Home | History | Annotate | Line # | Download | only in netipsec
ipsecif.c revision 1.1.2.4 
      1  1.1.2.4  martin /*	$NetBSD: ipsecif.c,v 1.1.2.4 2018/03/13 15:29:45 martin Exp $  */
      2  1.1.2.2     snj 
      3  1.1.2.2     snj /*
      4  1.1.2.2     snj  * Copyright (c) 2017 Internet Initiative Japan Inc.
      5  1.1.2.2     snj  * All rights reserved.
      6  1.1.2.2     snj  *
      7  1.1.2.2     snj  * Redistribution and use in source and binary forms, with or without
      8  1.1.2.2     snj  * modification, are permitted provided that the following conditions
      9  1.1.2.2     snj  * are met:
     10  1.1.2.2     snj  * 1. Redistributions of source code must retain the above copyright
     11  1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer.
     12  1.1.2.2     snj  * 2. Redistributions in binary form must reproduce the above copyright
     13  1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer in the
     14  1.1.2.2     snj  *    documentation and/or other materials provided with the distribution.
     15  1.1.2.2     snj  *
     16  1.1.2.2     snj  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17  1.1.2.2     snj  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18  1.1.2.2     snj  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19  1.1.2.2     snj  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20  1.1.2.2     snj  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21  1.1.2.2     snj  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22  1.1.2.2     snj  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23  1.1.2.2     snj  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24  1.1.2.2     snj  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25  1.1.2.2     snj  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26  1.1.2.2     snj  * POSSIBILITY OF SUCH DAMAGE.
     27  1.1.2.2     snj  */
     28  1.1.2.2     snj 
     29  1.1.2.2     snj #include <sys/cdefs.h>
     30  1.1.2.4  martin __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.1.2.4 2018/03/13 15:29:45 martin Exp $");
     31  1.1.2.2     snj 
     32  1.1.2.2     snj #ifdef _KERNEL_OPT
     33  1.1.2.2     snj #include "opt_inet.h"
     34  1.1.2.2     snj #include "opt_ipsec.h"
     35  1.1.2.2     snj #endif
     36  1.1.2.2     snj 
     37  1.1.2.2     snj #include <sys/param.h>
     38  1.1.2.2     snj #include <sys/systm.h>
     39  1.1.2.2     snj #include <sys/socket.h>
     40  1.1.2.2     snj #include <sys/sockio.h>
     41  1.1.2.2     snj #include <sys/mbuf.h>
     42  1.1.2.2     snj #include <sys/errno.h>
     43  1.1.2.2     snj #include <sys/ioctl.h>
     44  1.1.2.2     snj #include <sys/syslog.h>
     45  1.1.2.2     snj #include <sys/kernel.h>
     46  1.1.2.2     snj 
     47  1.1.2.2     snj #include <net/if.h>
     48  1.1.2.2     snj #include <net/route.h>
     49  1.1.2.2     snj 
     50  1.1.2.2     snj #include <netinet/in.h>
     51  1.1.2.2     snj #include <netinet/in_systm.h>
     52  1.1.2.2     snj #include <netinet/ip.h>
     53  1.1.2.2     snj #include <netinet/ip_var.h>
     54  1.1.2.2     snj #include <netinet/in_var.h>
     55  1.1.2.2     snj #include <netinet/ip_encap.h>
     56  1.1.2.2     snj #include <netinet/ip_ecn.h>
     57  1.1.2.2     snj #include <netinet/ip_private.h>
     58  1.1.2.2     snj #include <netinet/udp.h>
     59  1.1.2.2     snj 
     60  1.1.2.2     snj #ifdef INET6
     61  1.1.2.2     snj #include <netinet/ip6.h>
     62  1.1.2.2     snj #include <netinet6/ip6_var.h>
     63  1.1.2.2     snj #include <netinet6/ip6_private.h>
     64  1.1.2.2     snj #include <netinet6/in6_var.h>
     65  1.1.2.2     snj #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */
     66  1.1.2.2     snj #include <netinet/ip_ecn.h>
     67  1.1.2.2     snj #endif
     68  1.1.2.2     snj 
     69  1.1.2.2     snj #include <netipsec/key.h>
     70  1.1.2.2     snj #include <netipsec/ipsecif.h>
     71  1.1.2.2     snj 
     72  1.1.2.2     snj #include <net/if_ipsec.h>
     73  1.1.2.2     snj 
     74  1.1.2.2     snj static void ipsecif4_input(struct mbuf *, int, int, void *);
     75  1.1.2.2     snj static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *);
     76  1.1.2.2     snj static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *,
     77  1.1.2.2     snj 	struct ifnet *);
     78  1.1.2.2     snj 
     79  1.1.2.2     snj #ifdef INET6
     80  1.1.2.2     snj static int ipsecif6_input(struct mbuf **, int *, int, void *);
     81  1.1.2.2     snj static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *);
     82  1.1.2.2     snj static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *,
     83  1.1.2.2     snj 	struct ifnet *);
     84  1.1.2.2     snj #endif
     85  1.1.2.2     snj 
     86  1.1.2.2     snj static int ip_ipsec_ttl = IPSEC_TTL;
     87  1.1.2.2     snj static int ip_ipsec_copy_tos = 0;
     88  1.1.2.2     snj #ifdef INET6
     89  1.1.2.2     snj static int ip6_ipsec_hlim = IPSEC_HLIM;
     90  1.1.2.2     snj static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */
     91  1.1.2.2     snj static int ip6_ipsec_copy_tos = 0;
     92  1.1.2.2     snj #endif
     93  1.1.2.2     snj 
     94  1.1.2.2     snj struct encapsw ipsecif4_encapsw = {
     95  1.1.2.2     snj 	.encapsw4 = {
     96  1.1.2.2     snj 		.pr_input = ipsecif4_input,
     97  1.1.2.2     snj 		.pr_ctlinput = NULL,
     98  1.1.2.2     snj 	}
     99  1.1.2.2     snj };
    100  1.1.2.2     snj 
    101  1.1.2.2     snj #ifdef INET6
    102  1.1.2.2     snj static const struct encapsw ipsecif6_encapsw;
    103  1.1.2.2     snj #endif
    104  1.1.2.2     snj 
    105  1.1.2.2     snj static struct mbuf *
    106  1.1.2.2     snj ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m,
    107  1.1.2.2     snj     uint8_t proto, uint8_t tos)
    108  1.1.2.2     snj {
    109  1.1.2.2     snj 	struct ip *ip;
    110  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    111  1.1.2.2     snj 
    112  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    113  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    114  1.1.2.2     snj 
    115  1.1.2.2     snj 	if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) ||
    116  1.1.2.2     snj 	    src->sin_addr.s_addr == INADDR_BROADCAST ||
    117  1.1.2.2     snj 	    dst->sin_addr.s_addr == INADDR_BROADCAST) {
    118  1.1.2.2     snj 		m_freem(m);
    119  1.1.2.2     snj 		return NULL;
    120  1.1.2.2     snj 	}
    121  1.1.2.2     snj 	m->m_flags &= ~M_BCAST;
    122  1.1.2.2     snj 
    123  1.1.2.2     snj 	if (IN_MULTICAST(src->sin_addr.s_addr) ||
    124  1.1.2.2     snj 	   IN_MULTICAST(dst->sin_addr.s_addr)) {
    125  1.1.2.2     snj 		m_freem(m);
    126  1.1.2.2     snj 		return NULL;
    127  1.1.2.2     snj 	}
    128  1.1.2.2     snj 
    129  1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    130  1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip)))
    131  1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip));
    132  1.1.2.2     snj 	if (m == NULL)
    133  1.1.2.2     snj 		return NULL;
    134  1.1.2.2     snj 
    135  1.1.2.2     snj 	ip = mtod(m, struct ip *);
    136  1.1.2.2     snj 	ip->ip_v = IPVERSION;
    137  1.1.2.2     snj 	ip->ip_off = htons(0);
    138  1.1.2.2     snj 	ip->ip_id = 0;
    139  1.1.2.2     snj 	ip->ip_hl = sizeof(*ip) >> 2;
    140  1.1.2.2     snj 	if (ip_ipsec_copy_tos)
    141  1.1.2.2     snj 		ip->ip_tos = tos;
    142  1.1.2.2     snj 	else
    143  1.1.2.2     snj 		ip->ip_tos = 0;
    144  1.1.2.2     snj 	ip->ip_sum = 0;
    145  1.1.2.2     snj 	ip->ip_src = src->sin_addr;
    146  1.1.2.2     snj 	ip->ip_dst = dst->sin_addr;
    147  1.1.2.2     snj 	ip->ip_p = proto;
    148  1.1.2.2     snj 	ip->ip_ttl = ip_ipsec_ttl;
    149  1.1.2.2     snj 	ip->ip_len = htons(m->m_pkthdr.len);
    150  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    151  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    152  1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    153  1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
    154  1.1.2.2     snj 	else
    155  1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
    156  1.1.2.2     snj #endif
    157  1.1.2.2     snj 
    158  1.1.2.2     snj 	return m;
    159  1.1.2.2     snj }
    160  1.1.2.2     snj 
    161  1.1.2.2     snj static int
    162  1.1.2.2     snj ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr)
    163  1.1.2.2     snj {
    164  1.1.2.2     snj 	struct ip ip0;
    165  1.1.2.2     snj 	struct ip *ip;
    166  1.1.2.2     snj 	int mtu;
    167  1.1.2.2     snj 	struct secasvar *sav;
    168  1.1.2.2     snj 
    169  1.1.2.2     snj 	sav = key_lookup_sa_bysaidx(&isr->saidx);
    170  1.1.2.2     snj 	if (sav == NULL)
    171  1.1.2.2     snj 		return 0;
    172  1.1.2.2     snj 
    173  1.1.2.2     snj 	if (!(sav->natt_type & UDP_ENCAP_ESPINUDP) &&
    174  1.1.2.2     snj 	    !(sav->natt_type & UDP_ENCAP_ESPINUDP_NON_IKE)) {
    175  1.1.2.2     snj 		mtu = 0;
    176  1.1.2.2     snj 		goto out;
    177  1.1.2.2     snj 	}
    178  1.1.2.2     snj 
    179  1.1.2.2     snj 	if (m->m_len < sizeof(struct ip)) {
    180  1.1.2.2     snj 		m_copydata(m, 0, sizeof(ip0), &ip0);
    181  1.1.2.2     snj 		ip = &ip0;
    182  1.1.2.2     snj 
    183  1.1.2.2     snj 	} else {
    184  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    185  1.1.2.2     snj 	}
    186  1.1.2.2     snj 	mtu = sav->esp_frag;
    187  1.1.2.2     snj 	if (ntohs(ip->ip_len) <= mtu)
    188  1.1.2.2     snj 		mtu = 0;
    189  1.1.2.2     snj 
    190  1.1.2.2     snj out:
    191  1.1.2.2     snj 	KEY_SA_UNREF(&sav);
    192  1.1.2.2     snj 	return mtu;
    193  1.1.2.2     snj }
    194  1.1.2.2     snj 
    195  1.1.2.2     snj static struct mbuf *
    196  1.1.2.2     snj ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0)
    197  1.1.2.2     snj {
    198  1.1.2.2     snj 	const struct ip *ip;
    199  1.1.2.2     snj 	int proto;
    200  1.1.2.2     snj 	int tos;
    201  1.1.2.2     snj 
    202  1.1.2.2     snj 	KASSERT(proto0 != NULL);
    203  1.1.2.2     snj 	KASSERT(tos0 != NULL);
    204  1.1.2.2     snj 
    205  1.1.2.2     snj 	switch (family) {
    206  1.1.2.2     snj 	case AF_INET:
    207  1.1.2.2     snj 		proto = IPPROTO_IPV4;
    208  1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    209  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    210  1.1.2.2     snj 			if (!m) {
    211  1.1.2.2     snj 				*tos0 = 0;
    212  1.1.2.2     snj 				*proto0 = 0;
    213  1.1.2.2     snj 				return  NULL;
    214  1.1.2.2     snj 			}
    215  1.1.2.2     snj 		}
    216  1.1.2.2     snj 		ip = mtod(m, const struct ip *);
    217  1.1.2.2     snj 		tos = ip->ip_tos;
    218  1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    219  1.1.2.2     snj 		break;
    220  1.1.2.2     snj #ifdef INET6
    221  1.1.2.2     snj 	case AF_INET6: {
    222  1.1.2.2     snj 		const struct ip6_hdr *ip6;
    223  1.1.2.2     snj 		proto = IPPROTO_IPV6;
    224  1.1.2.2     snj 		if (m->m_len < sizeof(*ip6)) {
    225  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    226  1.1.2.2     snj 			if (!m) {
    227  1.1.2.2     snj 				*tos0 = 0;
    228  1.1.2.2     snj 				*proto0 = 0;
    229  1.1.2.2     snj 				return NULL;
    230  1.1.2.2     snj 			}
    231  1.1.2.2     snj 		}
    232  1.1.2.2     snj 		ip6 = mtod(m, const struct ip6_hdr *);
    233  1.1.2.2     snj 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    234  1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    235  1.1.2.2     snj 		break;
    236  1.1.2.2     snj 	}
    237  1.1.2.2     snj #endif /* INET6 */
    238  1.1.2.2     snj 	default:
    239  1.1.2.2     snj 		*tos0 = 0;
    240  1.1.2.2     snj 		*proto0 = 0;
    241  1.1.2.2     snj 		return NULL;
    242  1.1.2.2     snj 	}
    243  1.1.2.2     snj 
    244  1.1.2.2     snj 	*proto0 = proto;
    245  1.1.2.2     snj 	*tos0 = tos;
    246  1.1.2.2     snj 	return m;
    247  1.1.2.2     snj }
    248  1.1.2.2     snj 
    249  1.1.2.2     snj static int
    250  1.1.2.2     snj ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu)
    251  1.1.2.2     snj {
    252  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    253  1.1.2.2     snj 	struct mbuf *next;
    254  1.1.2.2     snj 	struct m_tag *mtag;
    255  1.1.2.2     snj 	int error;
    256  1.1.2.2     snj 
    257  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    258  1.1.2.2     snj 
    259  1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    260  1.1.2.2     snj 	if (mtag)
    261  1.1.2.2     snj 		m_tag_delete(m, mtag);
    262  1.1.2.2     snj 
    263  1.1.2.4  martin 	/* consider new IP header prepended in ipsecif4_output() */
    264  1.1.2.4  martin 	if (mtu <= sizeof(struct ip)) {
    265  1.1.2.4  martin 		m_freem(m);
    266  1.1.2.4  martin 		return ENETUNREACH;
    267  1.1.2.4  martin 	}
    268  1.1.2.4  martin 	m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
    269  1.1.2.4  martin 	error = ip_fragment(m, ifp, mtu - sizeof(struct ip));
    270  1.1.2.2     snj 	if (error)
    271  1.1.2.2     snj 		return error;
    272  1.1.2.2     snj 
    273  1.1.2.2     snj 	for (error = 0; m; m = next) {
    274  1.1.2.2     snj 		next = m->m_nextpkt;
    275  1.1.2.3  martin 		m->m_nextpkt = NULL;
    276  1.1.2.2     snj 		if (error) {
    277  1.1.2.2     snj 			m_freem(m);
    278  1.1.2.2     snj 			continue;
    279  1.1.2.2     snj 		}
    280  1.1.2.2     snj 
    281  1.1.2.2     snj 		error = ipsecif4_output(var, family, m);
    282  1.1.2.2     snj 	}
    283  1.1.2.2     snj 	if (error == 0)
    284  1.1.2.2     snj 		IP_STATINC(IP_STAT_FRAGMENTED);
    285  1.1.2.2     snj 
    286  1.1.2.2     snj 	return error;
    287  1.1.2.2     snj }
    288  1.1.2.2     snj 
    289  1.1.2.2     snj int
    290  1.1.2.2     snj ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var)
    291  1.1.2.2     snj {
    292  1.1.2.2     snj 	struct m_tag *mtag;
    293  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    294  1.1.2.2     snj 	u_int16_t src_port = 0;
    295  1.1.2.2     snj 	u_int16_t dst_port = 0;
    296  1.1.2.2     snj 
    297  1.1.2.2     snj 	KASSERT(var != NULL);
    298  1.1.2.2     snj 
    299  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    300  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    301  1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    302  1.1.2.2     snj 	if (mtag) {
    303  1.1.2.2     snj 		u_int16_t *ports;
    304  1.1.2.2     snj 
    305  1.1.2.2     snj 		ports = (u_int16_t *)(mtag + 1);
    306  1.1.2.2     snj 		src_port = ports[0];
    307  1.1.2.2     snj 		dst_port = ports[1];
    308  1.1.2.2     snj 	}
    309  1.1.2.2     snj 
    310  1.1.2.2     snj 	/* address match */
    311  1.1.2.2     snj 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
    312  1.1.2.2     snj 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
    313  1.1.2.2     snj 		return 0;
    314  1.1.2.2     snj 
    315  1.1.2.2     snj 	/* UDP encap? */
    316  1.1.2.2     snj 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    317  1.1.2.2     snj 		goto match;
    318  1.1.2.2     snj 
    319  1.1.2.2     snj 	/* port match */
    320  1.1.2.2     snj 	if (src_port != var->iv_dport ||
    321  1.1.2.2     snj 	    dst_port != var->iv_sport) {
    322  1.1.2.2     snj #ifdef DEBUG
    323  1.1.2.2     snj 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    324  1.1.2.2     snj 		    __func__, ntohs(src_port), ntohs(dst_port),
    325  1.1.2.2     snj 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    326  1.1.2.2     snj #endif
    327  1.1.2.2     snj 		return 0;
    328  1.1.2.2     snj 	}
    329  1.1.2.2     snj 
    330  1.1.2.2     snj match:
    331  1.1.2.2     snj 	/*
    332  1.1.2.2     snj 	 * hide NAT-T information from encapsulated traffics.
    333  1.1.2.2     snj 	 * they don't know about IPsec.
    334  1.1.2.2     snj 	 */
    335  1.1.2.2     snj 	if (mtag)
    336  1.1.2.2     snj 		m_tag_delete(m, mtag);
    337  1.1.2.2     snj 	return sizeof(src->sin_addr) + sizeof(dst->sin_addr);
    338  1.1.2.2     snj }
    339  1.1.2.2     snj 
    340  1.1.2.2     snj static int
    341  1.1.2.2     snj ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m)
    342  1.1.2.2     snj {
    343  1.1.2.2     snj 	struct secpolicy *sp = NULL;
    344  1.1.2.2     snj 	u_int8_t tos;
    345  1.1.2.2     snj 	int proto;
    346  1.1.2.2     snj 	int error;
    347  1.1.2.2     snj 	int mtu;
    348  1.1.2.2     snj 	u_long sa_mtu = 0;
    349  1.1.2.2     snj 
    350  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    351  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    352  1.1.2.2     snj 	KASSERT(var->iv_psrc->sa_family == AF_INET);
    353  1.1.2.2     snj 	KASSERT(var->iv_pdst->sa_family == AF_INET);
    354  1.1.2.2     snj 
    355  1.1.2.2     snj 	sp = IV_SP_OUT(var);
    356  1.1.2.2     snj 	KASSERT(sp != NULL);
    357  1.1.2.2     snj 	/*
    358  1.1.2.2     snj 	 * The SPs in ipsec_variant are prevented from freed by
    359  1.1.2.2     snj 	 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here.
    360  1.1.2.2     snj 	 */
    361  1.1.2.2     snj 
    362  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_NONE);
    363  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_ENTRUST);
    364  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_BYPASS);
    365  1.1.2.2     snj 	if(sp->policy != IPSEC_POLICY_IPSEC) {
    366  1.1.2.2     snj 		struct ifnet *ifp = &var->iv_softc->ipsec_if;
    367  1.1.2.2     snj 		m_freem(m);
    368  1.1.2.2     snj 		IF_DROP(&ifp->if_snd);
    369  1.1.2.2     snj 		return 0;
    370  1.1.2.2     snj 	}
    371  1.1.2.2     snj 
    372  1.1.2.2     snj 	/* get flowinfo */
    373  1.1.2.2     snj 	m = ipsecif4_flowinfo(m, family, &proto, &tos);
    374  1.1.2.2     snj 	if (m == NULL) {
    375  1.1.2.2     snj 		error = ENETUNREACH;
    376  1.1.2.2     snj 		goto done;
    377  1.1.2.2     snj 	}
    378  1.1.2.2     snj 
    379  1.1.2.2     snj 	/* prepend new IP header */
    380  1.1.2.2     snj 	m = ipsecif4_prepend_hdr(var, m, proto, tos);
    381  1.1.2.2     snj 	if (m == NULL) {
    382  1.1.2.2     snj 		error = ENETUNREACH;
    383  1.1.2.2     snj 		goto done;
    384  1.1.2.2     snj 	}
    385  1.1.2.2     snj 
    386  1.1.2.2     snj 	/*
    387  1.1.2.2     snj 	 * Normal netipsec's NAT-T fragmentation is done in ip_output().
    388  1.1.2.2     snj 	 * See "natt_frag" processing.
    389  1.1.2.2     snj 	 * However, ipsec(4) interface's one is not done in the same way,
    390  1.1.2.2     snj 	 * so we must do NAT-T fragmentation by own code.
    391  1.1.2.2     snj 	 */
    392  1.1.2.2     snj 	/* NAT-T ESP fragmentation */
    393  1.1.2.2     snj 	mtu = ipsecif4_needfrag(m, sp->req);
    394  1.1.2.2     snj 	if (mtu > 0)
    395  1.1.2.2     snj 		return ipsecif4_fragout(var, family, m, mtu);
    396  1.1.2.2     snj 
    397  1.1.2.2     snj 	/* IPsec output */
    398  1.1.2.2     snj 	IP_STATINC(IP_STAT_LOCALOUT);
    399  1.1.2.2     snj 	error = ipsec4_process_packet(m, sp->req, &sa_mtu);
    400  1.1.2.2     snj 	if (error == ENOENT)
    401  1.1.2.2     snj 		error = 0;
    402  1.1.2.2     snj 	/*
    403  1.1.2.2     snj 	 * frangmentation is already done in ipsecif4_fragout(),
    404  1.1.2.2     snj 	 * so ipsec4_process_packet() must not do fragmentation here.
    405  1.1.2.2     snj 	 */
    406  1.1.2.4  martin 	KASSERT(sa_mtu == 0);
    407  1.1.2.2     snj 
    408  1.1.2.2     snj done:
    409  1.1.2.2     snj 	return error;
    410  1.1.2.2     snj }
    411  1.1.2.2     snj 
    412  1.1.2.2     snj #ifdef INET6
    413  1.1.2.2     snj static int
    414  1.1.2.2     snj ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m)
    415  1.1.2.2     snj {
    416  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    417  1.1.2.2     snj 	struct ipsec_softc *sc = ifp->if_softc;
    418  1.1.2.2     snj 	struct ipsec_ro *iro;
    419  1.1.2.2     snj 	struct rtentry *rt;
    420  1.1.2.2     snj 	struct sockaddr_in6 *sin6_src;
    421  1.1.2.2     snj 	struct sockaddr_in6 *sin6_dst;
    422  1.1.2.2     snj 	struct ip6_hdr *ip6;
    423  1.1.2.2     snj 	int proto, error;
    424  1.1.2.2     snj 	u_int8_t itos, otos;
    425  1.1.2.2     snj 	union {
    426  1.1.2.2     snj 		struct sockaddr		dst;
    427  1.1.2.2     snj 		struct sockaddr_in6	dst6;
    428  1.1.2.2     snj 	} u;
    429  1.1.2.2     snj 
    430  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    431  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    432  1.1.2.2     snj 
    433  1.1.2.2     snj 	sin6_src = satosin6(var->iv_psrc);
    434  1.1.2.2     snj 	sin6_dst = satosin6(var->iv_pdst);
    435  1.1.2.2     snj 
    436  1.1.2.2     snj 	KASSERT(sin6_src->sin6_family == AF_INET6);
    437  1.1.2.2     snj 	KASSERT(sin6_dst->sin6_family == AF_INET6);
    438  1.1.2.2     snj 
    439  1.1.2.2     snj 	switch (family) {
    440  1.1.2.2     snj #ifdef INET
    441  1.1.2.2     snj 	case AF_INET:
    442  1.1.2.2     snj 	    {
    443  1.1.2.2     snj 		struct ip *ip;
    444  1.1.2.2     snj 
    445  1.1.2.2     snj 		proto = IPPROTO_IPV4;
    446  1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    447  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    448  1.1.2.2     snj 			if (!m)
    449  1.1.2.2     snj 				return ENOBUFS;
    450  1.1.2.2     snj 		}
    451  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    452  1.1.2.2     snj 		itos = ip->ip_tos;
    453  1.1.2.2     snj 		/*
    454  1.1.2.2     snj 		 * TODO:
    455  1.1.2.2     snj 		 *support ALTQ for innner packet
    456  1.1.2.2     snj 		 */
    457  1.1.2.2     snj 		break;
    458  1.1.2.2     snj 	    }
    459  1.1.2.2     snj #endif /* INET */
    460  1.1.2.2     snj 	case AF_INET6:
    461  1.1.2.2     snj 	    {
    462  1.1.2.2     snj 		struct ip6_hdr *xip6;
    463  1.1.2.2     snj 		proto = IPPROTO_IPV6;
    464  1.1.2.2     snj 		if (m->m_len < sizeof(*xip6)) {
    465  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    466  1.1.2.2     snj 			if (!m)
    467  1.1.2.2     snj 				return ENOBUFS;
    468  1.1.2.2     snj 		}
    469  1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    470  1.1.2.2     snj 		itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff;
    471  1.1.2.2     snj 		/* TODO:
    472  1.1.2.2     snj 		 * support ALTQ for innner packet
    473  1.1.2.2     snj 		 */
    474  1.1.2.2     snj 		break;
    475  1.1.2.2     snj 	    }
    476  1.1.2.2     snj 	default:
    477  1.1.2.2     snj 		m_freem(m);
    478  1.1.2.2     snj 		return EAFNOSUPPORT;
    479  1.1.2.2     snj 	}
    480  1.1.2.2     snj 
    481  1.1.2.2     snj 	/* prepend new IP header */
    482  1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
    483  1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr)))
    484  1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip6_hdr));
    485  1.1.2.2     snj 	if (m == NULL)
    486  1.1.2.2     snj 		return ENOBUFS;
    487  1.1.2.2     snj 
    488  1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    489  1.1.2.2     snj 	ip6->ip6_flow	= 0;
    490  1.1.2.2     snj 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
    491  1.1.2.2     snj 	ip6->ip6_vfc	|= IPV6_VERSION;
    492  1.1.2.2     snj 	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len);
    493  1.1.2.2     snj 	ip6->ip6_nxt	= proto;
    494  1.1.2.2     snj 	ip6->ip6_hlim	= ip6_ipsec_hlim;
    495  1.1.2.2     snj 	ip6->ip6_src	= sin6_src->sin6_addr;
    496  1.1.2.2     snj 	/* bidirectional configured tunnel mode */
    497  1.1.2.2     snj 	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
    498  1.1.2.2     snj 		ip6->ip6_dst = sin6_dst->sin6_addr;
    499  1.1.2.2     snj 	} else  {
    500  1.1.2.2     snj 		m_freem(m);
    501  1.1.2.2     snj 		return ENETUNREACH;
    502  1.1.2.2     snj 	}
    503  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    504  1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    505  1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    506  1.1.2.2     snj 	else
    507  1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
    508  1.1.2.2     snj 
    509  1.1.2.2     snj 	if (!ip6_ipsec_copy_tos)
    510  1.1.2.2     snj 		otos = 0;
    511  1.1.2.2     snj #else
    512  1.1.2.2     snj 	if (ip6_ipsec_copy_tos)
    513  1.1.2.2     snj 		otos = itos;
    514  1.1.2.2     snj 	else
    515  1.1.2.2     snj 		otos = 0;
    516  1.1.2.2     snj #endif
    517  1.1.2.2     snj 	ip6->ip6_flow &= ~ntohl(0xff00000);
    518  1.1.2.2     snj 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
    519  1.1.2.2     snj 
    520  1.1.2.2     snj 	sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
    521  1.1.2.2     snj 
    522  1.1.2.2     snj 	iro = percpu_getref(sc->ipsec_ro_percpu);
    523  1.1.2.2     snj 	mutex_enter(&iro->ir_lock);
    524  1.1.2.2     snj 	if ((rt = rtcache_lookup(&iro->ir_ro, &u.dst)) == NULL) {
    525  1.1.2.2     snj 		mutex_exit(&iro->ir_lock);
    526  1.1.2.2     snj 		percpu_putref(sc->ipsec_ro_percpu);
    527  1.1.2.2     snj 		m_freem(m);
    528  1.1.2.2     snj 		return ENETUNREACH;
    529  1.1.2.2     snj 	}
    530  1.1.2.2     snj 
    531  1.1.2.2     snj 	if (rt->rt_ifp == ifp) {
    532  1.1.2.2     snj 		rtcache_unref(rt, &iro->ir_ro);
    533  1.1.2.2     snj 		rtcache_free(&iro->ir_ro);
    534  1.1.2.2     snj 		mutex_exit(&iro->ir_lock);
    535  1.1.2.2     snj 		percpu_putref(sc->ipsec_ro_percpu);
    536  1.1.2.2     snj 		m_freem(m);
    537  1.1.2.2     snj 		return ENETUNREACH;
    538  1.1.2.2     snj 	}
    539  1.1.2.2     snj 	rtcache_unref(rt, &iro->ir_ro);
    540  1.1.2.2     snj 
    541  1.1.2.2     snj 	/*
    542  1.1.2.2     snj 	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
    543  1.1.2.2     snj 	 * it is too painful to ask for resend of inner packet, to achieve
    544  1.1.2.2     snj 	 * path MTU discovery for encapsulated packets.
    545  1.1.2.2     snj 	 */
    546  1.1.2.2     snj 	error = ip6_output(m, 0, &iro->ir_ro,
    547  1.1.2.2     snj 	    ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL);
    548  1.1.2.2     snj 	if (error)
    549  1.1.2.2     snj 		rtcache_free(&iro->ir_ro);
    550  1.1.2.2     snj 
    551  1.1.2.2     snj 	mutex_exit(&iro->ir_lock);
    552  1.1.2.2     snj 	percpu_putref(sc->ipsec_ro_percpu);
    553  1.1.2.2     snj 
    554  1.1.2.2     snj 	return error;
    555  1.1.2.2     snj }
    556  1.1.2.2     snj #endif /* INET6 */
    557  1.1.2.2     snj 
    558  1.1.2.2     snj static void
    559  1.1.2.2     snj ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg)
    560  1.1.2.2     snj {
    561  1.1.2.2     snj 	struct ifnet *ipsecp;
    562  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    563  1.1.2.2     snj 	struct ipsec_variant *var;
    564  1.1.2.2     snj 	const struct ip *ip;
    565  1.1.2.2     snj 	int af;
    566  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    567  1.1.2.2     snj 	u_int8_t otos;
    568  1.1.2.2     snj #endif
    569  1.1.2.2     snj 	struct psref psref_rcvif;
    570  1.1.2.2     snj 	struct psref psref_var;
    571  1.1.2.2     snj 	struct ifnet *rcvif;
    572  1.1.2.2     snj 
    573  1.1.2.2     snj 	KASSERT(sc != NULL);
    574  1.1.2.2     snj 
    575  1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    576  1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    577  1.1.2.2     snj 		m_freem(m);
    578  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    579  1.1.2.2     snj 		return;
    580  1.1.2.2     snj 	}
    581  1.1.2.2     snj 
    582  1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    583  1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    584  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    585  1.1.2.2     snj 		m_freem(m);
    586  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    587  1.1.2.2     snj 		return;
    588  1.1.2.2     snj 	}
    589  1.1.2.2     snj 
    590  1.1.2.2     snj 	ip = mtod(m, const struct ip *);
    591  1.1.2.2     snj 
    592  1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    593  1.1.2.2     snj 	if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) {
    594  1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    595  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    596  1.1.2.2     snj 		m_freem(m);
    597  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    598  1.1.2.2     snj 		return;
    599  1.1.2.2     snj 	}
    600  1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    601  1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    602  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    603  1.1.2.2     snj 	otos = ip->ip_tos;
    604  1.1.2.2     snj #endif
    605  1.1.2.2     snj 	m_adj(m, off);
    606  1.1.2.2     snj 
    607  1.1.2.2     snj 	switch (proto) {
    608  1.1.2.2     snj 	case IPPROTO_IPV4:
    609  1.1.2.2     snj 	    {
    610  1.1.2.2     snj 		struct ip *xip;
    611  1.1.2.2     snj 		af = AF_INET;
    612  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip))) {
    613  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip));
    614  1.1.2.2     snj 			if (!m)
    615  1.1.2.2     snj 				return;
    616  1.1.2.2     snj 		}
    617  1.1.2.2     snj 		xip = mtod(m, struct ip *);
    618  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    619  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    620  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
    621  1.1.2.2     snj 		else
    622  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
    623  1.1.2.2     snj #endif
    624  1.1.2.2     snj 		break;
    625  1.1.2.2     snj 	    }
    626  1.1.2.2     snj #ifdef INET6
    627  1.1.2.2     snj 	case IPPROTO_IPV6:
    628  1.1.2.2     snj 	    {
    629  1.1.2.2     snj 		struct ip6_hdr *ip6;
    630  1.1.2.2     snj 		u_int8_t itos;
    631  1.1.2.2     snj 		af = AF_INET6;
    632  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
    633  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    634  1.1.2.2     snj 			if (!m)
    635  1.1.2.2     snj 				return;
    636  1.1.2.2     snj 		}
    637  1.1.2.2     snj 		ip6 = mtod(m, struct ip6_hdr *);
    638  1.1.2.2     snj 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    639  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    640  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    641  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
    642  1.1.2.2     snj 		else
    643  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
    644  1.1.2.2     snj #endif
    645  1.1.2.2     snj 		ip6->ip6_flow &= ~htonl(0xff << 20);
    646  1.1.2.2     snj 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
    647  1.1.2.2     snj 		break;
    648  1.1.2.2     snj 	    }
    649  1.1.2.2     snj #endif /* INET6 */
    650  1.1.2.2     snj 	default:
    651  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    652  1.1.2.2     snj 		m_freem(m);
    653  1.1.2.2     snj 		return;
    654  1.1.2.2     snj 	}
    655  1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    656  1.1.2.2     snj 
    657  1.1.2.2     snj 	return;
    658  1.1.2.2     snj }
    659  1.1.2.2     snj 
    660  1.1.2.2     snj /*
    661  1.1.2.2     snj  * validate and filter the pakcet
    662  1.1.2.2     snj  */
    663  1.1.2.2     snj static int
    664  1.1.2.2     snj ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var,
    665  1.1.2.2     snj     struct ifnet *ifp)
    666  1.1.2.2     snj {
    667  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    668  1.1.2.2     snj 
    669  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    670  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    671  1.1.2.2     snj 
    672  1.1.2.2     snj 	return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr);
    673  1.1.2.2     snj }
    674  1.1.2.2     snj 
    675  1.1.2.2     snj #ifdef INET6
    676  1.1.2.2     snj static int
    677  1.1.2.2     snj ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg)
    678  1.1.2.2     snj {
    679  1.1.2.2     snj 	struct mbuf *m = *mp;
    680  1.1.2.2     snj 	struct ifnet *ipsecp;
    681  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    682  1.1.2.2     snj 	struct ipsec_variant *var;
    683  1.1.2.2     snj 	struct ip6_hdr *ip6;
    684  1.1.2.2     snj 	int af = 0;
    685  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    686  1.1.2.2     snj 	u_int32_t otos;
    687  1.1.2.2     snj #endif
    688  1.1.2.2     snj 	struct psref psref_rcvif;
    689  1.1.2.2     snj 	struct psref psref_var;
    690  1.1.2.2     snj 	struct ifnet *rcvif;
    691  1.1.2.2     snj 
    692  1.1.2.2     snj 	KASSERT(eparg != NULL);
    693  1.1.2.2     snj 
    694  1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    695  1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    696  1.1.2.2     snj 		m_freem(m);
    697  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    698  1.1.2.2     snj 		return IPPROTO_DONE;
    699  1.1.2.2     snj 	}
    700  1.1.2.2     snj 
    701  1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    702  1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    703  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    704  1.1.2.2     snj 		m_freem(m);
    705  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    706  1.1.2.2     snj 		return IPPROTO_DONE;
    707  1.1.2.2     snj 	}
    708  1.1.2.2     snj 
    709  1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    710  1.1.2.2     snj 
    711  1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    712  1.1.2.2     snj 	if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) {
    713  1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    714  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    715  1.1.2.2     snj 		m_freem(m);
    716  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    717  1.1.2.2     snj 		return IPPROTO_DONE;
    718  1.1.2.2     snj 	}
    719  1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    720  1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    721  1.1.2.2     snj 
    722  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    723  1.1.2.2     snj 	otos = ip6->ip6_flow;
    724  1.1.2.2     snj #endif
    725  1.1.2.2     snj 	m_adj(m, *offp);
    726  1.1.2.2     snj 
    727  1.1.2.2     snj 	switch (proto) {
    728  1.1.2.2     snj #ifdef INET
    729  1.1.2.2     snj 	case IPPROTO_IPV4:
    730  1.1.2.2     snj 	    {
    731  1.1.2.2     snj 		af = AF_INET;
    732  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    733  1.1.2.2     snj 		struct ip *ip;
    734  1.1.2.2     snj 		u_int8_t otos8;
    735  1.1.2.2     snj 		otos8 = (ntohl(otos) >> 20) & 0xff;
    736  1.1.2.2     snj 
    737  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip))) {
    738  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    739  1.1.2.2     snj 			if (!m)
    740  1.1.2.2     snj 				return IPPROTO_DONE;
    741  1.1.2.2     snj 		}
    742  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    743  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    744  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
    745  1.1.2.2     snj 		else
    746  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
    747  1.1.2.2     snj #endif
    748  1.1.2.2     snj 		break;
    749  1.1.2.2     snj 	    }
    750  1.1.2.2     snj #endif /* INET */
    751  1.1.2.2     snj 	case IPPROTO_IPV6:
    752  1.1.2.2     snj 	    {
    753  1.1.2.2     snj 		af = AF_INET6;
    754  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    755  1.1.2.2     snj 		struct ip6_hdr *xip6;
    756  1.1.2.2     snj 
    757  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip6))) {
    758  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    759  1.1.2.2     snj 			if (!m)
    760  1.1.2.2     snj 				return IPPROTO_DONE;
    761  1.1.2.2     snj 		}
    762  1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    763  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    764  1.1.2.2     snj 			ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow);
    765  1.1.2.2     snj 		else
    766  1.1.2.2     snj 			ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow);
    767  1.1.2.2     snj 		break;
    768  1.1.2.2     snj #endif
    769  1.1.2.2     snj 	    }
    770  1.1.2.2     snj 	default:
    771  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    772  1.1.2.2     snj 		m_freem(m);
    773  1.1.2.2     snj 		return IPPROTO_DONE;
    774  1.1.2.2     snj 	}
    775  1.1.2.2     snj 
    776  1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    777  1.1.2.2     snj 	return IPPROTO_DONE;
    778  1.1.2.2     snj }
    779  1.1.2.2     snj 
    780  1.1.2.2     snj /*
    781  1.1.2.2     snj  * validate and filter the packet.
    782  1.1.2.2     snj  */
    783  1.1.2.2     snj static int
    784  1.1.2.2     snj ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var,
    785  1.1.2.2     snj     struct ifnet *ifp)
    786  1.1.2.2     snj {
    787  1.1.2.2     snj 	struct sockaddr_in6 *src, *dst;
    788  1.1.2.2     snj 
    789  1.1.2.2     snj 	src = satosin6(var->iv_psrc);
    790  1.1.2.2     snj 	dst = satosin6(var->iv_pdst);
    791  1.1.2.2     snj 
    792  1.1.2.2     snj 	return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr);
    793  1.1.2.2     snj }
    794  1.1.2.2     snj #endif /* INET6 */
    795  1.1.2.2     snj 
    796  1.1.2.2     snj int
    797  1.1.2.2     snj ipsecif4_attach(struct ipsec_variant *var)
    798  1.1.2.2     snj {
    799  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    800  1.1.2.2     snj 
    801  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    802  1.1.2.2     snj 
    803  1.1.2.2     snj 	if (var->iv_encap_cookie4 != NULL)
    804  1.1.2.2     snj 		return EALREADY;
    805  1.1.2.2     snj 	var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func,
    806  1.1.2.2     snj 	    &ipsecif4_encapsw, sc);
    807  1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    808  1.1.2.2     snj 		return EEXIST;
    809  1.1.2.2     snj 
    810  1.1.2.2     snj 	var->iv_output = ipsecif4_output;
    811  1.1.2.2     snj 	return 0;
    812  1.1.2.2     snj }
    813  1.1.2.2     snj 
    814  1.1.2.2     snj int
    815  1.1.2.2     snj ipsecif4_detach(struct ipsec_variant *var)
    816  1.1.2.2     snj {
    817  1.1.2.2     snj 	int error;
    818  1.1.2.2     snj 
    819  1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    820  1.1.2.2     snj 		return 0;
    821  1.1.2.2     snj 
    822  1.1.2.2     snj 	var->iv_output = NULL;
    823  1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie4);
    824  1.1.2.2     snj 	if (error == 0)
    825  1.1.2.2     snj 		var->iv_encap_cookie4 = NULL;
    826  1.1.2.2     snj 
    827  1.1.2.2     snj 	return error;
    828  1.1.2.2     snj }
    829  1.1.2.2     snj 
    830  1.1.2.2     snj #ifdef INET6
    831  1.1.2.2     snj int
    832  1.1.2.2     snj ipsecif6_attach(struct ipsec_variant *var)
    833  1.1.2.2     snj {
    834  1.1.2.2     snj 	struct sockaddr_in6 mask6;
    835  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    836  1.1.2.2     snj 
    837  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    838  1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 == NULL);
    839  1.1.2.2     snj 
    840  1.1.2.2     snj 	memset(&mask6, 0, sizeof(mask6));
    841  1.1.2.2     snj 	mask6.sin6_len = sizeof(struct sockaddr_in6);
    842  1.1.2.2     snj 	mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] =
    843  1.1.2.2     snj 	mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0;
    844  1.1.2.2     snj 
    845  1.1.2.2     snj 	var->iv_encap_cookie6 = encap_attach(AF_INET6, -1,
    846  1.1.2.2     snj 	    var->iv_psrc, (struct sockaddr *)&mask6,
    847  1.1.2.2     snj 	    var->iv_pdst, (struct sockaddr *)&mask6,
    848  1.1.2.2     snj 	    &ipsecif6_encapsw, sc);
    849  1.1.2.2     snj 	if (var->iv_encap_cookie6 == NULL)
    850  1.1.2.2     snj 		return EEXIST;
    851  1.1.2.2     snj 
    852  1.1.2.2     snj 	var->iv_output = ipsecif6_output;
    853  1.1.2.2     snj 	return 0;
    854  1.1.2.2     snj }
    855  1.1.2.2     snj 
    856  1.1.2.2     snj static void
    857  1.1.2.2     snj ipsecif6_rtcache_free_pc(void *p, void *arg __unused, struct cpu_info *ci __unused)
    858  1.1.2.2     snj {
    859  1.1.2.2     snj 	struct ipsec_ro *iro = p;
    860  1.1.2.2     snj 
    861  1.1.2.2     snj 	mutex_enter(&iro->ir_lock);
    862  1.1.2.2     snj 	rtcache_free(&iro->ir_ro);
    863  1.1.2.2     snj 	mutex_exit(&iro->ir_lock);
    864  1.1.2.2     snj }
    865  1.1.2.2     snj 
    866  1.1.2.2     snj int
    867  1.1.2.2     snj ipsecif6_detach(struct ipsec_variant *var)
    868  1.1.2.2     snj {
    869  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    870  1.1.2.2     snj 	int error;
    871  1.1.2.2     snj 
    872  1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 != NULL);
    873  1.1.2.2     snj 
    874  1.1.2.2     snj 	percpu_foreach(sc->ipsec_ro_percpu, ipsecif6_rtcache_free_pc, NULL);
    875  1.1.2.2     snj 
    876  1.1.2.2     snj 	var->iv_output = NULL;
    877  1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie6);
    878  1.1.2.2     snj 	if (error == 0)
    879  1.1.2.2     snj 		var->iv_encap_cookie6 = NULL;
    880  1.1.2.2     snj 	return error;
    881  1.1.2.2     snj }
    882  1.1.2.2     snj 
    883  1.1.2.2     snj void *
    884  1.1.2.2     snj ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg)
    885  1.1.2.2     snj {
    886  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    887  1.1.2.2     snj 	struct ip6ctlparam *ip6cp = NULL;
    888  1.1.2.2     snj 	struct ip6_hdr *ip6;
    889  1.1.2.2     snj 	const struct sockaddr_in6 *dst6;
    890  1.1.2.2     snj 	struct ipsec_ro *iro;
    891  1.1.2.2     snj 
    892  1.1.2.2     snj 	if (sa->sa_family != AF_INET6 ||
    893  1.1.2.2     snj 	    sa->sa_len != sizeof(struct sockaddr_in6))
    894  1.1.2.2     snj 		return NULL;
    895  1.1.2.2     snj 
    896  1.1.2.2     snj 	if ((unsigned)cmd >= PRC_NCMDS)
    897  1.1.2.2     snj 		return NULL;
    898  1.1.2.2     snj 	if (cmd == PRC_HOSTDEAD)
    899  1.1.2.2     snj 		d = NULL;
    900  1.1.2.2     snj 	else if (inet6ctlerrmap[cmd] == 0)
    901  1.1.2.2     snj 		return NULL;
    902  1.1.2.2     snj 
    903  1.1.2.2     snj 	/* if the parameter is from icmp6, decode it. */
    904  1.1.2.2     snj 	if (d != NULL) {
    905  1.1.2.2     snj 		ip6cp = (struct ip6ctlparam *)d;
    906  1.1.2.2     snj 		ip6 = ip6cp->ip6c_ip6;
    907  1.1.2.2     snj 	} else {
    908  1.1.2.2     snj 		ip6 = NULL;
    909  1.1.2.2     snj 	}
    910  1.1.2.2     snj 
    911  1.1.2.2     snj 	if (!ip6)
    912  1.1.2.2     snj 		return NULL;
    913  1.1.2.2     snj 
    914  1.1.2.2     snj 	iro = percpu_getref(sc->ipsec_ro_percpu);
    915  1.1.2.2     snj 	mutex_enter(&iro->ir_lock);
    916  1.1.2.2     snj 	dst6 = satocsin6(rtcache_getdst(&iro->ir_ro));
    917  1.1.2.2     snj 	/* XXX scope */
    918  1.1.2.2     snj 	if (dst6 == NULL)
    919  1.1.2.2     snj 		;
    920  1.1.2.2     snj 	else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
    921  1.1.2.2     snj 		/* flush route cache */
    922  1.1.2.2     snj 		rtcache_free(&iro->ir_ro);
    923  1.1.2.2     snj 
    924  1.1.2.2     snj 	mutex_exit(&iro->ir_lock);
    925  1.1.2.2     snj 	percpu_putref(sc->ipsec_ro_percpu);
    926  1.1.2.2     snj 
    927  1.1.2.2     snj 	return NULL;
    928  1.1.2.2     snj }
    929  1.1.2.2     snj 
    930  1.1.2.2     snj ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput)
    931  1.1.2.2     snj #define	ipsecif6_ctlinput	ipsecif6_ctlinput_wrapper
    932  1.1.2.2     snj 
    933  1.1.2.2     snj static const struct encapsw ipsecif6_encapsw = {
    934  1.1.2.2     snj 	.encapsw6 = {
    935  1.1.2.2     snj 		.pr_input = ipsecif6_input,
    936  1.1.2.2     snj 		.pr_ctlinput = ipsecif6_ctlinput,
    937  1.1.2.2     snj 	}
    938  1.1.2.2     snj };
    939  1.1.2.2     snj #endif /* INET6 */
    940