Home | History | Annotate | Line # | Download | only in netipsec
xform_ipip.c revision 1.8
      1 /*	$NetBSD: xform_ipip.c,v 1.8 2004/01/16 11:06:27 scw Exp $	*/
      2 /*	$FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $	*/
      3 /*	$OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
      4 
      5 /*
      6  * The authors of this code are John Ioannidis (ji (at) tla.org),
      7  * Angelos D. Keromytis (kermit (at) csd.uch.gr) and
      8  * Niels Provos (provos (at) physnet.uni-hamburg.de).
      9  *
     10  * The original version of this code was written by John Ioannidis
     11  * for BSD/OS in Athens, Greece, in November 1995.
     12  *
     13  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
     14  * by Angelos D. Keromytis.
     15  *
     16  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
     17  * and Niels Provos.
     18  *
     19  * Additional features in 1999 by Angelos D. Keromytis.
     20  *
     21  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
     22  * Angelos D. Keromytis and Niels Provos.
     23  * Copyright (c) 2001, Angelos D. Keromytis.
     24  *
     25  * Permission to use, copy, and modify this software with or without fee
     26  * is hereby granted, provided that this entire notice is included in
     27  * all copies of any software which is or includes a copy or
     28  * modification of this software.
     29  * You may use this code under the GNU public license if you so wish. Please
     30  * contribute changes back to the authors under this freer than GPL license
     31  * so that we may further the use of strong encryption without limitations to
     32  * all.
     33  *
     34  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
     35  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
     36  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
     37  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
     38  * PURPOSE.
     39  */
     40 
     41 #include <sys/cdefs.h>
     42 __KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.8 2004/01/16 11:06:27 scw Exp $");
     43 
     44 /*
     45  * IP-inside-IP processing
     46  */
     47 #include "opt_inet.h"
     48 #ifdef __FreeBSD__
     49 #include "opt_inet6.h"
     50 #include "opt_random_ip_id.h"
     51 #endif /* __FreeBSD__ */
     52 
     53 
     54 #include <sys/param.h>
     55 #include <sys/systm.h>
     56 #include <sys/mbuf.h>
     57 #include <sys/socket.h>
     58 #include <sys/kernel.h>
     59 #include <sys/protosw.h>
     60 #include <sys/sysctl.h>
     61 
     62 #include <net/if.h>
     63 #include <net/route.h>
     64 #include <net/netisr.h>
     65 
     66 #include <netinet/in.h>
     67 #include <netinet/in_systm.h>
     68 #include <netinet/in_var.h>
     69 #include <netinet/ip.h>
     70 #include <netinet/ip_ecn.h>
     71 #include <netinet/ip_var.h>
     72 #include <netinet/ip_encap.h>
     73 #ifdef __FreeBSD__
     74 #include <netinet/ipprotosw.h>
     75 #endif
     76 
     77 #include <netipsec/ipsec.h>
     78 #include <netipsec/xform.h>
     79 
     80 #include <netipsec/ipip_var.h>
     81 
     82 #ifdef MROUTING
     83 #include <netinet/ip_mroute.h>
     84 #endif
     85 
     86 #ifdef INET6
     87 #include <netinet/ip6.h>
     88 #include <netipsec/ipsec6.h>
     89 #include <netinet6/ip6_ecn.h>
     90 #include <netinet6/in6_var.h>
     91 #include <netinet6/ip6protosw.h>
     92 #endif
     93 
     94 #include <netipsec/key.h>
     95 #include <netipsec/key_debug.h>
     96 #include <netipsec/ipsec_osdep.h>
     97 
     98 #include <machine/stdarg.h>
     99 
    100 #ifdef __FreeBSD__
    101 typedef void	pr_in_input_t (struct mbuf *, int, int); /* XXX FIX THIS */
    102 #else
    103 typedef void	pr_in_input_t (struct mbuf *m, ...);
    104 #endif
    105 
    106 /*
    107  * We can control the acceptance of IP4 packets by altering the sysctl
    108  * net.inet.ipip.allow value.  Zero means drop them, all else is acceptance.
    109  */
    110 int	ipip_allow = 0;
    111 struct	ipipstat ipipstat;
    112 
    113 #ifdef SYSCTL_DECL
    114 SYSCTL_DECL(_net_inet_ipip);
    115 
    116 SYSCTL_INT(_net_inet_ipip, OID_AUTO,
    117 	ipip_allow,	CTLFLAG_RW,	&ipip_allow,	0, "");
    118 SYSCTL_STRUCT(_net_inet_ipip, IPSECCTL_STATS,
    119 	stats,		CTLFLAG_RD,	&ipipstat,	ipipstat, "");
    120 
    121 #endif
    122 
    123 #ifdef __FreeBSD__
    124 static
    125 #endif
    126 void ipe4_attach(void);
    127 
    128 
    129 /* XXX IPCOMP */
    130 #define	M_IPSEC	(M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
    131 
    132 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp);
    133 
    134 #ifdef INET6
    135 /*
    136  * Really only a wrapper for ipip_input(), for use with IPv6.
    137  */
    138 int
    139 ip4_input6(struct mbuf **m, int *offp, int proto)
    140 {
    141 #if 0
    142 	/* If we do not accept IP-in-IP explicitly, drop.  */
    143 	if (!ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) {
    144 		DPRINTF(("ip4_input6: dropped due to policy\n"));
    145 		ipipstat.ipips_pdrops++;
    146 		m_freem(*m);
    147 		return IPPROTO_DONE;
    148 	}
    149 #endif
    150 	_ipip_input(*m, *offp, NULL);
    151 	return IPPROTO_DONE;
    152 }
    153 #endif /* INET6 */
    154 
    155 #ifdef INET
    156 /*
    157  * Really only a wrapper for ipip_input(), for use with IPv4.
    158  */
    159 void
    160 ip4_input(struct mbuf *m, ...)
    161 {
    162 	va_list ap;
    163 	int iphlen;
    164 
    165 #if 0
    166 	/* If we do not accept IP-in-IP explicitly, drop.  */
    167 	if (!ipip_allow && (m->m_flags & M_IPSEC) == 0) {
    168 		DPRINTF(("ip4_input: dropped due to policy\n"));
    169 		ipipstat.ipips_pdrops++;
    170 		m_freem(m);
    171 		return;
    172 	}
    173 #endif
    174 	va_start(ap, m);
    175 	iphlen = va_arg(ap, int);
    176 	va_end(ap);
    177 
    178 	_ipip_input(m, iphlen, NULL);
    179 }
    180 #endif /* INET */
    181 
    182 /*
    183  * ipip_input gets called when we receive an IP{46} encapsulated packet,
    184  * either because we got it at a real interface, or because AH or ESP
    185  * were being used in tunnel mode (in which case the rcvif element will
    186  * contain the address of the encX interface associated with the tunnel.
    187  */
    188 
    189 static void
    190 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
    191 {
    192 	register struct sockaddr_in *sin;
    193 	register struct ifnet *ifp;
    194 	register struct ifaddr *ifa;
    195 	struct ifqueue *ifq = NULL;
    196 	struct ip *ipo;
    197 #ifdef INET6
    198 	register struct sockaddr_in6 *sin6;
    199 	struct ip6_hdr *ip6 = NULL;
    200 	u_int8_t itos;
    201 #endif
    202 	u_int8_t nxt;
    203 	int isr;
    204 	u_int8_t otos;
    205 	u_int8_t v;
    206 	int hlen;
    207 
    208 	ipipstat.ipips_ipackets++;
    209 
    210 	m_copydata(m, 0, 1, &v);
    211 
    212 	switch (v >> 4) {
    213 #ifdef INET
    214         case 4:
    215 		hlen = sizeof(struct ip);
    216 		break;
    217 #endif /* INET */
    218 #ifdef INET6
    219         case 6:
    220 		hlen = sizeof(struct ip6_hdr);
    221 		break;
    222 #endif
    223         default:
    224 		DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) "
    225 			"for outer header\n", v, v>>4));
    226 		ipipstat.ipips_family++;
    227 		m_freem(m);
    228 		return /* EAFNOSUPPORT */;
    229 	}
    230 
    231 	/* Bring the IP header in the first mbuf, if not there already */
    232 	if (m->m_len < hlen) {
    233 		if ((m = m_pullup(m, hlen)) == NULL) {
    234 			DPRINTF(("ipip_input: m_pullup (1) failed\n"));
    235 			ipipstat.ipips_hdrops++;
    236 			return;
    237 		}
    238 	}
    239 
    240 	ipo = mtod(m, struct ip *);
    241 
    242 #ifdef MROUTING
    243 	if (ipo->ip_v == IPVERSION && ipo->ip_p == IPPROTO_IPV4) {
    244 		if (IN_MULTICAST(((struct ip *)((char *) ipo + iphlen))->ip_dst.s_addr)) {
    245 			ipip_mroute_input (m, iphlen);
    246 			return;
    247 		}
    248 	}
    249 #endif /* MROUTING */
    250 
    251 	/* Keep outer ecn field. */
    252 	switch (v >> 4) {
    253 #ifdef INET
    254 	case 4:
    255 		otos = ipo->ip_tos;
    256 		break;
    257 #endif /* INET */
    258 #ifdef INET6
    259 	case 6:
    260 		otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff;
    261 		break;
    262 #endif
    263 	default:
    264 		panic("ipip_input: unknown ip version %u (outer)", v>>4);
    265 	}
    266 
    267 	/* Remove outer IP header */
    268 	m_adj(m, iphlen);
    269 
    270 	/* Sanity check */
    271 	if (m->m_pkthdr.len < sizeof(struct ip))  {
    272 		ipipstat.ipips_hdrops++;
    273 		m_freem(m);
    274 		return;
    275 	}
    276 
    277 	m_copydata(m, 0, 1, &v);
    278 
    279 	switch (v >> 4) {
    280 #ifdef INET
    281         case 4:
    282 		hlen = sizeof(struct ip);
    283 		break;
    284 #endif /* INET */
    285 
    286 #ifdef INET6
    287         case 6:
    288 		hlen = sizeof(struct ip6_hdr);
    289 		break;
    290 #endif
    291 	default:
    292 		DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) "
    293 			"for inner header\n", v, v>>4));
    294 		ipipstat.ipips_family++;
    295 		m_freem(m);
    296 		return; /* EAFNOSUPPORT */
    297 	}
    298 
    299 	/*
    300 	 * Bring the inner IP header in the first mbuf, if not there already.
    301 	 */
    302 	if (m->m_len < hlen) {
    303 		if ((m = m_pullup(m, hlen)) == NULL) {
    304 			DPRINTF(("ipip_input: m_pullup (2) failed\n"));
    305 			ipipstat.ipips_hdrops++;
    306 			return;
    307 		}
    308 	}
    309 
    310 	/*
    311 	 * RFC 1853 specifies that the inner TTL should not be touched on
    312 	 * decapsulation. There's no reason this comment should be here, but
    313 	 * this is as good as any a position.
    314 	 */
    315 
    316 	/* Some sanity checks in the inner IP header */
    317 	switch (v >> 4) {
    318 #ifdef INET
    319     	case 4:
    320                 ipo = mtod(m, struct ip *);
    321                 nxt = ipo->ip_p;
    322 		ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos);
    323                 break;
    324 #endif /* INET */
    325 #ifdef INET6
    326     	case 6:
    327                 ip6 = (struct ip6_hdr *) ipo;
    328                 nxt = ip6->ip6_nxt;
    329 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    330 		ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
    331 		ip6->ip6_flow &= ~htonl(0xff << 20);
    332 		ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
    333                 break;
    334 #endif
    335 	default:
    336 		panic("ipip_input: unknown ip version %u (inner)", v>>4);
    337 	}
    338 
    339 	/* Check for local address spoofing. */
    340 	if ((m->m_pkthdr.rcvif == NULL ||
    341 	    !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) &&
    342 	    ipip_allow != 2) {
    343 		for (ifp = ifnet.tqh_first; ifp != 0;
    344 		     ifp = ifp->if_list.tqe_next) {
    345 			for (ifa = ifp->if_addrlist.tqh_first; ifa != 0;
    346 			     ifa = ifa->ifa_list.tqe_next) {
    347 #ifdef INET
    348 				if (ipo) {
    349 					if (ifa->ifa_addr->sa_family !=
    350 					    AF_INET)
    351 						continue;
    352 
    353 					sin = (struct sockaddr_in *) ifa->ifa_addr;
    354 
    355 					if (sin->sin_addr.s_addr ==
    356 					    ipo->ip_src.s_addr)	{
    357 						ipipstat.ipips_spoof++;
    358 						m_freem(m);
    359 						return;
    360 					}
    361 				}
    362 #endif /* INET */
    363 
    364 #ifdef INET6
    365 				if (ip6) {
    366 					if (ifa->ifa_addr->sa_family !=
    367 					    AF_INET6)
    368 						continue;
    369 
    370 					sin6 = (struct sockaddr_in6 *) ifa->ifa_addr;
    371 
    372 					if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) {
    373 						ipipstat.ipips_spoof++;
    374 						m_freem(m);
    375 						return;
    376 					}
    377 
    378 				}
    379 #endif /* INET6 */
    380 			}
    381 		}
    382 	}
    383 
    384 	/* Statistics */
    385 	ipipstat.ipips_ibytes += m->m_pkthdr.len - iphlen;
    386 
    387 	/*
    388 	 * Interface pointer stays the same; if no IPsec processing has
    389 	 * been done (or will be done), this will point to a normal
    390 	 * interface. Otherwise, it'll point to an enc interface, which
    391 	 * will allow a packet filter to distinguish between secure and
    392 	 * untrusted packets.
    393 	 */
    394 
    395 	switch (v >> 4) {
    396 #ifdef INET
    397 	case 4:
    398 		ifq = &ipintrq;
    399 		isr = NETISR_IP;
    400 		break;
    401 #endif
    402 #ifdef INET6
    403 	case 6:
    404 		ifq = &ip6intrq;
    405 		isr = NETISR_IPV6;
    406 		break;
    407 #endif
    408 	default:
    409 		panic("ipip_input: should never reach here");
    410 	}
    411 
    412 	if (!IF_HANDOFF(ifq, m, NULL)) {
    413 		ipipstat.ipips_qfull++;
    414 
    415 		DPRINTF(("ipip_input: packet dropped because of full queue\n"));
    416 	} else {
    417 		schednetisr(isr);
    418 	}
    419 }
    420 
    421 int
    422 ipip_output(
    423 	struct mbuf *m,
    424 	struct ipsecrequest *isr,
    425 	struct mbuf **mp,
    426 	int skip,
    427 	int protoff
    428 )
    429 {
    430 	struct secasvar *sav;
    431 	u_int8_t tp, otos;
    432 	struct secasindex *saidx;
    433 	int error;
    434 #ifdef INET
    435 	u_int8_t itos;
    436 	struct ip *ipo;
    437 #endif /* INET */
    438 #ifdef INET6
    439 	struct ip6_hdr *ip6, *ip6o;
    440 #endif /* INET6 */
    441 
    442 	IPSEC_SPLASSERT_SOFTNET("ipip_output");
    443 
    444 	sav = isr->sav;
    445 	IPSEC_ASSERT(sav != NULL, ("ipip_output: null SA"));
    446 	IPSEC_ASSERT(sav->sah != NULL, ("ipip_output: null SAH"));
    447 
    448 	/* XXX Deal with empty TDB source/destination addresses. */
    449 
    450 	m_copydata(m, 0, 1, &tp);
    451 	tp = (tp >> 4) & 0xff;  /* Get the IP version number. */
    452 
    453 	saidx = &sav->sah->saidx;
    454 	switch (saidx->dst.sa.sa_family) {
    455 #ifdef INET
    456 	case AF_INET:
    457 		if (saidx->src.sa.sa_family != AF_INET ||
    458 		    saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
    459 		    saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) {
    460 			DPRINTF(("ipip_output: unspecified tunnel endpoint "
    461 			    "address in SA %s/%08lx\n",
    462 			    ipsec_address(&saidx->dst),
    463 			    (u_long) ntohl(sav->spi)));
    464 			ipipstat.ipips_unspec++;
    465 			error = EINVAL;
    466 			goto bad;
    467 		}
    468 
    469 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    470 		if (m == 0) {
    471 			DPRINTF(("ipip_output: M_PREPEND failed\n"));
    472 			ipipstat.ipips_hdrops++;
    473 			error = ENOBUFS;
    474 			goto bad;
    475 		}
    476 
    477 		ipo = mtod(m, struct ip *);
    478 
    479 		ipo->ip_v = IPVERSION;
    480 		ipo->ip_hl = 5;
    481 		ipo->ip_len = htons(m->m_pkthdr.len);
    482 		ipo->ip_ttl = ip_defttl;
    483 		ipo->ip_sum = 0;
    484 		ipo->ip_src = saidx->src.sin.sin_addr;
    485 		ipo->ip_dst = saidx->dst.sin.sin_addr;
    486 
    487 #if defined(__NetBSD__)
    488 		ipo->ip_id = ip_newid();
    489 #elif defined(RANDOM_IP_ID)
    490 		ipo->ip_id = ip_randomid();
    491 #else
    492 		ipo->ip_id = htons(ip_id++);
    493 #endif
    494 
    495 		/* If the inner protocol is IP... */
    496 		if (tp == IPVERSION) {
    497 			/* Save ECN notification */
    498 			m_copydata(m, sizeof(struct ip) +
    499 			    offsetof(struct ip, ip_tos),
    500 			    sizeof(u_int8_t), (caddr_t) &itos);
    501 
    502 			ipo->ip_p = IPPROTO_IPIP;
    503 
    504 			/*
    505 			 * We should be keeping tunnel soft-state and
    506 			 * send back ICMPs if needed.
    507 			 */
    508 			m_copydata(m, sizeof(struct ip) +
    509 			    offsetof(struct ip, ip_off),
    510 			    sizeof(u_int16_t), (caddr_t) &ipo->ip_off);
    511 			ipo->ip_off = ntohs(ipo->ip_off);
    512 			ipo->ip_off &= ~(IP_DF | IP_MF | IP_OFFMASK);
    513 			ipo->ip_off = htons(ipo->ip_off);
    514 		}
    515 #ifdef INET6
    516 		else if (tp == (IPV6_VERSION >> 4)) {
    517 			u_int32_t itos32;
    518 
    519 			/* Save ECN notification. */
    520 			m_copydata(m, sizeof(struct ip) +
    521 			    offsetof(struct ip6_hdr, ip6_flow),
    522 			    sizeof(u_int32_t), (caddr_t) &itos32);
    523 			itos = ntohl(itos32) >> 20;
    524 			ipo->ip_p = IPPROTO_IPV6;
    525 			ipo->ip_off = 0;
    526 		}
    527 #endif /* INET6 */
    528 		else {
    529 			goto nofamily;
    530 		}
    531 
    532 		otos = 0;
    533 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    534 		ipo->ip_tos = otos;
    535 		break;
    536 #endif /* INET */
    537 
    538 #ifdef INET6
    539 	case AF_INET6:
    540 		if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) ||
    541 		    saidx->src.sa.sa_family != AF_INET6 ||
    542 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) {
    543 			DPRINTF(("ipip_output: unspecified tunnel endpoint "
    544 			    "address in SA %s/%08lx\n",
    545 			    ipsec_address(&saidx->dst),
    546 			    (u_long) ntohl(sav->spi)));
    547 			ipipstat.ipips_unspec++;
    548 			error = ENOBUFS;
    549 			goto bad;
    550 		}
    551 
    552 		/* scoped address handling */
    553 		ip6 = mtod(m, struct ip6_hdr *);
    554 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
    555 			ip6->ip6_src.s6_addr16[1] = 0;
    556 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
    557 			ip6->ip6_dst.s6_addr16[1] = 0;
    558 
    559 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
    560 		if (m == 0) {
    561 			DPRINTF(("ipip_output: M_PREPEND failed\n"));
    562 			ipipstat.ipips_hdrops++;
    563 			error = ENOBUFS;
    564 			goto bad;
    565 		}
    566 
    567 		/* Initialize IPv6 header */
    568 		ip6o = mtod(m, struct ip6_hdr *);
    569 		ip6o->ip6_flow = 0;
    570 		ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
    571 		ip6o->ip6_vfc |= IPV6_VERSION;
    572 		ip6o->ip6_plen = htons(m->m_pkthdr.len);
    573 		ip6o->ip6_hlim = ip_defttl;
    574 		ip6o->ip6_dst = saidx->dst.sin6.sin6_addr;
    575 		ip6o->ip6_src = saidx->src.sin6.sin6_addr;
    576 
    577 #ifdef INET
    578 		if (tp == IPVERSION) {
    579 			/* Save ECN notification */
    580 			m_copydata(m, sizeof(struct ip6_hdr) +
    581 			    offsetof(struct ip, ip_tos), sizeof(u_int8_t),
    582 			    (caddr_t) &itos);
    583 
    584 			/* This is really IPVERSION. */
    585 			ip6o->ip6_nxt = IPPROTO_IPIP;
    586 		} else
    587 #endif /* INET */
    588 			if (tp == (IPV6_VERSION >> 4)) {
    589 				u_int32_t itos32;
    590 
    591 				/* Save ECN notification. */
    592 				m_copydata(m, sizeof(struct ip6_hdr) +
    593 				    offsetof(struct ip6_hdr, ip6_flow),
    594 				    sizeof(u_int32_t), (caddr_t) &itos32);
    595 				itos = ntohl(itos32) >> 20;
    596 
    597 				ip6o->ip6_nxt = IPPROTO_IPV6;
    598 			} else {
    599 				goto nofamily;
    600 			}
    601 
    602 		otos = 0;
    603 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
    604 		ip6o->ip6_flow |= htonl((u_int32_t) otos << 20);
    605 		break;
    606 #endif /* INET6 */
    607 
    608 	default:
    609 nofamily:
    610 		DPRINTF(("ipip_output: unsupported protocol family %u\n",
    611 		    saidx->dst.sa.sa_family));
    612 		ipipstat.ipips_family++;
    613 		error = EAFNOSUPPORT;		/* XXX diffs from openbsd */
    614 		goto bad;
    615 	}
    616 
    617 	ipipstat.ipips_opackets++;
    618 	*mp = m;
    619 
    620 #ifdef INET
    621 	if (saidx->dst.sa.sa_family == AF_INET) {
    622 #if 0
    623 		if (sav->tdb_xform->xf_type == XF_IP4)
    624 			tdb->tdb_cur_bytes +=
    625 			    m->m_pkthdr.len - sizeof(struct ip);
    626 #endif
    627 		ipipstat.ipips_obytes += m->m_pkthdr.len - sizeof(struct ip);
    628 	}
    629 #endif /* INET */
    630 
    631 #ifdef INET6
    632 	if (saidx->dst.sa.sa_family == AF_INET6) {
    633 #if 0
    634 		if (sav->tdb_xform->xf_type == XF_IP4)
    635 			tdb->tdb_cur_bytes +=
    636 			    m->m_pkthdr.len - sizeof(struct ip6_hdr);
    637 #endif
    638 		ipipstat.ipips_obytes +=
    639 		    m->m_pkthdr.len - sizeof(struct ip6_hdr);
    640 	}
    641 #endif /* INET6 */
    642 
    643 	return 0;
    644 bad:
    645 	if (m)
    646 		m_freem(m);
    647 	*mp = NULL;
    648 	return (error);
    649 }
    650 
    651 #ifdef FAST_IPSEC
    652 static int
    653 ipe4_init(struct secasvar *sav, struct xformsw *xsp)
    654 {
    655 	sav->tdb_xform = xsp;
    656 	return 0;
    657 }
    658 
    659 static int
    660 ipe4_zeroize(struct secasvar *sav)
    661 {
    662 	sav->tdb_xform = NULL;
    663 	return 0;
    664 }
    665 
    666 static int
    667 ipe4_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
    668 {
    669 	/* This is a rather serious mistake, so no conditional printing. */
    670 	printf("ipe4_input: should never be called\n");
    671 	if (m)
    672 		m_freem(m);
    673 	return EOPNOTSUPP;
    674 }
    675 
    676 static struct xformsw ipe4_xformsw = {
    677 	XF_IP4,		0,		"IPv4 Simple Encapsulation",
    678 	ipe4_init,	ipe4_zeroize,	ipe4_input,	ipip_output,
    679 };
    680 
    681 extern struct domain inetdomain;
    682 static struct ipprotosw ipe4_protosw[] = {
    683 { SOCK_RAW,	&inetdomain,	IPPROTO_IPV4,	PR_ATOMIC|PR_ADDR|PR_LASTHDR,
    684   ip4_input,	0, 		0,		rip_ctloutput,
    685   rip_usrreq,
    686   0,		0,		0,		0,
    687 },
    688 #ifdef INET6
    689 { SOCK_RAW,	&inetdomain,	IPPROTO_IPV6,	PR_ATOMIC|PR_ADDR|PR_LASTHDR,
    690   ip4_input,	0,	 	0,		rip_ctloutput,
    691   rip_usrreq,
    692   0,		0,		0,		0,
    693 },
    694 #endif
    695 };
    696 
    697 /*
    698  * Check the encapsulated packet to see if we want it
    699  */
    700 static int
    701 ipe4_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
    702 {
    703 	/*
    704 	 * Only take packets coming from IPSEC tunnels; the rest
    705 	 * must be handled by the gif tunnel code.  Note that we
    706 	 * also return a minimum priority when we want the packet
    707 	 * so any explicit gif tunnels take precedence.
    708 	 */
    709 	return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0);
    710 }
    711 
    712 INITFN void
    713 ipe4_attach(void)
    714 {
    715 	xform_register(&ipe4_xformsw);
    716 	/* attach to encapsulation framework */
    717 	/* XXX save return cookie for detach on module remove */
    718 	(void) encap_attach_func(AF_INET, -1,
    719 		ipe4_encapcheck, (struct protosw*) &ipe4_protosw[0], NULL);
    720 #ifdef INET6
    721 	(void) encap_attach_func(AF_INET6, -1,
    722 		ipe4_encapcheck, (struct protosw*) &ipe4_protosw[1], NULL);
    723 #endif
    724 }
    725 
    726 #ifdef SYSINIT
    727 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL);
    728 #endif
    729 
    730 #endif	/* FAST_IPSEC */
    731