Home | History | Annotate | Line # | Download | only in netipsec
ipsecif.c revision 1.11
      1 /*	$NetBSD: ipsecif.c,v 1.11 2018/11/15 10:23:56 maxv Exp $  */
      2 
      3 /*
      4  * Copyright (c) 2017 Internet Initiative Japan Inc.
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  *
     16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26  * POSSIBILITY OF SUCH DAMAGE.
     27  */
     28 
     29 #include <sys/cdefs.h>
     30 __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.11 2018/11/15 10:23:56 maxv Exp $");
     31 
     32 #ifdef _KERNEL_OPT
     33 #include "opt_inet.h"
     34 #include "opt_ipsec.h"
     35 #endif
     36 
     37 #include <sys/param.h>
     38 #include <sys/systm.h>
     39 #include <sys/socket.h>
     40 #include <sys/sockio.h>
     41 #include <sys/mbuf.h>
     42 #include <sys/errno.h>
     43 #include <sys/ioctl.h>
     44 #include <sys/syslog.h>
     45 #include <sys/kernel.h>
     46 
     47 #include <net/if.h>
     48 #include <net/route.h>
     49 
     50 #include <netinet/in.h>
     51 #include <netinet/in_systm.h>
     52 #include <netinet/ip.h>
     53 #include <netinet/ip_var.h>
     54 #include <netinet/in_var.h>
     55 #include <netinet/ip_encap.h>
     56 #include <netinet/ip_ecn.h>
     57 #include <netinet/ip_private.h>
     58 #include <netinet/udp.h>
     59 
     60 #ifdef INET6
     61 #include <netinet/ip6.h>
     62 #include <netinet6/ip6_var.h>
     63 #include <netinet6/ip6_private.h>
     64 #include <netinet6/in6_var.h>
     65 #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */
     66 #include <netinet/ip_ecn.h>
     67 #endif
     68 
     69 #include <netipsec/key.h>
     70 #include <netipsec/ipsecif.h>
     71 
     72 #include <net/if_ipsec.h>
     73 
     74 static void ipsecif4_input(struct mbuf *, int, int, void *);
     75 static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *);
     76 static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *,
     77 	struct ifnet *);
     78 
     79 #ifdef INET6
     80 static int ipsecif6_input(struct mbuf **, int *, int, void *);
     81 static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *);
     82 static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *,
     83 	struct ifnet *);
     84 #endif
     85 
     86 static int ip_ipsec_ttl = IPSEC_TTL;
     87 static int ip_ipsec_copy_tos = 0;
     88 #ifdef INET6
     89 static int ip6_ipsec_hlim = IPSEC_HLIM;
     90 static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */
     91 static int ip6_ipsec_copy_tos = 0;
     92 #endif
     93 
     94 static const struct encapsw ipsecif4_encapsw = {
     95 	.encapsw4 = {
     96 		.pr_input = ipsecif4_input,
     97 		.pr_ctlinput = NULL,
     98 	}
     99 };
    100 
    101 #ifdef INET6
    102 static const struct encapsw ipsecif6_encapsw;
    103 #endif
    104 
    105 static struct mbuf *
    106 ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m,
    107     uint8_t proto, uint8_t tos)
    108 {
    109 	struct ip *ip;
    110 	struct sockaddr_in *src, *dst;
    111 
    112 	src = satosin(var->iv_psrc);
    113 	dst = satosin(var->iv_pdst);
    114 
    115 	if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) ||
    116 	    src->sin_addr.s_addr == INADDR_BROADCAST ||
    117 	    dst->sin_addr.s_addr == INADDR_BROADCAST) {
    118 		m_freem(m);
    119 		return NULL;
    120 	}
    121 	m->m_flags &= ~M_BCAST;
    122 
    123 	if (IN_MULTICAST(src->sin_addr.s_addr) ||
    124 	    IN_MULTICAST(dst->sin_addr.s_addr)) {
    125 		m_freem(m);
    126 		return NULL;
    127 	}
    128 
    129 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    130 	if (m && M_UNWRITABLE(m, sizeof(struct ip)))
    131 		m = m_pullup(m, sizeof(struct ip));
    132 	if (m == NULL)
    133 		return NULL;
    134 
    135 	ip = mtod(m, struct ip *);
    136 	ip->ip_v = IPVERSION;
    137 	ip->ip_off = htons(0);
    138 	if (m->m_pkthdr.len < IP_MINFRAGSIZE)
    139 		ip->ip_id = 0;
    140 	else
    141 		ip->ip_id = ip_newid(NULL);
    142 	ip->ip_hl = sizeof(*ip) >> 2;
    143 	if (ip_ipsec_copy_tos)
    144 		ip->ip_tos = tos;
    145 	else
    146 		ip->ip_tos = 0;
    147 	ip->ip_sum = 0;
    148 	ip->ip_src = src->sin_addr;
    149 	ip->ip_dst = dst->sin_addr;
    150 	ip->ip_p = proto;
    151 	ip->ip_ttl = ip_ipsec_ttl;
    152 	ip->ip_len = htons(m->m_pkthdr.len);
    153 #ifndef IPSEC_TX_TOS_CLEAR
    154 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    155 	if (ifp->if_flags & IFF_ECN)
    156 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
    157 	else
    158 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
    159 #endif
    160 
    161 	return m;
    162 }
    163 
    164 static int
    165 ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr)
    166 {
    167 	struct ip ip0;
    168 	struct ip *ip;
    169 	int mtu;
    170 	struct secasvar *sav;
    171 
    172 	sav = key_lookup_sa_bysaidx(&isr->saidx);
    173 	if (sav == NULL)
    174 		return 0;
    175 
    176 	if (!(sav->natt_type & UDP_ENCAP_ESPINUDP)) {
    177 		mtu = 0;
    178 		goto out;
    179 	}
    180 
    181 	if (m->m_len < sizeof(struct ip)) {
    182 		m_copydata(m, 0, sizeof(ip0), &ip0);
    183 		ip = &ip0;
    184 	} else {
    185 		ip = mtod(m, struct ip *);
    186 	}
    187 	mtu = sav->esp_frag;
    188 	if (ntohs(ip->ip_len) <= mtu)
    189 		mtu = 0;
    190 
    191 out:
    192 	KEY_SA_UNREF(&sav);
    193 	return mtu;
    194 }
    195 
    196 static struct mbuf *
    197 ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0)
    198 {
    199 	const struct ip *ip;
    200 	int proto;
    201 	int tos;
    202 
    203 	KASSERT(proto0 != NULL);
    204 	KASSERT(tos0 != NULL);
    205 
    206 	switch (family) {
    207 	case AF_INET:
    208 		proto = IPPROTO_IPV4;
    209 		if (m->m_len < sizeof(*ip)) {
    210 			m = m_pullup(m, sizeof(*ip));
    211 			if (m == NULL) {
    212 				*tos0 = 0;
    213 				*proto0 = 0;
    214 				return NULL;
    215 			}
    216 		}
    217 		ip = mtod(m, const struct ip *);
    218 		tos = ip->ip_tos;
    219 		/* TODO: support ALTQ for innner packet */
    220 		break;
    221 #ifdef INET6
    222 	case AF_INET6: {
    223 		const struct ip6_hdr *ip6;
    224 		proto = IPPROTO_IPV6;
    225 		if (m->m_len < sizeof(*ip6)) {
    226 			m = m_pullup(m, sizeof(*ip6));
    227 			if (m == NULL) {
    228 				*tos0 = 0;
    229 				*proto0 = 0;
    230 				return NULL;
    231 			}
    232 		}
    233 		ip6 = mtod(m, const struct ip6_hdr *);
    234 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    235 		/* TODO: support ALTQ for innner packet */
    236 		break;
    237 	}
    238 #endif /* INET6 */
    239 	default:
    240 		*tos0 = 0;
    241 		*proto0 = 0;
    242 		return NULL;
    243 	}
    244 
    245 	*proto0 = proto;
    246 	*tos0 = tos;
    247 	return m;
    248 }
    249 
    250 static int
    251 ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu)
    252 {
    253 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    254 	struct mbuf *next;
    255 	struct m_tag *mtag;
    256 	int error;
    257 
    258 	KASSERT(if_ipsec_heldref_variant(var));
    259 
    260 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS);
    261 	if (mtag)
    262 		m_tag_delete(m, mtag);
    263 
    264 	/* consider new IP header prepended in ipsecif4_output() */
    265 	if (mtu <= sizeof(struct ip)) {
    266 		m_freem(m);
    267 		return ENETUNREACH;
    268 	}
    269 	m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
    270 	error = ip_fragment(m, ifp, mtu - sizeof(struct ip));
    271 	if (error)
    272 		return error;
    273 
    274 	for (error = 0; m; m = next) {
    275 		next = m->m_nextpkt;
    276 		m->m_nextpkt = NULL;
    277 		if (error) {
    278 			m_freem(m);
    279 			continue;
    280 		}
    281 
    282 		error = ipsecif4_output(var, family, m);
    283 	}
    284 	if (error == 0)
    285 		IP_STATINC(IP_STAT_FRAGMENTED);
    286 
    287 	return error;
    288 }
    289 
    290 int
    291 ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var)
    292 {
    293 	struct m_tag *mtag;
    294 	struct sockaddr_in *src, *dst;
    295 	u_int16_t src_port = 0;
    296 	u_int16_t dst_port = 0;
    297 
    298 	KASSERT(var != NULL);
    299 
    300 	src = satosin(var->iv_psrc);
    301 	dst = satosin(var->iv_pdst);
    302 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS);
    303 	if (mtag) {
    304 		u_int16_t *ports;
    305 
    306 		ports = (u_int16_t *)(mtag + 1);
    307 		src_port = ports[0];
    308 		dst_port = ports[1];
    309 	}
    310 
    311 	/* address match */
    312 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
    313 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
    314 		return 0;
    315 
    316 	/* UDP encap? */
    317 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    318 		goto match;
    319 
    320 	/* port match */
    321 	if (src_port != var->iv_dport ||
    322 	    dst_port != var->iv_sport) {
    323 #ifdef DEBUG
    324 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    325 		    __func__, ntohs(src_port), ntohs(dst_port),
    326 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    327 #endif
    328 		return 0;
    329 	}
    330 
    331 match:
    332 	/*
    333 	 * hide NAT-T information from encapsulated traffics.
    334 	 * they don't know about IPsec.
    335 	 */
    336 	if (mtag)
    337 		m_tag_delete(m, mtag);
    338 	return sizeof(src->sin_addr) + sizeof(dst->sin_addr);
    339 }
    340 
    341 static int
    342 ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m)
    343 {
    344 	struct secpolicy *sp = NULL;
    345 	u_int8_t tos;
    346 	int proto;
    347 	int error;
    348 	int mtu;
    349 	u_long sa_mtu = 0;
    350 
    351 	KASSERT(if_ipsec_heldref_variant(var));
    352 	KASSERT(if_ipsec_variant_is_configured(var));
    353 	KASSERT(var->iv_psrc->sa_family == AF_INET);
    354 	KASSERT(var->iv_pdst->sa_family == AF_INET);
    355 
    356 	sp = IV_SP_OUT(var);
    357 	KASSERT(sp != NULL);
    358 	/*
    359 	 * The SPs in ipsec_variant are prevented from freed by
    360 	 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here.
    361 	 */
    362 
    363 	KASSERT(sp->policy != IPSEC_POLICY_NONE);
    364 	KASSERT(sp->policy != IPSEC_POLICY_ENTRUST);
    365 	KASSERT(sp->policy != IPSEC_POLICY_BYPASS);
    366 	if (sp->policy != IPSEC_POLICY_IPSEC) {
    367 		struct ifnet *ifp = &var->iv_softc->ipsec_if;
    368 		m_freem(m);
    369 		IF_DROP(&ifp->if_snd);
    370 		return 0;
    371 	}
    372 
    373 	/* get flowinfo */
    374 	m = ipsecif4_flowinfo(m, family, &proto, &tos);
    375 	if (m == NULL) {
    376 		error = ENETUNREACH;
    377 		goto done;
    378 	}
    379 
    380 	/* prepend new IP header */
    381 	m = ipsecif4_prepend_hdr(var, m, proto, tos);
    382 	if (m == NULL) {
    383 		error = ENETUNREACH;
    384 		goto done;
    385 	}
    386 
    387 	/*
    388 	 * Normal netipsec's NAT-T fragmentation is done in ip_output().
    389 	 * See "natt_frag" processing.
    390 	 * However, ipsec(4) interface's one is not done in the same way,
    391 	 * so we must do NAT-T fragmentation by own code.
    392 	 */
    393 	/* NAT-T ESP fragmentation */
    394 	mtu = ipsecif4_needfrag(m, sp->req);
    395 	if (mtu > 0)
    396 		return ipsecif4_fragout(var, family, m, mtu);
    397 
    398 	/* IPsec output */
    399 	IP_STATINC(IP_STAT_LOCALOUT);
    400 	error = ipsec4_process_packet(m, sp->req, &sa_mtu);
    401 	if (error == ENOENT)
    402 		error = 0;
    403 	/*
    404 	 * frangmentation is already done in ipsecif4_fragout(),
    405 	 * so ipsec4_process_packet() must not do fragmentation here.
    406 	 */
    407 	KASSERT(sa_mtu == 0);
    408 
    409 done:
    410 	return error;
    411 }
    412 
    413 #ifdef INET6
    414 int
    415 ipsecif6_encap_func(struct mbuf *m, struct ip6_hdr *ip6, struct ipsec_variant *var)
    416 {
    417 	struct m_tag *mtag;
    418 	struct sockaddr_in6 *src, *dst;
    419 	u_int16_t src_port = 0;
    420 	u_int16_t dst_port = 0;
    421 
    422 	KASSERT(var != NULL);
    423 
    424 	src = satosin6(var->iv_psrc);
    425 	dst = satosin6(var->iv_pdst);
    426 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS);
    427 	if (mtag) {
    428 		u_int16_t *ports;
    429 
    430 		ports = (u_int16_t *)(mtag + 1);
    431 		src_port = ports[0];
    432 		dst_port = ports[1];
    433 	}
    434 
    435 	/* address match */
    436 	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
    437 	    !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
    438 		return 0;
    439 
    440 	/* UDP encap? */
    441 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
    442 		goto match;
    443 
    444 	/* port match */
    445 	if (src_port != var->iv_dport ||
    446 	    dst_port != var->iv_sport) {
    447 #ifdef DEBUG
    448 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
    449 		    __func__, ntohs(src_port), ntohs(dst_port),
    450 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
    451 #endif
    452 		return 0;
    453 	}
    454 
    455 match:
    456 	/*
    457 	 * hide NAT-T information from encapsulated traffics.
    458 	 * they don't know about IPsec.
    459 	 */
    460 	if (mtag)
    461 		m_tag_delete(m, mtag);
    462 	return sizeof(src->sin6_addr) + sizeof(dst->sin6_addr);
    463 }
    464 
    465 static int
    466 ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m)
    467 {
    468 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
    469 	struct ipsec_softc *sc = ifp->if_softc;
    470 	struct ipsec_ro *iro;
    471 	struct rtentry *rt;
    472 	struct sockaddr_in6 *sin6_src;
    473 	struct sockaddr_in6 *sin6_dst;
    474 	struct ip6_hdr *ip6;
    475 	int proto, error;
    476 	u_int8_t itos, otos;
    477 	union {
    478 		struct sockaddr		dst;
    479 		struct sockaddr_in6	dst6;
    480 	} u;
    481 
    482 	KASSERT(if_ipsec_heldref_variant(var));
    483 	KASSERT(if_ipsec_variant_is_configured(var));
    484 
    485 	sin6_src = satosin6(var->iv_psrc);
    486 	sin6_dst = satosin6(var->iv_pdst);
    487 
    488 	KASSERT(sin6_src->sin6_family == AF_INET6);
    489 	KASSERT(sin6_dst->sin6_family == AF_INET6);
    490 
    491 	switch (family) {
    492 #ifdef INET
    493 	case AF_INET:
    494 	    {
    495 		struct ip *ip;
    496 
    497 		proto = IPPROTO_IPV4;
    498 		if (m->m_len < sizeof(*ip)) {
    499 			m = m_pullup(m, sizeof(*ip));
    500 			if (m == NULL)
    501 				return ENOBUFS;
    502 		}
    503 		ip = mtod(m, struct ip *);
    504 		itos = ip->ip_tos;
    505 		/* TODO: support ALTQ for innner packet */
    506 		break;
    507 	    }
    508 #endif /* INET */
    509 	case AF_INET6:
    510 	    {
    511 		struct ip6_hdr *xip6;
    512 		proto = IPPROTO_IPV6;
    513 		if (m->m_len < sizeof(*xip6)) {
    514 			m = m_pullup(m, sizeof(*xip6));
    515 			if (m == NULL)
    516 				return ENOBUFS;
    517 		}
    518 		xip6 = mtod(m, struct ip6_hdr *);
    519 		itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff;
    520 		/* TODO: support ALTQ for innner packet */
    521 		break;
    522 	    }
    523 	default:
    524 		m_freem(m);
    525 		return EAFNOSUPPORT;
    526 	}
    527 
    528 	/* prepend new IP header */
    529 	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
    530 	if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr)))
    531 		m = m_pullup(m, sizeof(struct ip6_hdr));
    532 	if (m == NULL)
    533 		return ENOBUFS;
    534 
    535 	ip6 = mtod(m, struct ip6_hdr *);
    536 	ip6->ip6_flow	= 0;
    537 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
    538 	ip6->ip6_vfc	|= IPV6_VERSION;
    539 #if 0	/* ip6->ip6_plen will be filled by ip6_output */
    540 	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len - sizeof(*ip6));
    541 #endif
    542 	ip6->ip6_nxt	= proto;
    543 	ip6->ip6_hlim	= ip6_ipsec_hlim;
    544 	ip6->ip6_src	= sin6_src->sin6_addr;
    545 	/* bidirectional configured tunnel mode */
    546 	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
    547 		ip6->ip6_dst = sin6_dst->sin6_addr;
    548 	} else  {
    549 		m_freem(m);
    550 		return ENETUNREACH;
    551 	}
    552 #ifndef IPSEC_TX_TOS_CLEAR
    553 	if (ifp->if_flags & IFF_ECN)
    554 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    555 	else
    556 		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
    557 
    558 	if (!ip6_ipsec_copy_tos)
    559 		otos = 0;
    560 #else
    561 	if (ip6_ipsec_copy_tos)
    562 		otos = itos;
    563 	else
    564 		otos = 0;
    565 #endif
    566 	ip6->ip6_flow &= ~ntohl(0xff00000);
    567 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
    568 
    569 	sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
    570 
    571 	iro = percpu_getref(sc->ipsec_ro_percpu);
    572 	mutex_enter(iro->ir_lock);
    573 	if ((rt = rtcache_lookup(&iro->ir_ro, &u.dst)) == NULL) {
    574 		mutex_exit(iro->ir_lock);
    575 		percpu_putref(sc->ipsec_ro_percpu);
    576 		m_freem(m);
    577 		return ENETUNREACH;
    578 	}
    579 
    580 	if (rt->rt_ifp == ifp) {
    581 		rtcache_unref(rt, &iro->ir_ro);
    582 		rtcache_free(&iro->ir_ro);
    583 		mutex_exit(iro->ir_lock);
    584 		percpu_putref(sc->ipsec_ro_percpu);
    585 		m_freem(m);
    586 		return ENETUNREACH;
    587 	}
    588 	rtcache_unref(rt, &iro->ir_ro);
    589 
    590 	/*
    591 	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
    592 	 * it is too painful to ask for resend of inner packet, to achieve
    593 	 * path MTU discovery for encapsulated packets.
    594 	 */
    595 	error = ip6_output(m, 0, &iro->ir_ro,
    596 	    ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL);
    597 	if (error)
    598 		rtcache_free(&iro->ir_ro);
    599 
    600 	mutex_exit(iro->ir_lock);
    601 	percpu_putref(sc->ipsec_ro_percpu);
    602 
    603 	return error;
    604 }
    605 #endif /* INET6 */
    606 
    607 static void
    608 ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg)
    609 {
    610 	struct ifnet *ipsecp;
    611 	struct ipsec_softc *sc = eparg;
    612 	struct ipsec_variant *var;
    613 	const struct ip *ip;
    614 	int af;
    615 #ifndef IPSEC_TX_TOS_CLEAR
    616 	u_int8_t otos;
    617 #endif
    618 	struct psref psref_rcvif;
    619 	struct psref psref_var;
    620 	struct ifnet *rcvif;
    621 
    622 	KASSERT(sc != NULL);
    623 
    624 	ipsecp = &sc->ipsec_if;
    625 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    626 		m_freem(m);
    627 		ip_statinc(IP_STAT_NOIPSEC);
    628 		return;
    629 	}
    630 
    631 	var = if_ipsec_getref_variant(sc, &psref_var);
    632 	if (if_ipsec_variant_is_unconfigured(var)) {
    633 		if_ipsec_putref_variant(var, &psref_var);
    634 		m_freem(m);
    635 		ip_statinc(IP_STAT_NOIPSEC);
    636 		return;
    637 	}
    638 
    639 	ip = mtod(m, const struct ip *);
    640 
    641 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    642 	if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) {
    643 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    644 		if_ipsec_putref_variant(var, &psref_var);
    645 		m_freem(m);
    646 		ip_statinc(IP_STAT_NOIPSEC);
    647 		return;
    648 	}
    649 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    650 	if_ipsec_putref_variant(var, &psref_var);
    651 #ifndef IPSEC_TX_TOS_CLEAR
    652 	otos = ip->ip_tos;
    653 #endif
    654 	m_adj(m, off);
    655 
    656 	switch (proto) {
    657 	case IPPROTO_IPV4:
    658 	    {
    659 		struct ip *xip;
    660 		af = AF_INET;
    661 		if (M_UNWRITABLE(m, sizeof(*xip))) {
    662 			m = m_pullup(m, sizeof(*xip));
    663 			if (m == NULL)
    664 				return;
    665 		}
    666 		xip = mtod(m, struct ip *);
    667 #ifndef IPSEC_TX_TOS_CLEAR
    668 		if (ipsecp->if_flags & IFF_ECN)
    669 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
    670 		else
    671 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
    672 #endif
    673 		break;
    674 	    }
    675 #ifdef INET6
    676 	case IPPROTO_IPV6:
    677 	    {
    678 		struct ip6_hdr *ip6;
    679 		u_int8_t itos;
    680 		af = AF_INET6;
    681 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
    682 			m = m_pullup(m, sizeof(*ip6));
    683 			if (m == NULL)
    684 				return;
    685 		}
    686 		ip6 = mtod(m, struct ip6_hdr *);
    687 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    688 #ifndef IPSEC_TX_TOS_CLEAR
    689 		if (ipsecp->if_flags & IFF_ECN)
    690 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
    691 		else
    692 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
    693 #endif
    694 		ip6->ip6_flow &= ~htonl(0xff << 20);
    695 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
    696 		break;
    697 	    }
    698 #endif /* INET6 */
    699 	default:
    700 		ip_statinc(IP_STAT_NOIPSEC);
    701 		m_freem(m);
    702 		return;
    703 	}
    704 	if_ipsec_input(m, af, ipsecp);
    705 
    706 	return;
    707 }
    708 
    709 /*
    710  * validate and filter the pakcet
    711  */
    712 static int
    713 ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var,
    714     struct ifnet *ifp)
    715 {
    716 	struct sockaddr_in *src, *dst;
    717 
    718 	src = satosin(var->iv_psrc);
    719 	dst = satosin(var->iv_pdst);
    720 
    721 	return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr);
    722 }
    723 
    724 #ifdef INET6
    725 static int
    726 ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg)
    727 {
    728 	struct mbuf *m = *mp;
    729 	struct ifnet *ipsecp;
    730 	struct ipsec_softc *sc = eparg;
    731 	struct ipsec_variant *var;
    732 	struct ip6_hdr *ip6;
    733 	int af = 0;
    734 #ifndef IPSEC_TX_TOS_CLEAR
    735 	u_int32_t otos;
    736 #endif
    737 	struct psref psref_rcvif;
    738 	struct psref psref_var;
    739 	struct ifnet *rcvif;
    740 
    741 	KASSERT(eparg != NULL);
    742 
    743 	ipsecp = &sc->ipsec_if;
    744 	if ((ipsecp->if_flags & IFF_UP) == 0) {
    745 		m_freem(m);
    746 		IP6_STATINC(IP6_STAT_NOIPSEC);
    747 		return IPPROTO_DONE;
    748 	}
    749 
    750 	var = if_ipsec_getref_variant(sc, &psref_var);
    751 	if (if_ipsec_variant_is_unconfigured(var)) {
    752 		if_ipsec_putref_variant(var, &psref_var);
    753 		m_freem(m);
    754 		IP6_STATINC(IP6_STAT_NOIPSEC);
    755 		return IPPROTO_DONE;
    756 	}
    757 
    758 	ip6 = mtod(m, struct ip6_hdr *);
    759 
    760 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
    761 	if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) {
    762 		m_put_rcvif_psref(rcvif, &psref_rcvif);
    763 		if_ipsec_putref_variant(var, &psref_var);
    764 		m_freem(m);
    765 		IP6_STATINC(IP6_STAT_NOIPSEC);
    766 		return IPPROTO_DONE;
    767 	}
    768 	m_put_rcvif_psref(rcvif, &psref_rcvif);
    769 	if_ipsec_putref_variant(var, &psref_var);
    770 
    771 #ifndef IPSEC_TX_TOS_CLEAR
    772 	otos = ip6->ip6_flow;
    773 #endif
    774 	m_adj(m, *offp);
    775 
    776 	switch (proto) {
    777 #ifdef INET
    778 	case IPPROTO_IPV4:
    779 	    {
    780 		af = AF_INET;
    781 #ifndef IPSEC_TX_TOS_CLEAR
    782 		struct ip *ip;
    783 		u_int8_t otos8;
    784 		otos8 = (ntohl(otos) >> 20) & 0xff;
    785 
    786 		if (M_UNWRITABLE(m, sizeof(*ip))) {
    787 			m = m_pullup(m, sizeof(*ip));
    788 			if (m == NULL)
    789 				return IPPROTO_DONE;
    790 		}
    791 		ip = mtod(m, struct ip *);
    792 		if (ipsecp->if_flags & IFF_ECN)
    793 			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
    794 		else
    795 			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
    796 #endif
    797 		break;
    798 	    }
    799 #endif /* INET */
    800 	case IPPROTO_IPV6:
    801 	    {
    802 		af = AF_INET6;
    803 #ifndef IPSEC_TX_TOS_CLEAR
    804 		struct ip6_hdr *xip6;
    805 
    806 		if (M_UNWRITABLE(m, sizeof(*xip6))) {
    807 			m = m_pullup(m, sizeof(*xip6));
    808 			if (m == NULL)
    809 				return IPPROTO_DONE;
    810 		}
    811 		xip6 = mtod(m, struct ip6_hdr *);
    812 		if (ipsecp->if_flags & IFF_ECN)
    813 			ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow);
    814 		else
    815 			ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow);
    816 		break;
    817 #endif
    818 	    }
    819 	default:
    820 		IP6_STATINC(IP6_STAT_NOIPSEC);
    821 		m_freem(m);
    822 		return IPPROTO_DONE;
    823 	}
    824 
    825 	if_ipsec_input(m, af, ipsecp);
    826 	return IPPROTO_DONE;
    827 }
    828 
    829 /*
    830  * validate and filter the packet.
    831  */
    832 static int
    833 ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var,
    834     struct ifnet *ifp)
    835 {
    836 	struct sockaddr_in6 *src, *dst;
    837 
    838 	src = satosin6(var->iv_psrc);
    839 	dst = satosin6(var->iv_pdst);
    840 
    841 	return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr);
    842 }
    843 #endif /* INET6 */
    844 
    845 int
    846 ipsecif4_attach(struct ipsec_variant *var)
    847 {
    848 	struct ipsec_softc *sc = var->iv_softc;
    849 
    850 	KASSERT(if_ipsec_variant_is_configured(var));
    851 
    852 	if (var->iv_encap_cookie4 != NULL)
    853 		return EALREADY;
    854 	var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func,
    855 	    &ipsecif4_encapsw, sc);
    856 	if (var->iv_encap_cookie4 == NULL)
    857 		return EEXIST;
    858 
    859 	var->iv_output = ipsecif4_output;
    860 	return 0;
    861 }
    862 
    863 int
    864 ipsecif4_detach(struct ipsec_variant *var)
    865 {
    866 	int error;
    867 
    868 	if (var->iv_encap_cookie4 == NULL)
    869 		return 0;
    870 
    871 	var->iv_output = NULL;
    872 	error = encap_detach(var->iv_encap_cookie4);
    873 	if (error == 0)
    874 		var->iv_encap_cookie4 = NULL;
    875 
    876 	return error;
    877 }
    878 
    879 #ifdef INET6
    880 int
    881 ipsecif6_attach(struct ipsec_variant *var)
    882 {
    883 	struct sockaddr_in6 mask6;
    884 	struct ipsec_softc *sc = var->iv_softc;
    885 
    886 	KASSERT(if_ipsec_variant_is_configured(var));
    887 	KASSERT(var->iv_encap_cookie6 == NULL);
    888 
    889 	memset(&mask6, 0, sizeof(mask6));
    890 	mask6.sin6_len = sizeof(struct sockaddr_in6);
    891 	mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] =
    892 	mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0;
    893 
    894 	var->iv_encap_cookie6 = encap_attach_func(AF_INET6, -1, if_ipsec_encap_func,
    895 	    &ipsecif6_encapsw, sc);
    896 	if (var->iv_encap_cookie6 == NULL)
    897 		return EEXIST;
    898 
    899 	var->iv_output = ipsecif6_output;
    900 	return 0;
    901 }
    902 
    903 static void
    904 ipsecif6_rtcache_free_pc(void *p, void *arg __unused, struct cpu_info *ci __unused)
    905 {
    906 	struct ipsec_ro *iro = p;
    907 
    908 	mutex_enter(iro->ir_lock);
    909 	rtcache_free(&iro->ir_ro);
    910 	mutex_exit(iro->ir_lock);
    911 }
    912 
    913 int
    914 ipsecif6_detach(struct ipsec_variant *var)
    915 {
    916 	struct ipsec_softc *sc = var->iv_softc;
    917 	int error;
    918 
    919 	KASSERT(var->iv_encap_cookie6 != NULL);
    920 
    921 	percpu_foreach(sc->ipsec_ro_percpu, ipsecif6_rtcache_free_pc, NULL);
    922 
    923 	var->iv_output = NULL;
    924 	error = encap_detach(var->iv_encap_cookie6);
    925 	if (error == 0)
    926 		var->iv_encap_cookie6 = NULL;
    927 	return error;
    928 }
    929 
    930 void *
    931 ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg)
    932 {
    933 	struct ipsec_softc *sc = eparg;
    934 	struct ip6ctlparam *ip6cp = NULL;
    935 	struct ip6_hdr *ip6;
    936 	const struct sockaddr_in6 *dst6;
    937 	struct ipsec_ro *iro;
    938 
    939 	if (sa->sa_family != AF_INET6 ||
    940 	    sa->sa_len != sizeof(struct sockaddr_in6))
    941 		return NULL;
    942 
    943 	if ((unsigned)cmd >= PRC_NCMDS)
    944 		return NULL;
    945 	if (cmd == PRC_HOSTDEAD)
    946 		d = NULL;
    947 	else if (inet6ctlerrmap[cmd] == 0)
    948 		return NULL;
    949 
    950 	/* if the parameter is from icmp6, decode it. */
    951 	if (d != NULL) {
    952 		ip6cp = (struct ip6ctlparam *)d;
    953 		ip6 = ip6cp->ip6c_ip6;
    954 	} else {
    955 		ip6 = NULL;
    956 	}
    957 
    958 	if (!ip6)
    959 		return NULL;
    960 
    961 	iro = percpu_getref(sc->ipsec_ro_percpu);
    962 	mutex_enter(iro->ir_lock);
    963 	dst6 = satocsin6(rtcache_getdst(&iro->ir_ro));
    964 	/* XXX scope */
    965 	if (dst6 == NULL)
    966 		;
    967 	else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
    968 		/* flush route cache */
    969 		rtcache_free(&iro->ir_ro);
    970 
    971 	mutex_exit(iro->ir_lock);
    972 	percpu_putref(sc->ipsec_ro_percpu);
    973 
    974 	return NULL;
    975 }
    976 
    977 ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput)
    978 #define	ipsecif6_ctlinput	ipsecif6_ctlinput_wrapper
    979 
    980 static const struct encapsw ipsecif6_encapsw = {
    981 	.encapsw6 = {
    982 		.pr_input = ipsecif6_input,
    983 		.pr_ctlinput = ipsecif6_ctlinput,
    984 	}
    985 };
    986 #endif /* INET6 */
    987