Home | History | Annotate | Line # | Download | only in netipsec
ipsecif.c revision 1.1.2.9 
      1  1.1.2.9  martin /*	$NetBSD: ipsecif.c,v 1.1.2.9 2019/09/24 18:27:09 martin Exp $  */
      2  1.1.2.2     snj 
      3  1.1.2.2     snj /*
      4  1.1.2.2     snj  * Copyright (c) 2017 Internet Initiative Japan Inc.
      5  1.1.2.2     snj  * All rights reserved.
      6  1.1.2.2     snj  *
      7  1.1.2.2     snj  * Redistribution and use in source and binary forms, with or without
      8  1.1.2.2     snj  * modification, are permitted provided that the following conditions
      9  1.1.2.2     snj  * are met:
     10  1.1.2.2     snj  * 1. Redistributions of source code must retain the above copyright
     11  1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer.
     12  1.1.2.2     snj  * 2. Redistributions in binary form must reproduce the above copyright
     13  1.1.2.2     snj  *    notice, this list of conditions and the following disclaimer in the
     14  1.1.2.2     snj  *    documentation and/or other materials provided with the distribution.
     15  1.1.2.2     snj  *
     16  1.1.2.2     snj  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17  1.1.2.2     snj  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18  1.1.2.2     snj  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19  1.1.2.2     snj  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20  1.1.2.2     snj  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21  1.1.2.2     snj  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22  1.1.2.2     snj  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23  1.1.2.2     snj  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24  1.1.2.2     snj  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25  1.1.2.2     snj  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26  1.1.2.2     snj  * POSSIBILITY OF SUCH DAMAGE.
     27  1.1.2.2     snj  */
     28  1.1.2.2     snj 
     29  1.1.2.2     snj #include <sys/cdefs.h>
     30  1.1.2.9  martin __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.1.2.9 2019/09/24 18:27:09 martin Exp $");
     31  1.1.2.2     snj 
     32  1.1.2.2     snj #ifdef _KERNEL_OPT
     33  1.1.2.2     snj #include "opt_inet.h"
     34  1.1.2.2     snj #include "opt_ipsec.h"
     35  1.1.2.2     snj #endif
     36  1.1.2.2     snj 
     37  1.1.2.2     snj #include <sys/param.h>
     38  1.1.2.2     snj #include <sys/systm.h>
     39  1.1.2.2     snj #include <sys/socket.h>
     40  1.1.2.2     snj #include <sys/sockio.h>
     41  1.1.2.2     snj #include <sys/mbuf.h>
     42  1.1.2.2     snj #include <sys/errno.h>
     43  1.1.2.2     snj #include <sys/ioctl.h>
     44  1.1.2.2     snj #include <sys/syslog.h>
     45  1.1.2.2     snj #include <sys/kernel.h>
     46  1.1.2.2     snj 
     47  1.1.2.2     snj #include <net/if.h>
     48  1.1.2.2     snj #include <net/route.h>
     49  1.1.2.2     snj 
     50  1.1.2.2     snj #include <netinet/in.h>
     51  1.1.2.2     snj #include <netinet/in_systm.h>
     52  1.1.2.2     snj #include <netinet/ip.h>
     53  1.1.2.2     snj #include <netinet/ip_var.h>
     54  1.1.2.2     snj #include <netinet/in_var.h>
     55  1.1.2.2     snj #include <netinet/ip_encap.h>
     56  1.1.2.2     snj #include <netinet/ip_ecn.h>
     57  1.1.2.2     snj #include <netinet/ip_private.h>
     58  1.1.2.2     snj #include <netinet/udp.h>
     59  1.1.2.2     snj 
     60  1.1.2.2     snj #ifdef INET6
     61  1.1.2.2     snj #include <netinet/ip6.h>
     62  1.1.2.2     snj #include <netinet6/ip6_var.h>
     63  1.1.2.2     snj #include <netinet6/ip6_private.h>
     64  1.1.2.2     snj #include <netinet6/in6_var.h>
     65  1.1.2.2     snj #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */
     66  1.1.2.2     snj #include <netinet/ip_ecn.h>
     67  1.1.2.2     snj #endif
     68  1.1.2.2     snj 
     69  1.1.2.2     snj #include <netipsec/key.h>
     70  1.1.2.2     snj #include <netipsec/ipsecif.h>
     71  1.1.2.2     snj 
     72  1.1.2.2     snj #include <net/if_ipsec.h>
     73  1.1.2.2     snj 
     74  1.1.2.9  martin static int ipsecif_set_natt_ports(struct ipsec_variant *, struct mbuf *);
     75  1.1.2.2     snj static void ipsecif4_input(struct mbuf *, int, int, void *);
     76  1.1.2.2     snj static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *);
     77  1.1.2.2     snj static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *,
     78  1.1.2.2     snj 	struct ifnet *);
     79  1.1.2.2     snj 
     80  1.1.2.2     snj #ifdef INET6
     81  1.1.2.2     snj static int ipsecif6_input(struct mbuf **, int *, int, void *);
     82  1.1.2.2     snj static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *);
     83  1.1.2.2     snj static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *,
     84  1.1.2.2     snj 	struct ifnet *);
     85  1.1.2.2     snj #endif
     86  1.1.2.2     snj 
     87  1.1.2.2     snj static int ip_ipsec_ttl = IPSEC_TTL;
     88  1.1.2.2     snj static int ip_ipsec_copy_tos = 0;
     89  1.1.2.2     snj #ifdef INET6
     90  1.1.2.2     snj static int ip6_ipsec_hlim = IPSEC_HLIM;
     91  1.1.2.2     snj static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */
     92  1.1.2.2     snj static int ip6_ipsec_copy_tos = 0;
     93  1.1.2.2     snj #endif
     94  1.1.2.2     snj 
     95  1.1.2.2     snj struct encapsw ipsecif4_encapsw = {
     96  1.1.2.2     snj 	.encapsw4 = {
     97  1.1.2.2     snj 		.pr_input = ipsecif4_input,
     98  1.1.2.2     snj 		.pr_ctlinput = NULL,
     99  1.1.2.2     snj 	}
    100  1.1.2.2     snj };
    101  1.1.2.2     snj 
    102  1.1.2.2     snj #ifdef INET6
    103  1.1.2.2     snj static const struct encapsw ipsecif6_encapsw;
    104  1.1.2.2     snj #endif
    105  1.1.2.2     snj 
    106  1.1.2.9  martin static int
    107  1.1.2.9  martin ipsecif_set_natt_ports(struct ipsec_variant *var, struct mbuf *m)
    108  1.1.2.9  martin {
    109  1.1.2.9  martin 
    110  1.1.2.9  martin 	KASSERT(if_ipsec_heldref_variant(var));
    111  1.1.2.9  martin 
    112  1.1.2.9  martin 	if (var->iv_sport || var->iv_dport) {
    113  1.1.2.9  martin 		struct m_tag *mtag;
    114  1.1.2.9  martin 
    115  1.1.2.9  martin 		mtag = m_tag_get(PACKET_TAG_IPSEC_NAT_T_PORTS,
    116  1.1.2.9  martin 		    sizeof(uint16_t) + sizeof(uint16_t), M_DONTWAIT);
    117  1.1.2.9  martin 		if (mtag) {
    118  1.1.2.9  martin 			uint16_t *natt_port;
    119  1.1.2.9  martin 
    120  1.1.2.9  martin 			natt_port = (uint16_t *)(mtag + 1);
    121  1.1.2.9  martin 			natt_port[0] = var->iv_dport;
    122  1.1.2.9  martin 			natt_port[1] = var->iv_sport;
    123  1.1.2.9  martin 			m_tag_prepend(m, mtag);
    124  1.1.2.9  martin 		} else {
    125  1.1.2.9  martin 			return ENOBUFS;
    126  1.1.2.9  martin 		}
    127  1.1.2.9  martin 	}
    128  1.1.2.9  martin 
    129  1.1.2.9  martin 	return 0;
    130  1.1.2.9  martin }
    131  1.1.2.9  martin 
    132  1.1.2.2     snj static struct mbuf *
    133  1.1.2.2     snj ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m,
    134  1.1.2.2     snj     uint8_t proto, uint8_t tos)
    135  1.1.2.2     snj {
    136  1.1.2.2     snj 	struct ip *ip;
    137  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    138  1.1.2.2     snj 
    139  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    140  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    141  1.1.2.2     snj 
    142  1.1.2.2     snj 	if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) ||
    143  1.1.2.2     snj 	    src->sin_addr.s_addr == INADDR_BROADCAST ||
    144  1.1.2.2     snj 	    dst->sin_addr.s_addr == INADDR_BROADCAST) {
    145  1.1.2.2     snj 		m_freem(m);
    146  1.1.2.2     snj 		return NULL;
    147  1.1.2.2     snj 	}
    148  1.1.2.2     snj 	m->m_flags &= ~M_BCAST;
    149  1.1.2.2     snj 
    150  1.1.2.2     snj 	if (IN_MULTICAST(src->sin_addr.s_addr) ||
    151  1.1.2.2     snj 	   IN_MULTICAST(dst->sin_addr.s_addr)) {
    152  1.1.2.2     snj 		m_freem(m);
    153  1.1.2.2     snj 		return NULL;
    154  1.1.2.2     snj 	}
    155  1.1.2.2     snj 
    156  1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    157  1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip)))
    158  1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip));
    159  1.1.2.2     snj 	if (m == NULL)
    160  1.1.2.2     snj 		return NULL;
    161  1.1.2.2     snj 
    162  1.1.2.2     snj 	ip = mtod(m, struct ip *);
    163  1.1.2.2     snj 	ip->ip_v = IPVERSION;
    164  1.1.2.2     snj 	ip->ip_off = htons(0);
    165  1.1.2.6  martin 	if (m->m_pkthdr.len < IP_MINFRAGSIZE)
    166  1.1.2.6  martin 		ip->ip_id = 0;
    167  1.1.2.6  martin 	else
    168  1.1.2.6  martin 		ip->ip_id = ip_newid(NULL);
    169  1.1.2.2     snj 	ip->ip_hl = sizeof(*ip) >> 2;
    170  1.1.2.2     snj 	if (ip_ipsec_copy_tos)
    171  1.1.2.2     snj 		ip->ip_tos = tos;
    172  1.1.2.2     snj 	else
    173  1.1.2.2     snj 		ip->ip_tos = 0;
    174  1.1.2.2     snj 	ip->ip_sum = 0;
    175  1.1.2.2     snj 	ip->ip_src = src->sin_addr;
    176  1.1.2.2     snj 	ip->ip_dst = dst->sin_addr;
    177  1.1.2.2     snj 	ip->ip_p = proto;
    178  1.1.2.2     snj 	ip->ip_ttl = ip_ipsec_ttl;
    179  1.1.2.2     snj 	ip->ip_len = htons(m->m_pkthdr.len);
    180  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    181  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    182  1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    183  1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
    184  1.1.2.2     snj 	else
    185  1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
    186  1.1.2.2     snj #endif
    187  1.1.2.2     snj 
    188  1.1.2.2     snj 	return m;
    189  1.1.2.2     snj }
    190  1.1.2.2     snj 
    191  1.1.2.2     snj static int
    192  1.1.2.2     snj ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr)
    193  1.1.2.2     snj {
    194  1.1.2.2     snj 	struct ip ip0;
    195  1.1.2.2     snj 	struct ip *ip;
    196  1.1.2.2     snj 	int mtu;
    197  1.1.2.2     snj 	struct secasvar *sav;
    198  1.1.2.2     snj 
    199  1.1.2.2     snj 	sav = key_lookup_sa_bysaidx(&isr->saidx);
    200  1.1.2.2     snj 	if (sav == NULL)
    201  1.1.2.2     snj 		return 0;
    202  1.1.2.2     snj 
    203  1.1.2.2     snj 	if (!(sav->natt_type & UDP_ENCAP_ESPINUDP) &&
    204  1.1.2.2     snj 	    !(sav->natt_type & UDP_ENCAP_ESPINUDP_NON_IKE)) {
    205  1.1.2.2     snj 		mtu = 0;
    206  1.1.2.2     snj 		goto out;
    207  1.1.2.2     snj 	}
    208  1.1.2.2     snj 
    209  1.1.2.2     snj 	if (m->m_len < sizeof(struct ip)) {
    210  1.1.2.2     snj 		m_copydata(m, 0, sizeof(ip0), &ip0);
    211  1.1.2.2     snj 		ip = &ip0;
    212  1.1.2.2     snj 
    213  1.1.2.2     snj 	} else {
    214  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    215  1.1.2.2     snj 	}
    216  1.1.2.2     snj 	mtu = sav->esp_frag;
    217  1.1.2.2     snj 	if (ntohs(ip->ip_len) <= mtu)
    218  1.1.2.2     snj 		mtu = 0;
    219  1.1.2.2     snj 
    220  1.1.2.2     snj out:
    221  1.1.2.2     snj 	KEY_SA_UNREF(&sav);
    222  1.1.2.2     snj 	return mtu;
    223  1.1.2.2     snj }
    224  1.1.2.2     snj 
    225  1.1.2.2     snj static struct mbuf *
    226  1.1.2.2     snj ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0)
    227  1.1.2.2     snj {
    228  1.1.2.2     snj 	const struct ip *ip;
    229  1.1.2.2     snj 	int proto;
    230  1.1.2.2     snj 	int tos;
    231  1.1.2.2     snj 
    232  1.1.2.2     snj 	KASSERT(proto0 != NULL);
    233  1.1.2.2     snj 	KASSERT(tos0 != NULL);
    234  1.1.2.2     snj 
    235  1.1.2.2     snj 	switch (family) {
    236  1.1.2.2     snj 	case AF_INET:
    237  1.1.2.2     snj 		proto = IPPROTO_IPV4;
    238  1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    239  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    240  1.1.2.2     snj 			if (!m) {
    241  1.1.2.2     snj 				*tos0 = 0;
    242  1.1.2.2     snj 				*proto0 = 0;
    243  1.1.2.2     snj 				return  NULL;
    244  1.1.2.2     snj 			}
    245  1.1.2.2     snj 		}
    246  1.1.2.2     snj 		ip = mtod(m, const struct ip *);
    247  1.1.2.2     snj 		tos = ip->ip_tos;
    248  1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    249  1.1.2.2     snj 		break;
    250  1.1.2.2     snj #ifdef INET6
    251  1.1.2.2     snj 	case AF_INET6: {
    252  1.1.2.2     snj 		const struct ip6_hdr *ip6;
    253  1.1.2.2     snj 		proto = IPPROTO_IPV6;
    254  1.1.2.2     snj 		if (m->m_len < sizeof(*ip6)) {
    255  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    256  1.1.2.2     snj 			if (!m) {
    257  1.1.2.2     snj 				*tos0 = 0;
    258  1.1.2.2     snj 				*proto0 = 0;
    259  1.1.2.2     snj 				return NULL;
    260  1.1.2.2     snj 			}
    261  1.1.2.2     snj 		}
    262  1.1.2.2     snj 		ip6 = mtod(m, const struct ip6_hdr *);
    263  1.1.2.2     snj 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    264  1.1.2.2     snj 		/* TODO: support ALTQ for innner packet */
    265  1.1.2.2     snj 		break;
    266  1.1.2.2     snj 	}
    267  1.1.2.2     snj #endif /* INET6 */
    268  1.1.2.2     snj 	default:
    269  1.1.2.2     snj 		*tos0 = 0;
    270  1.1.2.2     snj 		*proto0 = 0;
    271  1.1.2.2     snj 		return NULL;
    272  1.1.2.2     snj 	}
    273  1.1.2.2     snj 
    274  1.1.2.2     snj 	*proto0 = proto;
    275  1.1.2.2     snj 	*tos0 = tos;
    276  1.1.2.2     snj 	return m;
    277  1.1.2.2     snj }
    278  1.1.2.2     snj 
    279  1.1.2.2     snj static int
    280  1.1.2.2     snj ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu)
    281  1.1.2.2     snj {
    282  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    283  1.1.2.2     snj 	struct mbuf *next;
    284  1.1.2.2     snj 	struct m_tag *mtag;
    285  1.1.2.2     snj 	int error;
    286  1.1.2.2     snj 
    287  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    288  1.1.2.2     snj 
    289  1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    290  1.1.2.2     snj 	if (mtag)
    291  1.1.2.2     snj 		m_tag_delete(m, mtag);
    292  1.1.2.2     snj 
    293  1.1.2.4  martin 	/* consider new IP header prepended in ipsecif4_output() */
    294  1.1.2.4  martin 	if (mtu <= sizeof(struct ip)) {
    295  1.1.2.4  martin 		m_freem(m);
    296  1.1.2.4  martin 		return ENETUNREACH;
    297  1.1.2.4  martin 	}
    298  1.1.2.4  martin 	m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
    299  1.1.2.4  martin 	error = ip_fragment(m, ifp, mtu - sizeof(struct ip));
    300  1.1.2.2     snj 	if (error)
    301  1.1.2.2     snj 		return error;
    302  1.1.2.2     snj 
    303  1.1.2.2     snj 	for (error = 0; m; m = next) {
    304  1.1.2.2     snj 		next = m->m_nextpkt;
    305  1.1.2.3  martin 		m->m_nextpkt = NULL;
    306  1.1.2.2     snj 		if (error) {
    307  1.1.2.2     snj 			m_freem(m);
    308  1.1.2.2     snj 			continue;
    309  1.1.2.2     snj 		}
    310  1.1.2.2     snj 
    311  1.1.2.2     snj 		error = ipsecif4_output(var, family, m);
    312  1.1.2.2     snj 	}
    313  1.1.2.2     snj 	if (error == 0)
    314  1.1.2.2     snj 		IP_STATINC(IP_STAT_FRAGMENTED);
    315  1.1.2.2     snj 
    316  1.1.2.2     snj 	return error;
    317  1.1.2.2     snj }
    318  1.1.2.2     snj 
    319  1.1.2.2     snj int
    320  1.1.2.2     snj ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var)
    321  1.1.2.2     snj {
    322  1.1.2.2     snj 	struct m_tag *mtag;
    323  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    324  1.1.2.2     snj 	u_int16_t src_port = 0;
    325  1.1.2.2     snj 	u_int16_t dst_port = 0;
    326  1.1.2.2     snj 
    327  1.1.2.2     snj 	KASSERT(var != NULL);
    328  1.1.2.2     snj 
    329  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    330  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    331  1.1.2.2     snj 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    332  1.1.2.2     snj 	if (mtag) {
    333  1.1.2.2     snj 		u_int16_t *ports;
    334  1.1.2.2     snj 
    335  1.1.2.2     snj 		ports = (u_int16_t *)(mtag + 1);
    336  1.1.2.2     snj 		src_port = ports[0];
    337  1.1.2.2     snj 		dst_port = ports[1];
    338  1.1.2.2     snj 	}
    339  1.1.2.2     snj 
    340  1.1.2.2     snj 	/* address match */
    341  1.1.2.2     snj 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
    342  1.1.2.2     snj 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
    343  1.1.2.2     snj 		return 0;
    344  1.1.2.2     snj 
    345  1.1.2.2     snj 	/* UDP encap? */
    346  1.1.2.2     snj 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    347  1.1.2.2     snj 		goto match;
    348  1.1.2.2     snj 
    349  1.1.2.2     snj 	/* port match */
    350  1.1.2.2     snj 	if (src_port != var->iv_dport ||
    351  1.1.2.2     snj 	    dst_port != var->iv_sport) {
    352  1.1.2.2     snj #ifdef DEBUG
    353  1.1.2.2     snj 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    354  1.1.2.2     snj 		    __func__, ntohs(src_port), ntohs(dst_port),
    355  1.1.2.2     snj 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    356  1.1.2.2     snj #endif
    357  1.1.2.2     snj 		return 0;
    358  1.1.2.2     snj 	}
    359  1.1.2.2     snj 
    360  1.1.2.2     snj match:
    361  1.1.2.2     snj 	/*
    362  1.1.2.2     snj 	 * hide NAT-T information from encapsulated traffics.
    363  1.1.2.2     snj 	 * they don't know about IPsec.
    364  1.1.2.2     snj 	 */
    365  1.1.2.2     snj 	if (mtag)
    366  1.1.2.2     snj 		m_tag_delete(m, mtag);
    367  1.1.2.2     snj 	return sizeof(src->sin_addr) + sizeof(dst->sin_addr);
    368  1.1.2.2     snj }
    369  1.1.2.2     snj 
    370  1.1.2.2     snj static int
    371  1.1.2.2     snj ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m)
    372  1.1.2.2     snj {
    373  1.1.2.2     snj 	struct secpolicy *sp = NULL;
    374  1.1.2.2     snj 	u_int8_t tos;
    375  1.1.2.2     snj 	int proto;
    376  1.1.2.2     snj 	int error;
    377  1.1.2.2     snj 	int mtu;
    378  1.1.2.2     snj 	u_long sa_mtu = 0;
    379  1.1.2.2     snj 
    380  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    381  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    382  1.1.2.2     snj 	KASSERT(var->iv_psrc->sa_family == AF_INET);
    383  1.1.2.2     snj 	KASSERT(var->iv_pdst->sa_family == AF_INET);
    384  1.1.2.2     snj 
    385  1.1.2.2     snj 	sp = IV_SP_OUT(var);
    386  1.1.2.2     snj 	KASSERT(sp != NULL);
    387  1.1.2.2     snj 	/*
    388  1.1.2.2     snj 	 * The SPs in ipsec_variant are prevented from freed by
    389  1.1.2.2     snj 	 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here.
    390  1.1.2.2     snj 	 */
    391  1.1.2.2     snj 
    392  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_NONE);
    393  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_ENTRUST);
    394  1.1.2.2     snj 	KASSERT(sp->policy != IPSEC_POLICY_BYPASS);
    395  1.1.2.2     snj 	if(sp->policy != IPSEC_POLICY_IPSEC) {
    396  1.1.2.2     snj 		m_freem(m);
    397  1.1.2.9  martin 		error = ENETUNREACH;
    398  1.1.2.9  martin 		goto done;
    399  1.1.2.2     snj 	}
    400  1.1.2.2     snj 
    401  1.1.2.2     snj 	/* get flowinfo */
    402  1.1.2.2     snj 	m = ipsecif4_flowinfo(m, family, &proto, &tos);
    403  1.1.2.2     snj 	if (m == NULL) {
    404  1.1.2.2     snj 		error = ENETUNREACH;
    405  1.1.2.2     snj 		goto done;
    406  1.1.2.2     snj 	}
    407  1.1.2.2     snj 
    408  1.1.2.2     snj 	/* prepend new IP header */
    409  1.1.2.2     snj 	m = ipsecif4_prepend_hdr(var, m, proto, tos);
    410  1.1.2.2     snj 	if (m == NULL) {
    411  1.1.2.2     snj 		error = ENETUNREACH;
    412  1.1.2.2     snj 		goto done;
    413  1.1.2.2     snj 	}
    414  1.1.2.2     snj 
    415  1.1.2.2     snj 	/*
    416  1.1.2.2     snj 	 * Normal netipsec's NAT-T fragmentation is done in ip_output().
    417  1.1.2.2     snj 	 * See "natt_frag" processing.
    418  1.1.2.2     snj 	 * However, ipsec(4) interface's one is not done in the same way,
    419  1.1.2.2     snj 	 * so we must do NAT-T fragmentation by own code.
    420  1.1.2.2     snj 	 */
    421  1.1.2.2     snj 	/* NAT-T ESP fragmentation */
    422  1.1.2.2     snj 	mtu = ipsecif4_needfrag(m, sp->req);
    423  1.1.2.2     snj 	if (mtu > 0)
    424  1.1.2.2     snj 		return ipsecif4_fragout(var, family, m, mtu);
    425  1.1.2.2     snj 
    426  1.1.2.9  martin 	/* set NAT-T ports */
    427  1.1.2.9  martin 	error = ipsecif_set_natt_ports(var, m);
    428  1.1.2.9  martin 	if (error) {
    429  1.1.2.9  martin 		m_freem(m);
    430  1.1.2.9  martin 		goto done;
    431  1.1.2.9  martin 	}
    432  1.1.2.9  martin 
    433  1.1.2.2     snj 	/* IPsec output */
    434  1.1.2.2     snj 	IP_STATINC(IP_STAT_LOCALOUT);
    435  1.1.2.2     snj 	error = ipsec4_process_packet(m, sp->req, &sa_mtu);
    436  1.1.2.2     snj 	if (error == ENOENT)
    437  1.1.2.2     snj 		error = 0;
    438  1.1.2.2     snj 	/*
    439  1.1.2.2     snj 	 * frangmentation is already done in ipsecif4_fragout(),
    440  1.1.2.2     snj 	 * so ipsec4_process_packet() must not do fragmentation here.
    441  1.1.2.2     snj 	 */
    442  1.1.2.4  martin 	KASSERT(sa_mtu == 0);
    443  1.1.2.2     snj 
    444  1.1.2.2     snj done:
    445  1.1.2.2     snj 	return error;
    446  1.1.2.2     snj }
    447  1.1.2.2     snj 
    448  1.1.2.2     snj #ifdef INET6
    449  1.1.2.6  martin int
    450  1.1.2.6  martin ipsecif6_encap_func(struct mbuf *m, struct ip6_hdr *ip6, struct ipsec_variant *var)
    451  1.1.2.6  martin {
    452  1.1.2.6  martin 	struct m_tag *mtag;
    453  1.1.2.6  martin 	struct sockaddr_in6 *src, *dst;
    454  1.1.2.6  martin 	u_int16_t src_port = 0;
    455  1.1.2.6  martin 	u_int16_t dst_port = 0;
    456  1.1.2.6  martin 
    457  1.1.2.6  martin 	KASSERT(var != NULL);
    458  1.1.2.6  martin 
    459  1.1.2.6  martin 	src = satosin6(var->iv_psrc);
    460  1.1.2.6  martin 	dst = satosin6(var->iv_pdst);
    461  1.1.2.6  martin 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
    462  1.1.2.6  martin 	if (mtag) {
    463  1.1.2.6  martin 		u_int16_t *ports;
    464  1.1.2.6  martin 
    465  1.1.2.6  martin 		ports = (u_int16_t *)(mtag + 1);
    466  1.1.2.6  martin 		src_port = ports[0];
    467  1.1.2.6  martin 		dst_port = ports[1];
    468  1.1.2.6  martin 	}
    469  1.1.2.6  martin 
    470  1.1.2.6  martin 	/* address match */
    471  1.1.2.6  martin 	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
    472  1.1.2.6  martin 	    !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
    473  1.1.2.6  martin 		return 0;
    474  1.1.2.6  martin 
    475  1.1.2.6  martin 	/* UDP encap? */
    476  1.1.2.6  martin 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    477  1.1.2.6  martin 		goto match;
    478  1.1.2.6  martin 
    479  1.1.2.6  martin 	/* port match */
    480  1.1.2.6  martin 	if (src_port != var->iv_dport ||
    481  1.1.2.6  martin 	    dst_port != var->iv_sport) {
    482  1.1.2.6  martin #ifdef DEBUG
    483  1.1.2.6  martin 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    484  1.1.2.6  martin 		    __func__, ntohs(src_port), ntohs(dst_port),
    485  1.1.2.6  martin 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    486  1.1.2.6  martin #endif
    487  1.1.2.6  martin 		return 0;
    488  1.1.2.6  martin 	}
    489  1.1.2.6  martin 
    490  1.1.2.6  martin match:
    491  1.1.2.6  martin 	/*
    492  1.1.2.6  martin 	 * hide NAT-T information from encapsulated traffics.
    493  1.1.2.6  martin 	 * they don't know about IPsec.
    494  1.1.2.6  martin 	 */
    495  1.1.2.6  martin 	if (mtag)
    496  1.1.2.6  martin 		m_tag_delete(m, mtag);
    497  1.1.2.6  martin 	return sizeof(src->sin6_addr) + sizeof(dst->sin6_addr);
    498  1.1.2.6  martin }
    499  1.1.2.6  martin 
    500  1.1.2.2     snj static int
    501  1.1.2.2     snj ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m)
    502  1.1.2.2     snj {
    503  1.1.2.2     snj 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    504  1.1.2.2     snj 	struct ipsec_softc *sc = ifp->if_softc;
    505  1.1.2.9  martin 	struct route *ro_pc;
    506  1.1.2.9  martin 	kmutex_t *lock_pc;
    507  1.1.2.2     snj 	struct rtentry *rt;
    508  1.1.2.2     snj 	struct sockaddr_in6 *sin6_src;
    509  1.1.2.2     snj 	struct sockaddr_in6 *sin6_dst;
    510  1.1.2.2     snj 	struct ip6_hdr *ip6;
    511  1.1.2.2     snj 	int proto, error;
    512  1.1.2.2     snj 	u_int8_t itos, otos;
    513  1.1.2.2     snj 	union {
    514  1.1.2.2     snj 		struct sockaddr		dst;
    515  1.1.2.2     snj 		struct sockaddr_in6	dst6;
    516  1.1.2.2     snj 	} u;
    517  1.1.2.2     snj 
    518  1.1.2.2     snj 	KASSERT(if_ipsec_heldref_variant(var));
    519  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    520  1.1.2.2     snj 
    521  1.1.2.2     snj 	sin6_src = satosin6(var->iv_psrc);
    522  1.1.2.2     snj 	sin6_dst = satosin6(var->iv_pdst);
    523  1.1.2.2     snj 
    524  1.1.2.2     snj 	KASSERT(sin6_src->sin6_family == AF_INET6);
    525  1.1.2.2     snj 	KASSERT(sin6_dst->sin6_family == AF_INET6);
    526  1.1.2.2     snj 
    527  1.1.2.2     snj 	switch (family) {
    528  1.1.2.2     snj #ifdef INET
    529  1.1.2.2     snj 	case AF_INET:
    530  1.1.2.2     snj 	    {
    531  1.1.2.2     snj 		struct ip *ip;
    532  1.1.2.2     snj 
    533  1.1.2.2     snj 		proto = IPPROTO_IPV4;
    534  1.1.2.2     snj 		if (m->m_len < sizeof(*ip)) {
    535  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    536  1.1.2.2     snj 			if (!m)
    537  1.1.2.2     snj 				return ENOBUFS;
    538  1.1.2.2     snj 		}
    539  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    540  1.1.2.2     snj 		itos = ip->ip_tos;
    541  1.1.2.2     snj 		/*
    542  1.1.2.2     snj 		 * TODO:
    543  1.1.2.2     snj 		 *support ALTQ for innner packet
    544  1.1.2.2     snj 		 */
    545  1.1.2.2     snj 		break;
    546  1.1.2.2     snj 	    }
    547  1.1.2.2     snj #endif /* INET */
    548  1.1.2.2     snj 	case AF_INET6:
    549  1.1.2.2     snj 	    {
    550  1.1.2.2     snj 		struct ip6_hdr *xip6;
    551  1.1.2.2     snj 		proto = IPPROTO_IPV6;
    552  1.1.2.2     snj 		if (m->m_len < sizeof(*xip6)) {
    553  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    554  1.1.2.2     snj 			if (!m)
    555  1.1.2.2     snj 				return ENOBUFS;
    556  1.1.2.2     snj 		}
    557  1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    558  1.1.2.2     snj 		itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff;
    559  1.1.2.2     snj 		/* TODO:
    560  1.1.2.2     snj 		 * support ALTQ for innner packet
    561  1.1.2.2     snj 		 */
    562  1.1.2.2     snj 		break;
    563  1.1.2.2     snj 	    }
    564  1.1.2.2     snj 	default:
    565  1.1.2.2     snj 		m_freem(m);
    566  1.1.2.2     snj 		return EAFNOSUPPORT;
    567  1.1.2.2     snj 	}
    568  1.1.2.2     snj 
    569  1.1.2.2     snj 	/* prepend new IP header */
    570  1.1.2.2     snj 	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
    571  1.1.2.2     snj 	if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr)))
    572  1.1.2.2     snj 		m = m_pullup(m, sizeof(struct ip6_hdr));
    573  1.1.2.2     snj 	if (m == NULL)
    574  1.1.2.2     snj 		return ENOBUFS;
    575  1.1.2.2     snj 
    576  1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    577  1.1.2.2     snj 	ip6->ip6_flow	= 0;
    578  1.1.2.2     snj 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
    579  1.1.2.2     snj 	ip6->ip6_vfc	|= IPV6_VERSION;
    580  1.1.2.5  martin #if 0	/* ip6->ip6_plen will be filled by ip6_output */
    581  1.1.2.5  martin 	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len - sizeof(*ip6));
    582  1.1.2.5  martin #endif
    583  1.1.2.2     snj 	ip6->ip6_nxt	= proto;
    584  1.1.2.2     snj 	ip6->ip6_hlim	= ip6_ipsec_hlim;
    585  1.1.2.2     snj 	ip6->ip6_src	= sin6_src->sin6_addr;
    586  1.1.2.2     snj 	/* bidirectional configured tunnel mode */
    587  1.1.2.2     snj 	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
    588  1.1.2.2     snj 		ip6->ip6_dst = sin6_dst->sin6_addr;
    589  1.1.2.2     snj 	} else  {
    590  1.1.2.2     snj 		m_freem(m);
    591  1.1.2.2     snj 		return ENETUNREACH;
    592  1.1.2.2     snj 	}
    593  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    594  1.1.2.8  martin 	if (!ip6_ipsec_copy_tos)
    595  1.1.2.8  martin 		otos = 0;
    596  1.1.2.8  martin 
    597  1.1.2.2     snj 	if (ifp->if_flags & IFF_ECN)
    598  1.1.2.2     snj 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    599  1.1.2.2     snj 	else
    600  1.1.2.2     snj 		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
    601  1.1.2.2     snj #else
    602  1.1.2.2     snj 	if (ip6_ipsec_copy_tos)
    603  1.1.2.2     snj 		otos = itos;
    604  1.1.2.2     snj 	else
    605  1.1.2.2     snj 		otos = 0;
    606  1.1.2.2     snj #endif
    607  1.1.2.2     snj 	ip6->ip6_flow &= ~ntohl(0xff00000);
    608  1.1.2.2     snj 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
    609  1.1.2.2     snj 
    610  1.1.2.2     snj 	sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
    611  1.1.2.2     snj 
    612  1.1.2.9  martin 	if_tunnel_get_ro(sc->ipsec_ro_percpu, &ro_pc, &lock_pc);
    613  1.1.2.9  martin 	if ((rt = rtcache_lookup(ro_pc, &u.dst)) == NULL) {
    614  1.1.2.9  martin 		if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
    615  1.1.2.2     snj 		m_freem(m);
    616  1.1.2.2     snj 		return ENETUNREACH;
    617  1.1.2.2     snj 	}
    618  1.1.2.2     snj 
    619  1.1.2.2     snj 	if (rt->rt_ifp == ifp) {
    620  1.1.2.9  martin 		rtcache_unref(rt, ro_pc);
    621  1.1.2.9  martin 		rtcache_free(ro_pc);
    622  1.1.2.9  martin 		if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
    623  1.1.2.2     snj 		m_freem(m);
    624  1.1.2.2     snj 		return ENETUNREACH;
    625  1.1.2.2     snj 	}
    626  1.1.2.9  martin 	rtcache_unref(rt, ro_pc);
    627  1.1.2.9  martin 
    628  1.1.2.9  martin 	/* set NAT-T ports */
    629  1.1.2.9  martin 	error = ipsecif_set_natt_ports(var, m);
    630  1.1.2.9  martin 	if (error) {
    631  1.1.2.9  martin 		m_freem(m);
    632  1.1.2.9  martin 		goto out;
    633  1.1.2.9  martin 	}
    634  1.1.2.2     snj 
    635  1.1.2.2     snj 	/*
    636  1.1.2.2     snj 	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
    637  1.1.2.2     snj 	 * it is too painful to ask for resend of inner packet, to achieve
    638  1.1.2.2     snj 	 * path MTU discovery for encapsulated packets.
    639  1.1.2.2     snj 	 */
    640  1.1.2.9  martin 	error = ip6_output(m, 0, ro_pc,
    641  1.1.2.2     snj 	    ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL);
    642  1.1.2.2     snj 
    643  1.1.2.9  martin out:
    644  1.1.2.9  martin 	if (error)
    645  1.1.2.9  martin 		rtcache_free(ro_pc);
    646  1.1.2.9  martin 	if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
    647  1.1.2.2     snj 
    648  1.1.2.2     snj 	return error;
    649  1.1.2.2     snj }
    650  1.1.2.2     snj #endif /* INET6 */
    651  1.1.2.2     snj 
    652  1.1.2.2     snj static void
    653  1.1.2.2     snj ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg)
    654  1.1.2.2     snj {
    655  1.1.2.2     snj 	struct ifnet *ipsecp;
    656  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    657  1.1.2.2     snj 	struct ipsec_variant *var;
    658  1.1.2.2     snj 	const struct ip *ip;
    659  1.1.2.2     snj 	int af;
    660  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    661  1.1.2.2     snj 	u_int8_t otos;
    662  1.1.2.2     snj #endif
    663  1.1.2.2     snj 	struct psref psref_rcvif;
    664  1.1.2.2     snj 	struct psref psref_var;
    665  1.1.2.2     snj 	struct ifnet *rcvif;
    666  1.1.2.2     snj 
    667  1.1.2.2     snj 	KASSERT(sc != NULL);
    668  1.1.2.2     snj 
    669  1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    670  1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    671  1.1.2.2     snj 		m_freem(m);
    672  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    673  1.1.2.2     snj 		return;
    674  1.1.2.2     snj 	}
    675  1.1.2.2     snj 
    676  1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    677  1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    678  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    679  1.1.2.2     snj 		m_freem(m);
    680  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    681  1.1.2.2     snj 		return;
    682  1.1.2.2     snj 	}
    683  1.1.2.2     snj 
    684  1.1.2.2     snj 	ip = mtod(m, const struct ip *);
    685  1.1.2.2     snj 
    686  1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    687  1.1.2.2     snj 	if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) {
    688  1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    689  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    690  1.1.2.2     snj 		m_freem(m);
    691  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    692  1.1.2.2     snj 		return;
    693  1.1.2.2     snj 	}
    694  1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    695  1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    696  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    697  1.1.2.2     snj 	otos = ip->ip_tos;
    698  1.1.2.2     snj #endif
    699  1.1.2.2     snj 	m_adj(m, off);
    700  1.1.2.2     snj 
    701  1.1.2.2     snj 	switch (proto) {
    702  1.1.2.2     snj 	case IPPROTO_IPV4:
    703  1.1.2.2     snj 	    {
    704  1.1.2.2     snj 		struct ip *xip;
    705  1.1.2.2     snj 		af = AF_INET;
    706  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip))) {
    707  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip));
    708  1.1.2.2     snj 			if (!m)
    709  1.1.2.2     snj 				return;
    710  1.1.2.2     snj 		}
    711  1.1.2.2     snj 		xip = mtod(m, struct ip *);
    712  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    713  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    714  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
    715  1.1.2.2     snj 		else
    716  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
    717  1.1.2.2     snj #endif
    718  1.1.2.2     snj 		break;
    719  1.1.2.2     snj 	    }
    720  1.1.2.2     snj #ifdef INET6
    721  1.1.2.2     snj 	case IPPROTO_IPV6:
    722  1.1.2.2     snj 	    {
    723  1.1.2.2     snj 		struct ip6_hdr *ip6;
    724  1.1.2.2     snj 		u_int8_t itos;
    725  1.1.2.2     snj 		af = AF_INET6;
    726  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
    727  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip6));
    728  1.1.2.2     snj 			if (!m)
    729  1.1.2.2     snj 				return;
    730  1.1.2.2     snj 		}
    731  1.1.2.2     snj 		ip6 = mtod(m, struct ip6_hdr *);
    732  1.1.2.2     snj 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    733  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    734  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    735  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
    736  1.1.2.2     snj 		else
    737  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
    738  1.1.2.2     snj #endif
    739  1.1.2.2     snj 		ip6->ip6_flow &= ~htonl(0xff << 20);
    740  1.1.2.2     snj 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
    741  1.1.2.2     snj 		break;
    742  1.1.2.2     snj 	    }
    743  1.1.2.2     snj #endif /* INET6 */
    744  1.1.2.2     snj 	default:
    745  1.1.2.2     snj 		ip_statinc(IP_STAT_NOIPSEC);
    746  1.1.2.2     snj 		m_freem(m);
    747  1.1.2.2     snj 		return;
    748  1.1.2.2     snj 	}
    749  1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    750  1.1.2.2     snj 
    751  1.1.2.2     snj 	return;
    752  1.1.2.2     snj }
    753  1.1.2.2     snj 
    754  1.1.2.2     snj /*
    755  1.1.2.2     snj  * validate and filter the pakcet
    756  1.1.2.2     snj  */
    757  1.1.2.2     snj static int
    758  1.1.2.2     snj ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var,
    759  1.1.2.2     snj     struct ifnet *ifp)
    760  1.1.2.2     snj {
    761  1.1.2.2     snj 	struct sockaddr_in *src, *dst;
    762  1.1.2.2     snj 
    763  1.1.2.2     snj 	src = satosin(var->iv_psrc);
    764  1.1.2.2     snj 	dst = satosin(var->iv_pdst);
    765  1.1.2.2     snj 
    766  1.1.2.2     snj 	return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr);
    767  1.1.2.2     snj }
    768  1.1.2.2     snj 
    769  1.1.2.2     snj #ifdef INET6
    770  1.1.2.2     snj static int
    771  1.1.2.2     snj ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg)
    772  1.1.2.2     snj {
    773  1.1.2.2     snj 	struct mbuf *m = *mp;
    774  1.1.2.2     snj 	struct ifnet *ipsecp;
    775  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    776  1.1.2.2     snj 	struct ipsec_variant *var;
    777  1.1.2.2     snj 	struct ip6_hdr *ip6;
    778  1.1.2.2     snj 	int af = 0;
    779  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    780  1.1.2.2     snj 	u_int32_t otos;
    781  1.1.2.2     snj #endif
    782  1.1.2.2     snj 	struct psref psref_rcvif;
    783  1.1.2.2     snj 	struct psref psref_var;
    784  1.1.2.2     snj 	struct ifnet *rcvif;
    785  1.1.2.2     snj 
    786  1.1.2.2     snj 	KASSERT(eparg != NULL);
    787  1.1.2.2     snj 
    788  1.1.2.2     snj 	ipsecp = &sc->ipsec_if;
    789  1.1.2.2     snj 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    790  1.1.2.2     snj 		m_freem(m);
    791  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    792  1.1.2.2     snj 		return IPPROTO_DONE;
    793  1.1.2.2     snj 	}
    794  1.1.2.2     snj 
    795  1.1.2.2     snj 	var = if_ipsec_getref_variant(sc, &psref_var);
    796  1.1.2.2     snj 	if (if_ipsec_variant_is_unconfigured(var)) {
    797  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    798  1.1.2.2     snj 		m_freem(m);
    799  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    800  1.1.2.2     snj 		return IPPROTO_DONE;
    801  1.1.2.2     snj 	}
    802  1.1.2.2     snj 
    803  1.1.2.2     snj 	ip6 = mtod(m, struct ip6_hdr *);
    804  1.1.2.2     snj 
    805  1.1.2.2     snj 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    806  1.1.2.2     snj 	if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) {
    807  1.1.2.2     snj 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    808  1.1.2.2     snj 		if_ipsec_putref_variant(var, &psref_var);
    809  1.1.2.2     snj 		m_freem(m);
    810  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    811  1.1.2.2     snj 		return IPPROTO_DONE;
    812  1.1.2.2     snj 	}
    813  1.1.2.2     snj 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    814  1.1.2.2     snj 	if_ipsec_putref_variant(var, &psref_var);
    815  1.1.2.2     snj 
    816  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    817  1.1.2.2     snj 	otos = ip6->ip6_flow;
    818  1.1.2.2     snj #endif
    819  1.1.2.2     snj 	m_adj(m, *offp);
    820  1.1.2.2     snj 
    821  1.1.2.2     snj 	switch (proto) {
    822  1.1.2.2     snj #ifdef INET
    823  1.1.2.2     snj 	case IPPROTO_IPV4:
    824  1.1.2.2     snj 	    {
    825  1.1.2.2     snj 		af = AF_INET;
    826  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    827  1.1.2.2     snj 		struct ip *ip;
    828  1.1.2.2     snj 		u_int8_t otos8;
    829  1.1.2.2     snj 		otos8 = (ntohl(otos) >> 20) & 0xff;
    830  1.1.2.2     snj 
    831  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*ip))) {
    832  1.1.2.2     snj 			m = m_pullup(m, sizeof(*ip));
    833  1.1.2.2     snj 			if (!m)
    834  1.1.2.2     snj 				return IPPROTO_DONE;
    835  1.1.2.2     snj 		}
    836  1.1.2.2     snj 		ip = mtod(m, struct ip *);
    837  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    838  1.1.2.2     snj 			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
    839  1.1.2.2     snj 		else
    840  1.1.2.2     snj 			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
    841  1.1.2.2     snj #endif
    842  1.1.2.2     snj 		break;
    843  1.1.2.2     snj 	    }
    844  1.1.2.2     snj #endif /* INET */
    845  1.1.2.2     snj 	case IPPROTO_IPV6:
    846  1.1.2.2     snj 	    {
    847  1.1.2.2     snj 		af = AF_INET6;
    848  1.1.2.2     snj #ifndef IPSEC_TX_TOS_CLEAR
    849  1.1.2.2     snj 		struct ip6_hdr *xip6;
    850  1.1.2.2     snj 
    851  1.1.2.2     snj 		if (M_UNWRITABLE(m, sizeof(*xip6))) {
    852  1.1.2.2     snj 			m = m_pullup(m, sizeof(*xip6));
    853  1.1.2.2     snj 			if (!m)
    854  1.1.2.2     snj 				return IPPROTO_DONE;
    855  1.1.2.2     snj 		}
    856  1.1.2.2     snj 		xip6 = mtod(m, struct ip6_hdr *);
    857  1.1.2.2     snj 		if (ipsecp->if_flags & IFF_ECN)
    858  1.1.2.2     snj 			ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow);
    859  1.1.2.2     snj 		else
    860  1.1.2.2     snj 			ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow);
    861  1.1.2.2     snj 		break;
    862  1.1.2.2     snj #endif
    863  1.1.2.2     snj 	    }
    864  1.1.2.2     snj 	default:
    865  1.1.2.2     snj 		IP6_STATINC(IP6_STAT_NOIPSEC);
    866  1.1.2.2     snj 		m_freem(m);
    867  1.1.2.2     snj 		return IPPROTO_DONE;
    868  1.1.2.2     snj 	}
    869  1.1.2.2     snj 
    870  1.1.2.2     snj 	if_ipsec_input(m, af, ipsecp);
    871  1.1.2.2     snj 	return IPPROTO_DONE;
    872  1.1.2.2     snj }
    873  1.1.2.2     snj 
    874  1.1.2.2     snj /*
    875  1.1.2.2     snj  * validate and filter the packet.
    876  1.1.2.2     snj  */
    877  1.1.2.2     snj static int
    878  1.1.2.2     snj ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var,
    879  1.1.2.2     snj     struct ifnet *ifp)
    880  1.1.2.2     snj {
    881  1.1.2.2     snj 	struct sockaddr_in6 *src, *dst;
    882  1.1.2.2     snj 
    883  1.1.2.2     snj 	src = satosin6(var->iv_psrc);
    884  1.1.2.2     snj 	dst = satosin6(var->iv_pdst);
    885  1.1.2.2     snj 
    886  1.1.2.2     snj 	return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr);
    887  1.1.2.2     snj }
    888  1.1.2.2     snj #endif /* INET6 */
    889  1.1.2.2     snj 
    890  1.1.2.2     snj int
    891  1.1.2.2     snj ipsecif4_attach(struct ipsec_variant *var)
    892  1.1.2.2     snj {
    893  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    894  1.1.2.2     snj 
    895  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    896  1.1.2.2     snj 
    897  1.1.2.2     snj 	if (var->iv_encap_cookie4 != NULL)
    898  1.1.2.2     snj 		return EALREADY;
    899  1.1.2.2     snj 	var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func,
    900  1.1.2.2     snj 	    &ipsecif4_encapsw, sc);
    901  1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    902  1.1.2.2     snj 		return EEXIST;
    903  1.1.2.2     snj 
    904  1.1.2.2     snj 	var->iv_output = ipsecif4_output;
    905  1.1.2.2     snj 	return 0;
    906  1.1.2.2     snj }
    907  1.1.2.2     snj 
    908  1.1.2.2     snj int
    909  1.1.2.2     snj ipsecif4_detach(struct ipsec_variant *var)
    910  1.1.2.2     snj {
    911  1.1.2.2     snj 	int error;
    912  1.1.2.2     snj 
    913  1.1.2.2     snj 	if (var->iv_encap_cookie4 == NULL)
    914  1.1.2.2     snj 		return 0;
    915  1.1.2.2     snj 
    916  1.1.2.2     snj 	var->iv_output = NULL;
    917  1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie4);
    918  1.1.2.2     snj 	if (error == 0)
    919  1.1.2.2     snj 		var->iv_encap_cookie4 = NULL;
    920  1.1.2.2     snj 
    921  1.1.2.2     snj 	return error;
    922  1.1.2.2     snj }
    923  1.1.2.2     snj 
    924  1.1.2.2     snj #ifdef INET6
    925  1.1.2.2     snj int
    926  1.1.2.2     snj ipsecif6_attach(struct ipsec_variant *var)
    927  1.1.2.2     snj {
    928  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    929  1.1.2.2     snj 
    930  1.1.2.2     snj 	KASSERT(if_ipsec_variant_is_configured(var));
    931  1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 == NULL);
    932  1.1.2.2     snj 
    933  1.1.2.6  martin 	var->iv_encap_cookie6 = encap_attach_func(AF_INET6, -1, if_ipsec_encap_func,
    934  1.1.2.2     snj 	    &ipsecif6_encapsw, sc);
    935  1.1.2.2     snj 	if (var->iv_encap_cookie6 == NULL)
    936  1.1.2.2     snj 		return EEXIST;
    937  1.1.2.2     snj 
    938  1.1.2.2     snj 	var->iv_output = ipsecif6_output;
    939  1.1.2.2     snj 	return 0;
    940  1.1.2.2     snj }
    941  1.1.2.2     snj 
    942  1.1.2.2     snj int
    943  1.1.2.2     snj ipsecif6_detach(struct ipsec_variant *var)
    944  1.1.2.2     snj {
    945  1.1.2.2     snj 	struct ipsec_softc *sc = var->iv_softc;
    946  1.1.2.2     snj 	int error;
    947  1.1.2.2     snj 
    948  1.1.2.2     snj 	KASSERT(var->iv_encap_cookie6 != NULL);
    949  1.1.2.2     snj 
    950  1.1.2.9  martin 	if_tunnel_ro_percpu_rtcache_free(sc->ipsec_ro_percpu);
    951  1.1.2.2     snj 
    952  1.1.2.2     snj 	var->iv_output = NULL;
    953  1.1.2.2     snj 	error = encap_detach(var->iv_encap_cookie6);
    954  1.1.2.2     snj 	if (error == 0)
    955  1.1.2.2     snj 		var->iv_encap_cookie6 = NULL;
    956  1.1.2.2     snj 	return error;
    957  1.1.2.2     snj }
    958  1.1.2.2     snj 
    959  1.1.2.2     snj void *
    960  1.1.2.2     snj ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg)
    961  1.1.2.2     snj {
    962  1.1.2.2     snj 	struct ipsec_softc *sc = eparg;
    963  1.1.2.2     snj 	struct ip6ctlparam *ip6cp = NULL;
    964  1.1.2.2     snj 	struct ip6_hdr *ip6;
    965  1.1.2.2     snj 	const struct sockaddr_in6 *dst6;
    966  1.1.2.9  martin 	struct route *ro_pc;
    967  1.1.2.9  martin 	kmutex_t *lock_pc;
    968  1.1.2.2     snj 
    969  1.1.2.2     snj 	if (sa->sa_family != AF_INET6 ||
    970  1.1.2.2     snj 	    sa->sa_len != sizeof(struct sockaddr_in6))
    971  1.1.2.2     snj 		return NULL;
    972  1.1.2.2     snj 
    973  1.1.2.2     snj 	if ((unsigned)cmd >= PRC_NCMDS)
    974  1.1.2.2     snj 		return NULL;
    975  1.1.2.2     snj 	if (cmd == PRC_HOSTDEAD)
    976  1.1.2.2     snj 		d = NULL;
    977  1.1.2.2     snj 	else if (inet6ctlerrmap[cmd] == 0)
    978  1.1.2.2     snj 		return NULL;
    979  1.1.2.2     snj 
    980  1.1.2.2     snj 	/* if the parameter is from icmp6, decode it. */
    981  1.1.2.2     snj 	if (d != NULL) {
    982  1.1.2.2     snj 		ip6cp = (struct ip6ctlparam *)d;
    983  1.1.2.2     snj 		ip6 = ip6cp->ip6c_ip6;
    984  1.1.2.2     snj 	} else {
    985  1.1.2.2     snj 		ip6 = NULL;
    986  1.1.2.2     snj 	}
    987  1.1.2.2     snj 
    988  1.1.2.2     snj 	if (!ip6)
    989  1.1.2.2     snj 		return NULL;
    990  1.1.2.2     snj 
    991  1.1.2.9  martin 	if_tunnel_get_ro(sc->ipsec_ro_percpu, &ro_pc, &lock_pc);
    992  1.1.2.9  martin 	dst6 = satocsin6(rtcache_getdst(ro_pc));
    993  1.1.2.2     snj 	/* XXX scope */
    994  1.1.2.2     snj 	if (dst6 == NULL)
    995  1.1.2.2     snj 		;
    996  1.1.2.2     snj 	else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
    997  1.1.2.2     snj 		/* flush route cache */
    998  1.1.2.9  martin 		rtcache_free(ro_pc);
    999  1.1.2.2     snj 
   1000  1.1.2.9  martin 	if_tunnel_put_ro(sc->ipsec_ro_percpu, lock_pc);
   1001  1.1.2.2     snj 
   1002  1.1.2.2     snj 	return NULL;
   1003  1.1.2.2     snj }
   1004  1.1.2.2     snj 
   1005  1.1.2.2     snj ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput)
   1006  1.1.2.2     snj #define	ipsecif6_ctlinput	ipsecif6_ctlinput_wrapper
   1007  1.1.2.2     snj 
   1008  1.1.2.2     snj static const struct encapsw ipsecif6_encapsw = {
   1009  1.1.2.2     snj 	.encapsw6 = {
   1010  1.1.2.2     snj 		.pr_input = ipsecif6_input,
   1011  1.1.2.2     snj 		.pr_ctlinput = ipsecif6_ctlinput,
   1012  1.1.2.2     snj 	}
   1013  1.1.2.2     snj };
   1014  1.1.2.2     snj #endif /* INET6 */
   1015