sys/netinet6/ipsec.c

   1 /*      $FreeBSD: src/sys/netinet6/ipsec.c,v 1.3.2.12 2003/05/06 06:46:58 suz Exp $     */
   2 /*      $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
   3
   4 /*
   5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the name of the project nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * IPsec controller part.
  35  */
  36
  37 #include "opt_inet.h"
  38 #include "opt_inet6.h"
  39 #include "opt_ipsec.h"
  40
  41 #include <sys/param.h>
  42 #include <sys/systm.h>
  43 #include <sys/malloc.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/domain.h>
  46 #include <sys/protosw.h>
  47 #include <sys/socket.h>
  48 #include <sys/socketvar.h>
  49 #include <sys/errno.h>
  50 #include <sys/time.h>
  51 #include <sys/kernel.h>
  52 #include <sys/syslog.h>
  53 #include <sys/sysctl.h>
  54 #include <sys/proc.h>
  55 #include <sys/in_cksum.h>
  56 #include <sys/thread2.h>
  57
  58 #include <net/if.h>
  59 #include <net/route.h>
  60
  61 #include <netinet/in.h>
  62 #include <netinet/in_systm.h>
  63 #include <netinet/in_pcb.h>
  64 #include <netinet/ip.h>
  65 #include <netinet/ip_var.h>
  66 #include <netinet/in_var.h>
  67 #include <netinet/udp.h>
  68 #include <netinet/udp_var.h>
  69 #include <netinet/ip_ecn.h>
  70 #ifdef INET6
  71 #include <netinet6/ip6_ecn.h>
  72 #endif
  73 #include <netinet/tcp.h>
  74
  75 #include <netinet/ip6.h>
  76 #ifdef INET6
  77 #include <netinet6/ip6_var.h>
  78 #endif
  79 #ifdef INET6
  80 #include <netinet/icmp6.h>
  81 #endif
  82
  83 #include <netinet6/ipsec.h>
  84 #ifdef INET6
  85 #include <netinet6/ipsec6.h>
  86 #endif
  87 #include <netinet6/ah.h>
  88 #ifdef INET6
  89 #include <netinet6/ah6.h>
  90 #endif
  91 #ifdef IPSEC_ESP
  92 #include <netinet6/esp.h>
  93 #ifdef INET6
  94 #include <netinet6/esp6.h>
  95 #endif
  96 #endif
  97 #include <netinet6/ipcomp.h>
  98 #ifdef INET6
  99 #include <netinet6/ipcomp6.h>
 100 #endif
 101 #include <netproto/key/key.h>
 102 #include <netproto/key/keydb.h>
 103 #include <netproto/key/key_debug.h>
 104
 105 #include <net/net_osdep.h>
 106
 107 #ifdef IPSEC_DEBUG
 108 int ipsec_debug = 1;
 109 #else
 110 int ipsec_debug = 0;
 111 #endif
 112
 113 struct ipsecstat ipsecstat;
 114 int ip4_ah_cleartos = 1;
 115 int ip4_ah_offsetmask = 0;      /* maybe IP_DF? */
 116 int ip4_ipsec_dfbit = 0;        /* DF bit on encap. 0: clear 1: set 2: copy */
 117 int ip4_esp_trans_deflev = IPSEC_LEVEL_USE;
 118 int ip4_esp_net_deflev = IPSEC_LEVEL_USE;
 119 int ip4_ah_trans_deflev = IPSEC_LEVEL_USE;
 120 int ip4_ah_net_deflev = IPSEC_LEVEL_USE;
 121 struct secpolicy ip4_def_policy;
 122 int ip4_ipsec_ecn = 0;          /* ECN ignore(-1)/forbidden(0)/allowed(1) */
 123 int ip4_esp_randpad = -1;
 124
 125 #ifdef SYSCTL_DECL
 126 SYSCTL_DECL(_net_inet_ipsec);
 127 #ifdef INET6
 128 SYSCTL_DECL(_net_inet6_ipsec6);
 129 #endif
 130 #endif
 131
 132 /* net.inet.ipsec */
 133 SYSCTL_STRUCT(_net_inet_ipsec, IPSECCTL_STATS,
 134         stats, CTLFLAG_RD,      &ipsecstat,     ipsecstat, "");
 135 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_POLICY,
 136         def_policy, CTLFLAG_RW, &ip4_def_policy.policy, 0, "");
 137 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
 138         CTLFLAG_RW, &ip4_esp_trans_deflev,      0, "");
 139 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
 140         CTLFLAG_RW, &ip4_esp_net_deflev,        0, "");
 141 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
 142         CTLFLAG_RW, &ip4_ah_trans_deflev,       0, "");
 143 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
 144         CTLFLAG_RW, &ip4_ah_net_deflev, 0, "");
 145 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS,
 146         ah_cleartos, CTLFLAG_RW,        &ip4_ah_cleartos,       0, "");
 147 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK,
 148         ah_offsetmask, CTLFLAG_RW,      &ip4_ah_offsetmask,     0, "");
 149 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT,
 150         dfbit, CTLFLAG_RW,      &ip4_ipsec_dfbit,       0, "");
 151 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN,
 152         ecn, CTLFLAG_RW,        &ip4_ipsec_ecn, 0, "");
 153 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG,
 154         debug, CTLFLAG_RW,      &ipsec_debug,   0, "");
 155 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD,
 156         esp_randpad, CTLFLAG_RW,        &ip4_esp_randpad,       0, "");
 157
 158 #ifdef INET6
 159 struct ipsecstat ipsec6stat;
 160 int ip6_esp_trans_deflev = IPSEC_LEVEL_USE;
 161 int ip6_esp_net_deflev = IPSEC_LEVEL_USE;
 162 int ip6_ah_trans_deflev = IPSEC_LEVEL_USE;
 163 int ip6_ah_net_deflev = IPSEC_LEVEL_USE;
 164 struct secpolicy ip6_def_policy;
 165 int ip6_ipsec_ecn = 0;          /* ECN ignore(-1)/forbidden(0)/allowed(1) */
 166 int ip6_esp_randpad = -1;
 167
 168 /* net.inet6.ipsec6 */
 169 SYSCTL_STRUCT(_net_inet6_ipsec6, IPSECCTL_STATS,
 170         stats, CTLFLAG_RD, &ipsec6stat, ipsecstat, "");
 171 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY,
 172         def_policy, CTLFLAG_RW, &ip6_def_policy.policy, 0, "");
 173 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
 174         CTLFLAG_RW, &ip6_esp_trans_deflev,      0, "");
 175 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
 176         CTLFLAG_RW, &ip6_esp_net_deflev,        0, "");
 177 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
 178         CTLFLAG_RW, &ip6_ah_trans_deflev,       0, "");
 179 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
 180         CTLFLAG_RW, &ip6_ah_net_deflev, 0, "");
 181 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN,
 182         ecn, CTLFLAG_RW,        &ip6_ipsec_ecn, 0, "");
 183 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG,
 184         debug, CTLFLAG_RW,      &ipsec_debug,   0, "");
 185 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD,
 186         esp_randpad, CTLFLAG_RW,        &ip6_esp_randpad,       0, "");
 187 #endif /* INET6 */
 188
 189 static int ipsec_setspidx_mbuf
 190         (struct secpolicyindex *, u_int, u_int, struct mbuf *, int);
 191 static int ipsec4_setspidx_inpcb (struct mbuf *, struct inpcb *);
 192 #ifdef INET6
 193 static int ipsec6_setspidx_in6pcb (struct mbuf *, struct in6pcb *);
 194 #endif
 195 static int ipsec_setspidx (struct mbuf *, struct secpolicyindex *, int);
 196 static void ipsec4_get_ulp (struct mbuf *, struct secpolicyindex *, int);
 197 static int ipsec4_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *);
 198 #ifdef INET6
 199 static void ipsec6_get_ulp (struct mbuf *, struct secpolicyindex *, int);
 200 static int ipsec6_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *);
 201 #endif
 202 static struct inpcbpolicy *ipsec_newpcbpolicy (void);
 203 static void ipsec_delpcbpolicy (struct inpcbpolicy *);
 204 static struct secpolicy *ipsec_deepcopy_policy (struct secpolicy *);
 205 static int ipsec_set_policy (struct secpolicy **, int, caddr_t, size_t, int);
 206 static int ipsec_get_policy (struct secpolicy *, struct mbuf **);
 207 static void vshiftl (unsigned char *, int, int);
 208 static int ipsec_in_reject (struct secpolicy *, struct mbuf *);
 209 static size_t ipsec_hdrsiz (struct secpolicy *);
 210 #ifdef INET
 211 static struct mbuf *ipsec4_splithdr (struct mbuf *);
 212 #endif
 213 #ifdef INET6
 214 static struct mbuf *ipsec6_splithdr (struct mbuf *);
 215 #endif
 216 #ifdef INET
 217 static int ipsec4_encapsulate (struct mbuf *, struct secasvar *);
 218 #endif
 219 #ifdef INET6
 220 static int ipsec6_encapsulate (struct mbuf *, struct secasvar *);
 221 #endif
 222
 223 /*
 224  * For OUTBOUND packet having a socket. Searching SPD for packet,
 225  * and return a pointer to SP.
 226  * OUT: NULL:   no apropreate SP found, the following value is set to error.
 227  *              0       : bypass
 228  *              EACCES  : discard packet.
 229  *              ENOENT  : ipsec_acquire() in progress, maybe.
 230  *              others  : error occured.
 231  *      others: a pointer to SP
 232  *
 233  * NOTE: IPv6 mapped adddress concern is implemented here.
 234  */
 235 struct secpolicy *
 236 ipsec4_getpolicybysock(struct mbuf *m, u_int dir, struct socket *so, int *error)
 237 {
 238         struct inpcbpolicy *pcbsp = NULL;
 239         struct secpolicy *currsp = NULL;        /* policy on socket */
 240         struct secpolicy *kernsp = NULL;        /* policy on kernel */
 241
 242         /* sanity check */
 243         if (m == NULL || so == NULL || error == NULL)
 244                 panic("ipsec4_getpolicybysock: NULL pointer was passed.");
 245
 246         switch (so->so_proto->pr_domain->dom_family) {
 247         case AF_INET:
 248                 /* set spidx in pcb */
 249                 *error = ipsec4_setspidx_inpcb(m, so->so_pcb);
 250                 break;
 251 #ifdef INET6
 252         case AF_INET6:
 253                 /* set spidx in pcb */
 254                 *error = ipsec6_setspidx_in6pcb(m, so->so_pcb);
 255                 break;
 256 #endif
 257         default:
 258                 panic("ipsec4_getpolicybysock: unsupported address family");
 259         }
 260         if (*error)
 261                 return NULL;
 262         switch (so->so_proto->pr_domain->dom_family) {
 263         case AF_INET:
 264                 pcbsp = sotoinpcb(so)->inp_sp;
 265                 break;
 266 #ifdef INET6
 267         case AF_INET6:
 268                 pcbsp = sotoin6pcb(so)->in6p_sp;
 269                 break;
 270 #endif
 271         }
 272
 273         /* sanity check */
 274         if (pcbsp == NULL)
 275                 panic("ipsec4_getpolicybysock: pcbsp is NULL.");
 276
 277         switch (dir) {
 278         case IPSEC_DIR_INBOUND:
 279                 currsp = pcbsp->sp_in;
 280                 break;
 281         case IPSEC_DIR_OUTBOUND:
 282                 currsp = pcbsp->sp_out;
 283                 break;
 284         default:
 285                 panic("ipsec4_getpolicybysock: illegal direction.");
 286         }
 287
 288         /* sanity check */
 289         if (currsp == NULL)
 290                 panic("ipsec4_getpolicybysock: currsp is NULL.");
 291
 292         lwkt_gettoken(&key_token);
 293
 294         /* when privilieged socket */
 295         if (pcbsp->priv) {
 296                 switch (currsp->policy) {
 297                 case IPSEC_POLICY_BYPASS:
 298                         currsp->refcnt++;
 299                         *error = 0;
 300                         lwkt_reltoken(&key_token);
 301                         return currsp;
 302
 303                 case IPSEC_POLICY_ENTRUST:
 304                         /* look for a policy in SPD */
 305                         kernsp = key_allocsp(&currsp->spidx, dir);
 306
 307                         /* SP found */
 308                         if (kernsp != NULL) {
 309                                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 310                                         kprintf("DP ipsec4_getpolicybysock called "
 311                                                "to allocate SP:%p\n", kernsp));
 312                                 *error = 0;
 313                                 lwkt_reltoken(&key_token);
 314                                 return kernsp;
 315                         }
 316
 317                         /* no SP found */
 318                         if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 319                          && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 320                                 ipseclog((LOG_INFO,
 321                                     "fixed system default policy: %d->%d\n",
 322                                     ip4_def_policy.policy, IPSEC_POLICY_NONE));
 323                                 ip4_def_policy.policy = IPSEC_POLICY_NONE;
 324                         }
 325                         ip4_def_policy.refcnt++;
 326                         *error = 0;
 327                         lwkt_reltoken(&key_token);
 328                         return &ip4_def_policy;
 329
 330                 case IPSEC_POLICY_IPSEC:
 331                         currsp->refcnt++;
 332                         *error = 0;
 333                         lwkt_reltoken(&key_token);
 334                         return currsp;
 335
 336                 default:
 337                         ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 338                               "Invalid policy for PCB %d\n", currsp->policy));
 339                         *error = EINVAL;
 340                         lwkt_reltoken(&key_token);
 341                         return NULL;
 342                 }
 343                 /* NOTREACHED */
 344         }
 345
 346         /* when non-privilieged socket */
 347         /* look for a policy in SPD */
 348         kernsp = key_allocsp(&currsp->spidx, dir);
 349
 350         /* SP found */
 351         if (kernsp != NULL) {
 352                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 353                         kprintf("DP ipsec4_getpolicybysock called "
 354                                "to allocate SP:%p\n", kernsp));
 355                 *error = 0;
 356                 lwkt_reltoken(&key_token);
 357                 return kernsp;
 358         }
 359
 360         /* no SP found */
 361         switch (currsp->policy) {
 362         case IPSEC_POLICY_BYPASS:
 363                 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 364                        "Illegal policy for non-priviliged defined %d\n",
 365                         currsp->policy));
 366                 *error = EINVAL;
 367                 lwkt_reltoken(&key_token);
 368                 return NULL;
 369
 370         case IPSEC_POLICY_ENTRUST:
 371                 if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 372                  && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 373                         ipseclog((LOG_INFO,
 374                             "fixed system default policy: %d->%d\n",
 375                             ip4_def_policy.policy, IPSEC_POLICY_NONE));
 376                         ip4_def_policy.policy = IPSEC_POLICY_NONE;
 377                 }
 378                 ip4_def_policy.refcnt++;
 379                 *error = 0;
 380                 lwkt_reltoken(&key_token);
 381                 return &ip4_def_policy;
 382
 383         case IPSEC_POLICY_IPSEC:
 384                 currsp->refcnt++;
 385                 *error = 0;
 386                 lwkt_reltoken(&key_token);
 387                 return currsp;
 388
 389         default:
 390                 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 391                    "Invalid policy for PCB %d\n", currsp->policy));
 392                 *error = EINVAL;
 393                 lwkt_reltoken(&key_token);
 394                 return NULL;
 395         }
 396         /* NOTREACHED */
 397 }
 398
 399 /*
 400  * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
 401  * and return a pointer to SP.
 402  * OUT: positive: a pointer to the entry for security policy leaf matched.
 403  *      NULL:   no apropreate SP found, the following value is set to error.
 404  *              0       : bypass
 405  *              EACCES  : discard packet.
 406  *              ENOENT  : ipsec_acquire() in progress, maybe.
 407  *              others  : error occured.
 408  */
 409 struct secpolicy *
 410 ipsec4_getpolicybyaddr(struct mbuf *m, u_int dir, int flag, int *error)
 411 {
 412         struct secpolicy *sp = NULL;
 413         struct secpolicyindex spidx;
 414
 415         /* sanity check */
 416         if (m == NULL || error == NULL)
 417                 panic("ipsec4_getpolicybyaddr: NULL pointer was passed.");
 418
 419         bzero(&spidx, sizeof(spidx));
 420
 421         /* make an index to look for a policy */
 422         *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET, m,
 423                                      (flag & IP_FORWARDING) ? 0 : 1);
 424
 425         if (*error != 0)
 426                 return NULL;
 427
 428         lwkt_gettoken(&key_token);
 429         sp = key_allocsp(&spidx, dir);
 430
 431         /* SP found */
 432         if (sp != NULL) {
 433                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 434                         kprintf("DP ipsec4_getpolicybyaddr called "
 435                                "to allocate SP:%p\n", sp));
 436                 *error = 0;
 437                 lwkt_reltoken(&key_token);
 438                 return sp;
 439         }
 440
 441         /* no SP found */
 442         if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD &&
 443             ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 444                 ipseclog((LOG_INFO, "fixed system default policy:%d->%d\n",
 445                     ip4_def_policy.policy, IPSEC_POLICY_NONE));
 446                 ip4_def_policy.policy = IPSEC_POLICY_NONE;
 447         }
 448         ip4_def_policy.refcnt++;
 449         *error = 0;
 450         lwkt_reltoken(&key_token);
 451         return &ip4_def_policy;
 452 }
 453
 454 #ifdef INET6
 455 /*
 456  * For OUTBOUND packet having a socket. Searching SPD for packet,
 457  * and return a pointer to SP.
 458  * OUT: NULL:   no apropreate SP found, the following value is set to error.
 459  *              0       : bypass
 460  *              EACCES  : discard packet.
 461  *              ENOENT  : ipsec_acquire() in progress, maybe.
 462  *              others  : error occured.
 463  *      others: a pointer to SP
 464  */
 465 struct secpolicy *
 466 ipsec6_getpolicybysock(struct mbuf *m, u_int dir, struct socket *so, int *error)
 467 {
 468         struct inpcbpolicy *pcbsp = NULL;
 469         struct secpolicy *currsp = NULL;        /* policy on socket */
 470         struct secpolicy *kernsp = NULL;        /* policy on kernel */
 471
 472         /* sanity check */
 473         if (m == NULL || so == NULL || error == NULL)
 474                 panic("ipsec6_getpolicybysock: NULL pointer was passed.");
 475
 476 #ifdef DIAGNOSTIC
 477         if (so->so_proto->pr_domain->dom_family != AF_INET6)
 478                 panic("ipsec6_getpolicybysock: socket domain != inet6");
 479 #endif
 480
 481         lwkt_gettoken(&key_token);
 482
 483         /* set spidx in pcb */
 484         ipsec6_setspidx_in6pcb(m, so->so_pcb);
 485         pcbsp = sotoin6pcb(so)->in6p_sp;
 486
 487         /* sanity check */
 488         if (pcbsp == NULL)
 489                 panic("ipsec6_getpolicybysock: pcbsp is NULL.");
 490
 491         switch (dir) {
 492         case IPSEC_DIR_INBOUND:
 493                 currsp = pcbsp->sp_in;
 494                 break;
 495         case IPSEC_DIR_OUTBOUND:
 496                 currsp = pcbsp->sp_out;
 497                 break;
 498         default:
 499                 panic("ipsec6_getpolicybysock: illegal direction.");
 500         }
 501
 502         /* sanity check */
 503         if (currsp == NULL)
 504                 panic("ipsec6_getpolicybysock: currsp is NULL.");
 505
 506         /* when privilieged socket */
 507         if (pcbsp->priv) {
 508                 switch (currsp->policy) {
 509                 case IPSEC_POLICY_BYPASS:
 510                         currsp->refcnt++;
 511                         *error = 0;
 512                         break;
 513                 case IPSEC_POLICY_ENTRUST:
 514                         /* look for a policy in SPD */
 515                         kernsp = key_allocsp(&currsp->spidx, dir);
 516
 517                         /* SP found */
 518                         if (kernsp != NULL) {
 519                                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 520                                         kprintf("DP ipsec6_getpolicybysock called "
 521                                                "to allocate SP:%p\n", kernsp));
 522                                 *error = 0;
 523                                 currsp = kernsp;
 524                                 break;
 525                         }
 526
 527                         /* no SP found */
 528                         if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 529                          && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 530                                 ipseclog((LOG_INFO,
 531                                     "fixed system default policy: %d->%d\n",
 532                                     ip6_def_policy.policy, IPSEC_POLICY_NONE));
 533                                 ip6_def_policy.policy = IPSEC_POLICY_NONE;
 534                         }
 535                         currsp = &ip6_def_policy;
 536                         currsp->refcnt++;
 537                         *error = 0;
 538                         break;
 539                 case IPSEC_POLICY_IPSEC:
 540                         currsp->refcnt++;
 541                         *error = 0;
 542                         break;
 543                 default:
 544                         ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
 545                             "Invalid policy for PCB %d\n", currsp->policy));
 546                         *error = EINVAL;
 547                         lwkt_reltoken(&key_token);
 548                         currsp = NULL;
 549                         break;
 550                 }
 551                 lwkt_reltoken(&key_token);
 552                 return currsp;
 553                 /* NOTREACHED */
 554         }
 555
 556         /* when non-privilieged socket */
 557         /* look for a policy in SPD */
 558         kernsp = key_allocsp(&currsp->spidx, dir);
 559
 560         /* SP found */
 561         if (kernsp != NULL) {
 562                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 563                         kprintf("DP ipsec6_getpolicybysock called "
 564                                "to allocate SP:%p\n", kernsp));
 565                 *error = 0;
 566                 lwkt_reltoken(&key_token);
 567                 return kernsp;
 568         }
 569
 570         /* no SP found */
 571         switch (currsp->policy) {
 572         case IPSEC_POLICY_BYPASS:
 573                 ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
 574                     "Illegal policy for non-priviliged defined %d\n",
 575                     currsp->policy));
 576                 *error = EINVAL;
 577                 currsp = NULL;
 578                 break;
 579         case IPSEC_POLICY_ENTRUST:
 580                 if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 581                  && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 582                         ipseclog((LOG_INFO,
 583                             "fixed system default policy: %d->%d\n",
 584                             ip6_def_policy.policy, IPSEC_POLICY_NONE));
 585                         ip6_def_policy.policy = IPSEC_POLICY_NONE;
 586                 }
 587                 currsp = &ip6_def_policy;
 588                 currsp->refcnt++;
 589                 *error = 0;
 590                 break;
 591         case IPSEC_POLICY_IPSEC:
 592                 currsp->refcnt++;
 593                 *error = 0;
 594                 break;
 595         default:
 596                 ipseclog((LOG_ERR,
 597                     "ipsec6_policybysock: Invalid policy for PCB %d\n",
 598                     currsp->policy));
 599                 *error = EINVAL;
 600                 currsp = NULL;
 601                 break;
 602         }
 603         lwkt_reltoken(&key_token);
 604         return currsp;
 605 }
 606
 607 /*
 608  * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
 609  * and return a pointer to SP.
 610  * `flag' means that packet is to be forwarded whether or not.
 611  *      flag = 1: forwad
 612  * OUT: positive: a pointer to the entry for security policy leaf matched.
 613  *      NULL:   no apropreate SP found, the following value is set to error.
 614  *              0       : bypass
 615  *              EACCES  : discard packet.
 616  *              ENOENT  : ipsec_acquire() in progress, maybe.
 617  *              others  : error occured.
 618  */
 619 #ifndef IP_FORWARDING
 620 #define IP_FORWARDING 1
 621 #endif
 622
 623 struct secpolicy *
 624 ipsec6_getpolicybyaddr(struct mbuf *m, u_int dir, int flag, int *error)
 625 {
 626         struct secpolicy *sp = NULL;
 627         struct secpolicyindex spidx;
 628
 629         /* sanity check */
 630         if (m == NULL || error == NULL)
 631                 panic("ipsec6_getpolicybyaddr: NULL pointer was passed.");
 632         bzero(&spidx, sizeof(spidx));
 633
 634         lwkt_gettoken(&key_token);
 635
 636         /* make an index to look for a policy */
 637         *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET6, m,
 638                                      (flag & IP_FORWARDING) ? 0 : 1);
 639         if (*error != 0) {
 640                 lwkt_reltoken(&key_token);
 641                 return NULL;
 642         }
 643
 644         sp = key_allocsp(&spidx, dir);
 645
 646         /* SP found */
 647         if (sp != NULL) {
 648                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 649                         kprintf("DP ipsec6_getpolicybyaddr called "
 650                                "to allocate SP:%p\n", sp));
 651                 *error = 0;
 652                 lwkt_reltoken(&key_token);
 653                 return sp;
 654         }
 655
 656         /* no SP found */
 657         if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 658          && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 659                 ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n",
 660                     ip6_def_policy.policy, IPSEC_POLICY_NONE));
 661                 ip6_def_policy.policy = IPSEC_POLICY_NONE;
 662         }
 663         sp = &ip6_def_policy;
 664         sp->refcnt++;
 665         *error = 0;
 666         lwkt_reltoken(&key_token);
 667
 668         return sp;
 669 }
 670 #endif /* INET6 */
 671
 672 /*
 673  * set IP address into spidx from mbuf.
 674  * When Forwarding packet and ICMP echo reply, this function is used.
 675  *
 676  * IN:  get the followings from mbuf.
 677  *      protocol family, src, dst, next protocol
 678  * OUT:
 679  *      0:      success.
 680  *      other:  failure, and set errno.
 681  */
 682 static int
 683 ipsec_setspidx_mbuf(struct secpolicyindex *spidx, u_int dir, u_int family,
 684                     struct mbuf *m, int needport)
 685 {
 686         int error;
 687
 688         /* sanity check */
 689         if (spidx == NULL || m == NULL)
 690                 panic("ipsec_setspidx_mbuf: NULL pointer was passed.");
 691
 692         bzero(spidx, sizeof(*spidx));
 693
 694         error = ipsec_setspidx(m, spidx, needport);
 695         if (error)
 696                 goto bad;
 697         spidx->dir = dir;
 698
 699         return 0;
 700
 701 bad:
 702         /* XXX initialize */
 703         bzero(spidx, sizeof(*spidx));
 704         return EINVAL;
 705 }
 706
 707 static int
 708 ipsec4_setspidx_inpcb(struct mbuf *m, struct inpcb *pcb)
 709 {
 710         struct secpolicyindex *spidx;
 711         int error;
 712
 713         /* sanity check */
 714         if (pcb == NULL)
 715                 panic("ipsec4_setspidx_inpcb: no PCB found.");
 716         if (pcb->inp_sp == NULL)
 717                 panic("ipsec4_setspidx_inpcb: no inp_sp found.");
 718         if (pcb->inp_sp->sp_out == NULL || pcb->inp_sp->sp_in == NULL)
 719                 panic("ipsec4_setspidx_inpcb: no sp_in/out found.");
 720
 721         bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
 722         bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
 723
 724         spidx = &pcb->inp_sp->sp_in->spidx;
 725         error = ipsec_setspidx(m, spidx, 1);
 726         if (error)
 727                 goto bad;
 728         spidx->dir = IPSEC_DIR_INBOUND;
 729
 730         spidx = &pcb->inp_sp->sp_out->spidx;
 731         error = ipsec_setspidx(m, spidx, 1);
 732         if (error)
 733                 goto bad;
 734         spidx->dir = IPSEC_DIR_OUTBOUND;
 735
 736         return 0;
 737
 738 bad:
 739         bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
 740         bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
 741         return error;
 742 }
 743
 744 #ifdef INET6
 745 static int
 746 ipsec6_setspidx_in6pcb(struct mbuf *m, struct in6pcb *pcb)
 747 {
 748         struct secpolicyindex *spidx;
 749         int error;
 750
 751         /* sanity check */
 752         if (pcb == NULL)
 753                 panic("ipsec6_setspidx_in6pcb: no PCB found.");
 754         if (pcb->in6p_sp == NULL)
 755                 panic("ipsec6_setspidx_in6pcb: no in6p_sp found.");
 756         if (pcb->in6p_sp->sp_out == NULL || pcb->in6p_sp->sp_in == NULL)
 757                 panic("ipsec6_setspidx_in6pcb: no sp_in/out found.");
 758
 759         bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
 760         bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
 761
 762         spidx = &pcb->in6p_sp->sp_in->spidx;
 763         error = ipsec_setspidx(m, spidx, 1);
 764         if (error)
 765                 goto bad;
 766         spidx->dir = IPSEC_DIR_INBOUND;
 767
 768         spidx = &pcb->in6p_sp->sp_out->spidx;
 769         error = ipsec_setspidx(m, spidx, 1);
 770         if (error)
 771                 goto bad;
 772         spidx->dir = IPSEC_DIR_OUTBOUND;
 773
 774         return 0;
 775
 776 bad:
 777         bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
 778         bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
 779         return error;
 780 }
 781 #endif
 782
 783 /*
 784  * configure security policy index (src/dst/proto/sport/dport)
 785  * by looking at the content of mbuf.
 786  * the caller is responsible for error recovery (like clearing up spidx).
 787  */
 788 static int
 789 ipsec_setspidx(struct mbuf *m, struct secpolicyindex *spidx, int needport)
 790 {
 791         struct ip *ip = NULL;
 792         struct ip ipbuf;
 793         u_int v;
 794         struct mbuf *n;
 795         int len;
 796         int error;
 797
 798         if (m == NULL)
 799                 panic("ipsec_setspidx: m == 0 passed.");
 800
 801         /*
 802          * validate m->m_pkthdr.len.  we see incorrect length if we
 803          * mistakenly call this function with inconsistent mbuf chain
 804          * (like 4.4BSD tcp/udp processing).  XXX should we panic here?
 805          */
 806         len = 0;
 807         for (n = m; n; n = n->m_next)
 808                 len += n->m_len;
 809         if (m->m_pkthdr.len != len) {
 810                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 811                         kprintf("ipsec_setspidx: "
 812                                "total of m_len(%d) != pkthdr.len(%d), "
 813                                "ignored.\n",
 814                                 len, m->m_pkthdr.len));
 815                 return EINVAL;
 816         }
 817
 818         if (m->m_pkthdr.len < sizeof(struct ip)) {
 819                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 820                         kprintf("ipsec_setspidx: "
 821                             "pkthdr.len(%d) < sizeof(struct ip), ignored.\n",
 822                             m->m_pkthdr.len));
 823                 return EINVAL;
 824         }
 825
 826         if (m->m_len >= sizeof(*ip))
 827                 ip = mtod(m, struct ip *);
 828         else {
 829                 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
 830                 ip = &ipbuf;
 831         }
 832 #ifdef _IP_VHL
 833         v = _IP_VHL_V(ip->ip_vhl);
 834 #else
 835         v = ip->ip_v;
 836 #endif
 837         switch (v) {
 838         case 4:
 839                 error = ipsec4_setspidx_ipaddr(m, spidx);
 840                 if (error)
 841                         return error;
 842                 ipsec4_get_ulp(m, spidx, needport);
 843                 return 0;
 844 #ifdef INET6
 845         case 6:
 846                 if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) {
 847                         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 848                                 kprintf("ipsec_setspidx: "
 849                                     "pkthdr.len(%d) < sizeof(struct ip6_hdr), "
 850                                     "ignored.\n", m->m_pkthdr.len));
 851                         return EINVAL;
 852                 }
 853                 error = ipsec6_setspidx_ipaddr(m, spidx);
 854                 if (error)
 855                         return error;
 856                 ipsec6_get_ulp(m, spidx, needport);
 857                 return 0;
 858 #endif
 859         default:
 860                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 861                         kprintf("ipsec_setspidx: "
 862                             "unknown IP version %u, ignored.\n", v));
 863                 return EINVAL;
 864         }
 865 }
 866
 867 static void
 868 ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
 869 {
 870         struct ip ip;
 871         struct ip6_ext ip6e;
 872         u_int8_t nxt;
 873         int off;
 874         struct tcphdr th;
 875         struct udphdr uh;
 876
 877         /* sanity check */
 878         if (m == NULL)
 879                 panic("ipsec4_get_ulp: NULL pointer was passed.");
 880         if (m->m_pkthdr.len < sizeof(ip))
 881                 panic("ipsec4_get_ulp: too short");
 882
 883         /* set default */
 884         spidx->ul_proto = IPSEC_ULPROTO_ANY;
 885         ((struct sockaddr_in *)&spidx->src)->sin_port = IPSEC_PORT_ANY;
 886         ((struct sockaddr_in *)&spidx->dst)->sin_port = IPSEC_PORT_ANY;
 887
 888         m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
 889         /* ip_input() flips it into host endian XXX need more checking */
 890         if (ip.ip_off & (IP_MF | IP_OFFMASK))
 891                 return;
 892
 893         nxt = ip.ip_p;
 894 #ifdef _IP_VHL
 895         off = _IP_VHL_HL(ip->ip_vhl) << 2;
 896 #else
 897         off = ip.ip_hl << 2;
 898 #endif
 899         while (off < m->m_pkthdr.len) {
 900                 switch (nxt) {
 901                 case IPPROTO_TCP:
 902                         spidx->ul_proto = nxt;
 903                         if (!needport)
 904                                 return;
 905                         if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
 906                                 return;
 907                         m_copydata(m, off, sizeof(th), (caddr_t)&th);
 908                         ((struct sockaddr_in *)&spidx->src)->sin_port =
 909                             th.th_sport;
 910                         ((struct sockaddr_in *)&spidx->dst)->sin_port =
 911                             th.th_dport;
 912                         return;
 913                 case IPPROTO_UDP:
 914                         spidx->ul_proto = nxt;
 915                         if (!needport)
 916                                 return;
 917                         if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
 918                                 return;
 919                         m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
 920                         ((struct sockaddr_in *)&spidx->src)->sin_port =
 921                             uh.uh_sport;
 922                         ((struct sockaddr_in *)&spidx->dst)->sin_port =
 923                             uh.uh_dport;
 924                         return;
 925                 case IPPROTO_AH:
 926                         if (off + sizeof(ip6e) > m->m_pkthdr.len)
 927                                 return;
 928                         m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
 929                         off += (ip6e.ip6e_len + 2) << 2;
 930                         nxt = ip6e.ip6e_nxt;
 931                         break;
 932                 case IPPROTO_ICMP:
 933                 default:
 934                         /* XXX intermediate headers??? */
 935                         spidx->ul_proto = nxt;
 936                         return;
 937                 }
 938         }
 939 }
 940
 941 /* assumes that m is sane */
 942 static int
 943 ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
 944 {
 945         struct ip *ip = NULL;
 946         struct ip ipbuf;
 947         struct sockaddr_in *sin;
 948
 949         if (m->m_len >= sizeof(*ip))
 950                 ip = mtod(m, struct ip *);
 951         else {
 952                 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
 953                 ip = &ipbuf;
 954         }
 955
 956         sin = (struct sockaddr_in *)&spidx->src;
 957         bzero(sin, sizeof(*sin));
 958         sin->sin_family = AF_INET;
 959         sin->sin_len = sizeof(struct sockaddr_in);
 960         bcopy(&ip->ip_src, &sin->sin_addr, sizeof(ip->ip_src));
 961         spidx->prefs = sizeof(struct in_addr) << 3;
 962
 963         sin = (struct sockaddr_in *)&spidx->dst;
 964         bzero(sin, sizeof(*sin));
 965         sin->sin_family = AF_INET;
 966         sin->sin_len = sizeof(struct sockaddr_in);
 967         bcopy(&ip->ip_dst, &sin->sin_addr, sizeof(ip->ip_dst));
 968         spidx->prefd = sizeof(struct in_addr) << 3;
 969         return 0;
 970 }
 971
 972 #ifdef INET6
 973 static void
 974 ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
 975 {
 976         int off, nxt;
 977         struct tcphdr th;
 978         struct udphdr uh;
 979
 980         /* sanity check */
 981         if (m == NULL)
 982                 panic("ipsec6_get_ulp: NULL pointer was passed.");
 983
 984         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 985                 kprintf("ipsec6_get_ulp:\n"); kdebug_mbuf(m));
 986
 987         /* set default */
 988         spidx->ul_proto = IPSEC_ULPROTO_ANY;
 989         ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY;
 990         ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY;
 991
 992         nxt = -1;
 993         off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
 994         if (off < 0 || m->m_pkthdr.len < off)
 995                 return;
 996
 997         switch (nxt) {
 998         case IPPROTO_TCP:
 999                 spidx->ul_proto = nxt;
1000                 if (!needport)
1001                         break;
1002                 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
1003                         break;
1004                 m_copydata(m, off, sizeof(th), (caddr_t)&th);
1005                 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport;
1006                 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport;
1007                 break;
1008         case IPPROTO_UDP:
1009                 spidx->ul_proto = nxt;
1010                 if (!needport)
1011                         break;
1012                 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
1013                         break;
1014                 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
1015                 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport;
1016                 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport;
1017                 break;
1018         case IPPROTO_ICMPV6:
1019         default:
1020                 /* XXX intermediate headers??? */
1021                 spidx->ul_proto = nxt;
1022                 break;
1023         }
1024 }
1025
1026 /* assumes that m is sane */
1027 static int
1028 ipsec6_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
1029 {
1030         struct ip6_hdr *ip6 = NULL;
1031         struct ip6_hdr ip6buf;
1032         struct sockaddr_in6 *sin6;
1033
1034         if (m->m_len >= sizeof(*ip6))
1035                 ip6 = mtod(m, struct ip6_hdr *);
1036         else {
1037                 m_copydata(m, 0, sizeof(ip6buf), (caddr_t)&ip6buf);
1038                 ip6 = &ip6buf;
1039         }
1040
1041         sin6 = (struct sockaddr_in6 *)&spidx->src;
1042         bzero(sin6, sizeof(*sin6));
1043         sin6->sin6_family = AF_INET6;
1044         sin6->sin6_len = sizeof(struct sockaddr_in6);
1045         bcopy(&ip6->ip6_src, &sin6->sin6_addr, sizeof(ip6->ip6_src));
1046         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
1047                 sin6->sin6_addr.s6_addr16[1] = 0;
1048                 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
1049         }
1050         spidx->prefs = sizeof(struct in6_addr) << 3;
1051
1052         sin6 = (struct sockaddr_in6 *)&spidx->dst;
1053         bzero(sin6, sizeof(*sin6));
1054         sin6->sin6_family = AF_INET6;
1055         sin6->sin6_len = sizeof(struct sockaddr_in6);
1056         bcopy(&ip6->ip6_dst, &sin6->sin6_addr, sizeof(ip6->ip6_dst));
1057         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
1058                 sin6->sin6_addr.s6_addr16[1] = 0;
1059                 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
1060         }
1061         spidx->prefd = sizeof(struct in6_addr) << 3;
1062
1063         return 0;
1064 }
1065 #endif
1066
1067 static struct inpcbpolicy *
1068 ipsec_newpcbpolicy(void)
1069 {
1070         struct inpcbpolicy *p;
1071
1072         p = (struct inpcbpolicy *)kmalloc(sizeof(*p), M_SECA, M_NOWAIT);
1073         return p;
1074 }
1075
1076 static void
1077 ipsec_delpcbpolicy(struct inpcbpolicy *p)
1078 {
1079         kfree(p, M_SECA);
1080 }
1081
1082 /* initialize policy in PCB */
1083 int
1084 ipsec_init_policy(struct socket *so, struct inpcbpolicy **pcb_sp)
1085 {
1086         struct inpcbpolicy *new;
1087
1088         /* sanity check. */
1089         if (so == NULL || pcb_sp == NULL)
1090                 panic("ipsec_init_policy: NULL pointer was passed.");
1091
1092         lwkt_gettoken(&key_token);
1093
1094         new = ipsec_newpcbpolicy();
1095         if (new == NULL) {
1096                 ipseclog((LOG_DEBUG, "ipsec_init_policy: No more memory.\n"));
1097                 lwkt_reltoken(&key_token);
1098                 return ENOBUFS;
1099         }
1100         bzero(new, sizeof(*new));
1101
1102         if (so->so_cred != NULL && so->so_cred->cr_uid == 0)
1103                 new->priv = 1;
1104         else
1105                 new->priv = 0;
1106
1107         if ((new->sp_in = key_newsp()) == NULL) {
1108                 ipsec_delpcbpolicy(new);
1109                 lwkt_reltoken(&key_token);
1110                 return ENOBUFS;
1111         }
1112         new->sp_in->state = IPSEC_SPSTATE_ALIVE;
1113         new->sp_in->policy = IPSEC_POLICY_ENTRUST;
1114
1115         if ((new->sp_out = key_newsp()) == NULL) {
1116                 key_freesp(new->sp_in);
1117                 ipsec_delpcbpolicy(new);
1118                 lwkt_reltoken(&key_token);
1119                 return ENOBUFS;
1120         }
1121         new->sp_out->state = IPSEC_SPSTATE_ALIVE;
1122         new->sp_out->policy = IPSEC_POLICY_ENTRUST;
1123
1124         *pcb_sp = new;
1125         lwkt_reltoken(&key_token);
1126
1127         return 0;
1128 }
1129
1130 /* copy old ipsec policy into new */
1131 int
1132 ipsec_copy_policy(struct inpcbpolicy *old, struct inpcbpolicy *new)
1133 {
1134         struct secpolicy *sp;
1135
1136         lwkt_gettoken(&key_token);
1137         sp = ipsec_deepcopy_policy(old->sp_in);
1138         if (sp) {
1139                 key_freesp(new->sp_in);
1140                 new->sp_in = sp;
1141         } else {
1142                 lwkt_reltoken(&key_token);
1143                 return ENOBUFS;
1144         }
1145
1146         sp = ipsec_deepcopy_policy(old->sp_out);
1147         if (sp) {
1148                 key_freesp(new->sp_out);
1149                 new->sp_out = sp;
1150         } else {
1151                 lwkt_reltoken(&key_token);
1152                 return ENOBUFS;
1153         }
1154
1155         new->priv = old->priv;
1156         lwkt_reltoken(&key_token);
1157
1158         return 0;
1159 }
1160
1161 /* deep-copy a policy in PCB */
1162 static struct secpolicy *
1163 ipsec_deepcopy_policy(struct secpolicy *src)
1164 {
1165         struct ipsecrequest *newchain = NULL;
1166         struct ipsecrequest *p;
1167         struct ipsecrequest **q;
1168         struct ipsecrequest *r;
1169         struct secpolicy *dst;
1170
1171         lwkt_gettoken(&key_token);
1172         dst = key_newsp();
1173         if (src == NULL || dst == NULL) {
1174                 lwkt_reltoken(&key_token);
1175                 return NULL;
1176         }
1177
1178         /*
1179          * deep-copy IPsec request chain.  This is required since struct
1180          * ipsecrequest is not reference counted.
1181          */
1182         q = &newchain;
1183         for (p = src->req; p; p = p->next) {
1184                 *q = (struct ipsecrequest *)kmalloc(sizeof(struct ipsecrequest),
1185                         M_SECA, M_NOWAIT | M_ZERO);
1186                 if (*q == NULL)
1187                         goto fail;
1188                 (*q)->next = NULL;
1189
1190                 (*q)->saidx.proto = p->saidx.proto;
1191                 (*q)->saidx.mode = p->saidx.mode;
1192                 (*q)->level = p->level;
1193                 (*q)->saidx.reqid = p->saidx.reqid;
1194
1195                 bcopy(&p->saidx.src, &(*q)->saidx.src, sizeof((*q)->saidx.src));
1196                 bcopy(&p->saidx.dst, &(*q)->saidx.dst, sizeof((*q)->saidx.dst));
1197
1198                 (*q)->sav = NULL;
1199                 (*q)->sp = dst;
1200
1201                 q = &((*q)->next);
1202         }
1203
1204         dst->req = newchain;
1205         dst->state = src->state;
1206         dst->policy = src->policy;
1207         /* do not touch the refcnt fields */
1208         lwkt_reltoken(&key_token);
1209
1210         return dst;
1211
1212 fail:
1213         lwkt_reltoken(&key_token);
1214         for (p = newchain; p; p = r) {
1215                 r = p->next;
1216                 kfree(p, M_SECA);
1217                 p = NULL;
1218         }
1219         return NULL;
1220 }
1221
1222 /* set policy and ipsec request if present. */
1223 static int
1224 ipsec_set_policy(struct secpolicy **pcb_sp, int optname, caddr_t request,
1225                  size_t len, int priv)
1226 {
1227         struct sadb_x_policy *xpl;
1228         struct secpolicy *newsp = NULL;
1229         int error;
1230
1231         /* sanity check. */
1232         if (pcb_sp == NULL || *pcb_sp == NULL || request == NULL)
1233                 return EINVAL;
1234         if (len < sizeof(*xpl))
1235                 return EINVAL;
1236         xpl = (struct sadb_x_policy *)request;
1237
1238         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1239                 kprintf("ipsec_set_policy: passed policy\n");
1240                 kdebug_sadb_x_policy((struct sadb_ext *)xpl));
1241
1242         /* check policy type */
1243         /* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */
1244         if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD ||
1245             xpl->sadb_x_policy_type == IPSEC_POLICY_NONE)
1246                 return EINVAL;
1247
1248         /* check privileged socket */
1249         if (priv == 0 && xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS)
1250                 return EACCES;
1251
1252         /* allocation new SP entry */
1253         if ((newsp = key_msg2sp(xpl, len, &error)) == NULL)
1254                 return error;
1255
1256         newsp->state = IPSEC_SPSTATE_ALIVE;
1257
1258         /* clear old SP and set new SP */
1259         key_freesp(*pcb_sp);
1260         *pcb_sp = newsp;
1261         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1262                 kprintf("ipsec_set_policy: new policy\n");
1263                 kdebug_secpolicy(newsp));
1264
1265         return 0;
1266 }
1267
1268 static int
1269 ipsec_get_policy(struct secpolicy *pcb_sp, struct mbuf **mp)
1270 {
1271
1272         /* sanity check. */
1273         if (pcb_sp == NULL || mp == NULL)
1274                 return EINVAL;
1275
1276         *mp = key_sp2msg(pcb_sp);
1277         if (!*mp) {
1278                 ipseclog((LOG_DEBUG, "ipsec_get_policy: No more memory.\n"));
1279                 return ENOBUFS;
1280         }
1281
1282         KKASSERT((*mp)->m_type == MT_DATA);
1283         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1284                 kprintf("ipsec_get_policy:\n");
1285                 kdebug_mbuf(*mp));
1286
1287         return 0;
1288 }
1289
1290 int
1291 ipsec4_set_policy(struct inpcb *inp, int optname, caddr_t request, size_t len,
1292                   int priv)
1293 {
1294         struct sadb_x_policy *xpl;
1295         struct secpolicy **pcb_sp;
1296         int error;
1297
1298         /* sanity check. */
1299         if (inp == NULL || request == NULL)
1300                 return EINVAL;
1301         if (len < sizeof(*xpl))
1302                 return EINVAL;
1303         xpl = (struct sadb_x_policy *)request;
1304
1305         lwkt_gettoken(&key_token);
1306         /* select direction */
1307         switch (xpl->sadb_x_policy_dir) {
1308         case IPSEC_DIR_INBOUND:
1309                 pcb_sp = &inp->inp_sp->sp_in;
1310                 break;
1311         case IPSEC_DIR_OUTBOUND:
1312                 pcb_sp = &inp->inp_sp->sp_out;
1313                 break;
1314         default:
1315                 ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1316                         xpl->sadb_x_policy_dir));
1317                 lwkt_reltoken(&key_token);
1318                 return EINVAL;
1319         }
1320         error = ipsec_set_policy(pcb_sp, optname, request, len, priv);
1321         lwkt_reltoken(&key_token);
1322         return error;
1323 }
1324
1325 int
1326 ipsec4_get_policy(struct inpcb *inp, caddr_t request, size_t len,
1327                   struct mbuf **mp)
1328 {
1329         struct sadb_x_policy *xpl;
1330         struct secpolicy *pcb_sp;
1331         int error;
1332
1333         /* sanity check. */
1334         if (inp == NULL || request == NULL || mp == NULL)
1335                 return EINVAL;
1336         if (inp->inp_sp == NULL)
1337                 panic("policy in PCB is NULL");
1338         if (len < sizeof(*xpl))
1339                 return EINVAL;
1340         xpl = (struct sadb_x_policy *)request;
1341
1342         lwkt_gettoken(&key_token);
1343
1344         /* select direction */
1345         switch (xpl->sadb_x_policy_dir) {
1346         case IPSEC_DIR_INBOUND:
1347                 pcb_sp = inp->inp_sp->sp_in;
1348                 break;
1349         case IPSEC_DIR_OUTBOUND:
1350                 pcb_sp = inp->inp_sp->sp_out;
1351                 break;
1352         default:
1353                 ipseclog((LOG_ERR, "ipsec4_get_policy: invalid direction=%u\n",
1354                         xpl->sadb_x_policy_dir));
1355                 lwkt_reltoken(&key_token);
1356                 return EINVAL;
1357         }
1358         error = ipsec_get_policy(pcb_sp, mp);
1359         lwkt_reltoken(&key_token);
1360         return error;
1361 }
1362
1363 /* delete policy in PCB */
1364 int
1365 ipsec4_delete_pcbpolicy(struct inpcb *inp)
1366 {
1367         struct inpcbpolicy *isp;
1368
1369         /* sanity check. */
1370         if (inp == NULL)
1371                 panic("ipsec4_delete_pcbpolicy: NULL pointer was passed.");
1372
1373         lwkt_gettoken(&key_token);
1374
1375         if ((isp = inp->inp_sp) == NULL) {
1376                 lwkt_reltoken(&key_token);
1377                 return 0;
1378         }
1379
1380         if (isp->sp_in != NULL) {
1381                 key_freesp(isp->sp_in);
1382                 isp->sp_in = NULL;
1383         }
1384
1385         if (isp->sp_out != NULL) {
1386                 key_freesp(isp->sp_out);
1387                 isp->sp_out = NULL;
1388         }
1389         KKASSERT(inp->inp_sp == isp);
1390         inp->inp_sp = NULL;
1391         ipsec_delpcbpolicy(isp);
1392         lwkt_reltoken(&key_token);
1393
1394         return 0;
1395 }
1396
1397 #ifdef INET6
1398 int
1399 ipsec6_set_policy(struct in6pcb *in6p, int optname, caddr_t request, size_t len,
1400                   int priv)
1401 {
1402         struct sadb_x_policy *xpl;
1403         struct secpolicy **pcb_sp;
1404         int error;
1405
1406         /* sanity check. */
1407         if (in6p == NULL || request == NULL)
1408                 return EINVAL;
1409         if (len < sizeof(*xpl))
1410                 return EINVAL;
1411         xpl = (struct sadb_x_policy *)request;
1412
1413         lwkt_gettoken(&key_token);
1414
1415         /* select direction */
1416         switch (xpl->sadb_x_policy_dir) {
1417         case IPSEC_DIR_INBOUND:
1418                 pcb_sp = &in6p->in6p_sp->sp_in;
1419                 break;
1420         case IPSEC_DIR_OUTBOUND:
1421                 pcb_sp = &in6p->in6p_sp->sp_out;
1422                 break;
1423         default:
1424                 ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1425                         xpl->sadb_x_policy_dir));
1426                 lwkt_reltoken(&key_token);
1427                 return EINVAL;
1428         }
1429
1430         error = ipsec_set_policy(pcb_sp, optname, request, len, priv);
1431         lwkt_reltoken(&key_token);
1432         return error;
1433 }
1434
1435 int
1436 ipsec6_get_policy(struct in6pcb *in6p, caddr_t request, size_t len,
1437                   struct mbuf **mp)
1438 {
1439         struct sadb_x_policy *xpl;
1440         struct secpolicy *pcb_sp;
1441         int error;
1442
1443         /* sanity check. */
1444         if (in6p == NULL || request == NULL || mp == NULL)
1445                 return EINVAL;
1446         if (in6p->in6p_sp == NULL)
1447                 panic("policy in PCB is NULL");
1448         if (len < sizeof(*xpl))
1449                 return EINVAL;
1450         xpl = (struct sadb_x_policy *)request;
1451
1452         lwkt_gettoken(&key_token);
1453
1454         /* select direction */
1455         switch (xpl->sadb_x_policy_dir) {
1456         case IPSEC_DIR_INBOUND:
1457                 pcb_sp = in6p->in6p_sp->sp_in;
1458                 break;
1459         case IPSEC_DIR_OUTBOUND:
1460                 pcb_sp = in6p->in6p_sp->sp_out;
1461                 break;
1462         default:
1463                 ipseclog((LOG_ERR, "ipsec6_get_policy: invalid direction=%u\n",
1464                         xpl->sadb_x_policy_dir));
1465                 lwkt_reltoken(&key_token);
1466                 return EINVAL;
1467         }
1468
1469         error = ipsec_get_policy(pcb_sp, mp);
1470         lwkt_reltoken(&key_token);
1471         return error;
1472 }
1473
1474 int
1475 ipsec6_delete_pcbpolicy(struct in6pcb *in6p)
1476 {
1477         struct inpcbpolicy *isp;
1478
1479         /* sanity check. */
1480         if (in6p == NULL)
1481                 panic("ipsec6_delete_pcbpolicy: NULL pointer was passed.");
1482
1483         lwkt_gettoken(&key_token);
1484
1485         if ((isp = in6p->in6p_sp) == NULL) {
1486                 lwkt_reltoken(&key_token);
1487                 return 0;
1488         }
1489
1490         if (isp->sp_in != NULL) {
1491                 key_freesp(isp->sp_in);
1492                 isp->sp_in = NULL;
1493         }
1494
1495         if (isp->sp_out != NULL) {
1496                 key_freesp(isp->sp_out);
1497                 isp->sp_out = NULL;
1498         }
1499         KKASSERT(in6p->in6p_sp == isp);
1500         in6p->in6p_sp = NULL;
1501         ipsec_delpcbpolicy(isp);
1502         lwkt_reltoken(&key_token);
1503
1504         return 0;
1505 }
1506 #endif
1507
1508 /*
1509  * return current level.
1510  * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
1511  */
1512 u_int
1513 ipsec_get_reqlevel(struct ipsecrequest *isr)
1514 {
1515         u_int level = 0;
1516         u_int esp_trans_deflev, esp_net_deflev, ah_trans_deflev, ah_net_deflev;
1517
1518         /* sanity check */
1519         if (isr == NULL || isr->sp == NULL)
1520                 panic("ipsec_get_reqlevel: NULL pointer is passed.");
1521         if (((struct sockaddr *)&isr->sp->spidx.src)->sa_family
1522                         != ((struct sockaddr *)&isr->sp->spidx.dst)->sa_family)
1523                 panic("ipsec_get_reqlevel: family mismatched.");
1524
1525 /* XXX note that we have ipseclog() expanded here - code sync issue */
1526 #define IPSEC_CHECK_DEFAULT(lev) \
1527         (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE            \
1528                         && (lev) != IPSEC_LEVEL_UNIQUE)                       \
1529                 ? (ipsec_debug                                                \
1530                         ? log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
1531                                 (lev), IPSEC_LEVEL_REQUIRE)                   \
1532                         : 0),                                                 \
1533                         (lev) = IPSEC_LEVEL_REQUIRE,                          \
1534                         (lev)                                                 \
1535                 : (lev))
1536
1537         /* set default level */
1538         switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) {
1539 #ifdef INET
1540         case AF_INET:
1541                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev);
1542                 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev);
1543                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev);
1544                 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev);
1545                 break;
1546 #endif
1547 #ifdef INET6
1548         case AF_INET6:
1549                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev);
1550                 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev);
1551                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev);
1552                 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev);
1553                 break;
1554 #endif /* INET6 */
1555         default:
1556                 panic("key_get_reqlevel: Unknown family. %d",
1557                         ((struct sockaddr *)&isr->sp->spidx.src)->sa_family);
1558         }
1559
1560 #undef IPSEC_CHECK_DEFAULT
1561
1562         /* set level */
1563         switch (isr->level) {
1564         case IPSEC_LEVEL_DEFAULT:
1565                 switch (isr->saidx.proto) {
1566                 case IPPROTO_ESP:
1567                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1568                                 level = esp_net_deflev;
1569                         else
1570                                 level = esp_trans_deflev;
1571                         break;
1572                 case IPPROTO_AH:
1573                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1574                                 level = ah_net_deflev;
1575                         else
1576                                 level = ah_trans_deflev;
1577                 case IPPROTO_IPCOMP:
1578                         /*
1579                          * we don't really care, as IPcomp document says that
1580                          * we shouldn't compress small packets
1581                          */
1582                         level = IPSEC_LEVEL_USE;
1583                         break;
1584                 default:
1585                         panic("ipsec_get_reqlevel: "
1586                                 "Illegal protocol defined %u",
1587                                 isr->saidx.proto);
1588                 }
1589                 break;
1590
1591         case IPSEC_LEVEL_USE:
1592         case IPSEC_LEVEL_REQUIRE:
1593                 level = isr->level;
1594                 break;
1595         case IPSEC_LEVEL_UNIQUE:
1596                 level = IPSEC_LEVEL_REQUIRE;
1597                 break;
1598
1599         default:
1600                 panic("ipsec_get_reqlevel: Illegal IPsec level %u",
1601                         isr->level);
1602         }
1603
1604         return level;
1605 }
1606
1607 /*
1608  * Check AH/ESP integrity.
1609  * OUT:
1610  *      0: valid
1611  *      1: invalid
1612  */
1613 static int
1614 ipsec_in_reject(struct secpolicy *sp, struct mbuf *m)
1615 {
1616         struct ipsecrequest *isr;
1617         u_int level;
1618         int need_auth, need_conf, need_icv;
1619
1620         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1621                 kprintf("ipsec_in_reject: using SP\n");
1622                 kdebug_secpolicy(sp));
1623
1624         /* check policy */
1625         switch (sp->policy) {
1626         case IPSEC_POLICY_DISCARD:
1627                 return 1;
1628         case IPSEC_POLICY_BYPASS:
1629         case IPSEC_POLICY_NONE:
1630                 return 0;
1631
1632         case IPSEC_POLICY_IPSEC:
1633                 break;
1634
1635         case IPSEC_POLICY_ENTRUST:
1636         default:
1637                 panic("ipsec_hdrsiz: Invalid policy found. %d", sp->policy);
1638         }
1639
1640         need_auth = 0;
1641         need_conf = 0;
1642         need_icv = 0;
1643
1644         /* XXX should compare policy against ipsec header history */
1645
1646         for (isr = sp->req; isr != NULL; isr = isr->next) {
1647                 /* get current level */
1648                 level = ipsec_get_reqlevel(isr);
1649
1650                 switch (isr->saidx.proto) {
1651                 case IPPROTO_ESP:
1652                         if (level == IPSEC_LEVEL_REQUIRE) {
1653                                 need_conf++;
1654
1655                                 if (isr->sav != NULL
1656                                  && isr->sav->flags == SADB_X_EXT_NONE
1657                                  && isr->sav->alg_auth != SADB_AALG_NONE)
1658                                         need_icv++;
1659                         }
1660                         break;
1661                 case IPPROTO_AH:
1662                         if (level == IPSEC_LEVEL_REQUIRE) {
1663                                 need_auth++;
1664                                 need_icv++;
1665                         }
1666                         break;
1667                 case IPPROTO_IPCOMP:
1668                         /*
1669                          * we don't really care, as IPcomp document says that
1670                          * we shouldn't compress small packets, IPComp policy
1671                          * should always be treated as being in "use" level.
1672                          */
1673                         break;
1674                 }
1675         }
1676
1677         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1678                 kprintf("ipsec_in_reject: auth:%d conf:%d icv:%d m_flags:%x\n",
1679                         need_auth, need_conf, need_icv, m->m_flags));
1680
1681         if ((need_conf && !(m->m_flags & M_DECRYPTED))
1682          || (!need_auth && need_icv && !(m->m_flags & M_AUTHIPDGM))
1683          || (need_auth && !(m->m_flags & M_AUTHIPHDR)))
1684                 return 1;
1685
1686         return 0;
1687 }
1688
1689 /*
1690  * Check AH/ESP integrity.
1691  * This function is called from tcp_input(), udp_input(),
1692  * and {ah,esp}4_input for tunnel mode
1693  */
1694 int
1695 ipsec4_in_reject_so(struct mbuf *m, struct socket *so)
1696 {
1697         struct secpolicy *sp = NULL;
1698         int error;
1699         int result;
1700
1701         /* sanity check */
1702         if (m == NULL)
1703                 return 0;       /* XXX should be panic ? */
1704
1705         /* get SP for this packet.
1706          * When we are called from ip_forward(), we call
1707          * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
1708          */
1709         lwkt_gettoken(&key_token);
1710         if (so == NULL) {
1711                 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
1712                     IP_FORWARDING, &error);
1713         } else {
1714                 sp = ipsec4_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
1715         }
1716
1717         /* XXX should be panic ? -> No, there may be error. */
1718         if (sp == NULL) {
1719                 lwkt_reltoken(&key_token);
1720                 return 0;
1721         }
1722
1723         result = ipsec_in_reject(sp, m);
1724         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1725                 kprintf("DP ipsec4_in_reject_so call free SP:%p\n", sp));
1726         key_freesp(sp);
1727         lwkt_reltoken(&key_token);
1728
1729         return result;
1730 }
1731
1732 int
1733 ipsec4_in_reject(struct mbuf *m, struct inpcb *inp)
1734 {
1735         if (inp == NULL)
1736                 return ipsec4_in_reject_so(m, NULL);
1737         if (inp->inp_socket)
1738                 return ipsec4_in_reject_so(m, inp->inp_socket);
1739         else
1740                 panic("ipsec4_in_reject: invalid inpcb/socket");
1741 }
1742
1743 #ifdef INET6
1744 /*
1745  * Check AH/ESP integrity.
1746  * This function is called from tcp6_input(), udp6_input(),
1747  * and {ah,esp}6_input for tunnel mode
1748  */
1749 int
1750 ipsec6_in_reject_so(struct mbuf *m, struct socket *so)
1751 {
1752         struct secpolicy *sp = NULL;
1753         int error;
1754         int result;
1755
1756         /* sanity check */
1757         if (m == NULL)
1758                 return 0;       /* XXX should be panic ? */
1759
1760         /* get SP for this packet.
1761          * When we are called from ip_forward(), we call
1762          * ipsec6_getpolicybyaddr() with IP_FORWARDING flag.
1763          */
1764         lwkt_gettoken(&key_token);
1765         if (so == NULL) {
1766                 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
1767                     IP_FORWARDING, &error);
1768         } else {
1769                 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
1770         }
1771
1772         if (sp == NULL) {
1773                 lwkt_reltoken(&key_token);
1774                 return 0;       /* XXX should be panic ? */
1775         }
1776
1777         result = ipsec_in_reject(sp, m);
1778         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1779                 kprintf("DP ipsec6_in_reject_so call free SP:%p\n", sp));
1780         key_freesp(sp);
1781         lwkt_reltoken(&key_token);
1782
1783         return result;
1784 }
1785
1786 int
1787 ipsec6_in_reject(struct mbuf *m, struct in6pcb *in6p)
1788 {
1789         if (in6p == NULL)
1790                 return ipsec6_in_reject_so(m, NULL);
1791         if (in6p->in6p_socket)
1792                 return ipsec6_in_reject_so(m, in6p->in6p_socket);
1793         else
1794                 panic("ipsec6_in_reject: invalid in6p/socket");
1795 }
1796 #endif
1797
1798 /*
1799  * compute the byte size to be occupied by IPsec header.
1800  * in case it is tunneled, it includes the size of outer IP header.
1801  * NOTE: SP passed is free in this function.
1802  */
1803 static size_t
1804 ipsec_hdrsiz(struct secpolicy *sp)
1805 {
1806         struct ipsecrequest *isr;
1807         size_t siz, clen;
1808
1809         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1810                 kprintf("ipsec_hdrsiz: using SP\n");
1811                 kdebug_secpolicy(sp));
1812
1813         /* check policy */
1814         switch (sp->policy) {
1815         case IPSEC_POLICY_DISCARD:
1816         case IPSEC_POLICY_BYPASS:
1817         case IPSEC_POLICY_NONE:
1818                 return 0;
1819
1820         case IPSEC_POLICY_IPSEC:
1821                 break;
1822
1823         case IPSEC_POLICY_ENTRUST:
1824         default:
1825                 panic("ipsec_hdrsiz: Invalid policy found. %d", sp->policy);
1826         }
1827
1828         siz = 0;
1829
1830         for (isr = sp->req; isr != NULL; isr = isr->next) {
1831
1832                 clen = 0;
1833
1834                 switch (isr->saidx.proto) {
1835                 case IPPROTO_ESP:
1836 #ifdef IPSEC_ESP
1837                         clen = esp_hdrsiz(isr);
1838 #else
1839                         clen = 0;       /* XXX */
1840 #endif
1841                         break;
1842                 case IPPROTO_AH:
1843                         clen = ah_hdrsiz(isr);
1844                         break;
1845                 case IPPROTO_IPCOMP:
1846                         clen = sizeof(struct ipcomp);
1847                         break;
1848                 }
1849
1850                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
1851                         switch (((struct sockaddr *)&isr->saidx.dst)->sa_family) {
1852                         case AF_INET:
1853                                 clen += sizeof(struct ip);
1854                                 break;
1855 #ifdef INET6
1856                         case AF_INET6:
1857                                 clen += sizeof(struct ip6_hdr);
1858                                 break;
1859 #endif
1860                         default:
1861                                 ipseclog((LOG_ERR, "ipsec_hdrsiz: "
1862                                     "unknown AF %d in IPsec tunnel SA\n",
1863                                     ((struct sockaddr *)&isr->saidx.dst)->sa_family));
1864                                 break;
1865                         }
1866                 }
1867                 siz += clen;
1868         }
1869
1870         return siz;
1871 }
1872
1873 /* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */
1874 size_t
1875 ipsec4_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
1876 {
1877         struct secpolicy *sp = NULL;
1878         int error;
1879         size_t size;
1880
1881         /* sanity check */
1882         if (m == NULL)
1883                 return 0;       /* XXX should be panic ? */
1884         if (inp != NULL && inp->inp_socket == NULL)
1885                 panic("ipsec4_hdrsize: why is socket NULL but there is PCB.");
1886
1887         /* get SP for this packet.
1888          * When we are called from ip_forward(), we call
1889          * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
1890          */
1891         lwkt_gettoken(&key_token);
1892         if (inp == NULL)
1893                 sp = ipsec4_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1894         else
1895                 sp = ipsec4_getpolicybysock(m, dir, inp->inp_socket, &error);
1896
1897         if (sp == NULL) {
1898                 lwkt_reltoken(&key_token);
1899                 return 0;       /* XXX should be panic ? */
1900         }
1901
1902         size = ipsec_hdrsiz(sp);
1903         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1904                 kprintf("DP ipsec4_hdrsiz call free SP:%p\n", sp));
1905         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1906                 kprintf("ipsec4_hdrsiz: size:%lu.\n", (unsigned long)size));
1907         key_freesp(sp);
1908         lwkt_reltoken(&key_token);
1909
1910         return size;
1911 }
1912
1913 #ifdef INET6
1914 /* This function is called from ipsec6_hdrsize_tcp(),
1915  * and maybe from ip6_forward.()
1916  */
1917 size_t
1918 ipsec6_hdrsiz(struct mbuf *m, u_int dir, struct in6pcb *in6p)
1919 {
1920         struct secpolicy *sp = NULL;
1921         int error;
1922         size_t size;
1923
1924         /* sanity check */
1925         if (m == NULL)
1926                 return 0;       /* XXX shoud be panic ? */
1927         if (in6p != NULL && in6p->in6p_socket == NULL)
1928                 panic("ipsec6_hdrsize: why is socket NULL but there is PCB.");
1929
1930         /* get SP for this packet */
1931         /* XXX Is it right to call with IP_FORWARDING. */
1932         lwkt_gettoken(&key_token);
1933         if (in6p == NULL)
1934                 sp = ipsec6_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1935         else
1936                 sp = ipsec6_getpolicybysock(m, dir, in6p->in6p_socket, &error);
1937
1938         if (sp == NULL) {
1939                 lwkt_reltoken(&key_token);
1940                 return 0;
1941         }
1942         size = ipsec_hdrsiz(sp);
1943         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1944                 kprintf("DP ipsec6_hdrsiz call free SP:%p\n", sp));
1945         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1946                 kprintf("ipsec6_hdrsiz: size:%lu.\n", (unsigned long)size));
1947         key_freesp(sp);
1948         lwkt_reltoken(&key_token);
1949
1950         return size;
1951 }
1952 #endif /* INET6 */
1953
1954 #ifdef INET
1955 /*
1956  * encapsulate for ipsec tunnel.
1957  * ip->ip_src must be fixed later on.
1958  */
1959 static int
1960 ipsec4_encapsulate(struct mbuf *m, struct secasvar *sav)
1961 {
1962         struct ip *oip;
1963         struct ip *ip;
1964         size_t hlen;
1965         size_t plen;
1966
1967         /* can't tunnel between different AFs */
1968         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
1969                 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
1970          || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET) {
1971                 m_freem(m);
1972                 return EINVAL;
1973         }
1974 #if 0
1975         /* XXX if the dst is myself, perform nothing. */
1976         if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
1977                 m_freem(m);
1978                 return EINVAL;
1979         }
1980 #endif
1981
1982         if (m->m_len < sizeof(*ip))
1983                 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
1984
1985         ip = mtod(m, struct ip *);
1986 #ifdef _IP_VHL
1987         hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
1988 #else
1989         hlen = ip->ip_hl << 2;
1990 #endif
1991
1992         if (m->m_len != hlen)
1993                 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
1994
1995         /* generate header checksum */
1996         ip->ip_sum = 0;
1997 #ifdef _IP_VHL
1998         if (ip->ip_vhl == IP_VHL_BORING)
1999                 ip->ip_sum = in_cksum_hdr(ip);
2000         else
2001                 ip->ip_sum = in_cksum(m, hlen);
2002 #else
2003         ip->ip_sum = in_cksum(m, hlen);
2004 #endif
2005
2006         plen = m->m_pkthdr.len;
2007
2008         /*
2009          * grow the mbuf to accomodate the new IPv4 header.
2010          * NOTE: IPv4 options will never be copied.
2011          */
2012         if (M_LEADINGSPACE(m->m_next) < hlen) {
2013                 struct mbuf *n;
2014                 MGET(n, M_NOWAIT, MT_DATA);
2015                 if (!n) {
2016                         m_freem(m);
2017                         return ENOBUFS;
2018                 }
2019                 n->m_len = hlen;
2020                 n->m_next = m->m_next;
2021                 m->m_next = n;
2022                 m->m_pkthdr.len += hlen;
2023                 oip = mtod(n, struct ip *);
2024         } else {
2025                 m->m_next->m_len += hlen;
2026                 m->m_next->m_data -= hlen;
2027                 m->m_pkthdr.len += hlen;
2028                 oip = mtod(m->m_next, struct ip *);
2029         }
2030         ip = mtod(m, struct ip *);
2031         ovbcopy((caddr_t)ip, (caddr_t)oip, hlen);
2032         m->m_len = sizeof(struct ip);
2033         m->m_pkthdr.len -= (hlen - sizeof(struct ip));
2034
2035         /* construct new IPv4 header. see RFC 2401 5.1.2.1 */
2036         /* ECN consideration. */
2037         ip_ecn_ingress(ip4_ipsec_ecn, &ip->ip_tos, &oip->ip_tos);
2038 #ifdef _IP_VHL
2039         ip->ip_vhl = IP_MAKE_VHL(IPVERSION, sizeof(struct ip) >> 2);
2040 #else
2041         ip->ip_hl = sizeof(struct ip) >> 2;
2042 #endif
2043         ip->ip_off &= htons(~IP_OFFMASK);
2044         ip->ip_off &= htons(~IP_MF);
2045         switch (ip4_ipsec_dfbit) {
2046         case 0: /* clear DF bit */
2047                 ip->ip_off &= htons(~IP_DF);
2048                 break;
2049         case 1: /* set DF bit */
2050                 ip->ip_off |= htons(IP_DF);
2051                 break;
2052         default:        /* copy DF bit */
2053                 break;
2054         }
2055         ip->ip_p = IPPROTO_IPIP;
2056         if (plen + sizeof(struct ip) < IP_MAXPACKET)
2057                 ip->ip_len = htons(plen + sizeof(struct ip));
2058         else {
2059                 ipseclog((LOG_ERR, "IPv4 ipsec: size exceeds limit: "
2060                     "leave ip_len as is (invalid packet)\n"));
2061         }
2062 #ifdef RANDOM_IP_ID
2063         ip->ip_id = ip_randomid();
2064 #else
2065         ip->ip_id = htons(ip_id++);
2066 #endif
2067         bcopy(&((struct sockaddr_in *)&sav->sah->saidx.src)->sin_addr,
2068                 &ip->ip_src, sizeof(ip->ip_src));
2069         bcopy(&((struct sockaddr_in *)&sav->sah->saidx.dst)->sin_addr,
2070                 &ip->ip_dst, sizeof(ip->ip_dst));
2071         ip->ip_ttl = IPDEFTTL;
2072
2073         /* XXX Should ip_src be updated later ? */
2074
2075         return 0;
2076 }
2077 #endif /* INET */
2078
2079 #ifdef INET6
2080 static int
2081 ipsec6_encapsulate(struct mbuf *m, struct secasvar *sav)
2082 {
2083         struct ip6_hdr *oip6;
2084         struct ip6_hdr *ip6;
2085         size_t plen;
2086
2087         /* can't tunnel between different AFs */
2088         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2089                 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
2090          || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET6) {
2091                 m_freem(m);
2092                 return EINVAL;
2093         }
2094 #if 0
2095         /* XXX if the dst is myself, perform nothing. */
2096         if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
2097                 m_freem(m);
2098                 return EINVAL;
2099         }
2100 #endif
2101
2102         plen = m->m_pkthdr.len;
2103
2104         /*
2105          * grow the mbuf to accomodate the new IPv6 header.
2106          */
2107         if (m->m_len != sizeof(struct ip6_hdr))
2108                 panic("ipsec6_encapsulate: assumption failed (first mbuf length)");
2109         if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
2110                 struct mbuf *n;
2111                 MGET(n, M_NOWAIT, MT_DATA);
2112                 if (!n) {
2113                         m_freem(m);
2114                         return ENOBUFS;
2115                 }
2116                 n->m_len = sizeof(struct ip6_hdr);
2117                 n->m_next = m->m_next;
2118                 m->m_next = n;
2119                 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2120                 oip6 = mtod(n, struct ip6_hdr *);
2121         } else {
2122                 m->m_next->m_len += sizeof(struct ip6_hdr);
2123                 m->m_next->m_data -= sizeof(struct ip6_hdr);
2124                 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2125                 oip6 = mtod(m->m_next, struct ip6_hdr *);
2126         }
2127         ip6 = mtod(m, struct ip6_hdr *);
2128         ovbcopy((caddr_t)ip6, (caddr_t)oip6, sizeof(struct ip6_hdr));
2129
2130         /* XXX: Fake scoped addresses */
2131         in6_clearscope(&oip6->ip6_src);
2132         in6_clearscope(&oip6->ip6_dst);
2133
2134         /* construct new IPv6 header. see RFC 2401 5.1.2.2 */
2135         /* ECN consideration. */
2136         ip6_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &oip6->ip6_flow);
2137         if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
2138                 ip6->ip6_plen = htons(plen);
2139         else {
2140                 /* ip6->ip6_plen will be updated in ip6_output() */
2141         }
2142         ip6->ip6_nxt = IPPROTO_IPV6;
2143         bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.src)->sin6_addr,
2144                 &ip6->ip6_src, sizeof(ip6->ip6_src));
2145         bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.dst)->sin6_addr,
2146                 &ip6->ip6_dst, sizeof(ip6->ip6_dst));
2147         ip6->ip6_hlim = IPV6_DEFHLIM;
2148
2149         /* XXX Should ip6_src be updated later ? */
2150
2151         return 0;
2152 }
2153 #endif /* INET6 */
2154
2155 /*
2156  * Check the variable replay window.
2157  * ipsec_chkreplay() performs replay check before ICV verification.
2158  * ipsec_updatereplay() updates replay bitmap.  This must be called after
2159  * ICV verification (it also performs replay check, which is usually done
2160  * beforehand).
2161  * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
2162  *
2163  * based on RFC 2401.
2164  *
2165  * XXX need to update for 64bit sequence number - 2401bis
2166  */
2167 int
2168 ipsec_chkreplay(u_int32_t seq, struct secasvar *sav)
2169 {
2170         const struct secreplay *replay;
2171         u_int32_t diff;
2172         int fr;
2173         u_int32_t wsizeb;       /* constant: bits of window size */
2174         int frlast;             /* constant: last frame */
2175
2176         /* sanity check */
2177         if (sav == NULL)
2178                 panic("ipsec_chkreplay: NULL pointer was passed.");
2179
2180         replay = sav->replay;
2181
2182         if (replay->wsize == 0)
2183                 return 1;       /* no need to check replay. */
2184
2185         /* constant */
2186         frlast = replay->wsize - 1;
2187         wsizeb = replay->wsize << 3;
2188
2189         /* sequence number of 0 is invalid */
2190         if (seq == 0)
2191                 return 0;
2192
2193         /* first time is always okay */
2194         if (replay->count == 0)
2195                 return 1;
2196
2197         if (seq > replay->lastseq) {
2198                 /* larger sequences are okay */
2199                 return 1;
2200         } else {
2201                 /* seq is equal or less than lastseq. */
2202                 diff = replay->lastseq - seq;
2203
2204                 /* over range to check, i.e. too old or wrapped */
2205                 if (diff >= wsizeb)
2206                         return 0;
2207
2208                 fr = frlast - diff / 8;
2209
2210                 /* this packet already seen ? */
2211                 if (replay->bitmap[fr] & (1 << (diff % 8)))
2212                         return 0;
2213
2214                 /* out of order but good */
2215                 return 1;
2216         }
2217 }
2218
2219 /*
2220  * check replay counter whether to update or not.
2221  * OUT: 0:      OK
2222  *      1:      NG
2223  * XXX need to update for 64bit sequence number - 2401bis
2224  */
2225 int
2226 ipsec_updatereplay(u_int32_t seq, struct secasvar *sav)
2227 {
2228         struct secreplay *replay;
2229         u_int32_t diff;
2230         int fr;
2231         u_int32_t wsizeb;       /* constant: bits of window size */
2232         int frlast;             /* constant: last frame */
2233
2234         /* sanity check */
2235         if (sav == NULL)
2236                 panic("ipsec_chkreplay: NULL pointer was passed.");
2237
2238         replay = sav->replay;
2239
2240         if (replay->wsize == 0)
2241                 goto ok;        /* no need to check replay. */
2242
2243         /* constant */
2244         frlast = replay->wsize - 1;
2245         wsizeb = replay->wsize << 3;
2246
2247         /* sequence number of 0 is invalid */
2248         if (seq == 0)
2249                 return 1;
2250
2251         /* first time */
2252         if (replay->count == 0) {
2253                 replay->lastseq = seq;
2254                 bzero(replay->bitmap, replay->wsize);
2255                 replay->bitmap[frlast] = 1;
2256                 goto ok;
2257         }
2258
2259         if (seq > replay->lastseq) {
2260                 /* seq is larger than lastseq. */
2261                 diff = seq - replay->lastseq;
2262
2263                 /* new larger sequence number */
2264                 if (diff < wsizeb) {
2265                         /* In window */
2266                         /* set bit for this packet */
2267                         vshiftl(replay->bitmap, diff, replay->wsize);
2268                         replay->bitmap[frlast] |= 1;
2269                 } else {
2270                         /* this packet has a "way larger" */
2271                         bzero(replay->bitmap, replay->wsize);
2272                         replay->bitmap[frlast] = 1;
2273                 }
2274                 replay->lastseq = seq;
2275
2276                 /* larger is good */
2277         } else {
2278                 /* seq is equal or less than lastseq. */
2279                 diff = replay->lastseq - seq;
2280
2281                 /* over range to check, i.e. too old or wrapped */
2282                 if (diff >= wsizeb)
2283                         return 1;
2284
2285                 fr = frlast - diff / 8;
2286
2287                 /* this packet already seen ? */
2288                 if (replay->bitmap[fr] & (1 << (diff % 8)))
2289                         return 1;
2290
2291                 /* mark as seen */
2292                 replay->bitmap[fr] |= (1 << (diff % 8));
2293
2294                 /* out of order but good */
2295         }
2296
2297 ok:
2298         if (replay->count == ~0) {
2299
2300                 /* set overflow flag */
2301                 replay->overflow++;
2302
2303                 /* don't increment, no more packets accepted */
2304                 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0)
2305                         return 1;
2306
2307                 ipseclog((LOG_WARNING, "replay counter made %d cycle. %s\n",
2308                     replay->overflow, ipsec_logsastr(sav)));
2309         }
2310
2311         replay->count++;
2312
2313         return 0;
2314 }
2315
2316 /*
2317  * shift variable length buffer to left.
2318  * IN:  bitmap: pointer to the buffer
2319  *      nbit:   the number of to shift.
2320  *      wsize:  buffer size (bytes).
2321  */
2322 static void
2323 vshiftl(unsigned char *bitmap, int nbit, int wsize)
2324 {
2325         int s, j, i;
2326         unsigned char over;
2327
2328         for (j = 0; j < nbit; j += 8) {
2329                 s = (nbit - j < 8) ? (nbit - j): 8;
2330                 bitmap[0] <<= s;
2331                 for (i = 1; i < wsize; i++) {
2332                         over = (bitmap[i] >> (8 - s));
2333                         bitmap[i] <<= s;
2334                         bitmap[i-1] |= over;
2335                 }
2336         }
2337
2338         return;
2339 }
2340
2341 const char *
2342 ipsec4_logpacketstr(struct ip *ip, u_int32_t spi)
2343 {
2344         static char buf[256];
2345         char *p;
2346         u_int8_t *s, *d;
2347
2348         s = (u_int8_t *)(&ip->ip_src);
2349         d = (u_int8_t *)(&ip->ip_dst);
2350
2351         p = buf;
2352         ksnprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
2353         while (p && *p)
2354                 p++;
2355         ksnprintf(p, sizeof(buf) - (p - buf), "src=%u.%u.%u.%u",
2356                 s[0], s[1], s[2], s[3]);
2357         while (p && *p)
2358                 p++;
2359         ksnprintf(p, sizeof(buf) - (p - buf), " dst=%u.%u.%u.%u",
2360                 d[0], d[1], d[2], d[3]);
2361         while (p && *p)
2362                 p++;
2363         ksnprintf(p, sizeof(buf) - (p - buf), ")");
2364
2365         return buf;
2366 }
2367
2368 #ifdef INET6
2369 const char *
2370 ipsec6_logpacketstr(struct ip6_hdr *ip6, u_int32_t spi)
2371 {
2372         static char buf[256];
2373         char *p;
2374
2375         p = buf;
2376         ksnprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
2377         while (p && *p)
2378                 p++;
2379         ksnprintf(p, sizeof(buf) - (p - buf), "src=%s",
2380                 ip6_sprintf(&ip6->ip6_src));
2381         while (p && *p)
2382                 p++;
2383         ksnprintf(p, sizeof(buf) - (p - buf), " dst=%s",
2384                 ip6_sprintf(&ip6->ip6_dst));
2385         while (p && *p)
2386                 p++;
2387         ksnprintf(p, sizeof(buf) - (p - buf), ")");
2388
2389         return buf;
2390 }
2391 #endif /* INET6 */
2392
2393 const char *
2394 ipsec_logsastr(struct secasvar *sav)
2395 {
2396         static char buf[256];
2397         char *p;
2398         struct secasindex *saidx = &sav->sah->saidx;
2399
2400         /* validity check */
2401         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2402                         != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family)
2403                 panic("ipsec_logsastr: family mismatched.");
2404
2405         p = buf;
2406         ksnprintf(buf, sizeof(buf), "SA(SPI=%u ", (u_int32_t)ntohl(sav->spi));
2407         while (p && *p)
2408                 p++;
2409         if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET) {
2410                 u_int8_t *s, *d;
2411                 s = (u_int8_t *)&((struct sockaddr_in *)&saidx->src)->sin_addr;
2412                 d = (u_int8_t *)&((struct sockaddr_in *)&saidx->dst)->sin_addr;
2413                 ksnprintf(p, sizeof(buf) - (p - buf),
2414                         "src=%d.%d.%d.%d dst=%d.%d.%d.%d",
2415                         s[0], s[1], s[2], s[3], d[0], d[1], d[2], d[3]);
2416         }
2417 #ifdef INET6
2418         else if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET6) {
2419                 ksnprintf(p, sizeof(buf) - (p - buf),
2420                         "src=%s",
2421                         ip6_sprintf(&((struct sockaddr_in6 *)&saidx->src)->sin6_addr));
2422                 while (p && *p)
2423                         p++;
2424                 ksnprintf(p, sizeof(buf) - (p - buf),
2425                         " dst=%s",
2426                         ip6_sprintf(&((struct sockaddr_in6 *)&saidx->dst)->sin6_addr));
2427         }
2428 #endif
2429         while (p && *p)
2430                 p++;
2431         ksnprintf(p, sizeof(buf) - (p - buf), ")");
2432
2433         return buf;
2434 }
2435
2436 void
2437 ipsec_dumpmbuf(struct mbuf *m)
2438 {
2439         int totlen;
2440         int i;
2441         u_char *p;
2442
2443         totlen = 0;
2444         kprintf("---\n");
2445         while (m) {
2446                 p = mtod(m, u_char *);
2447                 for (i = 0; i < m->m_len; i++) {
2448                         kprintf("%02x ", p[i]);
2449                         totlen++;
2450                         if (totlen % 16 == 0)
2451                                 kprintf("\n");
2452                 }
2453                 m = m->m_next;
2454         }
2455         if (totlen % 16 != 0)
2456                 kprintf("\n");
2457         kprintf("---\n");
2458 }
2459
2460 #ifdef INET
2461 /*
2462  * IPsec output logic for IPv4.
2463  */
2464 int
2465 ipsec4_output(struct ipsec_output_state *state, struct secpolicy *sp, int flags)
2466 {
2467         struct ip *ip = NULL;
2468         struct ipsecrequest *isr = NULL;
2469         struct secasindex saidx;
2470         int error;
2471         struct sockaddr_in *dst4;
2472         struct sockaddr_in *sin;
2473
2474         if (!state)
2475                 panic("state == NULL in ipsec4_output");
2476         if (!state->m)
2477                 panic("state->m == NULL in ipsec4_output");
2478         if (!state->ro)
2479                 panic("state->ro == NULL in ipsec4_output");
2480         if (!state->dst)
2481                 panic("state->dst == NULL in ipsec4_output");
2482
2483         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2484                 kprintf("ipsec4_output: applyed SP\n");
2485                 kdebug_secpolicy(sp));
2486
2487         for (isr = sp->req; isr != NULL; isr = isr->next) {
2488
2489 #if 0   /* give up to check restriction of transport mode */
2490         /* XXX but should be checked somewhere */
2491                 /*
2492                  * some of the IPsec operation must be performed only in
2493                  * originating case.
2494                  */
2495                 if (isr->saidx.mode == IPSEC_MODE_TRANSPORT
2496                  && (flags & IP_FORWARDING))
2497                         continue;
2498 #endif
2499
2500                 /* make SA index for search proper SA */
2501                 ip = mtod(state->m, struct ip *);
2502                 bcopy(&isr->saidx, &saidx, sizeof(saidx));
2503                 saidx.mode = isr->saidx.mode;
2504                 saidx.reqid = isr->saidx.reqid;
2505                 sin = (struct sockaddr_in *)&saidx.src;
2506                 if (sin->sin_len == 0) {
2507                         sin->sin_len = sizeof(*sin);
2508                         sin->sin_family = AF_INET;
2509                         sin->sin_port = IPSEC_PORT_ANY;
2510                         bcopy(&ip->ip_src, &sin->sin_addr,
2511                             sizeof(sin->sin_addr));
2512                 }
2513                 sin = (struct sockaddr_in *)&saidx.dst;
2514                 if (sin->sin_len == 0) {
2515                         sin->sin_len = sizeof(*sin);
2516                         sin->sin_family = AF_INET;
2517                         sin->sin_port = IPSEC_PORT_ANY;
2518                         bcopy(&ip->ip_dst, &sin->sin_addr,
2519                             sizeof(sin->sin_addr));
2520                 }
2521
2522                 if ((error = key_checkrequest(isr, &saidx)) != 0) {
2523                         /*
2524                          * IPsec processing is required, but no SA found.
2525                          * I assume that key_acquire() had been called
2526                          * to get/establish the SA. Here I discard
2527                          * this packet because it is responsibility for
2528                          * upper layer to retransmit the packet.
2529                          */
2530                         ipsecstat.out_nosa++;
2531                         goto bad;
2532                 }
2533
2534                 /* validity check */
2535                 if (isr->sav == NULL) {
2536                         switch (ipsec_get_reqlevel(isr)) {
2537                         case IPSEC_LEVEL_USE:
2538                                 continue;
2539                         case IPSEC_LEVEL_REQUIRE:
2540                                 /* must be not reached here. */
2541                                 panic("ipsec4_output: no SA found, but required.");
2542                         }
2543                 }
2544
2545                 /*
2546                  * If there is no valid SA, we give up to process any
2547                  * more.  In such a case, the SA's status is changed
2548                  * from DYING to DEAD after allocating.  If a packet
2549                  * send to the receiver by dead SA, the receiver can
2550                  * not decode a packet because SA has been dead.
2551                  */
2552                 if (isr->sav->state != SADB_SASTATE_MATURE
2553                  && isr->sav->state != SADB_SASTATE_DYING) {
2554                         ipsecstat.out_nosa++;
2555                         error = EINVAL;
2556                         goto bad;
2557                 }
2558
2559                 /*
2560                  * There may be the case that SA status will be changed when
2561                  * we are refering to one. So calling crit_enter().
2562                  */
2563                 crit_enter();
2564
2565                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2566                         /*
2567                          * build IPsec tunnel.
2568                          */
2569                         /* XXX should be processed with other familiy */
2570                         if (((struct sockaddr *)&isr->sav->sah->saidx.src)->sa_family != AF_INET) {
2571                                 ipseclog((LOG_ERR, "ipsec4_output: "
2572                                     "family mismatched between inner and outer spi=%u\n",
2573                                     (u_int32_t)ntohl(isr->sav->spi)));
2574                                 crit_exit();
2575                                 error = EAFNOSUPPORT;
2576                                 goto bad;
2577                         }
2578
2579                         state->m = ipsec4_splithdr(state->m);
2580                         if (!state->m) {
2581                                 crit_exit();
2582                                 error = ENOMEM;
2583                                 goto bad;
2584                         }
2585                         error = ipsec4_encapsulate(state->m, isr->sav);
2586                         crit_exit();
2587                         if (error) {
2588                                 state->m = NULL;
2589                                 goto bad;
2590                         }
2591                         ip = mtod(state->m, struct ip *);
2592
2593                         state->ro = &isr->sav->sah->sa_route;
2594                         state->dst = (struct sockaddr *)&state->ro->ro_dst;
2595                         dst4 = (struct sockaddr_in *)state->dst;
2596                         if (state->ro->ro_rt
2597                          && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
2598                           || dst4->sin_addr.s_addr != ip->ip_dst.s_addr)) {
2599                                 RTFREE(state->ro->ro_rt);
2600                                 state->ro->ro_rt = NULL;
2601                         }
2602                         if (state->ro->ro_rt == NULL) {
2603                                 dst4->sin_family = AF_INET;
2604                                 dst4->sin_len = sizeof(*dst4);
2605                                 dst4->sin_addr = ip->ip_dst;
2606                                 rtalloc(state->ro);
2607                         }
2608                         if (state->ro->ro_rt == NULL) {
2609                                 ipstat.ips_noroute++;
2610                                 error = EHOSTUNREACH;
2611                                 goto bad;
2612                         }
2613
2614                         /* adjust state->dst if tunnel endpoint is offlink */
2615                         if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
2616                                 state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
2617                                 dst4 = (struct sockaddr_in *)state->dst;
2618                         }
2619                 } else
2620                         crit_exit();
2621
2622                 state->m = ipsec4_splithdr(state->m);
2623                 if (!state->m) {
2624                         error = ENOMEM;
2625                         goto bad;
2626                 }
2627                 switch (isr->saidx.proto) {
2628                 case IPPROTO_ESP:
2629 #ifdef IPSEC_ESP
2630                         if ((error = esp4_output(state->m, isr)) != 0) {
2631                                 state->m = NULL;
2632                                 goto bad;
2633                         }
2634                         break;
2635 #else
2636                         m_freem(state->m);
2637                         state->m = NULL;
2638                         error = EINVAL;
2639                         goto bad;
2640 #endif
2641                 case IPPROTO_AH:
2642                         if ((error = ah4_output(state->m, isr)) != 0) {
2643                                 state->m = NULL;
2644                                 goto bad;
2645                         }
2646                         break;
2647                 case IPPROTO_IPCOMP:
2648                         if ((error = ipcomp4_output(state->m, isr)) != 0) {
2649                                 state->m = NULL;
2650                                 goto bad;
2651                         }
2652                         break;
2653                 default:
2654                         ipseclog((LOG_ERR,
2655                             "ipsec4_output: unknown ipsec protocol %d\n",
2656                             isr->saidx.proto));
2657                         m_freem(state->m);
2658                         state->m = NULL;
2659                         error = EINVAL;
2660                         goto bad;
2661                 }
2662
2663                 if (state->m == NULL) {
2664                         error = ENOMEM;
2665                         goto bad;
2666                 }
2667                 ip = mtod(state->m, struct ip *);
2668         }
2669
2670         return 0;
2671
2672 bad:
2673         m_freem(state->m);
2674         state->m = NULL;
2675         return error;
2676 }
2677 #endif
2678
2679 #ifdef INET6
2680 /*
2681  * IPsec output logic for IPv6, transport mode.
2682  */
2683 int
2684 ipsec6_output_trans(struct ipsec_output_state *state, u_char *nexthdrp,
2685                     struct mbuf *mprev, struct secpolicy *sp, int flags,
2686                     boolean_t *tun)
2687 {
2688         struct ip6_hdr *ip6;
2689         struct ipsecrequest *isr = NULL;
2690         struct secasindex saidx;
2691         int error = 0;
2692         int plen;
2693         struct sockaddr_in6 *sin6;
2694
2695         if (!state)
2696                 panic("state == NULL in ipsec6_output_trans");
2697         if (!state->m)
2698                 panic("state->m == NULL in ipsec6_output_trans");
2699         if (!nexthdrp)
2700                 panic("nexthdrp == NULL in ipsec6_output_trans");
2701         if (!mprev)
2702                 panic("mprev == NULL in ipsec6_output_trans");
2703         if (!sp)
2704                 panic("sp == NULL in ipsec6_output_trans");
2705         if (!tun)
2706                 panic("tun == NULL in ipsec6_output_trans");
2707
2708         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2709                 kprintf("ipsec6_output_trans: applyed SP\n");
2710                 kdebug_secpolicy(sp));
2711
2712         lwkt_gettoken(&key_token);
2713
2714         *tun = 0;
2715         for (isr = sp->req; isr; isr = isr->next) {
2716                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2717                         /* the rest will be handled by ipsec6_output_tunnel() */
2718                         break;
2719                 }
2720
2721                 /* make SA index for search proper SA */
2722                 ip6 = mtod(state->m, struct ip6_hdr *);
2723                 bcopy(&isr->saidx, &saidx, sizeof(saidx));
2724                 saidx.mode = isr->saidx.mode;
2725                 saidx.reqid = isr->saidx.reqid;
2726                 sin6 = (struct sockaddr_in6 *)&saidx.src;
2727                 if (sin6->sin6_len == 0) {
2728                         sin6->sin6_len = sizeof(*sin6);
2729                         sin6->sin6_family = AF_INET6;
2730                         sin6->sin6_port = IPSEC_PORT_ANY;
2731                         bcopy(&ip6->ip6_src, &sin6->sin6_addr,
2732                             sizeof(ip6->ip6_src));
2733                         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
2734                                 /* fix scope id for comparing SPD */
2735                                 sin6->sin6_addr.s6_addr16[1] = 0;
2736                                 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
2737                         }
2738                 }
2739                 sin6 = (struct sockaddr_in6 *)&saidx.dst;
2740                 if (sin6->sin6_len == 0) {
2741                         sin6->sin6_len = sizeof(*sin6);
2742                         sin6->sin6_family = AF_INET6;
2743                         sin6->sin6_port = IPSEC_PORT_ANY;
2744                         bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
2745                             sizeof(ip6->ip6_dst));
2746                         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
2747                                 /* fix scope id for comparing SPD */
2748                                 sin6->sin6_addr.s6_addr16[1] = 0;
2749                                 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
2750                         }
2751                 }
2752
2753                 if (key_checkrequest(isr, &saidx) == ENOENT) {
2754                         /*
2755                          * IPsec processing is required, but no SA found.
2756                          * I assume that key_acquire() had been called
2757                          * to get/establish the SA. Here I discard
2758                          * this packet because it is responsibility for
2759                          * upper layer to retransmit the packet.
2760                          */
2761                         ipsec6stat.out_nosa++;
2762                         error = ENOENT;
2763
2764                         /*
2765                          * Notify the fact that the packet is discarded
2766                          * to ourselves. I believe this is better than
2767                          * just silently discarding. (jinmei@kame.net)
2768                          * XXX: should we restrict the error to TCP packets?
2769                          * XXX: should we directly notify sockets via
2770                          *      kpfctlinputs?
2771                          */
2772                         icmp6_error(state->m, ICMP6_DST_UNREACH,
2773                                     ICMP6_DST_UNREACH_ADMIN, 0);
2774                         state->m = NULL; /* icmp6_error freed the mbuf */
2775                         goto bad;
2776                 }
2777
2778                 /* validity check */
2779                 if (isr->sav == NULL) {
2780                         switch (ipsec_get_reqlevel(isr)) {
2781                         case IPSEC_LEVEL_USE:
2782                                 continue;
2783                         case IPSEC_LEVEL_REQUIRE:
2784                                 /* must be not reached here. */
2785                                 panic("ipsec6_output_trans: no SA found, but required.");
2786                         }
2787                 }
2788
2789                 /*
2790                  * If there is no valid SA, we give up to process.
2791                  * see same place at ipsec4_output().
2792                  */
2793                 if (isr->sav->state != SADB_SASTATE_MATURE
2794                  && isr->sav->state != SADB_SASTATE_DYING) {
2795                         ipsec6stat.out_nosa++;
2796                         error = EINVAL;
2797                         goto bad;
2798                 }
2799
2800                 switch (isr->saidx.proto) {
2801                 case IPPROTO_ESP:
2802 #ifdef IPSEC_ESP
2803                         error = esp6_output(state->m, nexthdrp, mprev->m_next, isr);
2804 #else
2805                         m_freem(state->m);
2806                         error = EINVAL;
2807 #endif
2808                         break;
2809                 case IPPROTO_AH:
2810                         error = ah6_output(state->m, nexthdrp, mprev->m_next, isr);
2811                         break;
2812                 case IPPROTO_IPCOMP:
2813                         error = ipcomp6_output(state->m, nexthdrp, mprev->m_next, isr);
2814                         break;
2815                 default:
2816                         ipseclog((LOG_ERR, "ipsec6_output_trans: "
2817                             "unknown ipsec protocol %d\n", isr->saidx.proto));
2818                         m_freem(state->m);
2819                         ipsec6stat.out_inval++;
2820                         error = EINVAL;
2821                         break;
2822                 }
2823                 if (error) {
2824                         state->m = NULL;
2825                         goto bad;
2826                 }
2827                 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
2828                 if (plen > IPV6_MAXPACKET) {
2829                         ipseclog((LOG_ERR, "ipsec6_output_trans: "
2830                             "IPsec with IPv6 jumbogram is not supported\n"));
2831                         ipsec6stat.out_inval++;
2832                         error = EINVAL; /* XXX */
2833                         goto bad;
2834                 }
2835                 ip6 = mtod(state->m, struct ip6_hdr *);
2836                 ip6->ip6_plen = htons(plen);
2837         }
2838
2839         /* if we have more to go, we need a tunnel mode processing */
2840         if (isr != NULL)
2841                 *tun = TRUE;
2842         lwkt_reltoken(&key_token);
2843         return 0;
2844
2845 bad:
2846         lwkt_reltoken(&key_token);
2847         m_freem(state->m);
2848         state->m = NULL;
2849         return error;
2850 }
2851
2852 /*
2853  * IPsec output logic for IPv6, tunnel mode.
2854  */
2855 int
2856 ipsec6_output_tunnel(struct ipsec_output_state *state, struct secpolicy *sp,
2857                      int flags)
2858 {
2859         struct ip6_hdr *ip6;
2860         struct ipsecrequest *isr = NULL;
2861         struct secasindex saidx;
2862         int error = 0;
2863         int plen;
2864         struct sockaddr_in6* dst6;
2865
2866         if (!state)
2867                 panic("state == NULL in ipsec6_output_tunnel");
2868         if (!state->m)
2869                 panic("state->m == NULL in ipsec6_output_tunnel");
2870         if (!sp)
2871                 panic("sp == NULL in ipsec6_output_tunnel");
2872
2873         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2874                 kprintf("ipsec6_output_tunnel: applyed SP\n");
2875                 kdebug_secpolicy(sp));
2876
2877         /*
2878          * transport mode ipsec (before the 1st tunnel mode) is already
2879          * processed by ipsec6_output_trans().
2880          */
2881         lwkt_gettoken(&key_token);
2882         for (isr = sp->req; isr; isr = isr->next) {
2883                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
2884                         break;
2885         }
2886
2887         for (/* already initialized */; isr; isr = isr->next) {
2888                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2889                         /* When tunnel mode, SA peers must be specified. */
2890                         bcopy(&isr->saidx, &saidx, sizeof(saidx));
2891                 } else {
2892                         /* make SA index to look for a proper SA */
2893                         struct sockaddr_in6 *sin6;
2894
2895                         bzero(&saidx, sizeof(saidx));
2896                         saidx.proto = isr->saidx.proto;
2897                         saidx.mode = isr->saidx.mode;
2898                         saidx.reqid = isr->saidx.reqid;
2899
2900                         ip6 = mtod(state->m, struct ip6_hdr *);
2901                         sin6 = (struct sockaddr_in6 *)&saidx.src;
2902                         if (sin6->sin6_len == 0) {
2903                                 sin6->sin6_len = sizeof(*sin6);
2904                                 sin6->sin6_family = AF_INET6;
2905                                 sin6->sin6_port = IPSEC_PORT_ANY;
2906                                 bcopy(&ip6->ip6_src, &sin6->sin6_addr,
2907                                     sizeof(ip6->ip6_src));
2908                                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
2909                                         /* fix scope id for comparing SPD */
2910                                         sin6->sin6_addr.s6_addr16[1] = 0;
2911                                         sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
2912                                 }
2913                         }
2914                         sin6 = (struct sockaddr_in6 *)&saidx.dst;
2915                         if (sin6->sin6_len == 0) {
2916                                 sin6->sin6_len = sizeof(*sin6);
2917                                 sin6->sin6_family = AF_INET6;
2918                                 sin6->sin6_port = IPSEC_PORT_ANY;
2919                                 bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
2920                                     sizeof(ip6->ip6_dst));
2921                                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
2922                                         /* fix scope id for comparing SPD */
2923                                         sin6->sin6_addr.s6_addr16[1] = 0;
2924                                         sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
2925                                 }
2926                         }
2927                 }
2928
2929                 if (key_checkrequest(isr, &saidx) == ENOENT) {
2930                         /*
2931                          * IPsec processing is required, but no SA found.
2932                          * I assume that key_acquire() had been called
2933                          * to get/establish the SA. Here I discard
2934                          * this packet because it is responsibility for
2935                          * upper layer to retransmit the packet.
2936                          */
2937                         ipsec6stat.out_nosa++;
2938                         error = ENOENT;
2939                         goto bad;
2940                 }
2941
2942                 /* validity check */
2943                 if (isr->sav == NULL) {
2944                         switch (ipsec_get_reqlevel(isr)) {
2945                         case IPSEC_LEVEL_USE:
2946                                 continue;
2947                         case IPSEC_LEVEL_REQUIRE:
2948                                 /* must be not reached here. */
2949                                 panic("ipsec6_output_tunnel: no SA found, but required.");
2950                         }
2951                 }
2952
2953                 /*
2954                  * If there is no valid SA, we give up to process.
2955                  * see same place at ipsec4_output().
2956                  */
2957                 if (isr->sav->state != SADB_SASTATE_MATURE
2958                  && isr->sav->state != SADB_SASTATE_DYING) {
2959                         ipsec6stat.out_nosa++;
2960                         error = EINVAL;
2961                         goto bad;
2962                 }
2963
2964                 /*
2965                  * There may be the case that SA status will be changed when
2966                  * we are refering to one. So calling crit_enter().
2967                  */
2968                 crit_enter();
2969
2970                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2971                         /*
2972                          * build IPsec tunnel.
2973                          */
2974                         /* XXX should be processed with other familiy */
2975                         if (((struct sockaddr *)&isr->sav->sah->saidx.src)->sa_family != AF_INET6) {
2976                                 ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
2977                                     "family mismatched between inner and outer, spi=%u\n",
2978                                     (u_int32_t)ntohl(isr->sav->spi)));
2979                                 crit_exit();
2980                                 ipsec6stat.out_inval++;
2981                                 error = EAFNOSUPPORT;
2982                                 goto bad;
2983                         }
2984
2985                         state->m = ipsec6_splithdr(state->m);
2986                         if (!state->m) {
2987                                 crit_exit();
2988                                 ipsec6stat.out_nomem++;
2989                                 error = ENOMEM;
2990                                 goto bad;
2991                         }
2992                         error = ipsec6_encapsulate(state->m, isr->sav);
2993                         crit_exit();
2994                         if (error) {
2995                                 state->m = NULL;
2996                                 goto bad;
2997                         }
2998                         ip6 = mtod(state->m, struct ip6_hdr *);
2999
3000                         state->ro = &isr->sav->sah->sa_route;
3001                         state->dst = (struct sockaddr *)&state->ro->ro_dst;
3002                         dst6 = (struct sockaddr_in6 *)state->dst;
3003                         if (state->ro->ro_rt &&
3004                             ((state->ro->ro_rt->rt_flags & RTF_UP) == 0 ||
3005                              !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst))) {
3006                                 RTFREE(state->ro->ro_rt);
3007                                 state->ro->ro_rt = NULL;
3008                         }
3009                         if (state->ro->ro_rt == NULL) {
3010                                 bzero(dst6, sizeof(*dst6));
3011                                 dst6->sin6_family = AF_INET6;
3012                                 dst6->sin6_len = sizeof(*dst6);
3013                                 dst6->sin6_addr = ip6->ip6_dst;
3014                                 rtalloc(state->ro);
3015                         }
3016                         if (state->ro->ro_rt == NULL) {
3017                                 ip6stat.ip6s_noroute++;
3018                                 ipsec6stat.out_noroute++;
3019                                 error = EHOSTUNREACH;
3020                                 goto bad;
3021                         }
3022
3023                         /* adjust state->dst if tunnel endpoint is offlink */
3024                         if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
3025                                 state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
3026                                 dst6 = (struct sockaddr_in6 *)state->dst;
3027                         }
3028                 } else
3029                         crit_exit();
3030
3031                 state->m = ipsec6_splithdr(state->m);
3032                 if (!state->m) {
3033                         ipsec6stat.out_nomem++;
3034                         error = ENOMEM;
3035                         goto bad;
3036                 }
3037                 ip6 = mtod(state->m, struct ip6_hdr *);
3038                 switch (isr->saidx.proto) {
3039                 case IPPROTO_ESP:
3040 #ifdef IPSEC_ESP
3041                         error = esp6_output(state->m, &ip6->ip6_nxt,
3042                             state->m->m_next, isr);
3043 #else
3044                         m_freem(state->m);
3045                         error = EINVAL;
3046 #endif
3047                         break;
3048                 case IPPROTO_AH:
3049                         error = ah6_output(state->m, &ip6->ip6_nxt,
3050                             state->m->m_next, isr);
3051                         break;
3052                 case IPPROTO_IPCOMP:
3053                         /* XXX code should be here */
3054                         /* FALLTHROUGH */
3055                 default:
3056                         ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
3057                             "unknown ipsec protocol %d\n", isr->saidx.proto));
3058                         m_freem(state->m);
3059                         ipsec6stat.out_inval++;
3060                         error = EINVAL;
3061                         break;
3062                 }
3063                 if (error) {
3064                         state->m = NULL;
3065                         goto bad;
3066                 }
3067                 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
3068                 if (plen > IPV6_MAXPACKET) {
3069                         ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
3070                             "IPsec with IPv6 jumbogram is not supported\n"));
3071                         ipsec6stat.out_inval++;
3072                         error = EINVAL; /* XXX */
3073                         goto bad;
3074                 }
3075                 ip6 = mtod(state->m, struct ip6_hdr *);
3076                 ip6->ip6_plen = htons(plen);
3077         }
3078         lwkt_reltoken(&key_token);
3079
3080         return 0;
3081
3082 bad:
3083         lwkt_reltoken(&key_token);
3084         m_freem(state->m);
3085         state->m = NULL;
3086         return error;
3087 }
3088 #endif /* INET6 */
3089
3090 #ifdef INET
3091 /*
3092  * Chop IP header and option off from the payload.
3093  */
3094 static struct mbuf *
3095 ipsec4_splithdr(struct mbuf *m)
3096 {
3097         struct mbuf *mh;
3098         struct ip *ip;
3099         int hlen;
3100
3101         if (m->m_len < sizeof(struct ip))
3102                 panic("ipsec4_splithdr: first mbuf too short");
3103         ip = mtod(m, struct ip *);
3104 #ifdef _IP_VHL
3105         hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
3106 #else
3107         hlen = ip->ip_hl << 2;
3108 #endif
3109         if (m->m_len > hlen) {
3110                 MGETHDR(mh, M_NOWAIT, MT_HEADER);
3111                 if (!mh) {
3112                         m_freem(m);
3113                         return NULL;
3114                 }
3115                 M_MOVE_PKTHDR(mh, m);
3116                 MH_ALIGN(mh, hlen);
3117                 m->m_len -= hlen;
3118                 m->m_data += hlen;
3119                 mh->m_next = m;
3120                 m = mh;
3121                 m->m_len = hlen;
3122                 bcopy((caddr_t)ip, mtod(m, caddr_t), hlen);
3123         } else if (m->m_len < hlen) {
3124                 m = m_pullup(m, hlen);
3125                 if (!m)
3126                         return NULL;
3127         }
3128         return m;
3129 }
3130 #endif
3131
3132 #ifdef INET6
3133 static struct mbuf *
3134 ipsec6_splithdr(struct mbuf *m)
3135 {
3136         struct mbuf *mh;
3137         struct ip6_hdr *ip6;
3138         int hlen;
3139
3140         if (m->m_len < sizeof(struct ip6_hdr))
3141                 panic("ipsec6_splithdr: first mbuf too short");
3142         ip6 = mtod(m, struct ip6_hdr *);
3143         hlen = sizeof(struct ip6_hdr);
3144         if (m->m_len > hlen) {
3145                 MGETHDR(mh, M_NOWAIT, MT_HEADER);
3146                 if (!mh) {
3147                         m_freem(m);
3148                         return NULL;
3149                 }
3150                 M_MOVE_PKTHDR(mh, m);
3151                 MH_ALIGN(mh, hlen);
3152                 m->m_len -= hlen;
3153                 m->m_data += hlen;
3154                 mh->m_next = m;
3155                 m = mh;
3156                 m->m_len = hlen;
3157                 bcopy((caddr_t)ip6, mtod(m, caddr_t), hlen);
3158         } else if (m->m_len < hlen) {
3159                 m = m_pullup(m, hlen);
3160                 if (!m)
3161                         return NULL;
3162         }
3163         return m;
3164 }
3165 #endif
3166
3167 /* validate inbound IPsec tunnel packet. */
3168 int
3169 ipsec4_tunnel_validate(struct mbuf *m, /* no pullup permitted, m->m_len >= ip */
3170                        int off, u_int nxt0, struct secasvar *sav)
3171 {
3172         u_int8_t nxt = nxt0 & 0xff;
3173         struct sockaddr_in *sin;
3174         struct sockaddr_in osrc, odst, isrc, idst;
3175         int hlen;
3176         struct secpolicy *sp;
3177         struct ip *oip;
3178
3179 #ifdef DIAGNOSTIC
3180         if (m->m_len < sizeof(struct ip))
3181                 panic("too short mbuf on ipsec4_tunnel_validate");
3182 #endif
3183         if (nxt != IPPROTO_IPV4)
3184                 return 0;
3185         if (m->m_pkthdr.len < off + sizeof(struct ip))
3186                 return 0;
3187         /* do not decapsulate if the SA is for transport mode only */
3188         if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
3189                 return 0;
3190
3191         oip = mtod(m, struct ip *);
3192 #ifdef _IP_VHL
3193         hlen = _IP_VHL_HL(oip->ip_vhl) << 2;
3194 #else
3195         hlen = oip->ip_hl << 2;
3196 #endif
3197         if (hlen != sizeof(struct ip))
3198                 return 0;
3199
3200         /* AF_INET6 should be supported, but at this moment we don't. */
3201         sin = (struct sockaddr_in *)&sav->sah->saidx.dst;
3202         if (sin->sin_family != AF_INET)
3203                 return 0;
3204         if (bcmp(&oip->ip_dst, &sin->sin_addr, sizeof(oip->ip_dst)) != 0)
3205                 return 0;
3206
3207         /* XXX slow */
3208         bzero(&osrc, sizeof(osrc));
3209         bzero(&odst, sizeof(odst));
3210         bzero(&isrc, sizeof(isrc));
3211         bzero(&idst, sizeof(idst));
3212         osrc.sin_family = odst.sin_family = isrc.sin_family = idst.sin_family =
3213             AF_INET;
3214         osrc.sin_len = odst.sin_len = isrc.sin_len = idst.sin_len =
3215             sizeof(struct sockaddr_in);
3216         osrc.sin_addr = oip->ip_src;
3217         odst.sin_addr = oip->ip_dst;
3218         m_copydata(m, off + offsetof(struct ip, ip_src), sizeof(isrc.sin_addr),
3219             (caddr_t)&isrc.sin_addr);
3220         m_copydata(m, off + offsetof(struct ip, ip_dst), sizeof(idst.sin_addr),
3221             (caddr_t)&idst.sin_addr);
3222
3223         /*
3224          * RFC2401 5.2.1 (b): (assume that we are using tunnel mode)
3225          * - if the inner destination is multicast address, there can be
3226          *   multiple permissible inner source address.  implementation
3227          *   may want to skip verification of inner source address against
3228          *   SPD selector.
3229          * - if the inner protocol is ICMP, the packet may be an error report
3230          *   from routers on the other side of the VPN cloud (R in the
3231          *   following diagram).  in this case, we cannot verify inner source
3232          *   address against SPD selector.
3233          *      me -- gw === gw -- R -- you
3234          *
3235          * we consider the first bullet to be users responsibility on SPD entry
3236          * configuration (if you need to encrypt multicast traffic, set
3237          * the source range of SPD selector to 0.0.0.0/0, or have explicit
3238          * address ranges for possible senders).
3239          * the second bullet is not taken care of (yet).
3240          *
3241          * therefore, we do not do anything special about inner source.
3242          */
3243
3244         lwkt_gettoken(&key_token);
3245         sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
3246                            (struct sockaddr *)&isrc, (struct sockaddr *)&idst);
3247         if (sp) {
3248                 key_freesp(sp);
3249                 lwkt_reltoken(&key_token);
3250                 return 1;
3251         } else{
3252                 lwkt_reltoken(&key_token);
3253                 return 0;
3254         }
3255 }
3256
3257 #ifdef INET6
3258 /* validate inbound IPsec tunnel packet. */
3259 int
3260 ipsec6_tunnel_validate(struct mbuf *m, /* no pullup permitted, m->m_len >= ip */
3261                        int off, u_int nxt0, struct secasvar *sav)
3262 {
3263         u_int8_t nxt = nxt0 & 0xff;
3264         struct sockaddr_in6 *sin6;
3265         struct sockaddr_in6 osrc, odst, isrc, idst;
3266         struct secpolicy *sp;
3267         struct ip6_hdr *oip6;
3268
3269 #ifdef DIAGNOSTIC
3270         if (m->m_len < sizeof(struct ip6_hdr))
3271                 panic("too short mbuf on ipsec6_tunnel_validate");
3272 #endif
3273         if (nxt != IPPROTO_IPV6)
3274                 return 0;
3275         if (m->m_pkthdr.len < off + sizeof(struct ip6_hdr))
3276                 return 0;
3277         /* do not decapsulate if the SA is for transport mode only */
3278         if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
3279                 return 0;
3280
3281         oip6 = mtod(m, struct ip6_hdr *);
3282         /* AF_INET should be supported, but at this moment we don't. */
3283         sin6 = (struct sockaddr_in6 *)&sav->sah->saidx.dst;
3284         if (sin6->sin6_family != AF_INET6)
3285                 return 0;
3286         if (!IN6_ARE_ADDR_EQUAL(&oip6->ip6_dst, &sin6->sin6_addr))
3287                 return 0;
3288
3289         /* XXX slow */
3290         bzero(&osrc, sizeof(osrc));
3291         bzero(&odst, sizeof(odst));
3292         bzero(&isrc, sizeof(isrc));
3293         bzero(&idst, sizeof(idst));
3294         osrc.sin6_family = odst.sin6_family = isrc.sin6_family =
3295             idst.sin6_family = AF_INET6;
3296         osrc.sin6_len = odst.sin6_len = isrc.sin6_len = idst.sin6_len =
3297             sizeof(struct sockaddr_in6);
3298         osrc.sin6_addr = oip6->ip6_src;
3299         odst.sin6_addr = oip6->ip6_dst;
3300         m_copydata(m, off + offsetof(struct ip6_hdr, ip6_src),
3301             sizeof(isrc.sin6_addr), (caddr_t)&isrc.sin6_addr);
3302         m_copydata(m, off + offsetof(struct ip6_hdr, ip6_dst),
3303             sizeof(idst.sin6_addr), (caddr_t)&idst.sin6_addr);
3304
3305         /*
3306          * regarding to inner source address validation, see a long comment
3307          * in ipsec4_tunnel_validate.
3308          */
3309
3310         lwkt_gettoken(&key_token);
3311         sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
3312                            (struct sockaddr *)&isrc, (struct sockaddr *)&idst);
3313         /*
3314          * when there is no suitable inbound policy for the packet of the ipsec
3315          * tunnel mode, the kernel never decapsulate the tunneled packet
3316          * as the ipsec tunnel mode even when the system wide policy is "none".
3317          * then the kernel leaves the generic tunnel module to process this
3318          * packet.  if there is no rule of the generic tunnel, the packet
3319          * is rejected and the statistics will be counted up.
3320          */
3321         if (sp) {
3322                 key_freesp(sp);
3323                 lwkt_reltoken(&key_token);
3324                 return 1;
3325         } else {
3326                 lwkt_reltoken(&key_token);
3327                 return 0;
3328         }
3329 }
3330 #endif
3331
3332 /*
3333  * Make a mbuf chain for encryption.
3334  * If the original mbuf chain contains a mbuf with a cluster,
3335  * allocate a new cluster and copy the data to the new cluster.
3336  * XXX: this hack is inefficient, but is necessary to handle cases
3337  * of TCP retransmission...
3338  */
3339 struct mbuf *
3340 ipsec_copypkt(struct mbuf *m)
3341 {
3342         struct mbuf *n, **mpp, *mnew;
3343
3344         for (n = m, mpp = &m; n; n = n->m_next) {
3345                 if (n->m_flags & M_EXT) {
3346                         /*
3347                          * Make a copy only if there is more than one
3348                          * references to the cluster.
3349                          * XXX: is this approach effective?
3350                          */
3351                         if (m_sharecount(n) > 1) {
3352                                 int remain, copied;
3353                                 struct mbuf *mm;
3354
3355                                 if (n->m_flags & M_PKTHDR) {
3356                                         MGETHDR(mnew, M_NOWAIT, MT_HEADER);
3357                                         if (mnew == NULL)
3358                                                 goto fail;
3359                                         if (!m_dup_pkthdr(mnew, n, M_NOWAIT)) {
3360                                                 m_free(mnew);
3361                                                 goto fail;
3362                                         }
3363                                 } else {
3364                                         MGET(mnew, M_NOWAIT, MT_DATA);
3365                                         if (mnew == NULL)
3366                                                 goto fail;
3367                                 }
3368                                 mnew->m_len = 0;
3369                                 mm = mnew;
3370
3371                                 /*
3372                                  * Copy data. If we don't have enough space to
3373                                  * store the whole data, allocate a cluster
3374                                  * or additional mbufs.
3375                                  * XXX: we don't use m_copyback(), since the
3376                                  * function does not use clusters and thus is
3377                                  * inefficient.
3378                                  */
3379                                 remain = n->m_len;
3380                                 copied = 0;
3381                                 while (1) {
3382                                         int len;
3383                                         struct mbuf *mn;
3384
3385                                         if (remain <= (mm->m_flags & M_PKTHDR ? MHLEN : MLEN))
3386                                                 len = remain;
3387                                         else { /* allocate a cluster */
3388                                                 MCLGET(mm, M_NOWAIT);
3389                                                 if (!(mm->m_flags & M_EXT)) {
3390                                                         m_free(mm);
3391                                                         goto fail;
3392                                                 }
3393                                                 len = remain < MCLBYTES ?
3394                                                         remain : MCLBYTES;
3395                                         }
3396
3397                                         bcopy(n->m_data + copied, mm->m_data,
3398                                               len);
3399
3400                                         copied += len;
3401                                         remain -= len;
3402                                         mm->m_len = len;
3403
3404                                         if (remain <= 0) /* completed? */
3405                                                 break;
3406
3407                                         /* need another mbuf */
3408                                         MGETHDR(mn, M_NOWAIT, MT_HEADER);
3409                                         if (mn == NULL)
3410                                                 goto fail;
3411                                         mn->m_pkthdr.rcvif = NULL;
3412                                         mm->m_next = mn;
3413                                         mm = mn;
3414                                 }
3415
3416                                 /* adjust chain */
3417                                 mm->m_next = m_free(n);
3418                                 n = mm;
3419                                 *mpp = mnew;
3420                                 mpp = &n->m_next;
3421
3422                                 continue;
3423                         }
3424                 }
3425                 *mpp = n;
3426                 mpp = &n->m_next;
3427         }
3428
3429         return (m);
3430 fail:
3431         m_freem(m);
3432         return (NULL);
3433 }
3434
3435 void
3436 ipsec_delaux(struct mbuf *m)
3437 {
3438         struct m_tag *mtag;
3439
3440         while ((mtag = m_tag_find(m, PACKET_TAG_IPSEC_HISTORY, NULL)) != NULL)
3441                 m_tag_delete(m, mtag);
3442 }
3443
3444 int
3445 ipsec_addhist(struct mbuf *m, int proto, u_int32_t spi)
3446 {
3447         struct m_tag *mtag;
3448         struct ipsec_history *p;
3449
3450         mtag = m_tag_get(PACKET_TAG_IPSEC_HISTORY,
3451             sizeof(struct ipsec_history), M_NOWAIT);
3452         if (mtag == NULL)
3453                 return ENOBUFS;
3454         p = (struct ipsec_history *)m_tag_data(mtag);
3455         bzero(p, sizeof(*p));
3456         p->ih_proto = proto;
3457         p->ih_spi = spi;
3458         m_tag_prepend(m, mtag);
3459         return 0;
3460 }
3461
3462 struct ipsec_history *
3463 ipsec_gethist(struct mbuf *m, int *lenp)
3464 {
3465         struct m_tag *mtag;
3466
3467         mtag = m_tag_find(m, PACKET_TAG_IPSEC_HISTORY, NULL);
3468         if (mtag == NULL)
3469                 return NULL;
3470         /* XXX NB: noone uses this so fake it */
3471         if (lenp)
3472                 *lenp = sizeof(struct ipsec_history);
3473         return (struct ipsec_history *)m_tag_data(mtag);
3474 }