Home | History | Annotate | Line # | Download | only in netipsec
ipsecif.c revision 1.1.2.8 
      1  1.1.2.8  martin /*	$NetBSD: ipsecif.c,v 1.1.2.8 2019/05/29 15:57:38 martin Exp $  */
      2  1.1.2.2     snj 
      3  1.1.2.2     snj /*
      4  1.1.2.2     snj  * Copyright (c) 2017 Internet Initiative Japan Inc.
      5  1.1.2.2     snj  * All rights reserved.
      6  1.1.2.2     snj  *
      7  1.1.2.2     snj  * Redistribution and use in source and binary forms, with or without
      8  1.1.2.2     snj  * modification, are permitted provided that the following conditions
      9  1.1.2.2     snj  * are met:
     10  1.1.2.2     snj  * 1. Redistributions of source code must retain the above copyright
     11  1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer.
     12  1.1.2.2     snj  * 2. Redistributions in binary form must reproduce the above copyright
     13  1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer in the
     14  1.1.2.2     snj  *    documentation and/or other materials provided with the distribution.
     15  1.1.2.2     snj  *
     16  1.1.2.2     snj  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17  1.1.2.2     snj  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18  1.1.2.2     snj  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19  1.1.2.2     snj  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20  1.1.2.2     snj  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21  1.1.2.2     snj  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22  1.1.2.2     snj  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23  1.1.2.2     snj  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24  1.1.2.2     snj  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25  1.1.2.2     snj  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26  1.1.2.2     snj  * POSSIBILITY OF SUCH DAMAGE.
     27  1.1.2.2     snj  */
     28  1.1.2.2     snj 
     29  1.1.2.2     snj #include <sys/cdefs.h>
     30  1.1.2.8  martin __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.1.2.8 2019/05/29 15:57:38 martin Exp $");
     31  1.1.2.2     snj 
     32  1.1.2.2     snj #ifdef _KERNEL_OPT
     33  1.1.2.2     snj #include "opt_inet.h"
     34  1.1.2.2     snj #include "opt_ipsec.h"
     35  1.1.2.2     snj #endif
     36  1.1.2.2     snj 
     37  1.1.2.2     snj #include <sys/param.h>
     38  1.1.2.2     snj #include <sys/systm.h>
     39  1.1.2.2     snj #include <sys/socket.h>
     40  1.1.2.2     snj #include <sys/sockio.h>
     41  1.1.2.2     snj #include <sys/mbuf.h>
     42  1.1.2.2     snj #include <sys/errno.h>
     43  1.1.2.2     snj #include <sys/ioctl.h>
     44  1.1.2.2     snj #include <sys/syslog.h>
     45  1.1.2.2     snj #include <sys/kernel.h>
     46  1.1.2.2     snj 
     47  1.1.2.2     snj #include <net/if.h>
     48  1.1.2.2     snj #include <net/route.h>
     49  1.1.2.2     snj 
     50  1.1.2.2     snj #include <netinet/in.h>
     51  1.1.2.2     snj #include <netinet/in_systm.h>
     52  1.1.2.2     snj #include <netinet/ip.h>
     53  1.1.2.2     snj #include <netinet/ip_var.h>
     54  1.1.2.2     snj #include <netinet/in_var.h>
     55  1.1.2.2     snj #include <netinet/ip_encap.h>
     56  1.1.2.2     snj #include <netinet/ip_ecn.h>
     57  1.1.2.2     snj #include <netinet/ip_private.h>
     58  1.1.2.2     snj #include <netinet/udp.h>
     59  1.1.2.2     snj 
     60  1.1.2.2     snj #ifdef INET6
     61  1.1.2.2     snj #include <netinet/ip6.h>
     62  1.1.2.2     snj #include <netinet6/ip6_var.h>
     63  1.1.2.2     snj #include <netinet6/ip6_private.h>
     64  1.1.2.2     snj #include <netinet6/in6_var.h>
     65  1.1.2.2     snj #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */
     66  1.1.2.2     snj #include <netinet/ip_ecn.h>
     67  1.1.2.2     snj #endif
     68  1.1.2.2     snj 
     69  1.1.2.2     snj #include <netipsec/key.h>
     70  1.1.2.2     snj #include <netipsec/ipsecif.h>
     71  1.1.2.2     snj 
     72  1.1.2.2     snj #include <net/if_ipsec.h>
     73  1.1.2.2     snj 
     74  1.1.2.2     snj static void ipsecif4_input(struct mbuf *, int, int, void *);
     75  1.1.2.2     snj static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *);
     76  1.1.2.2     snj static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *,
     77  1.1.2.2     snj 	struct ifnet *);
     78  1.1.2.2     snj 
     79  1.1.2.2     snj #ifdef INET6
     80  1.1.2.2     snj static int ipsecif6_input(struct mbuf **, int *, int, void *);
     81  1.1.2.2     snj static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *);
     82  1.1.2.2     snj static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *,
     83  1.1.2.2     snj 	struct ifnet *);
     84  1.1.2.2     snj #endif
     85  1.1.2.2     snj 
     86  1.1.2.2     snj static int ip_ipsec_ttl = IPSEC_TTL;
     87  1.1.2.2     snj static int ip_ipsec_copy_tos = 0;
     88  1.1.2.2     snj #ifdef INET6
     89  1.1.2.2     snj static int ip6_ipsec_hlim = IPSEC_HLIM;
     90  1.1.2.2     snj static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */
     91  1.1.2.2     snj static int ip6_ipsec_copy_tos = 0;
     92  1.1.2.2     snj #endif
     93  1.1.2.2     snj 
     94  1.1.2.2     snj struct encapsw ipsecif4_encapsw = {
     95  1.1.2.2     snj 	.encapsw4 = {
     96  1.1.2.2     snj 		.pr_input = ipsecif4_input,
     97  1.1.2.2     snj 		.pr_ctlinput = NULL,
     98  1.1.2.2     snj 	}
     99  1.1.2.2     snj };
    100  1.1.2.2     snj 
    101  1.1.2.2     snj #ifdef INET6
    102  1.1.2.2     snj static const struct encapsw ipsecif6_encapsw;
    103  1.1.2.2     snj #endif
    104  1.1.2.2     snj 
    105  1.1.2.2     snj static struct mbuf *
    106  1.1.2.2     snj ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m,
    107  1.1.2.2     snj     uint8_t proto, uint8_t tos)
    108  1.1.2.2     snj {
    109  1.1.2.2     snj 	struct ip *ip;
    110  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    111  1.1.2.2     snj 
    112  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    113  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    114  1.1.2.2     snj 
    115  1.1.2.2     snj 	if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) ||
    116  1.1.2.2     snj 	    src->sin_addr.s_addr == INADDR_BROADCAST ||
    117  1.1.2.2     snj 	    dst->sin_addr.s_addr == INADDR_BROADCAST) {
    118  1.1.2.2     snj 		m_freem(m);
    119  1.1.2.2     snj 		return NULL;
    120  1.1.2.2     snj 	}
    121  1.1.2.2     snj 	m->m_flags &= ~M_BCAST;
    122  1.1.2.2     snj 
    123  1.1.2.2     snj 	if (IN_MULTICAST(src->sin_addr.s_addr) ||
    124  1.1.2.2     snj 	   IN_MULTICAST(dst->sin_addr.s_addr)) {
    125  1.1.2.2     snj 		m_freem(m);
    126  1.1.2.2     snj 		return NULL;
    127  1.1.2.2     snj 	}
    128  1.1.2.2     snj 
    129  1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    130  1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip)))
    131  1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip));
    132  1.1.2.2     snj 	if (m == NULL)
    133  1.1.2.2     snj 		return NULL;
    134  1.1.2.2     snj 
    135  1.1.2.2     snj 	ip = mtod(m, struct ip *);
    136  1.1.2.2     snj 	ip->ip_v = IPVERSION;
    137  1.1.2.2     snj 	ip->ip_off = htons(0);
    138  1.1.2.6  martin 	if (m->m_pkthdr.len < IP_MINFRAGSIZE)
    139  1.1.2.6  martin 		ip->ip_id = 0;
    140  1.1.2.6  martin 	else
    141  1.1.2.6  martin 		ip->ip_id = ip_newid(NULL);
    142  1.1.2.2     snj 	ip->ip_hl = sizeof(*ip) >> 2;
    143  1.1.2.2     snj 	if (ip_ipsec_copy_tos)
    144  1.1.2.2     snj 		ip->ip_tos = tos;
    145  1.1.2.2     snj 	else
    146  1.1.2.2     snj 		ip->ip_tos = 0;
    147  1.1.2.2     snj 	ip->ip_sum = 0;
    148  1.1.2.2     snj 	ip->ip_src = src->sin_addr;
    149  1.1.2.2     snj 	ip->ip_dst = dst->sin_addr;
    150  1.1.2.2     snj 	ip->ip_p = proto;
    151  1.1.2.2     snj 	ip->ip_ttl = ip_ipsec_ttl;
    152  1.1.2.2     snj 	ip->ip_len = htons(m->m_pkthdr.len);
    153  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    154  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    155  1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    156  1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
    157  1.1.2.2     snj 	else
    158  1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
    159  1.1.2.2     snj #endif
    160  1.1.2.2     snj 
    161  1.1.2.2     snj 	return m;
    162  1.1.2.2     snj }
    163  1.1.2.2     snj 
    164  1.1.2.2     snj static int
    165  1.1.2.2     snj ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr)
    166  1.1.2.2     snj {
    167  1.1.2.2     snj 	struct ip ip0;
    168  1.1.2.2     snj 	struct ip *ip;
    169  1.1.2.2     snj 	int mtu;
    170  1.1.2.2     snj 	struct secasvar *sav;
    171  1.1.2.2     snj 
    172  1.1.2.2     snj 	sav = key_lookup_sa_bysaidx(&isr->saidx);
    173  1.1.2.2     snj 	if (sav == NULL)
    174  1.1.2.2     snj 		return 0;
    175  1.1.2.2     snj 
    176  1.1.2.2     snj 	if (!(sav->natt_type & UDP_ENCAP_ESPINUDP) &&
    177  1.1.2.2     snj 	    !(sav->natt_type & UDP_ENCAP_ESPINUDP_NON_IKE)) {
    178  1.1.2.2     snj 		mtu = 0;
    179  1.1.2.2     snj 		goto out;
    180  1.1.2.2     snj 	}
    181  1.1.2.2     snj 
    182  1.1.2.2     snj 	if (m->m_len < sizeof(struct ip)) {
    183  1.1.2.2     snj 		m_copydata(m, 0, sizeof(ip0), &ip0);
    184  1.1.2.2     snj 		ip = &ip0;
    185  1.1.2.2     snj 
    186  1.1.2.2     snj 	} else {
    187  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    188  1.1.2.2     snj 	}
    189  1.1.2.2     snj 	mtu = sav->esp_frag;
    190  1.1.2.2     snj 	if (ntohs(ip->ip_len) <= mtu)
    191  1.1.2.2     snj 		mtu = 0;
    192  1.1.2.2     snj 
    193  1.1.2.2     snj out:
    194  1.1.2.2     snj 	KEY_SA_UNREF(&sav);
    195  1.1.2.2     snj 	return mtu;
    196  1.1.2.2     snj }
    197  1.1.2.2     snj 
    198  1.1.2.2     snj static struct mbuf *
    199  1.1.2.2     snj ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0)
    200  1.1.2.2     snj {
    201  1.1.2.2     snj 	const struct ip *ip;
    202  1.1.2.2     snj 	int proto;
    203  1.1.2.2     snj 	int tos;
    204  1.1.2.2     snj 
    205  1.1.2.2     snj 	KASSERT(proto0 != NULL);
    206  1.1.2.2     snj 	KASSERT(tos0 != NULL);
    207  1.1.2.2     snj 
    208  1.1.2.2     snj 	switch (family) {
    209  1.1.2.2     snj 	case AF_INET:
    210  1.1.2.2     snj 		proto = IPPROTO_IPV4;
    211  1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    212  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    213  1.1.2.2     snj 			if (!m) {
    214  1.1.2.2     snj 				*tos0 = 0;
    215  1.1.2.2     snj 				*proto0 = 0;
    216  1.1.2.2     snj 				return  NULL;
    217  1.1.2.2     snj 			}
    218  1.1.2.2     snj 		}
    219  1.1.2.2     snj 		ip = mtod(m, const struct ip *);
    220  1.1.2.2     snj 		tos = ip->ip_tos;
    221  1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    222  1.1.2.2     snj 		break;
    223  1.1.2.2     snj #ifdef INET6
    224  1.1.2.2     snj 	case AF_INET6: {
    225  1.1.2.2     snj 		const struct ip6_hdr *ip6;
    226  1.1.2.2     snj 		proto = IPPROTO_IPV6;
    227  1.1.2.2     snj 		if (m->m_len < sizeof(*ip6)) {
    228  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    229  1.1.2.2     snj 			if (!m) {
    230  1.1.2.2     snj 				*tos0 = 0;
    231  1.1.2.2     snj 				*proto0 = 0;
    232  1.1.2.2     snj 				return NULL;
    233  1.1.2.2     snj 			}
    234  1.1.2.2     snj 		}
    235  1.1.2.2     snj 		ip6 = mtod(m, const struct ip6_hdr *);
    236  1.1.2.2     snj 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    237  1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    238  1.1.2.2     snj 		break;
    239  1.1.2.2     snj 	}
    240  1.1.2.2     snj #endif /* INET6 */
    241  1.1.2.2     snj 	default:
    242  1.1.2.2     snj 		*tos0 = 0;
    243  1.1.2.2     snj 		*proto0 = 0;
    244  1.1.2.2     snj 		return NULL;
    245  1.1.2.2     snj 	}
    246  1.1.2.2     snj 
    247  1.1.2.2     snj 	*proto0 = proto;
    248  1.1.2.2     snj 	*tos0 = tos;
    249  1.1.2.2     snj 	return m;
    250  1.1.2.2     snj }
    251  1.1.2.2     snj 
    252  1.1.2.2     snj static int
    253  1.1.2.2     snj ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu)
    254  1.1.2.2     snj {
    255  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    256  1.1.2.2     snj 	struct mbuf *next;
    257  1.1.2.2     snj 	struct m_tag *mtag;
    258  1.1.2.2     snj 	int error;
    259  1.1.2.2     snj 
    260  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    261  1.1.2.2     snj 
    262  1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    263  1.1.2.2     snj 	if (mtag)
    264  1.1.2.2     snj 		m_tag_delete(m, mtag);
    265  1.1.2.2     snj 
    266  1.1.2.4  martin 	/* consider new IP header prepended in ipsecif4_output() */
    267  1.1.2.4  martin 	if (mtu <= sizeof(struct ip)) {
    268  1.1.2.4  martin 		m_freem(m);
    269  1.1.2.4  martin 		return ENETUNREACH;
    270  1.1.2.4  martin 	}
    271  1.1.2.4  martin 	m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
    272  1.1.2.4  martin 	error = ip_fragment(m, ifp, mtu - sizeof(struct ip));
    273  1.1.2.2     snj 	if (error)
    274  1.1.2.2     snj 		return error;
    275  1.1.2.2     snj 
    276  1.1.2.2     snj 	for (error = 0; m; m = next) {
    277  1.1.2.2     snj 		next = m->m_nextpkt;
    278  1.1.2.3  martin 		m->m_nextpkt = NULL;
    279  1.1.2.2     snj 		if (error) {
    280  1.1.2.2     snj 			m_freem(m);
    281  1.1.2.2     snj 			continue;
    282  1.1.2.2     snj 		}
    283  1.1.2.2     snj 
    284  1.1.2.2     snj 		error = ipsecif4_output(var, family, m);
    285  1.1.2.2     snj 	}
    286  1.1.2.2     snj 	if (error == 0)
    287  1.1.2.2     snj 		IP_STATINC(IP_STAT_FRAGMENTED);
    288  1.1.2.2     snj 
    289  1.1.2.2     snj 	return error;
    290  1.1.2.2     snj }
    291  1.1.2.2     snj 
    292  1.1.2.2     snj int
    293  1.1.2.2     snj ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var)
    294  1.1.2.2     snj {
    295  1.1.2.2     snj 	struct m_tag *mtag;
    296  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    297  1.1.2.2     snj 	u_int16_t src_port = 0;
    298  1.1.2.2     snj 	u_int16_t dst_port = 0;
    299  1.1.2.2     snj 
    300  1.1.2.2     snj 	KASSERT(var != NULL);
    301  1.1.2.2     snj 
    302  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    303  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    304  1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    305  1.1.2.2     snj 	if (mtag) {
    306  1.1.2.2     snj 		u_int16_t *ports;
    307  1.1.2.2     snj 
    308  1.1.2.2     snj 		ports = (u_int16_t *)(mtag + 1);
    309  1.1.2.2     snj 		src_port = ports[0];
    310  1.1.2.2     snj 		dst_port = ports[1];
    311  1.1.2.2     snj 	}
    312  1.1.2.2     snj 
    313  1.1.2.2     snj 	/* address match */
    314  1.1.2.2     snj 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
    315  1.1.2.2     snj 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
    316  1.1.2.2     snj 		return 0;
    317  1.1.2.2     snj 
    318  1.1.2.2     snj 	/* UDP encap? */
    319  1.1.2.2     snj 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    320  1.1.2.2     snj 		goto match;
    321  1.1.2.2     snj 
    322  1.1.2.2     snj 	/* port match */
    323  1.1.2.2     snj 	if (src_port != var->iv_dport ||
    324  1.1.2.2     snj 	    dst_port != var->iv_sport) {
    325  1.1.2.2     snj #ifdef DEBUG
    326  1.1.2.2     snj 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    327  1.1.2.2     snj 		    __func__, ntohs(src_port), ntohs(dst_port),
    328  1.1.2.2     snj 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    329  1.1.2.2     snj #endif
    330  1.1.2.2     snj 		return 0;
    331  1.1.2.2     snj 	}
    332  1.1.2.2     snj 
    333  1.1.2.2     snj match:
    334  1.1.2.2     snj 	/*
    335  1.1.2.2     snj 	 * hide NAT-T information from encapsulated traffics.
    336  1.1.2.2     snj 	 * they don't know about IPsec.
    337  1.1.2.2     snj 	 */
    338  1.1.2.2     snj 	if (mtag)
    339  1.1.2.2     snj 		m_tag_delete(m, mtag);
    340  1.1.2.2     snj 	return sizeof(src->sin_addr) + sizeof(dst->sin_addr);
    341  1.1.2.2     snj }
    342  1.1.2.2     snj 
    343  1.1.2.2     snj static int
    344  1.1.2.2     snj ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m)
    345  1.1.2.2     snj {
    346  1.1.2.2     snj 	struct secpolicy *sp = NULL;
    347  1.1.2.2     snj 	u_int8_t tos;
    348  1.1.2.2     snj 	int proto;
    349  1.1.2.2     snj 	int error;
    350  1.1.2.2     snj 	int mtu;
    351  1.1.2.2     snj 	u_long sa_mtu = 0;
    352  1.1.2.2     snj 
    353  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    354  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    355  1.1.2.2     snj 	KASSERT(var->iv_psrc->sa_family == AF_INET);
    356  1.1.2.2     snj 	KASSERT(var->iv_pdst->sa_family == AF_INET);
    357  1.1.2.2     snj 
    358  1.1.2.2     snj 	sp = IV_SP_OUT(var);
    359  1.1.2.2     snj 	KASSERT(sp != NULL);
    360  1.1.2.2     snj 	/*
    361  1.1.2.2     snj 	 * The SPs in ipsec_variant are prevented from freed by
    362  1.1.2.2     snj 	 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here.
    363  1.1.2.2     snj 	 */
    364  1.1.2.2     snj 
    365  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_NONE);
    366  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_ENTRUST);
    367  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_BYPASS);
    368  1.1.2.2     snj 	if(sp->policy != IPSEC_POLICY_IPSEC) {
    369  1.1.2.2     snj 		struct ifnet *ifp = &var->iv_softc->ipsec_if;
    370  1.1.2.2     snj 		m_freem(m);
    371  1.1.2.2     snj 		IF_DROP(&ifp->if_snd);
    372  1.1.2.2     snj 		return 0;
    373  1.1.2.2     snj 	}
    374  1.1.2.2     snj 
    375  1.1.2.2     snj 	/* get flowinfo */
    376  1.1.2.2     snj 	m = ipsecif4_flowinfo(m, family, &proto, &tos);
    377  1.1.2.2     snj 	if (m == NULL) {
    378  1.1.2.2     snj 		error = ENETUNREACH;
    379  1.1.2.2     snj 		goto done;
    380  1.1.2.2     snj 	}
    381  1.1.2.2     snj 
    382  1.1.2.2     snj 	/* prepend new IP header */
    383  1.1.2.2     snj 	m = ipsecif4_prepend_hdr(var, m, proto, tos);
    384  1.1.2.2     snj 	if (m == NULL) {
    385  1.1.2.2     snj 		error = ENETUNREACH;
    386  1.1.2.2     snj 		goto done;
    387  1.1.2.2     snj 	}
    388  1.1.2.2     snj 
    389  1.1.2.2     snj 	/*
    390  1.1.2.2     snj 	 * Normal netipsec's NAT-T fragmentation is done in ip_output().
    391  1.1.2.2     snj 	 * See "natt_frag" processing.
    392  1.1.2.2     snj 	 * However, ipsec(4) interface's one is not done in the same way,
    393  1.1.2.2     snj 	 * so we must do NAT-T fragmentation by own code.
    394  1.1.2.2     snj 	 */
    395  1.1.2.2     snj 	/* NAT-T ESP fragmentation */
    396  1.1.2.2     snj 	mtu = ipsecif4_needfrag(m, sp->req);
    397  1.1.2.2     snj 	if (mtu > 0)
    398  1.1.2.2     snj 		return ipsecif4_fragout(var, family, m, mtu);
    399  1.1.2.2     snj 
    400  1.1.2.2     snj 	/* IPsec output */
    401  1.1.2.2     snj 	IP_STATINC(IP_STAT_LOCALOUT);
    402  1.1.2.2     snj 	error = ipsec4_process_packet(m, sp->req, &sa_mtu);
    403  1.1.2.2     snj 	if (error == ENOENT)
    404  1.1.2.2     snj 		error = 0;
    405  1.1.2.2     snj 	/*
    406  1.1.2.2     snj 	 * frangmentation is already done in ipsecif4_fragout(),
    407  1.1.2.2     snj 	 * so ipsec4_process_packet() must not do fragmentation here.
    408  1.1.2.2     snj 	 */
    409  1.1.2.4  martin 	KASSERT(sa_mtu == 0);
    410  1.1.2.2     snj 
    411  1.1.2.2     snj done:
    412  1.1.2.2     snj 	return error;
    413  1.1.2.2     snj }
    414  1.1.2.2     snj 
    415  1.1.2.2     snj #ifdef INET6
    416  1.1.2.6  martin int
    417  1.1.2.6  martin ipsecif6_encap_func(struct mbuf *m, struct ip6_hdr *ip6, struct ipsec_variant *var)
    418  1.1.2.6  martin {
    419  1.1.2.6  martin 	struct m_tag *mtag;
    420  1.1.2.6  martin 	struct sockaddr_in6 *src, *dst;
    421  1.1.2.6  martin 	u_int16_t src_port = 0;
    422  1.1.2.6  martin 	u_int16_t dst_port = 0;
    423  1.1.2.6  martin 
    424  1.1.2.6  martin 	KASSERT(var != NULL);
    425  1.1.2.6  martin 
    426  1.1.2.6  martin 	src = satosin6(var->iv_psrc);
    427  1.1.2.6  martin 	dst = satosin6(var->iv_pdst);
    428  1.1.2.6  martin 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    429  1.1.2.6  martin 	if (mtag) {
    430  1.1.2.6  martin 		u_int16_t *ports;
    431  1.1.2.6  martin 
    432  1.1.2.6  martin 		ports = (u_int16_t *)(mtag + 1);
    433  1.1.2.6  martin 		src_port = ports[0];
    434  1.1.2.6  martin 		dst_port = ports[1];
    435  1.1.2.6  martin 	}
    436  1.1.2.6  martin 
    437  1.1.2.6  martin 	/* address match */
    438  1.1.2.6  martin 	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
    439  1.1.2.6  martin 	    !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
    440  1.1.2.6  martin 		return 0;
    441  1.1.2.6  martin 
    442  1.1.2.6  martin 	/* UDP encap? */
    443  1.1.2.6  martin 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    444  1.1.2.6  martin 		goto match;
    445  1.1.2.6  martin 
    446  1.1.2.6  martin 	/* port match */
    447  1.1.2.6  martin 	if (src_port != var->iv_dport ||
    448  1.1.2.6  martin 	    dst_port != var->iv_sport) {
    449  1.1.2.6  martin #ifdef DEBUG
    450  1.1.2.6  martin 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    451  1.1.2.6  martin 		    __func__, ntohs(src_port), ntohs(dst_port),
    452  1.1.2.6  martin 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    453  1.1.2.6  martin #endif
    454  1.1.2.6  martin 		return 0;
    455  1.1.2.6  martin 	}
    456  1.1.2.6  martin 
    457  1.1.2.6  martin match:
    458  1.1.2.6  martin 	/*
    459  1.1.2.6  martin 	 * hide NAT-T information from encapsulated traffics.
    460  1.1.2.6  martin 	 * they don't know about IPsec.
    461  1.1.2.6  martin 	 */
    462  1.1.2.6  martin 	if (mtag)
    463  1.1.2.6  martin 		m_tag_delete(m, mtag);
    464  1.1.2.6  martin 	return sizeof(src->sin6_addr) + sizeof(dst->sin6_addr);
    465  1.1.2.6  martin }
    466  1.1.2.6  martin 
    467  1.1.2.2     snj static int
    468  1.1.2.2     snj ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m)
    469  1.1.2.2     snj {
    470  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    471  1.1.2.2     snj 	struct ipsec_softc *sc = ifp->if_softc;
    472  1.1.2.2     snj 	struct ipsec_ro *iro;
    473  1.1.2.2     snj 	struct rtentry *rt;
    474  1.1.2.2     snj 	struct sockaddr_in6 *sin6_src;
    475  1.1.2.2     snj 	struct sockaddr_in6 *sin6_dst;
    476  1.1.2.2     snj 	struct ip6_hdr *ip6;
    477  1.1.2.2     snj 	int proto, error;
    478  1.1.2.2     snj 	u_int8_t itos, otos;
    479  1.1.2.2     snj 	union {
    480  1.1.2.2     snj 		struct sockaddr		dst;
    481  1.1.2.2     snj 		struct sockaddr_in6	dst6;
    482  1.1.2.2     snj 	} u;
    483  1.1.2.2     snj 
    484  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    485  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    486  1.1.2.2     snj 
    487  1.1.2.2     snj 	sin6_src = satosin6(var->iv_psrc);
    488  1.1.2.2     snj 	sin6_dst = satosin6(var->iv_pdst);
    489  1.1.2.2     snj 
    490  1.1.2.2     snj 	KASSERT(sin6_src->sin6_family == AF_INET6);
    491  1.1.2.2     snj 	KASSERT(sin6_dst->sin6_family == AF_INET6);
    492  1.1.2.2     snj 
    493  1.1.2.2     snj 	switch (family) {
    494  1.1.2.2     snj #ifdef INET
    495  1.1.2.2     snj 	case AF_INET:
    496  1.1.2.2     snj 	    {
    497  1.1.2.2     snj 		struct ip *ip;
    498  1.1.2.2     snj 
    499  1.1.2.2     snj 		proto = IPPROTO_IPV4;
    500  1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    501  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    502  1.1.2.2     snj 			if (!m)
    503  1.1.2.2     snj 				return ENOBUFS;
    504  1.1.2.2     snj 		}
    505  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    506  1.1.2.2     snj 		itos = ip->ip_tos;
    507  1.1.2.2     snj 		/*
    508  1.1.2.2     snj 		 * TODO:
    509  1.1.2.2     snj 		 *support ALTQ for innner packet
    510  1.1.2.2     snj 		 */
    511  1.1.2.2     snj 		break;
    512  1.1.2.2     snj 	    }
    513  1.1.2.2     snj #endif /* INET */
    514  1.1.2.2     snj 	case AF_INET6:
    515  1.1.2.2     snj 	    {
    516  1.1.2.2     snj 		struct ip6_hdr *xip6;
    517  1.1.2.2     snj 		proto = IPPROTO_IPV6;
    518  1.1.2.2     snj 		if (m->m_len < sizeof(*xip6)) {
    519  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    520  1.1.2.2     snj 			if (!m)
    521  1.1.2.2     snj 				return ENOBUFS;
    522  1.1.2.2     snj 		}
    523  1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    524  1.1.2.2     snj 		itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff;
    525  1.1.2.2     snj 		/* TODO:
    526  1.1.2.2     snj 		 * support ALTQ for innner packet
    527  1.1.2.2     snj 		 */
    528  1.1.2.2     snj 		break;
    529  1.1.2.2     snj 	    }
    530  1.1.2.2     snj 	default:
    531  1.1.2.2     snj 		m_freem(m);
    532  1.1.2.2     snj 		return EAFNOSUPPORT;
    533  1.1.2.2     snj 	}
    534  1.1.2.2     snj 
    535  1.1.2.2     snj 	/* prepend new IP header */
    536  1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
    537  1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr)))
    538  1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip6_hdr));
    539  1.1.2.2     snj 	if (m == NULL)
    540  1.1.2.2     snj 		return ENOBUFS;
    541  1.1.2.2     snj 
    542  1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    543  1.1.2.2     snj 	ip6->ip6_flow	= 0;
    544  1.1.2.2     snj 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
    545  1.1.2.2     snj 	ip6->ip6_vfc	|= IPV6_VERSION;
    546  1.1.2.5  martin #if 0	/* ip6->ip6_plen will be filled by ip6_output */
    547  1.1.2.5  martin 	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len - sizeof(*ip6));
    548  1.1.2.5  martin #endif
    549  1.1.2.2     snj 	ip6->ip6_nxt	= proto;
    550  1.1.2.2     snj 	ip6->ip6_hlim	= ip6_ipsec_hlim;
    551  1.1.2.2     snj 	ip6->ip6_src	= sin6_src->sin6_addr;
    552  1.1.2.2     snj 	/* bidirectional configured tunnel mode */
    553  1.1.2.2     snj 	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
    554  1.1.2.2     snj 		ip6->ip6_dst = sin6_dst->sin6_addr;
    555  1.1.2.2     snj 	} else  {
    556  1.1.2.2     snj 		m_freem(m);
    557  1.1.2.2     snj 		return ENETUNREACH;
    558  1.1.2.2     snj 	}
    559  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    560  1.1.2.8  martin 	if (!ip6_ipsec_copy_tos)
    561  1.1.2.8  martin 		otos = 0;
    562  1.1.2.8  martin 
    563  1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    564  1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    565  1.1.2.2     snj 	else
    566  1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
    567  1.1.2.2     snj #else
    568  1.1.2.2     snj 	if (ip6_ipsec_copy_tos)
    569  1.1.2.2     snj 		otos = itos;
    570  1.1.2.2     snj 	else
    571  1.1.2.2     snj 		otos = 0;
    572  1.1.2.2     snj #endif
    573  1.1.2.2     snj 	ip6->ip6_flow &= ~ntohl(0xff00000);
    574  1.1.2.2     snj 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
    575  1.1.2.2     snj 
    576  1.1.2.2     snj 	sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
    577  1.1.2.2     snj 
    578  1.1.2.2     snj 	iro = percpu_getref(sc->ipsec_ro_percpu);
    579  1.1.2.7  martin 	mutex_enter(iro->ir_lock);
    580  1.1.2.2     snj 	if ((rt = rtcache_lookup(&iro->ir_ro, &u.dst)) == NULL) {
    581  1.1.2.7  martin 		mutex_exit(iro->ir_lock);
    582  1.1.2.2     snj 		percpu_putref(sc->ipsec_ro_percpu);
    583  1.1.2.2     snj 		m_freem(m);
    584  1.1.2.2     snj 		return ENETUNREACH;
    585  1.1.2.2     snj 	}
    586  1.1.2.2     snj 
    587  1.1.2.2     snj 	if (rt->rt_ifp == ifp) {
    588  1.1.2.2     snj 		rtcache_unref(rt, &iro->ir_ro);
    589  1.1.2.2     snj 		rtcache_free(&iro->ir_ro);
    590  1.1.2.7  martin 		mutex_exit(iro->ir_lock);
    591  1.1.2.2     snj 		percpu_putref(sc->ipsec_ro_percpu);
    592  1.1.2.2     snj 		m_freem(m);
    593  1.1.2.2     snj 		return ENETUNREACH;
    594  1.1.2.2     snj 	}
    595  1.1.2.2     snj 	rtcache_unref(rt, &iro->ir_ro);
    596  1.1.2.2     snj 
    597  1.1.2.2     snj 	/*
    598  1.1.2.2     snj 	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
    599  1.1.2.2     snj 	 * it is too painful to ask for resend of inner packet, to achieve
    600  1.1.2.2     snj 	 * path MTU discovery for encapsulated packets.
    601  1.1.2.2     snj 	 */
    602  1.1.2.2     snj 	error = ip6_output(m, 0, &iro->ir_ro,
    603  1.1.2.2     snj 	    ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL);
    604  1.1.2.2     snj 	if (error)
    605  1.1.2.2     snj 		rtcache_free(&iro->ir_ro);
    606  1.1.2.2     snj 
    607  1.1.2.7  martin 	mutex_exit(iro->ir_lock);
    608  1.1.2.2     snj 	percpu_putref(sc->ipsec_ro_percpu);
    609  1.1.2.2     snj 
    610  1.1.2.2     snj 	return error;
    611  1.1.2.2     snj }
    612  1.1.2.2     snj #endif /* INET6 */
    613  1.1.2.2     snj 
    614  1.1.2.2     snj static void
    615  1.1.2.2     snj ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg)
    616  1.1.2.2     snj {
    617  1.1.2.2     snj 	struct ifnet *ipsecp;
    618  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    619  1.1.2.2     snj 	struct ipsec_variant *var;
    620  1.1.2.2     snj 	const struct ip *ip;
    621  1.1.2.2     snj 	int af;
    622  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    623  1.1.2.2     snj 	u_int8_t otos;
    624  1.1.2.2     snj #endif
    625  1.1.2.2     snj 	struct psref psref_rcvif;
    626  1.1.2.2     snj 	struct psref psref_var;
    627  1.1.2.2     snj 	struct ifnet *rcvif;
    628  1.1.2.2     snj 
    629  1.1.2.2     snj 	KASSERT(sc != NULL);
    630  1.1.2.2     snj 
    631  1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    632  1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    633  1.1.2.2     snj 		m_freem(m);
    634  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    635  1.1.2.2     snj 		return;
    636  1.1.2.2     snj 	}
    637  1.1.2.2     snj 
    638  1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    639  1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    640  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    641  1.1.2.2     snj 		m_freem(m);
    642  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    643  1.1.2.2     snj 		return;
    644  1.1.2.2     snj 	}
    645  1.1.2.2     snj 
    646  1.1.2.2     snj 	ip = mtod(m, const struct ip *);
    647  1.1.2.2     snj 
    648  1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    649  1.1.2.2     snj 	if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) {
    650  1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    651  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    652  1.1.2.2     snj 		m_freem(m);
    653  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    654  1.1.2.2     snj 		return;
    655  1.1.2.2     snj 	}
    656  1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    657  1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    658  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    659  1.1.2.2     snj 	otos = ip->ip_tos;
    660  1.1.2.2     snj #endif
    661  1.1.2.2     snj 	m_adj(m, off);
    662  1.1.2.2     snj 
    663  1.1.2.2     snj 	switch (proto) {
    664  1.1.2.2     snj 	case IPPROTO_IPV4:
    665  1.1.2.2     snj 	    {
    666  1.1.2.2     snj 		struct ip *xip;
    667  1.1.2.2     snj 		af = AF_INET;
    668  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip))) {
    669  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip));
    670  1.1.2.2     snj 			if (!m)
    671  1.1.2.2     snj 				return;
    672  1.1.2.2     snj 		}
    673  1.1.2.2     snj 		xip = mtod(m, struct ip *);
    674  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    675  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    676  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
    677  1.1.2.2     snj 		else
    678  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
    679  1.1.2.2     snj #endif
    680  1.1.2.2     snj 		break;
    681  1.1.2.2     snj 	    }
    682  1.1.2.2     snj #ifdef INET6
    683  1.1.2.2     snj 	case IPPROTO_IPV6:
    684  1.1.2.2     snj 	    {
    685  1.1.2.2     snj 		struct ip6_hdr *ip6;
    686  1.1.2.2     snj 		u_int8_t itos;
    687  1.1.2.2     snj 		af = AF_INET6;
    688  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
    689  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    690  1.1.2.2     snj 			if (!m)
    691  1.1.2.2     snj 				return;
    692  1.1.2.2     snj 		}
    693  1.1.2.2     snj 		ip6 = mtod(m, struct ip6_hdr *);
    694  1.1.2.2     snj 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    695  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    696  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    697  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
    698  1.1.2.2     snj 		else
    699  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
    700  1.1.2.2     snj #endif
    701  1.1.2.2     snj 		ip6->ip6_flow &= ~htonl(0xff << 20);
    702  1.1.2.2     snj 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
    703  1.1.2.2     snj 		break;
    704  1.1.2.2     snj 	    }
    705  1.1.2.2     snj #endif /* INET6 */
    706  1.1.2.2     snj 	default:
    707  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    708  1.1.2.2     snj 		m_freem(m);
    709  1.1.2.2     snj 		return;
    710  1.1.2.2     snj 	}
    711  1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    712  1.1.2.2     snj 
    713  1.1.2.2     snj 	return;
    714  1.1.2.2     snj }
    715  1.1.2.2     snj 
    716  1.1.2.2     snj /*
    717  1.1.2.2     snj  * validate and filter the pakcet
    718  1.1.2.2     snj  */
    719  1.1.2.2     snj static int
    720  1.1.2.2     snj ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var,
    721  1.1.2.2     snj     struct ifnet *ifp)
    722  1.1.2.2     snj {
    723  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    724  1.1.2.2     snj 
    725  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    726  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    727  1.1.2.2     snj 
    728  1.1.2.2     snj 	return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr);
    729  1.1.2.2     snj }
    730  1.1.2.2     snj 
    731  1.1.2.2     snj #ifdef INET6
    732  1.1.2.2     snj static int
    733  1.1.2.2     snj ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg)
    734  1.1.2.2     snj {
    735  1.1.2.2     snj 	struct mbuf *m = *mp;
    736  1.1.2.2     snj 	struct ifnet *ipsecp;
    737  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    738  1.1.2.2     snj 	struct ipsec_variant *var;
    739  1.1.2.2     snj 	struct ip6_hdr *ip6;
    740  1.1.2.2     snj 	int af = 0;
    741  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    742  1.1.2.2     snj 	u_int32_t otos;
    743  1.1.2.2     snj #endif
    744  1.1.2.2     snj 	struct psref psref_rcvif;
    745  1.1.2.2     snj 	struct psref psref_var;
    746  1.1.2.2     snj 	struct ifnet *rcvif;
    747  1.1.2.2     snj 
    748  1.1.2.2     snj 	KASSERT(eparg != NULL);
    749  1.1.2.2     snj 
    750  1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    751  1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    752  1.1.2.2     snj 		m_freem(m);
    753  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    754  1.1.2.2     snj 		return IPPROTO_DONE;
    755  1.1.2.2     snj 	}
    756  1.1.2.2     snj 
    757  1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    758  1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    759  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    760  1.1.2.2     snj 		m_freem(m);
    761  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    762  1.1.2.2     snj 		return IPPROTO_DONE;
    763  1.1.2.2     snj 	}
    764  1.1.2.2     snj 
    765  1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    766  1.1.2.2     snj 
    767  1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    768  1.1.2.2     snj 	if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) {
    769  1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    770  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    771  1.1.2.2     snj 		m_freem(m);
    772  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    773  1.1.2.2     snj 		return IPPROTO_DONE;
    774  1.1.2.2     snj 	}
    775  1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    776  1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    777  1.1.2.2     snj 
    778  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    779  1.1.2.2     snj 	otos = ip6->ip6_flow;
    780  1.1.2.2     snj #endif
    781  1.1.2.2     snj 	m_adj(m, *offp);
    782  1.1.2.2     snj 
    783  1.1.2.2     snj 	switch (proto) {
    784  1.1.2.2     snj #ifdef INET
    785  1.1.2.2     snj 	case IPPROTO_IPV4:
    786  1.1.2.2     snj 	    {
    787  1.1.2.2     snj 		af = AF_INET;
    788  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    789  1.1.2.2     snj 		struct ip *ip;
    790  1.1.2.2     snj 		u_int8_t otos8;
    791  1.1.2.2     snj 		otos8 = (ntohl(otos) >> 20) & 0xff;
    792  1.1.2.2     snj 
    793  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip))) {
    794  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    795  1.1.2.2     snj 			if (!m)
    796  1.1.2.2     snj 				return IPPROTO_DONE;
    797  1.1.2.2     snj 		}
    798  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    799  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    800  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
    801  1.1.2.2     snj 		else
    802  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
    803  1.1.2.2     snj #endif
    804  1.1.2.2     snj 		break;
    805  1.1.2.2     snj 	    }
    806  1.1.2.2     snj #endif /* INET */
    807  1.1.2.2     snj 	case IPPROTO_IPV6:
    808  1.1.2.2     snj 	    {
    809  1.1.2.2     snj 		af = AF_INET6;
    810  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    811  1.1.2.2     snj 		struct ip6_hdr *xip6;
    812  1.1.2.2     snj 
    813  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip6))) {
    814  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    815  1.1.2.2     snj 			if (!m)
    816  1.1.2.2     snj 				return IPPROTO_DONE;
    817  1.1.2.2     snj 		}
    818  1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    819  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    820  1.1.2.2     snj 			ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow);
    821  1.1.2.2     snj 		else
    822  1.1.2.2     snj 			ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow);
    823  1.1.2.2     snj 		break;
    824  1.1.2.2     snj #endif
    825  1.1.2.2     snj 	    }
    826  1.1.2.2     snj 	default:
    827  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    828  1.1.2.2     snj 		m_freem(m);
    829  1.1.2.2     snj 		return IPPROTO_DONE;
    830  1.1.2.2     snj 	}
    831  1.1.2.2     snj 
    832  1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    833  1.1.2.2     snj 	return IPPROTO_DONE;
    834  1.1.2.2     snj }
    835  1.1.2.2     snj 
    836  1.1.2.2     snj /*
    837  1.1.2.2     snj  * validate and filter the packet.
    838  1.1.2.2     snj  */
    839  1.1.2.2     snj static int
    840  1.1.2.2     snj ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var,
    841  1.1.2.2     snj     struct ifnet *ifp)
    842  1.1.2.2     snj {
    843  1.1.2.2     snj 	struct sockaddr_in6 *src, *dst;
    844  1.1.2.2     snj 
    845  1.1.2.2     snj 	src = satosin6(var->iv_psrc);
    846  1.1.2.2     snj 	dst = satosin6(var->iv_pdst);
    847  1.1.2.2     snj 
    848  1.1.2.2     snj 	return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr);
    849  1.1.2.2     snj }
    850  1.1.2.2     snj #endif /* INET6 */
    851  1.1.2.2     snj 
    852  1.1.2.2     snj int
    853  1.1.2.2     snj ipsecif4_attach(struct ipsec_variant *var)
    854  1.1.2.2     snj {
    855  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    856  1.1.2.2     snj 
    857  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    858  1.1.2.2     snj 
    859  1.1.2.2     snj 	if (var->iv_encap_cookie4 != NULL)
    860  1.1.2.2     snj 		return EALREADY;
    861  1.1.2.2     snj 	var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func,
    862  1.1.2.2     snj 	    &ipsecif4_encapsw, sc);
    863  1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    864  1.1.2.2     snj 		return EEXIST;
    865  1.1.2.2     snj 
    866  1.1.2.2     snj 	var->iv_output = ipsecif4_output;
    867  1.1.2.2     snj 	return 0;
    868  1.1.2.2     snj }
    869  1.1.2.2     snj 
    870  1.1.2.2     snj int
    871  1.1.2.2     snj ipsecif4_detach(struct ipsec_variant *var)
    872  1.1.2.2     snj {
    873  1.1.2.2     snj 	int error;
    874  1.1.2.2     snj 
    875  1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    876  1.1.2.2     snj 		return 0;
    877  1.1.2.2     snj 
    878  1.1.2.2     snj 	var->iv_output = NULL;
    879  1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie4);
    880  1.1.2.2     snj 	if (error == 0)
    881  1.1.2.2     snj 		var->iv_encap_cookie4 = NULL;
    882  1.1.2.2     snj 
    883  1.1.2.2     snj 	return error;
    884  1.1.2.2     snj }
    885  1.1.2.2     snj 
    886  1.1.2.2     snj #ifdef INET6
    887  1.1.2.2     snj int
    888  1.1.2.2     snj ipsecif6_attach(struct ipsec_variant *var)
    889  1.1.2.2     snj {
    890  1.1.2.2     snj 	struct sockaddr_in6 mask6;
    891  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    892  1.1.2.2     snj 
    893  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    894  1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 == NULL);
    895  1.1.2.2     snj 
    896  1.1.2.2     snj 	memset(&mask6, 0, sizeof(mask6));
    897  1.1.2.2     snj 	mask6.sin6_len = sizeof(struct sockaddr_in6);
    898  1.1.2.2     snj 	mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] =
    899  1.1.2.2     snj 	mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0;
    900  1.1.2.2     snj 
    901  1.1.2.6  martin 	var->iv_encap_cookie6 = encap_attach_func(AF_INET6, -1, if_ipsec_encap_func,
    902  1.1.2.2     snj 	    &ipsecif6_encapsw, sc);
    903  1.1.2.2     snj 	if (var->iv_encap_cookie6 == NULL)
    904  1.1.2.2     snj 		return EEXIST;
    905  1.1.2.2     snj 
    906  1.1.2.2     snj 	var->iv_output = ipsecif6_output;
    907  1.1.2.2     snj 	return 0;
    908  1.1.2.2     snj }
    909  1.1.2.2     snj 
    910  1.1.2.2     snj static void
    911  1.1.2.2     snj ipsecif6_rtcache_free_pc(void *p, void *arg __unused, struct cpu_info *ci __unused)
    912  1.1.2.2     snj {
    913  1.1.2.2     snj 	struct ipsec_ro *iro = p;
    914  1.1.2.2     snj 
    915  1.1.2.7  martin 	mutex_enter(iro->ir_lock);
    916  1.1.2.2     snj 	rtcache_free(&iro->ir_ro);
    917  1.1.2.7  martin 	mutex_exit(iro->ir_lock);
    918  1.1.2.2     snj }
    919  1.1.2.2     snj 
    920  1.1.2.2     snj int
    921  1.1.2.2     snj ipsecif6_detach(struct ipsec_variant *var)
    922  1.1.2.2     snj {
    923  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    924  1.1.2.2     snj 	int error;
    925  1.1.2.2     snj 
    926  1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 != NULL);
    927  1.1.2.2     snj 
    928  1.1.2.2     snj 	percpu_foreach(sc->ipsec_ro_percpu, ipsecif6_rtcache_free_pc, NULL);
    929  1.1.2.2     snj 
    930  1.1.2.2     snj 	var->iv_output = NULL;
    931  1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie6);
    932  1.1.2.2     snj 	if (error == 0)
    933  1.1.2.2     snj 		var->iv_encap_cookie6 = NULL;
    934  1.1.2.2     snj 	return error;
    935  1.1.2.2     snj }
    936  1.1.2.2     snj 
    937  1.1.2.2     snj void *
    938  1.1.2.2     snj ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg)
    939  1.1.2.2     snj {
    940  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    941  1.1.2.2     snj 	struct ip6ctlparam *ip6cp = NULL;
    942  1.1.2.2     snj 	struct ip6_hdr *ip6;
    943  1.1.2.2     snj 	const struct sockaddr_in6 *dst6;
    944  1.1.2.2     snj 	struct ipsec_ro *iro;
    945  1.1.2.2     snj 
    946  1.1.2.2     snj 	if (sa->sa_family != AF_INET6 ||
    947  1.1.2.2     snj 	    sa->sa_len != sizeof(struct sockaddr_in6))
    948  1.1.2.2     snj 		return NULL;
    949  1.1.2.2     snj 
    950  1.1.2.2     snj 	if ((unsigned)cmd >= PRC_NCMDS)
    951  1.1.2.2     snj 		return NULL;
    952  1.1.2.2     snj 	if (cmd == PRC_HOSTDEAD)
    953  1.1.2.2     snj 		d = NULL;
    954  1.1.2.2     snj 	else if (inet6ctlerrmap[cmd] == 0)
    955  1.1.2.2     snj 		return NULL;
    956  1.1.2.2     snj 
    957  1.1.2.2     snj 	/* if the parameter is from icmp6, decode it. */
    958  1.1.2.2     snj 	if (d != NULL) {
    959  1.1.2.2     snj 		ip6cp = (struct ip6ctlparam *)d;
    960  1.1.2.2     snj 		ip6 = ip6cp->ip6c_ip6;
    961  1.1.2.2     snj 	} else {
    962  1.1.2.2     snj 		ip6 = NULL;
    963  1.1.2.2     snj 	}
    964  1.1.2.2     snj 
    965  1.1.2.2     snj 	if (!ip6)
    966  1.1.2.2     snj 		return NULL;
    967  1.1.2.2     snj 
    968  1.1.2.2     snj 	iro = percpu_getref(sc->ipsec_ro_percpu);
    969  1.1.2.7  martin 	mutex_enter(iro->ir_lock);
    970  1.1.2.2     snj 	dst6 = satocsin6(rtcache_getdst(&iro->ir_ro));
    971  1.1.2.2     snj 	/* XXX scope */
    972  1.1.2.2     snj 	if (dst6 == NULL)
    973  1.1.2.2     snj 		;
    974  1.1.2.2     snj 	else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
    975  1.1.2.2     snj 		/* flush route cache */
    976  1.1.2.2     snj 		rtcache_free(&iro->ir_ro);
    977  1.1.2.2     snj 
    978  1.1.2.7  martin 	mutex_exit(iro->ir_lock);
    979  1.1.2.2     snj 	percpu_putref(sc->ipsec_ro_percpu);
    980  1.1.2.2     snj 
    981  1.1.2.2     snj 	return NULL;
    982  1.1.2.2     snj }
    983  1.1.2.2     snj 
    984  1.1.2.2     snj ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput)
    985  1.1.2.2     snj #define	ipsecif6_ctlinput	ipsecif6_ctlinput_wrapper
    986  1.1.2.2     snj 
    987  1.1.2.2     snj static const struct encapsw ipsecif6_encapsw = {
    988  1.1.2.2     snj 	.encapsw6 = {
    989  1.1.2.2     snj 		.pr_input = ipsecif6_input,
    990  1.1.2.2     snj 		.pr_ctlinput = ipsecif6_ctlinput,
    991  1.1.2.2     snj 	}
    992  1.1.2.2     snj };
    993  1.1.2.2     snj #endif /* INET6 */
    994