pdst);
    429  1.1.2.2  snj 
    430  1.1.2.2  snj 	KASSERT(sin6_src->sin6_family == AF_INET6);
    431  1.1.2.2  snj 	KASSERT(sin6_dst->sin6_family == AF_INET6);
    432  1.1.2.2  snj 
    433  1.1.2.2  snj 	switch (family) {
    434  1.1.2.2  snj #ifdef INET
    435  1.1.2.2  snj 	case AF_INET:
    436  1.1.2.2  snj 	    {
    437  1.1.2.2  snj 		struct ip *ip;
    438  1.1.2.2  snj 
    439  1.1.2.2  snj 		proto = IPPROTO_IPV4;
    440  1.1.2.2  snj 		if (m->m_len < sizeof(*ip)) {
    441  1.1.2.2  snj 			m = m_pullup(m, sizeof(*ip));
    442  1.1.2.2  snj 			if (!m)
    443  1.1.2.2  snj 				return ENOBUFS;
    444  1.1.2.2  snj 		}
    445  1.1.2.2  snj 		ip = mtod(m, struct ip *);
    446  1.1.2.2  snj 		itos = ip->ip_tos;
    447  1.1.2.2  snj 		/*
    448  1.1.2.2  snj 		 * TODO:
    449  1.1.2.2  snj 		 *support ALTQ for innner packet
    450  1.1.2.2  snj 		 */
    451  1.1.2.2  snj 		break;
    452  1.1.2.2  snj 	    }
    453  1.1.2.2  snj #endif /* INET */
    454  1.1.2.2  snj 	case AF_INET6:
    455  1.1.2.2  snj 	    {
    456  1.1.2.2  snj 		struct ip6_hdr *xip6;
    457  1.1.2.2  snj 		proto = IPPROTO_IPV6;
    458  1.1.2.2  snj 		if (m->m_len < sizeof(*xip6)) {
    459  1.1.2.2  snj 			m = m_pullup(m, sizeof(*xip6));
    460  1.1.2.2  snj 			if (!m)
    461  1.1.2.2  snj 				return ENOBUFS;
    462  1.1.2.2  snj 		}
    463  1.1.2.2  snj 		xip6 = mtod(m, struct ip6_hdr *);
    464  1.1.2.2  snj 		itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff;
    465  1.1.2.2  snj 		/* TODO:
    466  1.1.2.2  snj 		 * support ALTQ for innner packet
    467  1.1.2.2  snj 		 */
    468  1.1.2.2  snj 		break;
    469  1.1.2.2  snj 	    }
    470  1.1.2.2  snj 	default:
    471  1.1.2.2  snj 		m_freem(m);
    472  1.1.2.2  snj 		return EAFNOSUPPORT;
    473  1.1.2.2  snj 	}
    474  1.1.2.2  snj 
    475  1.1.2.2  snj 	/* prepend new IP header */
    476  1.1.2.2  snj 	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
    477  1.1.2.2  snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr)))
    478  1.1.2.2  snj 		m = m_pullup(m, sizeof(struct ip6_hdr));
    479  1.1.2.2  snj 	if (m == NULL)
    480  1.1.2.2  snj 		return ENOBUFS;
    481  1.1.2.2  snj 
    482  1.1.2.2  snj 	ip6 = mtod(m, struct ip6_hdr *);
    483  1.1.2.2  snj 	ip6->ip6_flow	= 0;
    484  1.1.2.2  snj 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
    485  1.1.2.2  snj 	ip6->ip6_vfc	|= IPV6_VERSION;
    486  1.1.2.2  snj 	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len);
    487  1.1.2.2  snj 	ip6->ip6_nxt	= proto;
    488  1.1.2.2  snj 	ip6->ip6_hlim	= ip6_ipsec_hlim;
    489  1.1.2.2  snj 	ip6->ip6_src	= sin6_src->sin6_addr;
    490  1.1.2.2  snj 	/* bidirectional configured tunnel mode */
    491  1.1.2.2  snj 	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
    492  1.1.2.2  snj 		ip6->ip6_dst = sin6_dst->sin6_addr;
    493  1.1.2.2  snj 	} else  {
    494  1.1.2.2  snj 		m_freem(m);
    495  1.1.2.2  snj 		return ENETUNREACH;
    496  1.1.2.2  snj 	}
    497  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    498  1.1.2.2  snj 	if (ifp->if_flags & IFF_ECN)
    499  1.1.2.2  snj 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    500  1.1.2.2  snj 	else
    501  1.1.2.2  snj 		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
    502  1.1.2.2  snj 
    503  1.1.2.2  snj 	if (!ip6_ipsec_copy_tos)
    504  1.1.2.2  snj 		otos = 0;
    505  1.1.2.2  snj #else
    506  1.1.2.2  snj 	if (ip6_ipsec_copy_tos)
    507  1.1.2.2  snj 		otos = itos;
    508  1.1.2.2  snj 	else
    509  1.1.2.2  snj 		otos = 0;
    510  1.1.2.2  snj #endif
    511  1.1.2.2  snj 	ip6->ip6_flow &= ~ntohl(0xff00000);
    512  1.1.2.2  snj 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
    513  1.1.2.2  snj 
    514  1.1.2.2  snj 	sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
    515  1.1.2.2  snj 
    516  1.1.2.2  snj 	iro = percpu_getref(sc->ipsec_ro_percpu);
    517  1.1.2.2  snj 	mutex_enter(&iro->ir_lock);
    518  1.1.2.2  snj 	if ((rt = rtcache_lookup(&iro->ir_ro, &u.dst)) == NULL) {
    519  1.1.2.2  snj 		mutex_exit(&iro->ir_lock);
    520  1.1.2.2  snj 		percpu_putref(sc->ipsec_ro_percpu);
    521  1.1.2.2  snj 		m_freem(m);
    522  1.1.2.2  snj 		return ENETUNREACH;
    523  1.1.2.2  snj 	}
    524  1.1.2.2  snj 
    525  1.1.2.2  snj 	if (rt->rt_ifp == ifp) {
    526  1.1.2.2  snj 		rtcache_unref(rt, &iro->ir_ro);
    527  1.1.2.2  snj 		rtcache_free(&iro->ir_ro);
    528  1.1.2.2  snj 		mutex_exit(&iro->ir_lock);
    529  1.1.2.2  snj 		percpu_putref(sc->ipsec_ro_percpu);
    530  1.1.2.2  snj 		m_freem(m);
    531  1.1.2.2  snj 		return ENETUNREACH;
    532  1.1.2.2  snj 	}
    533  1.1.2.2  snj 	rtcache_unref(rt, &iro->ir_ro);
    534  1.1.2.2  snj 
    535  1.1.2.2  snj 	/*
    536  1.1.2.2  snj 	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
    537  1.1.2.2  snj 	 * it is too painful to ask for resend of inner packet, to achieve
    538  1.1.2.2  snj 	 * path MTU discovery for encapsulated packets.
    539  1.1.2.2  snj 	 */
    540  1.1.2.2  snj 	error = ip6_output(m, 0, &iro->ir_ro,
    541  1.1.2.2  snj 	    ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL);
    542  1.1.2.2  snj 	if (error)
    543  1.1.2.2  snj 		rtcache_free(&iro->ir_ro);
    544  1.1.2.2  snj 
    545  1.1.2.2  snj 	mutex_exit(&iro->ir_lock);
    546  1.1.2.2  snj 	percpu_putref(sc->ipsec_ro_percpu);
    547  1.1.2.2  snj 
    548  1.1.2.2  snj 	return error;
    549  1.1.2.2  snj }
    550  1.1.2.2  snj #endif /* INET6 */
    551  1.1.2.2  snj 
    552  1.1.2.2  snj static void
    553  1.1.2.2  snj ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg)
    554  1.1.2.2  snj {
    555  1.1.2.2  snj 	struct ifnet *ipsecp;
    556  1.1.2.2  snj 	struct ipsec_softc *sc = eparg;
    557  1.1.2.2  snj 	struct ipsec_variant *var;
    558  1.1.2.2  snj 	const struct ip *ip;
    559  1.1.2.2  snj 	int af;
    560  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    561  1.1.2.2  snj 	u_int8_t otos;
    562  1.1.2.2  snj #endif
    563  1.1.2.2  snj 	struct psref psref_rcvif;
    564  1.1.2.2  snj 	struct psref psref_var;
    565  1.1.2.2  snj 	struct ifnet *rcvif;
    566  1.1.2.2  snj 
    567  1.1.2.2  snj 	KASSERT(sc != NULL);
    568  1.1.2.2  snj 
    569  1.1.2.2  snj 	ipsecp = &sc->ipsec_if;
    570  1.1.2.2  snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    571  1.1.2.2  snj 		m_freem(m);
    572  1.1.2.2  snj 		ip_statinc(IP_STAT_NOIPSEC);
    573  1.1.2.2  snj 		return;
    574  1.1.2.2  snj 	}
    575  1.1.2.2  snj 
    576  1.1.2.2  snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    577  1.1.2.2  snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    578  1.1.2.2  snj 		if_ipsec_putref_variant(var, &psref_var);
    579  1.1.2.2  snj 		m_freem(m);
    580  1.1.2.2  snj 		ip_statinc(IP_STAT_NOIPSEC);
    581  1.1.2.2  snj 		return;
    582  1.1.2.2  snj 	}
    583  1.1.2.2  snj 
    584  1.1.2.2  snj 	ip = mtod(m, const struct ip *);
    585  1.1.2.2  snj 
    586  1.1.2.2  snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    587  1.1.2.2  snj 	if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) {
    588  1.1.2.2  snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    589  1.1.2.2  snj 		if_ipsec_putref_variant(var, &psref_var);
    590  1.1.2.2  snj 		m_freem(m);
    591  1.1.2.2  snj 		ip_statinc(IP_STAT_NOIPSEC);
    592  1.1.2.2  snj 		return;
    593  1.1.2.2  snj 	}
    594  1.1.2.2  snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    595  1.1.2.2  snj 	if_ipsec_putref_variant(var, &psref_var);
    596  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    597  1.1.2.2  snj 	otos = ip->ip_tos;
    598  1.1.2.2  snj #endif
    599  1.1.2.2  snj 	m_adj(m, off);
    600  1.1.2.2  snj 
    601  1.1.2.2  snj 	switch (proto) {
    602  1.1.2.2  snj 	case IPPROTO_IPV4:
    603  1.1.2.2  snj 	    {
    604  1.1.2.2  snj 		struct ip *xip;
    605  1.1.2.2  snj 		af = AF_INET;
    606  1.1.2.2  snj 		if (M_UNWRITABLE(m, sizeof(*xip))) {
    607  1.1.2.2  snj 			m = m_pullup(m, sizeof(*xip));
    608  1.1.2.2  snj 			if (!m)
    609  1.1.2.2  snj 				return;
    610  1.1.2.2  snj 		}
    611  1.1.2.2  snj 		xip = mtod(m, struct ip *);
    612  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    613  1.1.2.2  snj 		if (ipsecp->if_flags & IFF_ECN)
    614  1.1.2.2  snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
    615  1.1.2.2  snj 		else
    616  1.1.2.2  snj 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
    617  1.1.2.2  snj #endif
    618  1.1.2.2  snj 		break;
    619  1.1.2.2  snj 	    }
    620  1.1.2.2  snj #ifdef INET6
    621  1.1.2.2  snj 	case IPPROTO_IPV6:
    622  1.1.2.2  snj 	    {
    623  1.1.2.2  snj 		struct ip6_hdr *ip6;
    624  1.1.2.2  snj 		u_int8_t itos;
    625  1.1.2.2  snj 		af = AF_INET6;
    626  1.1.2.2  snj 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
    627  1.1.2.2  snj 			m = m_pullup(m, sizeof(*ip6));
    628  1.1.2.2  snj 			if (!m)
    629  1.1.2.2  snj 				return;
    630  1.1.2.2  snj 		}
    631  1.1.2.2  snj 		ip6 = mtod(m, struct ip6_hdr *);
    632  1.1.2.2  snj 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    633  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    634  1.1.2.2  snj 		if (ipsecp->if_flags & IFF_ECN)
    635  1.1.2.2  snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
    636  1.1.2.2  snj 		else
    637  1.1.2.2  snj 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
    638  1.1.2.2  snj #endif
    639  1.1.2.2  snj 		ip6->ip6_flow &= ~htonl(0xff << 20);
    640  1.1.2.2  snj 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
    641  1.1.2.2  snj 		break;
    642  1.1.2.2  snj 	    }
    643  1.1.2.2  snj #endif /* INET6 */
    644  1.1.2.2  snj 	default:
    645  1.1.2.2  snj 		ip_statinc(IP_STAT_NOIPSEC);
    646  1.1.2.2  snj 		m_freem(m);
    647  1.1.2.2  snj 		return;
    648  1.1.2.2  snj 	}
    649  1.1.2.2  snj 	if_ipsec_input(m, af, ipsecp);
    650  1.1.2.2  snj 
    651  1.1.2.2  snj 	return;
    652  1.1.2.2  snj }
    653  1.1.2.2  snj 
    654  1.1.2.2  snj /*
    655  1.1.2.2  snj  * validate and filter the pakcet
    656  1.1.2.2  snj  */
    657  1.1.2.2  snj static int
    658  1.1.2.2  snj ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var,
    659  1.1.2.2  snj     struct ifnet *ifp)
    660  1.1.2.2  snj {
    661  1.1.2.2  snj 	struct sockaddr_in *src, *dst;
    662  1.1.2.2  snj 
    663  1.1.2.2  snj 	src = satosin(var->iv_psrc);
    664  1.1.2.2  snj 	dst = satosin(var->iv_pdst);
    665  1.1.2.2  snj 
    666  1.1.2.2  snj 	return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr);
    667  1.1.2.2  snj }
    668  1.1.2.2  snj 
    669  1.1.2.2  snj #ifdef INET6
    670  1.1.2.2  snj static int
    671  1.1.2.2  snj ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg)
    672  1.1.2.2  snj {
    673  1.1.2.2  snj 	struct mbuf *m = *mp;
    674  1.1.2.2  snj 	struct ifnet *ipsecp;
    675  1.1.2.2  snj 	struct ipsec_softc *sc = eparg;
    676  1.1.2.2  snj 	struct ipsec_variant *var;
    677  1.1.2.2  snj 	struct ip6_hdr *ip6;
    678  1.1.2.2  snj 	int af = 0;
    679  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    680  1.1.2.2  snj 	u_int32_t otos;
    681  1.1.2.2  snj #endif
    682  1.1.2.2  snj 	struct psref psref_rcvif;
    683  1.1.2.2  snj 	struct psref psref_var;
    684  1.1.2.2  snj 	struct ifnet *rcvif;
    685  1.1.2.2  snj 
    686  1.1.2.2  snj 	KASSERT(eparg != NULL);
    687  1.1.2.2  snj 
    688  1.1.2.2  snj 	ipsecp = &sc->ipsec_if;
    689  1.1.2.2  snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    690  1.1.2.2  snj 		m_freem(m);
    691  1.1.2.2  snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    692  1.1.2.2  snj 		return IPPROTO_DONE;
    693  1.1.2.2  snj 	}
    694  1.1.2.2  snj 
    695  1.1.2.2  snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    696  1.1.2.2  snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    697  1.1.2.2  snj 		if_ipsec_putref_variant(var, &psref_var);
    698  1.1.2.2  snj 		m_freem(m);
    699  1.1.2.2  snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    700  1.1.2.2  snj 		return IPPROTO_DONE;
    701  1.1.2.2  snj 	}
    702  1.1.2.2  snj 
    703  1.1.2.2  snj 	ip6 = mtod(m, struct ip6_hdr *);
    704  1.1.2.2  snj 
    705  1.1.2.2  snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    706  1.1.2.2  snj 	if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) {
    707  1.1.2.2  snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    708  1.1.2.2  snj 		if_ipsec_putref_variant(var, &psref_var);
    709  1.1.2.2  snj 		m_freem(m);
    710  1.1.2.2  snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    711  1.1.2.2  snj 		return IPPROTO_DONE;
    712  1.1.2.2  snj 	}
    713  1.1.2.2  snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    714  1.1.2.2  snj 	if_ipsec_putref_variant(var, &psref_var);
    715  1.1.2.2  snj 
    716  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    717  1.1.2.2  snj 	otos = ip6->ip6_flow;
    718  1.1.2.2  snj #endif
    719  1.1.2.2  snj 	m_adj(m, *offp);
    720  1.1.2.2  snj 
    721  1.1.2.2  snj 	switch (proto) {
    722  1.1.2.2  snj #ifdef INET
    723  1.1.2.2  snj 	case IPPROTO_IPV4:
    724  1.1.2.2  snj 	    {
    725  1.1.2.2  snj 		af = AF_INET;
    726  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    727  1.1.2.2  snj 		struct ip *ip;
    728  1.1.2.2  snj 		u_int8_t otos8;
    729  1.1.2.2  snj 		otos8 = (ntohl(otos) >> 20) & 0xff;
    730  1.1.2.2  snj 
    731  1.1.2.2  snj 		if (M_UNWRITABLE(m, sizeof(*ip))) {
    732  1.1.2.2  snj 			m = m_pullup(m, sizeof(*ip));
    733  1.1.2.2  snj 			if (!m)
    734  1.1.2.2  snj 				return IPPROTO_DONE;
    735  1.1.2.2  snj 		}
    736  1.1.2.2  snj 		ip = mtod(m, struct ip *);
    737  1.1.2.2  snj 		if (ipsecp->if_flags & IFF_ECN)
    738  1.1.2.2  snj 			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
    739  1.1.2.2  snj 		else
    740  1.1.2.2  snj 			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
    741  1.1.2.2  snj #endif
    742  1.1.2.2  snj 		break;
    743  1.1.2.2  snj 	    }
    744  1.1.2.2  snj #endif /* INET */
    745  1.1.2.2  snj 	case IPPROTO_IPV6:
    746  1.1.2.2  snj 	    {
    747  1.1.2.2  snj 		af = AF_INET6;
    748  1.1.2.2  snj #ifndef IPSEC_TX_TOS_CLEAR
    749  1.1.2.2  snj 		struct ip6_hdr *xip6;
    750  1.1.2.2  snj 
    751  1.1.2.2  snj 		if (M_UNWRITABLE(m, sizeof(*xip6))) {
    752  1.1.2.2  snj 			m = m_pullup(m, sizeof(*xip6));
    753  1.1.2.2  snj 			if (!m)
    754  1.1.2.2  snj 				return IPPROTO_DONE;
    755  1.1.2.2  snj 		}
    756  1.1.2.2  snj 		xip6 = mtod(m, struct ip6_hdr *);
    757  1.1.2.2  snj 		if (ipsecp->if_flags & IFF_ECN)
    758  1.1.2.2  snj 			ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow);
    759  1.1.2.2  snj 		else
    760  1.1.2.2  snj 			ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow);
    761  1.1.2.2  snj 		break;
    762  1.1.2.2  snj #endif
    763  1.1.2.2  snj 	    }
    764  1.1.2.2  snj 	default:
    765  1.1.2.2  snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    766  1.1.2.2  snj 		m_freem(m);
    767  1.1.2.2  snj 		return IPPROTO_DONE;
    768  1.1.2.2  snj 	}
    769  1.1.2.2  snj 
    770  1.1.2.2  snj 	if_ipsec_input(m, af, ipsecp);
    771  1.1.2.2  snj 	return IPPROTO_DONE;
    772  1.1.2.2  snj }
    773  1.1.2.2  snj 
    774  1.1.2.2  snj /*
    775  1.1.2.2  snj  * validate and filter the packet.
    776  1.1.2.2  snj  */
    777  1.1.2.2  snj static int
    778  1.1.2.2  snj ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var,
    779  1.1.2.2  snj     struct ifnet *ifp)
    780  1.1.2.2  snj {
    781  1.1.2.2  snj 	struct sockaddr_in6 *src, *dst;
    782  1.1.2.2  snj 
    783  1.1.2.2  snj 	src = satosin6(var->iv_psrc);
    784  1.1.2.2  snj 	dst = satosin6(var->iv_pdst);
    785  1.1.2.2  snj 
    786  1.1.2.2  snj 	return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr);
    787  1.1.2.2  snj }
    788  1.1.2.2  snj #endif /* INET6 */
    789  1.1.2.2  snj 
    790  1.1.2.2  snj int
    791  1.1.2.2  snj ipsecif4_attach(struct ipsec_variant *var)
    792  1.1.2.2  snj {
    793  1.1.2.2  snj 	struct ipsec_softc *sc = var->iv_softc;
    794  1.1.2.2  snj 
    795  1.1.2.2  snj 	KASSERT(if_ipsec_variant_is_configured(var));
    796  1.1.2.2  snj 
    797  1.1.2.2  snj 	if (var->iv_encap_cookie4 != NULL)
    798  1.1.2.2  snj 		return EALREADY;
    799  1.1.2.2  snj 	var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func,
    800  1.1.2.2  snj 	    &ipsecif4_encapsw, sc);
    801  1.1.2.2  snj 	if (var->iv_encap_cookie4 == NULL)
    802  1.1.2.2  snj 		return EEXIST;
    803  1.1.2.2  snj 
    804  1.1.2.2  snj 	var->iv_output = ipsecif4_output;
    805  1.1.2.2  snj 	return 0;
    806  1.1.2.2  snj }
    807  1.1.2.2  snj 
    808  1.1.2.2  snj int
    809  1.1.2.2  snj ipsecif4_detach(struct ipsec_variant *var)
    810  1.1.2.2  snj {
    811  1.1.2.2  snj 	int error;
    812  1.1.2.2  snj 
    813  1.1.2.2  snj 	if (var->iv_encap_cookie4 == NULL)
    814  1.1.2.2  snj 		return 0;
    815  1.1.2.2  snj 
    816  1.1.2.2  snj 	var->iv_output = NULL;
    817  1.1.2.2  snj 	error = encap_detach(var->iv_encap_cookie4);
    818  1.1.2.2  snj 	if (error == 0)
    819  1.1.2.2  snj 		var->iv_encap_cookie4 = NULL;
    820  1.1.2.2  snj 
    821  1.1.2.2  snj 	return error;
    822  1.1.2.2  snj }
    823  1.1.2.2  snj 
    824  1.1.2.2  snj #ifdef INET6
    825  1.1.2.2  snj int
    826  1.1.2.2  snj ipsecif6_attach(struct ipsec_variant *var)
    827  1.1.2.2  snj {
    828  1.1.2.2  snj 	struct sockaddr_in6 mask6;
    829  1.1.2.2  snj 	struct ipsec_softc *sc = var->iv_softc;
    830  1.1.2.2  snj 
    831  1.1.2.2  snj 	KASSERT(if_ipsec_variant_is_configured(var));
    832  1.1.2.2  snj 	KASSERT(var->iv_encap_cookie6 == NULL);
    833  1.1.2.2  snj 
    834  1.1.2.2  snj 	memset(&mask6, 0, sizeof(mask6));
    835  1.1.2.2  snj 	mask6.sin6_len = sizeof(struct sockaddr_in6);
    836  1.1.2.2  snj 	mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] =
    837  1.1.2.2  snj 	mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0;
    838  1.1.2.2  snj 
    839  1.1.2.2  snj 	var->iv_encap_cookie6 = encap_attach(AF_INET6, -1,
    840  1.1.2.2  snj 	    var->iv_psrc, (struct sockaddr *)&mask6,
    841  1.1.2.2  snj 	    var->iv_pdst, (struct sockaddr *)&mask6,
    842  1.1.2.2  snj 	    &ipsecif6_encapsw, sc);
    843  1.1.2.2  snj 	if (var->iv_encap_cookie6 == NULL)
    844  1.1.2.2  snj 		return EEXIST;
    845  1.1.2.2  snj 
    846  1.1.2.2  snj 	var->iv_output = ipsecif6_output;
    847  1.1.2.2  snj 	return 0;
    848  1.1.2.2  snj }
    849  1.1.2.2  snj 
    850  1.1.2.2  snj static void
    851  1.1.2.2  snj ipsecif6_rtcache_free_pc(void *p, void *arg __unused, struct cpu_info *ci __unused)
    852  1.1.2.2  snj {
    853  1.1.2.2  snj 	struct ipsec_ro *iro = p;
    854  1.1.2.2  snj 
    855  1.1.2.2  snj 	mutex_enter(&iro->ir_lock);
    856  1.1.2.2  snj 	rtcache_free(&iro->ir_ro);
    857  1.1.2.2  snj 	mutex_exit(&iro->ir_lock);
    858  1.1.2.2  snj }
    859  1.1.2.2  snj 
    860  1.1.2.2  snj int
    861  1.1.2.2  snj ipsecif6_detach(struct ipsec_variant *var)
    862  1.1.2.2  snj {
    863  1.1.2.2  snj 	struct ipsec_softc *sc = var->iv_softc;
    864  1.1.2.2  snj 	int error;
    865  1.1.2.2  snj 
    866  1.1.2.2  snj 	KASSERT(var->iv_encap_cookie6 != NULL);
    867  1.1.2.2  snj 
    868  1.1.2.2  snj 	percpu_foreach(sc->ipsec_ro_percpu, ipsecif6_rtcache_free_pc, NULL);
    869  1.1.2.2  snj 
    870  1.1.2.2  snj 	var->iv_output = NULL;
    871  1.1.2.2  snj 	error = encap_detach(var->iv_encap_cookie6);
    872  1.1.2.2  snj 	if (error == 0)
    873  1.1.2.2  snj 		var->iv_encap_cookie6 = NULL;
    874  1.1.2.2  snj 	return error;
    875  1.1.2.2  snj }
    876  1.1.2.2  snj 
    877  1.1.2.2  snj void *
    878  1.1.2.2  snj ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg)
    879  1.1.2.2  snj {
    880  1.1.2.2  snj 	struct ipsec_softc *sc = eparg;
    881  1.1.2.2  snj 	struct ip6ctlparam *ip6cp = NULL;
    882  1.1.2.2  snj 	struct ip6_hdr *ip6;
    883  1.1.2.2  snj 	const struct sockaddr_in6 *dst6;
    884  1.1.2.2  snj 	struct ipsec_ro *iro;
    885  1.1.2.2  snj 
    886  1.1.2.2  snj 	if (sa->sa_family != AF_INET6 ||
    887  1.1.2.2  snj 	    sa->sa_len != sizeof(struct sockaddr_in6))
    888  1.1.2.2  snj 		return NULL;
    889  1.1.2.2  snj 
    890  1.1.2.2  snj 	if ((unsigned)cmd >= PRC_NCMDS)
    891  1.1.2.2  snj 		return NULL;
    892  1.1.2.2  snj 	if (cmd == PRC_HOSTDEAD)
    893  1.1.2.2  snj 		d = NULL;
    894  1.1.2.2  snj 	else if (inet6ctlerrmap[cmd] == 0)
    895  1.1.2.2  snj 		return NULL;
    896  1.1.2.2  snj 
    897  1.1.2.2  snj 	/* if the parameter is from icmp6, decode it. */
    898  1.1.2.2  snj 	if (d != NULL) {
    899  1.1.2.2  snj 		ip6cp = (struct ip6ctlparam *)d;
    900  1.1.2.2  snj 		ip6 = ip6cp->ip6c_ip6;
    901  1.1.2.2  snj 	} else {
    902  1.1.2.2  snj 		ip6 = NULL;
    903  1.1.2.2  snj 	}
    904  1.1.2.2  snj 
    905  1.1.2.2  snj 	if (!ip6)
    906  1.1.2.2  snj 		return NULL;
    907  1.1.2.2  snj 
    908  1.1.2.2  snj 	iro = percpu_getref(sc->ipsec_ro_percpu);
    909  1.1.2.2  snj 	mutex_enter(&iro->ir_lock);
    910  1.1.2.2  snj 	dst6 = satocsin6(rtcache_getdst(&iro->ir_ro));
    911  1.1.2.2  snj 	/* XXX scope */
    912  1.1.2.2  snj 	if (dst6 == NULL)
    913  1.1.2.2  snj 		;
    914  1.1.2.2  snj 	else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
    915  1.1.2.2  snj 		/* flush route cache */
    916  1.1.2.2  snj 		rtcache_free(&iro->ir_ro);
    917  1.1.2.2  snj 
    918  1.1.2.2  snj 	mutex_exit(&iro->ir_lock);
    919  1.1.2.2  snj 	percpu_putref(sc->ipsec_ro_percpu);
    920  1.1.2.2  snj 
    921  1.1.2.2  snj 	return NULL;
    922  1.1.2.2  snj }
    923  1.1.2.2  snj 
    924  1.1.2.2  snj ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput)
    925  1.1.2.2  snj #define	ipsecif6_ctlinput	ipsecif6_ctlinput_wrapper
    926  1.1.2.2  snj 
    927  1.1.2.2  snj static const struct encapsw ipsecif6_encapsw = {
    928  1.1.2.2  snj 	.encapsw6 = {
    929  1.1.2.2  snj 		.pr_input = ipsecif6_input,
    930  1.1.2.2  snj 		.pr_ctlinput = ipsecif6_ctlinput,
    931  1.1.2.2  snj 	}
    932  1.1.2.2  snj };
    933  1.1.2.2  snj #endif /* INET6 */
    934