sys/netinet6/ipsec.c

   1 /*      $FreeBSD: src/sys/netinet6/ipsec.c,v 1.3.2.12 2003/05/06 06:46:58 suz Exp $     */
   2 /*      $DragonFly: src/sys/netinet6/ipsec.c,v 1.22 2008/05/27 01:10:43 dillon Exp $    */
   3 /*      $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
   4
   5 /*
   6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 /*
  35  * IPsec controller part.
  36  */
  37
  38 #include "opt_inet.h"
  39 #include "opt_inet6.h"
  40 #include "opt_ipsec.h"
  41
  42 #include <sys/param.h>
  43 #include <sys/systm.h>
  44 #include <sys/malloc.h>
  45 #include <sys/mbuf.h>
  46 #include <sys/domain.h>
  47 #include <sys/protosw.h>
  48 #include <sys/socket.h>
  49 #include <sys/socketvar.h>
  50 #include <sys/errno.h>
  51 #include <sys/time.h>
  52 #include <sys/kernel.h>
  53 #include <sys/syslog.h>
  54 #include <sys/sysctl.h>
  55 #include <sys/proc.h>
  56 #include <sys/in_cksum.h>
  57 #include <sys/thread2.h>
  58
  59 #include <net/if.h>
  60 #include <net/route.h>
  61
  62 #include <netinet/in.h>
  63 #include <netinet/in_systm.h>
  64 #include <netinet/ip.h>
  65 #include <netinet/ip_var.h>
  66 #include <netinet/in_var.h>
  67 #include <netinet/udp.h>
  68 #include <netinet/udp_var.h>
  69 #include <netinet/ip_ecn.h>
  70 #ifdef INET6
  71 #include <netinet6/ip6_ecn.h>
  72 #endif
  73 #include <netinet/tcp.h>
  74 #include <netinet/udp.h>
  75
  76 #include <netinet/ip6.h>
  77 #ifdef INET6
  78 #include <netinet6/ip6_var.h>
  79 #endif
  80 #include <netinet/in_pcb.h>
  81 #ifdef INET6
  82 #include <netinet/icmp6.h>
  83 #endif
  84
  85 #include <netinet6/ipsec.h>
  86 #ifdef INET6
  87 #include <netinet6/ipsec6.h>
  88 #endif
  89 #include <netinet6/ah.h>
  90 #ifdef INET6
  91 #include <netinet6/ah6.h>
  92 #endif
  93 #ifdef IPSEC_ESP
  94 #include <netinet6/esp.h>
  95 #ifdef INET6
  96 #include <netinet6/esp6.h>
  97 #endif
  98 #endif
  99 #include <netinet6/ipcomp.h>
 100 #ifdef INET6
 101 #include <netinet6/ipcomp6.h>
 102 #endif
 103 #include <netproto/key/key.h>
 104 #include <netproto/key/keydb.h>
 105 #include <netproto/key/key_debug.h>
 106
 107 #include <net/net_osdep.h>
 108
 109 #ifdef IPSEC_DEBUG
 110 int ipsec_debug = 1;
 111 #else
 112 int ipsec_debug = 0;
 113 #endif
 114
 115 struct ipsecstat ipsecstat;
 116 int ip4_ah_cleartos = 1;
 117 int ip4_ah_offsetmask = 0;      /* maybe IP_DF? */
 118 int ip4_ipsec_dfbit = 0;        /* DF bit on encap. 0: clear 1: set 2: copy */
 119 int ip4_esp_trans_deflev = IPSEC_LEVEL_USE;
 120 int ip4_esp_net_deflev = IPSEC_LEVEL_USE;
 121 int ip4_ah_trans_deflev = IPSEC_LEVEL_USE;
 122 int ip4_ah_net_deflev = IPSEC_LEVEL_USE;
 123 struct secpolicy ip4_def_policy;
 124 int ip4_ipsec_ecn = 0;          /* ECN ignore(-1)/forbidden(0)/allowed(1) */
 125 int ip4_esp_randpad = -1;
 126
 127 #ifdef SYSCTL_DECL
 128 SYSCTL_DECL(_net_inet_ipsec);
 129 #ifdef INET6
 130 SYSCTL_DECL(_net_inet6_ipsec6);
 131 #endif
 132 #endif
 133
 134 /* net.inet.ipsec */
 135 SYSCTL_STRUCT(_net_inet_ipsec, IPSECCTL_STATS,
 136         stats, CTLFLAG_RD,      &ipsecstat,     ipsecstat, "");
 137 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_POLICY,
 138         def_policy, CTLFLAG_RW, &ip4_def_policy.policy, 0, "");
 139 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
 140         CTLFLAG_RW, &ip4_esp_trans_deflev,      0, "");
 141 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
 142         CTLFLAG_RW, &ip4_esp_net_deflev,        0, "");
 143 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
 144         CTLFLAG_RW, &ip4_ah_trans_deflev,       0, "");
 145 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
 146         CTLFLAG_RW, &ip4_ah_net_deflev, 0, "");
 147 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS,
 148         ah_cleartos, CTLFLAG_RW,        &ip4_ah_cleartos,       0, "");
 149 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK,
 150         ah_offsetmask, CTLFLAG_RW,      &ip4_ah_offsetmask,     0, "");
 151 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT,
 152         dfbit, CTLFLAG_RW,      &ip4_ipsec_dfbit,       0, "");
 153 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN,
 154         ecn, CTLFLAG_RW,        &ip4_ipsec_ecn, 0, "");
 155 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG,
 156         debug, CTLFLAG_RW,      &ipsec_debug,   0, "");
 157 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD,
 158         esp_randpad, CTLFLAG_RW,        &ip4_esp_randpad,       0, "");
 159
 160 #ifdef INET6
 161 struct ipsecstat ipsec6stat;
 162 int ip6_esp_trans_deflev = IPSEC_LEVEL_USE;
 163 int ip6_esp_net_deflev = IPSEC_LEVEL_USE;
 164 int ip6_ah_trans_deflev = IPSEC_LEVEL_USE;
 165 int ip6_ah_net_deflev = IPSEC_LEVEL_USE;
 166 struct secpolicy ip6_def_policy;
 167 int ip6_ipsec_ecn = 0;          /* ECN ignore(-1)/forbidden(0)/allowed(1) */
 168 int ip6_esp_randpad = -1;
 169
 170 /* net.inet6.ipsec6 */
 171 SYSCTL_STRUCT(_net_inet6_ipsec6, IPSECCTL_STATS,
 172         stats, CTLFLAG_RD, &ipsec6stat, ipsecstat, "");
 173 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY,
 174         def_policy, CTLFLAG_RW, &ip6_def_policy.policy, 0, "");
 175 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
 176         CTLFLAG_RW, &ip6_esp_trans_deflev,      0, "");
 177 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
 178         CTLFLAG_RW, &ip6_esp_net_deflev,        0, "");
 179 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
 180         CTLFLAG_RW, &ip6_ah_trans_deflev,       0, "");
 181 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
 182         CTLFLAG_RW, &ip6_ah_net_deflev, 0, "");
 183 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN,
 184         ecn, CTLFLAG_RW,        &ip6_ipsec_ecn, 0, "");
 185 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG,
 186         debug, CTLFLAG_RW,      &ipsec_debug,   0, "");
 187 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD,
 188         esp_randpad, CTLFLAG_RW,        &ip6_esp_randpad,       0, "");
 189 #endif /* INET6 */
 190
 191 static int ipsec_setspidx_mbuf
 192         (struct secpolicyindex *, u_int, u_int, struct mbuf *, int);
 193 static int ipsec4_setspidx_inpcb (struct mbuf *, struct inpcb *pcb);
 194 #ifdef INET6
 195 static int ipsec6_setspidx_in6pcb (struct mbuf *, struct in6pcb *pcb);
 196 #endif
 197 static int ipsec_setspidx (struct mbuf *, struct secpolicyindex *, int);
 198 static void ipsec4_get_ulp (struct mbuf *m, struct secpolicyindex *, int);
 199 static int ipsec4_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *);
 200 #ifdef INET6
 201 static void ipsec6_get_ulp (struct mbuf *m, struct secpolicyindex *, int);
 202 static int ipsec6_setspidx_ipaddr (struct mbuf *, struct secpolicyindex *);
 203 #endif
 204 static struct inpcbpolicy *ipsec_newpcbpolicy (void);
 205 static void ipsec_delpcbpolicy (struct inpcbpolicy *);
 206 static struct secpolicy *ipsec_deepcopy_policy (struct secpolicy *src);
 207 static int ipsec_set_policy (struct secpolicy **pcb_sp,
 208         int optname, caddr_t request, size_t len, int priv);
 209 static int ipsec_get_policy (struct secpolicy *pcb_sp, struct mbuf **mp);
 210 static void vshiftl (unsigned char *, int, int);
 211 static int ipsec_in_reject (struct secpolicy *, struct mbuf *);
 212 static size_t ipsec_hdrsiz (struct secpolicy *);
 213 #ifdef INET
 214 static struct mbuf *ipsec4_splithdr (struct mbuf *);
 215 #endif
 216 #ifdef INET6
 217 static struct mbuf *ipsec6_splithdr (struct mbuf *);
 218 #endif
 219 #ifdef INET
 220 static int ipsec4_encapsulate (struct mbuf *, struct secasvar *);
 221 #endif
 222 #ifdef INET6
 223 static int ipsec6_encapsulate (struct mbuf *, struct secasvar *);
 224 #endif
 225
 226 /*
 227  * For OUTBOUND packet having a socket. Searching SPD for packet,
 228  * and return a pointer to SP.
 229  * OUT: NULL:   no apropreate SP found, the following value is set to error.
 230  *              0       : bypass
 231  *              EACCES  : discard packet.
 232  *              ENOENT  : ipsec_acquire() in progress, maybe.
 233  *              others  : error occured.
 234  *      others: a pointer to SP
 235  *
 236  * NOTE: IPv6 mapped adddress concern is implemented here.
 237  */
 238 struct secpolicy *
 239 ipsec4_getpolicybysock(struct mbuf *m, u_int dir, struct socket *so, int *error)
 240 {
 241         struct inpcbpolicy *pcbsp = NULL;
 242         struct secpolicy *currsp = NULL;        /* policy on socket */
 243         struct secpolicy *kernsp = NULL;        /* policy on kernel */
 244
 245         /* sanity check */
 246         if (m == NULL || so == NULL || error == NULL)
 247                 panic("ipsec4_getpolicybysock: NULL pointer was passed.");
 248
 249         switch (so->so_proto->pr_domain->dom_family) {
 250         case AF_INET:
 251                 /* set spidx in pcb */
 252                 *error = ipsec4_setspidx_inpcb(m, so->so_pcb);
 253                 break;
 254 #ifdef INET6
 255         case AF_INET6:
 256                 /* set spidx in pcb */
 257                 *error = ipsec6_setspidx_in6pcb(m, so->so_pcb);
 258                 break;
 259 #endif
 260         default:
 261                 panic("ipsec4_getpolicybysock: unsupported address family\n");
 262         }
 263         if (*error)
 264                 return NULL;
 265         switch (so->so_proto->pr_domain->dom_family) {
 266         case AF_INET:
 267                 pcbsp = sotoinpcb(so)->inp_sp;
 268                 break;
 269 #ifdef INET6
 270         case AF_INET6:
 271                 pcbsp = sotoin6pcb(so)->in6p_sp;
 272                 break;
 273 #endif
 274         }
 275
 276         /* sanity check */
 277         if (pcbsp == NULL)
 278                 panic("ipsec4_getpolicybysock: pcbsp is NULL.");
 279
 280         switch (dir) {
 281         case IPSEC_DIR_INBOUND:
 282                 currsp = pcbsp->sp_in;
 283                 break;
 284         case IPSEC_DIR_OUTBOUND:
 285                 currsp = pcbsp->sp_out;
 286                 break;
 287         default:
 288                 panic("ipsec4_getpolicybysock: illegal direction.");
 289         }
 290
 291         /* sanity check */
 292         if (currsp == NULL)
 293                 panic("ipsec4_getpolicybysock: currsp is NULL.");
 294
 295         lwkt_gettoken(&key_token);
 296
 297         /* when privilieged socket */
 298         if (pcbsp->priv) {
 299                 switch (currsp->policy) {
 300                 case IPSEC_POLICY_BYPASS:
 301                         currsp->refcnt++;
 302                         *error = 0;
 303                         lwkt_reltoken(&key_token);
 304                         return currsp;
 305
 306                 case IPSEC_POLICY_ENTRUST:
 307                         /* look for a policy in SPD */
 308                         kernsp = key_allocsp(&currsp->spidx, dir);
 309
 310                         /* SP found */
 311                         if (kernsp != NULL) {
 312                                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 313                                         kprintf("DP ipsec4_getpolicybysock called "
 314                                                "to allocate SP:%p\n", kernsp));
 315                                 *error = 0;
 316                                 lwkt_reltoken(&key_token);
 317                                 return kernsp;
 318                         }
 319
 320                         /* no SP found */
 321                         if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 322                          && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 323                                 ipseclog((LOG_INFO,
 324                                     "fixed system default policy: %d->%d\n",
 325                                     ip4_def_policy.policy, IPSEC_POLICY_NONE));
 326                                 ip4_def_policy.policy = IPSEC_POLICY_NONE;
 327                         }
 328                         ip4_def_policy.refcnt++;
 329                         *error = 0;
 330                         lwkt_reltoken(&key_token);
 331                         return &ip4_def_policy;
 332
 333                 case IPSEC_POLICY_IPSEC:
 334                         currsp->refcnt++;
 335                         *error = 0;
 336                         lwkt_reltoken(&key_token);
 337                         return currsp;
 338
 339                 default:
 340                         ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 341                               "Invalid policy for PCB %d\n", currsp->policy));
 342                         *error = EINVAL;
 343                         lwkt_reltoken(&key_token);
 344                         return NULL;
 345                 }
 346                 /* NOTREACHED */
 347         }
 348
 349         /* when non-privilieged socket */
 350         /* look for a policy in SPD */
 351         kernsp = key_allocsp(&currsp->spidx, dir);
 352
 353         /* SP found */
 354         if (kernsp != NULL) {
 355                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 356                         kprintf("DP ipsec4_getpolicybysock called "
 357                                "to allocate SP:%p\n", kernsp));
 358                 *error = 0;
 359                 lwkt_reltoken(&key_token);
 360                 return kernsp;
 361         }
 362
 363         /* no SP found */
 364         switch (currsp->policy) {
 365         case IPSEC_POLICY_BYPASS:
 366                 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 367                        "Illegal policy for non-priviliged defined %d\n",
 368                         currsp->policy));
 369                 *error = EINVAL;
 370                 lwkt_reltoken(&key_token);
 371                 return NULL;
 372
 373         case IPSEC_POLICY_ENTRUST:
 374                 if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 375                  && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 376                         ipseclog((LOG_INFO,
 377                             "fixed system default policy: %d->%d\n",
 378                             ip4_def_policy.policy, IPSEC_POLICY_NONE));
 379                         ip4_def_policy.policy = IPSEC_POLICY_NONE;
 380                 }
 381                 ip4_def_policy.refcnt++;
 382                 *error = 0;
 383                 lwkt_reltoken(&key_token);
 384                 return &ip4_def_policy;
 385
 386         case IPSEC_POLICY_IPSEC:
 387                 currsp->refcnt++;
 388                 *error = 0;
 389                 lwkt_reltoken(&key_token);
 390                 return currsp;
 391
 392         default:
 393                 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 394                    "Invalid policy for PCB %d\n", currsp->policy));
 395                 *error = EINVAL;
 396                 lwkt_reltoken(&key_token);
 397                 return NULL;
 398         }
 399         /* NOTREACHED */
 400 }
 401
 402 /*
 403  * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
 404  * and return a pointer to SP.
 405  * OUT: positive: a pointer to the entry for security policy leaf matched.
 406  *      NULL:   no apropreate SP found, the following value is set to error.
 407  *              0       : bypass
 408  *              EACCES  : discard packet.
 409  *              ENOENT  : ipsec_acquire() in progress, maybe.
 410  *              others  : error occured.
 411  */
 412 struct secpolicy *
 413 ipsec4_getpolicybyaddr(struct mbuf *m, u_int dir, int flag, int *error)
 414 {
 415         struct secpolicy *sp = NULL;
 416
 417         /* sanity check */
 418         if (m == NULL || error == NULL)
 419                 panic("ipsec4_getpolicybyaddr: NULL pointer was passed.");
 420
 421     {
 422         struct secpolicyindex spidx;
 423
 424         bzero(&spidx, sizeof(spidx));
 425
 426         /* make a index to look for a policy */
 427         *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET, m,
 428             (flag & IP_FORWARDING) ? 0 : 1);
 429
 430         if (*error != 0)
 431                 return NULL;
 432
 433         sp = key_allocsp(&spidx, dir);
 434     }
 435
 436         /* SP found */
 437         if (sp != NULL) {
 438                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 439                         kprintf("DP ipsec4_getpolicybyaddr called "
 440                                "to allocate SP:%p\n", sp));
 441                 *error = 0;
 442                 return sp;
 443         }
 444
 445         /* no SP found */
 446         if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 447          && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 448                 ipseclog((LOG_INFO, "fixed system default policy:%d->%d\n",
 449                         ip4_def_policy.policy,
 450                         IPSEC_POLICY_NONE));
 451                 ip4_def_policy.policy = IPSEC_POLICY_NONE;
 452         }
 453         ip4_def_policy.refcnt++;
 454         *error = 0;
 455         return &ip4_def_policy;
 456 }
 457
 458 #ifdef INET6
 459 /*
 460  * For OUTBOUND packet having a socket. Searching SPD for packet,
 461  * and return a pointer to SP.
 462  * OUT: NULL:   no apropreate SP found, the following value is set to error.
 463  *              0       : bypass
 464  *              EACCES  : discard packet.
 465  *              ENOENT  : ipsec_acquire() in progress, maybe.
 466  *              others  : error occured.
 467  *      others: a pointer to SP
 468  */
 469 struct secpolicy *
 470 ipsec6_getpolicybysock(struct mbuf *m, u_int dir, struct socket *so, int *error)
 471 {
 472         struct inpcbpolicy *pcbsp = NULL;
 473         struct secpolicy *currsp = NULL;        /* policy on socket */
 474         struct secpolicy *kernsp = NULL;        /* policy on kernel */
 475
 476         /* sanity check */
 477         if (m == NULL || so == NULL || error == NULL)
 478                 panic("ipsec6_getpolicybysock: NULL pointer was passed.");
 479
 480 #ifdef DIAGNOSTIC
 481         if (so->so_proto->pr_domain->dom_family != AF_INET6)
 482                 panic("ipsec6_getpolicybysock: socket domain != inet6");
 483 #endif
 484
 485         /* set spidx in pcb */
 486         ipsec6_setspidx_in6pcb(m, so->so_pcb);
 487
 488         pcbsp = sotoin6pcb(so)->in6p_sp;
 489
 490         /* sanity check */
 491         if (pcbsp == NULL)
 492                 panic("ipsec6_getpolicybysock: pcbsp is NULL.");
 493
 494         switch (dir) {
 495         case IPSEC_DIR_INBOUND:
 496                 currsp = pcbsp->sp_in;
 497                 break;
 498         case IPSEC_DIR_OUTBOUND:
 499                 currsp = pcbsp->sp_out;
 500                 break;
 501         default:
 502                 panic("ipsec6_getpolicybysock: illegal direction.");
 503         }
 504
 505         /* sanity check */
 506         if (currsp == NULL)
 507                 panic("ipsec6_getpolicybysock: currsp is NULL.");
 508
 509         /* when privilieged socket */
 510         if (pcbsp->priv) {
 511                 switch (currsp->policy) {
 512                 case IPSEC_POLICY_BYPASS:
 513                         currsp->refcnt++;
 514                         *error = 0;
 515                         return currsp;
 516
 517                 case IPSEC_POLICY_ENTRUST:
 518                         /* look for a policy in SPD */
 519                         kernsp = key_allocsp(&currsp->spidx, dir);
 520
 521                         /* SP found */
 522                         if (kernsp != NULL) {
 523                                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 524                                         kprintf("DP ipsec6_getpolicybysock called "
 525                                                "to allocate SP:%p\n", kernsp));
 526                                 *error = 0;
 527                                 return kernsp;
 528                         }
 529
 530                         /* no SP found */
 531                         if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 532                          && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 533                                 ipseclog((LOG_INFO,
 534                                     "fixed system default policy: %d->%d\n",
 535                                     ip6_def_policy.policy, IPSEC_POLICY_NONE));
 536                                 ip6_def_policy.policy = IPSEC_POLICY_NONE;
 537                         }
 538                         ip6_def_policy.refcnt++;
 539                         *error = 0;
 540                         return &ip6_def_policy;
 541
 542                 case IPSEC_POLICY_IPSEC:
 543                         currsp->refcnt++;
 544                         *error = 0;
 545                         return currsp;
 546
 547                 default:
 548                         ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
 549                             "Invalid policy for PCB %d\n", currsp->policy));
 550                         *error = EINVAL;
 551                         return NULL;
 552                 }
 553                 /* NOTREACHED */
 554         }
 555
 556         /* when non-privilieged socket */
 557         /* look for a policy in SPD */
 558         kernsp = key_allocsp(&currsp->spidx, dir);
 559
 560         /* SP found */
 561         if (kernsp != NULL) {
 562                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 563                         kprintf("DP ipsec6_getpolicybysock called "
 564                                "to allocate SP:%p\n", kernsp));
 565                 *error = 0;
 566                 return kernsp;
 567         }
 568
 569         /* no SP found */
 570         switch (currsp->policy) {
 571         case IPSEC_POLICY_BYPASS:
 572                 ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
 573                     "Illegal policy for non-priviliged defined %d\n",
 574                     currsp->policy));
 575                 *error = EINVAL;
 576                 return NULL;
 577
 578         case IPSEC_POLICY_ENTRUST:
 579                 if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 580                  && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 581                         ipseclog((LOG_INFO,
 582                             "fixed system default policy: %d->%d\n",
 583                             ip6_def_policy.policy, IPSEC_POLICY_NONE));
 584                         ip6_def_policy.policy = IPSEC_POLICY_NONE;
 585                 }
 586                 ip6_def_policy.refcnt++;
 587                 *error = 0;
 588                 return &ip6_def_policy;
 589
 590         case IPSEC_POLICY_IPSEC:
 591                 currsp->refcnt++;
 592                 *error = 0;
 593                 return currsp;
 594
 595         default:
 596                 ipseclog((LOG_ERR,
 597                     "ipsec6_policybysock: Invalid policy for PCB %d\n",
 598                     currsp->policy));
 599                 *error = EINVAL;
 600                 return NULL;
 601         }
 602         /* NOTREACHED */
 603 }
 604
 605 /*
 606  * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
 607  * and return a pointer to SP.
 608  * `flag' means that packet is to be forwarded whether or not.
 609  *      flag = 1: forwad
 610  * OUT: positive: a pointer to the entry for security policy leaf matched.
 611  *      NULL:   no apropreate SP found, the following value is set to error.
 612  *              0       : bypass
 613  *              EACCES  : discard packet.
 614  *              ENOENT  : ipsec_acquire() in progress, maybe.
 615  *              others  : error occured.
 616  */
 617 #ifndef IP_FORWARDING
 618 #define IP_FORWARDING 1
 619 #endif
 620
 621 struct secpolicy *
 622 ipsec6_getpolicybyaddr(struct mbuf *m, u_int dir, int flag, int *error)
 623 {
 624         struct secpolicy *sp = NULL;
 625
 626         /* sanity check */
 627         if (m == NULL || error == NULL)
 628                 panic("ipsec6_getpolicybyaddr: NULL pointer was passed.");
 629
 630     {
 631         struct secpolicyindex spidx;
 632
 633         bzero(&spidx, sizeof(spidx));
 634
 635         /* make a index to look for a policy */
 636         *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET6, m,
 637             (flag & IP_FORWARDING) ? 0 : 1);
 638
 639         if (*error != 0)
 640                 return NULL;
 641
 642         sp = key_allocsp(&spidx, dir);
 643     }
 644
 645         /* SP found */
 646         if (sp != NULL) {
 647                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 648                         kprintf("DP ipsec6_getpolicybyaddr called "
 649                                "to allocate SP:%p\n", sp));
 650                 *error = 0;
 651                 return sp;
 652         }
 653
 654         /* no SP found */
 655         if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 656          && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 657                 ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n",
 658                     ip6_def_policy.policy, IPSEC_POLICY_NONE));
 659                 ip6_def_policy.policy = IPSEC_POLICY_NONE;
 660         }
 661         ip6_def_policy.refcnt++;
 662         *error = 0;
 663         return &ip6_def_policy;
 664 }
 665 #endif /* INET6 */
 666
 667 /*
 668  * set IP address into spidx from mbuf.
 669  * When Forwarding packet and ICMP echo reply, this function is used.
 670  *
 671  * IN:  get the followings from mbuf.
 672  *      protocol family, src, dst, next protocol
 673  * OUT:
 674  *      0:      success.
 675  *      other:  failure, and set errno.
 676  */
 677 int
 678 ipsec_setspidx_mbuf(struct secpolicyindex *spidx, u_int dir, u_int family,
 679                     struct mbuf *m, int needport)
 680 {
 681         int error;
 682
 683         /* sanity check */
 684         if (spidx == NULL || m == NULL)
 685                 panic("ipsec_setspidx_mbuf: NULL pointer was passed.");
 686
 687         bzero(spidx, sizeof(*spidx));
 688
 689         error = ipsec_setspidx(m, spidx, needport);
 690         if (error)
 691                 goto bad;
 692         spidx->dir = dir;
 693
 694         return 0;
 695
 696 bad:
 697         /* XXX initialize */
 698         bzero(spidx, sizeof(*spidx));
 699         return EINVAL;
 700 }
 701
 702 static int
 703 ipsec4_setspidx_inpcb(struct mbuf *m, struct inpcb *pcb)
 704 {
 705         struct secpolicyindex *spidx;
 706         int error;
 707
 708         /* sanity check */
 709         if (pcb == NULL)
 710                 panic("ipsec4_setspidx_inpcb: no PCB found.");
 711         if (pcb->inp_sp == NULL)
 712                 panic("ipsec4_setspidx_inpcb: no inp_sp found.");
 713         if (pcb->inp_sp->sp_out == NULL || pcb->inp_sp->sp_in == NULL)
 714                 panic("ipsec4_setspidx_inpcb: no sp_in/out found.");
 715
 716         bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
 717         bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
 718
 719         spidx = &pcb->inp_sp->sp_in->spidx;
 720         error = ipsec_setspidx(m, spidx, 1);
 721         if (error)
 722                 goto bad;
 723         spidx->dir = IPSEC_DIR_INBOUND;
 724
 725         spidx = &pcb->inp_sp->sp_out->spidx;
 726         error = ipsec_setspidx(m, spidx, 1);
 727         if (error)
 728                 goto bad;
 729         spidx->dir = IPSEC_DIR_OUTBOUND;
 730
 731         return 0;
 732
 733 bad:
 734         bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
 735         bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
 736         return error;
 737 }
 738
 739 #ifdef INET6
 740 static int
 741 ipsec6_setspidx_in6pcb(struct mbuf *m, struct in6pcb *pcb)
 742 {
 743         struct secpolicyindex *spidx;
 744         int error;
 745
 746         /* sanity check */
 747         if (pcb == NULL)
 748                 panic("ipsec6_setspidx_in6pcb: no PCB found.");
 749         if (pcb->in6p_sp == NULL)
 750                 panic("ipsec6_setspidx_in6pcb: no in6p_sp found.");
 751         if (pcb->in6p_sp->sp_out == NULL || pcb->in6p_sp->sp_in == NULL)
 752                 panic("ipsec6_setspidx_in6pcb: no sp_in/out found.");
 753
 754         bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
 755         bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
 756
 757         spidx = &pcb->in6p_sp->sp_in->spidx;
 758         error = ipsec_setspidx(m, spidx, 1);
 759         if (error)
 760                 goto bad;
 761         spidx->dir = IPSEC_DIR_INBOUND;
 762
 763         spidx = &pcb->in6p_sp->sp_out->spidx;
 764         error = ipsec_setspidx(m, spidx, 1);
 765         if (error)
 766                 goto bad;
 767         spidx->dir = IPSEC_DIR_OUTBOUND;
 768
 769         return 0;
 770
 771 bad:
 772         bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
 773         bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
 774         return error;
 775 }
 776 #endif
 777
 778 /*
 779  * configure security policy index (src/dst/proto/sport/dport)
 780  * by looking at the content of mbuf.
 781  * the caller is responsible for error recovery (like clearing up spidx).
 782  */
 783 static int
 784 ipsec_setspidx(struct mbuf *m, struct secpolicyindex *spidx, int needport)
 785 {
 786         struct ip *ip = NULL;
 787         struct ip ipbuf;
 788         u_int v;
 789         struct mbuf *n;
 790         int len;
 791         int error;
 792
 793         if (m == NULL)
 794                 panic("ipsec_setspidx: m == 0 passed.");
 795
 796         /*
 797          * validate m->m_pkthdr.len.  we see incorrect length if we
 798          * mistakenly call this function with inconsistent mbuf chain
 799          * (like 4.4BSD tcp/udp processing).  XXX should we panic here?
 800          */
 801         len = 0;
 802         for (n = m; n; n = n->m_next)
 803                 len += n->m_len;
 804         if (m->m_pkthdr.len != len) {
 805                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 806                         kprintf("ipsec_setspidx: "
 807                                "total of m_len(%d) != pkthdr.len(%d), "
 808                                "ignored.\n",
 809                                 len, m->m_pkthdr.len));
 810                 return EINVAL;
 811         }
 812
 813         if (m->m_pkthdr.len < sizeof(struct ip)) {
 814                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 815                         kprintf("ipsec_setspidx: "
 816                             "pkthdr.len(%d) < sizeof(struct ip), ignored.\n",
 817                             m->m_pkthdr.len));
 818                 return EINVAL;
 819         }
 820
 821         if (m->m_len >= sizeof(*ip))
 822                 ip = mtod(m, struct ip *);
 823         else {
 824                 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
 825                 ip = &ipbuf;
 826         }
 827 #ifdef _IP_VHL
 828         v = _IP_VHL_V(ip->ip_vhl);
 829 #else
 830         v = ip->ip_v;
 831 #endif
 832         switch (v) {
 833         case 4:
 834                 error = ipsec4_setspidx_ipaddr(m, spidx);
 835                 if (error)
 836                         return error;
 837                 ipsec4_get_ulp(m, spidx, needport);
 838                 return 0;
 839 #ifdef INET6
 840         case 6:
 841                 if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) {
 842                         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 843                                 kprintf("ipsec_setspidx: "
 844                                     "pkthdr.len(%d) < sizeof(struct ip6_hdr), "
 845                                     "ignored.\n", m->m_pkthdr.len));
 846                         return EINVAL;
 847                 }
 848                 error = ipsec6_setspidx_ipaddr(m, spidx);
 849                 if (error)
 850                         return error;
 851                 ipsec6_get_ulp(m, spidx, needport);
 852                 return 0;
 853 #endif
 854         default:
 855                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 856                         kprintf("ipsec_setspidx: "
 857                             "unknown IP version %u, ignored.\n", v));
 858                 return EINVAL;
 859         }
 860 }
 861
 862 static void
 863 ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
 864 {
 865         struct ip ip;
 866         struct ip6_ext ip6e;
 867         u_int8_t nxt;
 868         int off;
 869         struct tcphdr th;
 870         struct udphdr uh;
 871
 872         /* sanity check */
 873         if (m == NULL)
 874                 panic("ipsec4_get_ulp: NULL pointer was passed.");
 875         if (m->m_pkthdr.len < sizeof(ip))
 876                 panic("ipsec4_get_ulp: too short");
 877
 878         /* set default */
 879         spidx->ul_proto = IPSEC_ULPROTO_ANY;
 880         ((struct sockaddr_in *)&spidx->src)->sin_port = IPSEC_PORT_ANY;
 881         ((struct sockaddr_in *)&spidx->dst)->sin_port = IPSEC_PORT_ANY;
 882
 883         m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
 884         /* ip_input() flips it into host endian XXX need more checking */
 885         if (ip.ip_off & (IP_MF | IP_OFFMASK))
 886                 return;
 887
 888         nxt = ip.ip_p;
 889 #ifdef _IP_VHL
 890         off = _IP_VHL_HL(ip->ip_vhl) << 2;
 891 #else
 892         off = ip.ip_hl << 2;
 893 #endif
 894         while (off < m->m_pkthdr.len) {
 895                 switch (nxt) {
 896                 case IPPROTO_TCP:
 897                         spidx->ul_proto = nxt;
 898                         if (!needport)
 899                                 return;
 900                         if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
 901                                 return;
 902                         m_copydata(m, off, sizeof(th), (caddr_t)&th);
 903                         ((struct sockaddr_in *)&spidx->src)->sin_port =
 904                             th.th_sport;
 905                         ((struct sockaddr_in *)&spidx->dst)->sin_port =
 906                             th.th_dport;
 907                         return;
 908                 case IPPROTO_UDP:
 909                         spidx->ul_proto = nxt;
 910                         if (!needport)
 911                                 return;
 912                         if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
 913                                 return;
 914                         m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
 915                         ((struct sockaddr_in *)&spidx->src)->sin_port =
 916                             uh.uh_sport;
 917                         ((struct sockaddr_in *)&spidx->dst)->sin_port =
 918                             uh.uh_dport;
 919                         return;
 920                 case IPPROTO_AH:
 921                         if (off + sizeof(ip6e) > m->m_pkthdr.len)
 922                                 return;
 923                         m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
 924                         off += (ip6e.ip6e_len + 2) << 2;
 925                         nxt = ip6e.ip6e_nxt;
 926                         break;
 927                 case IPPROTO_ICMP:
 928                 default:
 929                         /* XXX intermediate headers??? */
 930                         spidx->ul_proto = nxt;
 931                         return;
 932                 }
 933         }
 934 }
 935
 936 /* assumes that m is sane */
 937 static int
 938 ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
 939 {
 940         struct ip *ip = NULL;
 941         struct ip ipbuf;
 942         struct sockaddr_in *sin;
 943
 944         if (m->m_len >= sizeof(*ip))
 945                 ip = mtod(m, struct ip *);
 946         else {
 947                 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
 948                 ip = &ipbuf;
 949         }
 950
 951         sin = (struct sockaddr_in *)&spidx->src;
 952         bzero(sin, sizeof(*sin));
 953         sin->sin_family = AF_INET;
 954         sin->sin_len = sizeof(struct sockaddr_in);
 955         bcopy(&ip->ip_src, &sin->sin_addr, sizeof(ip->ip_src));
 956         spidx->prefs = sizeof(struct in_addr) << 3;
 957
 958         sin = (struct sockaddr_in *)&spidx->dst;
 959         bzero(sin, sizeof(*sin));
 960         sin->sin_family = AF_INET;
 961         sin->sin_len = sizeof(struct sockaddr_in);
 962         bcopy(&ip->ip_dst, &sin->sin_addr, sizeof(ip->ip_dst));
 963         spidx->prefd = sizeof(struct in_addr) << 3;
 964         return 0;
 965 }
 966
 967 #ifdef INET6
 968 static void
 969 ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
 970 {
 971         int off, nxt;
 972         struct tcphdr th;
 973         struct udphdr uh;
 974
 975         /* sanity check */
 976         if (m == NULL)
 977                 panic("ipsec6_get_ulp: NULL pointer was passed.");
 978
 979         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 980                 kprintf("ipsec6_get_ulp:\n"); kdebug_mbuf(m));
 981
 982         /* set default */
 983         spidx->ul_proto = IPSEC_ULPROTO_ANY;
 984         ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY;
 985         ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY;
 986
 987         nxt = -1;
 988         off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
 989         if (off < 0 || m->m_pkthdr.len < off)
 990                 return;
 991
 992         switch (nxt) {
 993         case IPPROTO_TCP:
 994                 spidx->ul_proto = nxt;
 995                 if (!needport)
 996                         break;
 997                 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
 998                         break;
 999                 m_copydata(m, off, sizeof(th), (caddr_t)&th);
1000                 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport;
1001                 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport;
1002                 break;
1003         case IPPROTO_UDP:
1004                 spidx->ul_proto = nxt;
1005                 if (!needport)
1006                         break;
1007                 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
1008                         break;
1009                 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
1010                 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport;
1011                 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport;
1012                 break;
1013         case IPPROTO_ICMPV6:
1014         default:
1015                 /* XXX intermediate headers??? */
1016                 spidx->ul_proto = nxt;
1017                 break;
1018         }
1019 }
1020
1021 /* assumes that m is sane */
1022 static int
1023 ipsec6_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
1024 {
1025         struct ip6_hdr *ip6 = NULL;
1026         struct ip6_hdr ip6buf;
1027         struct sockaddr_in6 *sin6;
1028
1029         if (m->m_len >= sizeof(*ip6))
1030                 ip6 = mtod(m, struct ip6_hdr *);
1031         else {
1032                 m_copydata(m, 0, sizeof(ip6buf), (caddr_t)&ip6buf);
1033                 ip6 = &ip6buf;
1034         }
1035
1036         sin6 = (struct sockaddr_in6 *)&spidx->src;
1037         bzero(sin6, sizeof(*sin6));
1038         sin6->sin6_family = AF_INET6;
1039         sin6->sin6_len = sizeof(struct sockaddr_in6);
1040         bcopy(&ip6->ip6_src, &sin6->sin6_addr, sizeof(ip6->ip6_src));
1041         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
1042                 sin6->sin6_addr.s6_addr16[1] = 0;
1043                 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
1044         }
1045         spidx->prefs = sizeof(struct in6_addr) << 3;
1046
1047         sin6 = (struct sockaddr_in6 *)&spidx->dst;
1048         bzero(sin6, sizeof(*sin6));
1049         sin6->sin6_family = AF_INET6;
1050         sin6->sin6_len = sizeof(struct sockaddr_in6);
1051         bcopy(&ip6->ip6_dst, &sin6->sin6_addr, sizeof(ip6->ip6_dst));
1052         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
1053                 sin6->sin6_addr.s6_addr16[1] = 0;
1054                 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
1055         }
1056         spidx->prefd = sizeof(struct in6_addr) << 3;
1057
1058         return 0;
1059 }
1060 #endif
1061
1062 static struct inpcbpolicy *
1063 ipsec_newpcbpolicy(void)
1064 {
1065         struct inpcbpolicy *p;
1066
1067         p = (struct inpcbpolicy *)kmalloc(sizeof(*p), M_SECA, M_NOWAIT);
1068         return p;
1069 }
1070
1071 static void
1072 ipsec_delpcbpolicy(struct inpcbpolicy *p)
1073 {
1074         kfree(p, M_SECA);
1075 }
1076
1077 /* initialize policy in PCB */
1078 int
1079 ipsec_init_policy(struct socket *so, struct inpcbpolicy **pcb_sp)
1080 {
1081         struct inpcbpolicy *new;
1082
1083         /* sanity check. */
1084         if (so == NULL || pcb_sp == NULL)
1085                 panic("ipsec_init_policy: NULL pointer was passed.");
1086
1087         new = ipsec_newpcbpolicy();
1088         if (new == NULL) {
1089                 ipseclog((LOG_DEBUG, "ipsec_init_policy: No more memory.\n"));
1090                 return ENOBUFS;
1091         }
1092         bzero(new, sizeof(*new));
1093
1094         if (so->so_cred != 0 && so->so_cred->cr_uid == 0)
1095                 new->priv = 1;
1096         else
1097                 new->priv = 0;
1098
1099         if ((new->sp_in = key_newsp()) == NULL) {
1100                 ipsec_delpcbpolicy(new);
1101                 return ENOBUFS;
1102         }
1103         new->sp_in->state = IPSEC_SPSTATE_ALIVE;
1104         new->sp_in->policy = IPSEC_POLICY_ENTRUST;
1105
1106         if ((new->sp_out = key_newsp()) == NULL) {
1107                 key_freesp(new->sp_in);
1108                 ipsec_delpcbpolicy(new);
1109                 return ENOBUFS;
1110         }
1111         new->sp_out->state = IPSEC_SPSTATE_ALIVE;
1112         new->sp_out->policy = IPSEC_POLICY_ENTRUST;
1113
1114         *pcb_sp = new;
1115
1116         return 0;
1117 }
1118
1119 /* copy old ipsec policy into new */
1120 int
1121 ipsec_copy_policy(struct inpcbpolicy *old, struct inpcbpolicy *new)
1122 {
1123         struct secpolicy *sp;
1124
1125         sp = ipsec_deepcopy_policy(old->sp_in);
1126         if (sp) {
1127                 key_freesp(new->sp_in);
1128                 new->sp_in = sp;
1129         } else
1130                 return ENOBUFS;
1131
1132         sp = ipsec_deepcopy_policy(old->sp_out);
1133         if (sp) {
1134                 key_freesp(new->sp_out);
1135                 new->sp_out = sp;
1136         } else
1137                 return ENOBUFS;
1138
1139         new->priv = old->priv;
1140
1141         return 0;
1142 }
1143
1144 /* deep-copy a policy in PCB */
1145 static struct secpolicy *
1146 ipsec_deepcopy_policy(struct secpolicy *src)
1147 {
1148         struct ipsecrequest *newchain = NULL;
1149         struct ipsecrequest *p;
1150         struct ipsecrequest **q;
1151         struct ipsecrequest *r;
1152         struct secpolicy *dst;
1153
1154         dst = key_newsp();
1155         if (src == NULL || dst == NULL)
1156                 return NULL;
1157
1158         /*
1159          * deep-copy IPsec request chain.  This is required since struct
1160          * ipsecrequest is not reference counted.
1161          */
1162         q = &newchain;
1163         for (p = src->req; p; p = p->next) {
1164                 *q = (struct ipsecrequest *)kmalloc(sizeof(struct ipsecrequest),
1165                         M_SECA, M_NOWAIT | M_ZERO);
1166                 if (*q == NULL)
1167                         goto fail;
1168                 (*q)->next = NULL;
1169
1170                 (*q)->saidx.proto = p->saidx.proto;
1171                 (*q)->saidx.mode = p->saidx.mode;
1172                 (*q)->level = p->level;
1173                 (*q)->saidx.reqid = p->saidx.reqid;
1174
1175                 bcopy(&p->saidx.src, &(*q)->saidx.src, sizeof((*q)->saidx.src));
1176                 bcopy(&p->saidx.dst, &(*q)->saidx.dst, sizeof((*q)->saidx.dst));
1177
1178                 (*q)->sav = NULL;
1179                 (*q)->sp = dst;
1180
1181                 q = &((*q)->next);
1182         }
1183
1184         dst->req = newchain;
1185         dst->state = src->state;
1186         dst->policy = src->policy;
1187         /* do not touch the refcnt fields */
1188
1189         return dst;
1190
1191 fail:
1192         for (p = newchain; p; p = r) {
1193                 r = p->next;
1194                 kfree(p, M_SECA);
1195                 p = NULL;
1196         }
1197         return NULL;
1198 }
1199
1200 /* set policy and ipsec request if present. */
1201 static int
1202 ipsec_set_policy(struct secpolicy **pcb_sp, int optname, caddr_t request,
1203                  size_t len, int priv)
1204 {
1205         struct sadb_x_policy *xpl;
1206         struct secpolicy *newsp = NULL;
1207         int error;
1208
1209         /* sanity check. */
1210         if (pcb_sp == NULL || *pcb_sp == NULL || request == NULL)
1211                 return EINVAL;
1212         if (len < sizeof(*xpl))
1213                 return EINVAL;
1214         xpl = (struct sadb_x_policy *)request;
1215
1216         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1217                 kprintf("ipsec_set_policy: passed policy\n");
1218                 kdebug_sadb_x_policy((struct sadb_ext *)xpl));
1219
1220         /* check policy type */
1221         /* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */
1222         if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD
1223          || xpl->sadb_x_policy_type == IPSEC_POLICY_NONE)
1224                 return EINVAL;
1225
1226         /* check privileged socket */
1227         if (priv == 0 && xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS)
1228                 return EACCES;
1229
1230         /* allocation new SP entry */
1231         if ((newsp = key_msg2sp(xpl, len, &error)) == NULL)
1232                 return error;
1233
1234         newsp->state = IPSEC_SPSTATE_ALIVE;
1235
1236         /* clear old SP and set new SP */
1237         key_freesp(*pcb_sp);
1238         *pcb_sp = newsp;
1239         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1240                 kprintf("ipsec_set_policy: new policy\n");
1241                 kdebug_secpolicy(newsp));
1242
1243         return 0;
1244 }
1245
1246 static int
1247 ipsec_get_policy(struct secpolicy *pcb_sp, struct mbuf **mp)
1248 {
1249
1250         /* sanity check. */
1251         if (pcb_sp == NULL || mp == NULL)
1252                 return EINVAL;
1253
1254         *mp = key_sp2msg(pcb_sp);
1255         if (!*mp) {
1256                 ipseclog((LOG_DEBUG, "ipsec_get_policy: No more memory.\n"));
1257                 return ENOBUFS;
1258         }
1259
1260         KKASSERT((*mp)->m_type == MT_DATA);
1261         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1262                 kprintf("ipsec_get_policy:\n");
1263                 kdebug_mbuf(*mp));
1264
1265         return 0;
1266 }
1267
1268 int
1269 ipsec4_set_policy(struct inpcb *inp, int optname, caddr_t request, size_t len,
1270                   int priv)
1271 {
1272         struct sadb_x_policy *xpl;
1273         struct secpolicy **pcb_sp;
1274
1275         /* sanity check. */
1276         if (inp == NULL || request == NULL)
1277                 return EINVAL;
1278         if (len < sizeof(*xpl))
1279                 return EINVAL;
1280         xpl = (struct sadb_x_policy *)request;
1281
1282         /* select direction */
1283         switch (xpl->sadb_x_policy_dir) {
1284         case IPSEC_DIR_INBOUND:
1285                 pcb_sp = &inp->inp_sp->sp_in;
1286                 break;
1287         case IPSEC_DIR_OUTBOUND:
1288                 pcb_sp = &inp->inp_sp->sp_out;
1289                 break;
1290         default:
1291                 ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1292                         xpl->sadb_x_policy_dir));
1293                 return EINVAL;
1294         }
1295
1296         return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1297 }
1298
1299 int
1300 ipsec4_get_policy(struct inpcb *inp, caddr_t request, size_t len,
1301                   struct mbuf **mp)
1302 {
1303         struct sadb_x_policy *xpl;
1304         struct secpolicy *pcb_sp;
1305
1306         /* sanity check. */
1307         if (inp == NULL || request == NULL || mp == NULL)
1308                 return EINVAL;
1309         if (inp->inp_sp == NULL)
1310                 panic("policy in PCB is NULL");
1311         if (len < sizeof(*xpl))
1312                 return EINVAL;
1313         xpl = (struct sadb_x_policy *)request;
1314
1315         /* select direction */
1316         switch (xpl->sadb_x_policy_dir) {
1317         case IPSEC_DIR_INBOUND:
1318                 pcb_sp = inp->inp_sp->sp_in;
1319                 break;
1320         case IPSEC_DIR_OUTBOUND:
1321                 pcb_sp = inp->inp_sp->sp_out;
1322                 break;
1323         default:
1324                 ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1325                         xpl->sadb_x_policy_dir));
1326                 return EINVAL;
1327         }
1328
1329         return ipsec_get_policy(pcb_sp, mp);
1330 }
1331
1332 /* delete policy in PCB */
1333 int
1334 ipsec4_delete_pcbpolicy(struct inpcb *inp)
1335 {
1336         /* sanity check. */
1337         if (inp == NULL)
1338                 panic("ipsec4_delete_pcbpolicy: NULL pointer was passed.");
1339
1340         if (inp->inp_sp == NULL)
1341                 return 0;
1342
1343         if (inp->inp_sp->sp_in != NULL) {
1344                 key_freesp(inp->inp_sp->sp_in);
1345                 inp->inp_sp->sp_in = NULL;
1346         }
1347
1348         if (inp->inp_sp->sp_out != NULL) {
1349                 key_freesp(inp->inp_sp->sp_out);
1350                 inp->inp_sp->sp_out = NULL;
1351         }
1352
1353         ipsec_delpcbpolicy(inp->inp_sp);
1354         inp->inp_sp = NULL;
1355
1356         return 0;
1357 }
1358
1359 #ifdef INET6
1360 int
1361 ipsec6_set_policy(struct in6pcb *in6p, int optname, caddr_t request, size_t len,
1362                   int priv)
1363 {
1364         struct sadb_x_policy *xpl;
1365         struct secpolicy **pcb_sp;
1366
1367         /* sanity check. */
1368         if (in6p == NULL || request == NULL)
1369                 return EINVAL;
1370         if (len < sizeof(*xpl))
1371                 return EINVAL;
1372         xpl = (struct sadb_x_policy *)request;
1373
1374         /* select direction */
1375         switch (xpl->sadb_x_policy_dir) {
1376         case IPSEC_DIR_INBOUND:
1377                 pcb_sp = &in6p->in6p_sp->sp_in;
1378                 break;
1379         case IPSEC_DIR_OUTBOUND:
1380                 pcb_sp = &in6p->in6p_sp->sp_out;
1381                 break;
1382         default:
1383                 ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1384                         xpl->sadb_x_policy_dir));
1385                 return EINVAL;
1386         }
1387
1388         return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1389 }
1390
1391 int
1392 ipsec6_get_policy(struct in6pcb *in6p, caddr_t request, size_t len,
1393                   struct mbuf **mp)
1394 {
1395         struct sadb_x_policy *xpl;
1396         struct secpolicy *pcb_sp;
1397
1398         /* sanity check. */
1399         if (in6p == NULL || request == NULL || mp == NULL)
1400                 return EINVAL;
1401         if (in6p->in6p_sp == NULL)
1402                 panic("policy in PCB is NULL");
1403         if (len < sizeof(*xpl))
1404                 return EINVAL;
1405         xpl = (struct sadb_x_policy *)request;
1406
1407         /* select direction */
1408         switch (xpl->sadb_x_policy_dir) {
1409         case IPSEC_DIR_INBOUND:
1410                 pcb_sp = in6p->in6p_sp->sp_in;
1411                 break;
1412         case IPSEC_DIR_OUTBOUND:
1413                 pcb_sp = in6p->in6p_sp->sp_out;
1414                 break;
1415         default:
1416                 ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1417                         xpl->sadb_x_policy_dir));
1418                 return EINVAL;
1419         }
1420
1421         return ipsec_get_policy(pcb_sp, mp);
1422 }
1423
1424 int
1425 ipsec6_delete_pcbpolicy(struct in6pcb *in6p)
1426 {
1427         /* sanity check. */
1428         if (in6p == NULL)
1429                 panic("ipsec6_delete_pcbpolicy: NULL pointer was passed.");
1430
1431         if (in6p->in6p_sp == NULL)
1432                 return 0;
1433
1434         if (in6p->in6p_sp->sp_in != NULL) {
1435                 key_freesp(in6p->in6p_sp->sp_in);
1436                 in6p->in6p_sp->sp_in = NULL;
1437         }
1438
1439         if (in6p->in6p_sp->sp_out != NULL) {
1440                 key_freesp(in6p->in6p_sp->sp_out);
1441                 in6p->in6p_sp->sp_out = NULL;
1442         }
1443
1444         ipsec_delpcbpolicy(in6p->in6p_sp);
1445         in6p->in6p_sp = NULL;
1446
1447         return 0;
1448 }
1449 #endif
1450
1451 /*
1452  * return current level.
1453  * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
1454  */
1455 u_int
1456 ipsec_get_reqlevel(struct ipsecrequest *isr)
1457 {
1458         u_int level = 0;
1459         u_int esp_trans_deflev, esp_net_deflev, ah_trans_deflev, ah_net_deflev;
1460
1461         /* sanity check */
1462         if (isr == NULL || isr->sp == NULL)
1463                 panic("ipsec_get_reqlevel: NULL pointer is passed.");
1464         if (((struct sockaddr *)&isr->sp->spidx.src)->sa_family
1465                         != ((struct sockaddr *)&isr->sp->spidx.dst)->sa_family)
1466                 panic("ipsec_get_reqlevel: family mismatched.");
1467
1468 /* XXX note that we have ipseclog() expanded here - code sync issue */
1469 #define IPSEC_CHECK_DEFAULT(lev) \
1470         (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE            \
1471                         && (lev) != IPSEC_LEVEL_UNIQUE)                       \
1472                 ? (ipsec_debug                                                \
1473                         ? log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
1474                                 (lev), IPSEC_LEVEL_REQUIRE)                   \
1475                         : 0),                                                 \
1476                         (lev) = IPSEC_LEVEL_REQUIRE,                          \
1477                         (lev)                                                 \
1478                 : (lev))
1479
1480         /* set default level */
1481         switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) {
1482 #ifdef INET
1483         case AF_INET:
1484                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev);
1485                 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev);
1486                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev);
1487                 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev);
1488                 break;
1489 #endif
1490 #ifdef INET6
1491         case AF_INET6:
1492                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev);
1493                 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev);
1494                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev);
1495                 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev);
1496                 break;
1497 #endif /* INET6 */
1498         default:
1499                 panic("key_get_reqlevel: Unknown family. %d",
1500                         ((struct sockaddr *)&isr->sp->spidx.src)->sa_family);
1501         }
1502
1503 #undef IPSEC_CHECK_DEFAULT
1504
1505         /* set level */
1506         switch (isr->level) {
1507         case IPSEC_LEVEL_DEFAULT:
1508                 switch (isr->saidx.proto) {
1509                 case IPPROTO_ESP:
1510                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1511                                 level = esp_net_deflev;
1512                         else
1513                                 level = esp_trans_deflev;
1514                         break;
1515                 case IPPROTO_AH:
1516                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1517                                 level = ah_net_deflev;
1518                         else
1519                                 level = ah_trans_deflev;
1520                 case IPPROTO_IPCOMP:
1521                         /*
1522                          * we don't really care, as IPcomp document says that
1523                          * we shouldn't compress small packets
1524                          */
1525                         level = IPSEC_LEVEL_USE;
1526                         break;
1527                 default:
1528                         panic("ipsec_get_reqlevel: "
1529                                 "Illegal protocol defined %u",
1530                                 isr->saidx.proto);
1531                 }
1532                 break;
1533
1534         case IPSEC_LEVEL_USE:
1535         case IPSEC_LEVEL_REQUIRE:
1536                 level = isr->level;
1537                 break;
1538         case IPSEC_LEVEL_UNIQUE:
1539                 level = IPSEC_LEVEL_REQUIRE;
1540                 break;
1541
1542         default:
1543                 panic("ipsec_get_reqlevel: Illegal IPsec level %u",
1544                         isr->level);
1545         }
1546
1547         return level;
1548 }
1549
1550 /*
1551  * Check AH/ESP integrity.
1552  * OUT:
1553  *      0: valid
1554  *      1: invalid
1555  */
1556 static int
1557 ipsec_in_reject(struct secpolicy *sp, struct mbuf *m)
1558 {
1559         struct ipsecrequest *isr;
1560         u_int level;
1561         int need_auth, need_conf, need_icv;
1562
1563         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1564                 kprintf("ipsec_in_reject: using SP\n");
1565                 kdebug_secpolicy(sp));
1566
1567         /* check policy */
1568         switch (sp->policy) {
1569         case IPSEC_POLICY_DISCARD:
1570                 return 1;
1571         case IPSEC_POLICY_BYPASS:
1572         case IPSEC_POLICY_NONE:
1573                 return 0;
1574
1575         case IPSEC_POLICY_IPSEC:
1576                 break;
1577
1578         case IPSEC_POLICY_ENTRUST:
1579         default:
1580                 panic("ipsec_hdrsiz: Invalid policy found. %d", sp->policy);
1581         }
1582
1583         need_auth = 0;
1584         need_conf = 0;
1585         need_icv = 0;
1586
1587         /* XXX should compare policy against ipsec header history */
1588
1589         for (isr = sp->req; isr != NULL; isr = isr->next) {
1590
1591                 /* get current level */
1592                 level = ipsec_get_reqlevel(isr);
1593
1594                 switch (isr->saidx.proto) {
1595                 case IPPROTO_ESP:
1596                         if (level == IPSEC_LEVEL_REQUIRE) {
1597                                 need_conf++;
1598
1599                                 if (isr->sav != NULL
1600                                  && isr->sav->flags == SADB_X_EXT_NONE
1601                                  && isr->sav->alg_auth != SADB_AALG_NONE)
1602                                         need_icv++;
1603                         }
1604                         break;
1605                 case IPPROTO_AH:
1606                         if (level == IPSEC_LEVEL_REQUIRE) {
1607                                 need_auth++;
1608                                 need_icv++;
1609                         }
1610                         break;
1611                 case IPPROTO_IPCOMP:
1612                         /*
1613                          * we don't really care, as IPcomp document says that
1614                          * we shouldn't compress small packets, IPComp policy
1615                          * should always be treated as being in "use" level.
1616                          */
1617                         break;
1618                 }
1619         }
1620
1621         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1622                 kprintf("ipsec_in_reject: auth:%d conf:%d icv:%d m_flags:%x\n",
1623                         need_auth, need_conf, need_icv, m->m_flags));
1624
1625         if ((need_conf && !(m->m_flags & M_DECRYPTED))
1626          || (!need_auth && need_icv && !(m->m_flags & M_AUTHIPDGM))
1627          || (need_auth && !(m->m_flags & M_AUTHIPHDR)))
1628                 return 1;
1629
1630         return 0;
1631 }
1632
1633 /*
1634  * Check AH/ESP integrity.
1635  * This function is called from tcp_input(), udp_input(),
1636  * and {ah,esp}4_input for tunnel mode
1637  */
1638 int
1639 ipsec4_in_reject_so(struct mbuf *m, struct socket *so)
1640 {
1641         struct secpolicy *sp = NULL;
1642         int error;
1643         int result;
1644
1645         /* sanity check */
1646         if (m == NULL)
1647                 return 0;       /* XXX should be panic ? */
1648
1649         /* get SP for this packet.
1650          * When we are called from ip_forward(), we call
1651          * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
1652          */
1653         if (so == NULL)
1654                 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
1655         else
1656                 sp = ipsec4_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
1657
1658         if (sp == NULL)
1659                 return 0;       /* XXX should be panic ?
1660                                  * -> No, there may be error. */
1661
1662         result = ipsec_in_reject(sp, m);
1663         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1664                 kprintf("DP ipsec4_in_reject_so call free SP:%p\n", sp));
1665         key_freesp(sp);
1666
1667         return result;
1668 }
1669
1670 int
1671 ipsec4_in_reject(struct mbuf *m, struct inpcb *inp)
1672 {
1673         if (inp == NULL)
1674                 return ipsec4_in_reject_so(m, NULL);
1675         if (inp->inp_socket)
1676                 return ipsec4_in_reject_so(m, inp->inp_socket);
1677         else
1678                 panic("ipsec4_in_reject: invalid inpcb/socket");
1679 }
1680
1681 #ifdef INET6
1682 /*
1683  * Check AH/ESP integrity.
1684  * This function is called from tcp6_input(), udp6_input(),
1685  * and {ah,esp}6_input for tunnel mode
1686  */
1687 int
1688 ipsec6_in_reject_so(struct mbuf *m, struct socket *so)
1689 {
1690         struct secpolicy *sp = NULL;
1691         int error;
1692         int result;
1693
1694         /* sanity check */
1695         if (m == NULL)
1696                 return 0;       /* XXX should be panic ? */
1697
1698         /* get SP for this packet.
1699          * When we are called from ip_forward(), we call
1700          * ipsec6_getpolicybyaddr() with IP_FORWARDING flag.
1701          */
1702         if (so == NULL)
1703                 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
1704         else
1705                 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
1706
1707         if (sp == NULL)
1708                 return 0;       /* XXX should be panic ? */
1709
1710         result = ipsec_in_reject(sp, m);
1711         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1712                 kprintf("DP ipsec6_in_reject_so call free SP:%p\n", sp));
1713         key_freesp(sp);
1714
1715         return result;
1716 }
1717
1718 int
1719 ipsec6_in_reject(struct mbuf *m, struct in6pcb *in6p)
1720 {
1721         if (in6p == NULL)
1722                 return ipsec6_in_reject_so(m, NULL);
1723         if (in6p->in6p_socket)
1724                 return ipsec6_in_reject_so(m, in6p->in6p_socket);
1725         else
1726                 panic("ipsec6_in_reject: invalid in6p/socket");
1727 }
1728 #endif
1729
1730 /*
1731  * compute the byte size to be occupied by IPsec header.
1732  * in case it is tunneled, it includes the size of outer IP header.
1733  * NOTE: SP passed is free in this function.
1734  */
1735 static size_t
1736 ipsec_hdrsiz(struct secpolicy *sp)
1737 {
1738         struct ipsecrequest *isr;
1739         size_t siz, clen;
1740
1741         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1742                 kprintf("ipsec_hdrsiz: using SP\n");
1743                 kdebug_secpolicy(sp));
1744
1745         /* check policy */
1746         switch (sp->policy) {
1747         case IPSEC_POLICY_DISCARD:
1748         case IPSEC_POLICY_BYPASS:
1749         case IPSEC_POLICY_NONE:
1750                 return 0;
1751
1752         case IPSEC_POLICY_IPSEC:
1753                 break;
1754
1755         case IPSEC_POLICY_ENTRUST:
1756         default:
1757                 panic("ipsec_hdrsiz: Invalid policy found. %d", sp->policy);
1758         }
1759
1760         siz = 0;
1761
1762         for (isr = sp->req; isr != NULL; isr = isr->next) {
1763
1764                 clen = 0;
1765
1766                 switch (isr->saidx.proto) {
1767                 case IPPROTO_ESP:
1768 #ifdef IPSEC_ESP
1769                         clen = esp_hdrsiz(isr);
1770 #else
1771                         clen = 0;       /* XXX */
1772 #endif
1773                         break;
1774                 case IPPROTO_AH:
1775                         clen = ah_hdrsiz(isr);
1776                         break;
1777                 case IPPROTO_IPCOMP:
1778                         clen = sizeof(struct ipcomp);
1779                         break;
1780                 }
1781
1782                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
1783                         switch (((struct sockaddr *)&isr->saidx.dst)->sa_family) {
1784                         case AF_INET:
1785                                 clen += sizeof(struct ip);
1786                                 break;
1787 #ifdef INET6
1788                         case AF_INET6:
1789                                 clen += sizeof(struct ip6_hdr);
1790                                 break;
1791 #endif
1792                         default:
1793                                 ipseclog((LOG_ERR, "ipsec_hdrsiz: "
1794                                     "unknown AF %d in IPsec tunnel SA\n",
1795                                     ((struct sockaddr *)&isr->saidx.dst)->sa_family));
1796                                 break;
1797                         }
1798                 }
1799                 siz += clen;
1800         }
1801
1802         return siz;
1803 }
1804
1805 /* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */
1806 size_t
1807 ipsec4_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
1808 {
1809         struct secpolicy *sp = NULL;
1810         int error;
1811         size_t size;
1812
1813         /* sanity check */
1814         if (m == NULL)
1815                 return 0;       /* XXX should be panic ? */
1816         if (inp != NULL && inp->inp_socket == NULL)
1817                 panic("ipsec4_hdrsize: why is socket NULL but there is PCB.");
1818
1819         /* get SP for this packet.
1820          * When we are called from ip_forward(), we call
1821          * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
1822          */
1823         if (inp == NULL)
1824                 sp = ipsec4_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1825         else
1826                 sp = ipsec4_getpolicybysock(m, dir, inp->inp_socket, &error);
1827
1828         if (sp == NULL)
1829                 return 0;       /* XXX should be panic ? */
1830
1831         size = ipsec_hdrsiz(sp);
1832         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1833                 kprintf("DP ipsec4_hdrsiz call free SP:%p\n", sp));
1834         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1835                 kprintf("ipsec4_hdrsiz: size:%lu.\n", (unsigned long)size));
1836         key_freesp(sp);
1837
1838         return size;
1839 }
1840
1841 #ifdef INET6
1842 /* This function is called from ipsec6_hdrsize_tcp(),
1843  * and maybe from ip6_forward.()
1844  */
1845 size_t
1846 ipsec6_hdrsiz(struct mbuf *m, u_int dir, struct in6pcb *in6p)
1847 {
1848         struct secpolicy *sp = NULL;
1849         int error;
1850         size_t size;
1851
1852         /* sanity check */
1853         if (m == NULL)
1854                 return 0;       /* XXX shoud be panic ? */
1855         if (in6p != NULL && in6p->in6p_socket == NULL)
1856                 panic("ipsec6_hdrsize: why is socket NULL but there is PCB.");
1857
1858         /* get SP for this packet */
1859         /* XXX Is it right to call with IP_FORWARDING. */
1860         if (in6p == NULL)
1861                 sp = ipsec6_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1862         else
1863                 sp = ipsec6_getpolicybysock(m, dir, in6p->in6p_socket, &error);
1864
1865         if (sp == NULL)
1866                 return 0;
1867         size = ipsec_hdrsiz(sp);
1868         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1869                 kprintf("DP ipsec6_hdrsiz call free SP:%p\n", sp));
1870         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1871                 kprintf("ipsec6_hdrsiz: size:%lu.\n", (unsigned long)size));
1872         key_freesp(sp);
1873
1874         return size;
1875 }
1876 #endif /* INET6 */
1877
1878 #ifdef INET
1879 /*
1880  * encapsulate for ipsec tunnel.
1881  * ip->ip_src must be fixed later on.
1882  */
1883 static int
1884 ipsec4_encapsulate(struct mbuf *m, struct secasvar *sav)
1885 {
1886         struct ip *oip;
1887         struct ip *ip;
1888         size_t hlen;
1889         size_t plen;
1890
1891         /* can't tunnel between different AFs */
1892         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
1893                 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
1894          || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET) {
1895                 m_freem(m);
1896                 return EINVAL;
1897         }
1898 #if 0
1899         /* XXX if the dst is myself, perform nothing. */
1900         if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
1901                 m_freem(m);
1902                 return EINVAL;
1903         }
1904 #endif
1905
1906         if (m->m_len < sizeof(*ip))
1907                 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
1908
1909         ip = mtod(m, struct ip *);
1910 #ifdef _IP_VHL
1911         hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
1912 #else
1913         hlen = ip->ip_hl << 2;
1914 #endif
1915
1916         if (m->m_len != hlen)
1917                 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
1918
1919         /* generate header checksum */
1920         ip->ip_sum = 0;
1921 #ifdef _IP_VHL
1922         if (ip->ip_vhl == IP_VHL_BORING)
1923                 ip->ip_sum = in_cksum_hdr(ip);
1924         else
1925                 ip->ip_sum = in_cksum(m, hlen);
1926 #else
1927         ip->ip_sum = in_cksum(m, hlen);
1928 #endif
1929
1930         plen = m->m_pkthdr.len;
1931
1932         /*
1933          * grow the mbuf to accomodate the new IPv4 header.
1934          * NOTE: IPv4 options will never be copied.
1935          */
1936         if (M_LEADINGSPACE(m->m_next) < hlen) {
1937                 struct mbuf *n;
1938                 MGET(n, MB_DONTWAIT, MT_DATA);
1939                 if (!n) {
1940                         m_freem(m);
1941                         return ENOBUFS;
1942                 }
1943                 n->m_len = hlen;
1944                 n->m_next = m->m_next;
1945                 m->m_next = n;
1946                 m->m_pkthdr.len += hlen;
1947                 oip = mtod(n, struct ip *);
1948         } else {
1949                 m->m_next->m_len += hlen;
1950                 m->m_next->m_data -= hlen;
1951                 m->m_pkthdr.len += hlen;
1952                 oip = mtod(m->m_next, struct ip *);
1953         }
1954         ip = mtod(m, struct ip *);
1955         ovbcopy((caddr_t)ip, (caddr_t)oip, hlen);
1956         m->m_len = sizeof(struct ip);
1957         m->m_pkthdr.len -= (hlen - sizeof(struct ip));
1958
1959         /* construct new IPv4 header. see RFC 2401 5.1.2.1 */
1960         /* ECN consideration. */
1961         ip_ecn_ingress(ip4_ipsec_ecn, &ip->ip_tos, &oip->ip_tos);
1962 #ifdef _IP_VHL
1963         ip->ip_vhl = IP_MAKE_VHL(IPVERSION, sizeof(struct ip) >> 2);
1964 #else
1965         ip->ip_hl = sizeof(struct ip) >> 2;
1966 #endif
1967         ip->ip_off &= htons(~IP_OFFMASK);
1968         ip->ip_off &= htons(~IP_MF);
1969         switch (ip4_ipsec_dfbit) {
1970         case 0: /* clear DF bit */
1971                 ip->ip_off &= htons(~IP_DF);
1972                 break;
1973         case 1: /* set DF bit */
1974                 ip->ip_off |= htons(IP_DF);
1975                 break;
1976         default:        /* copy DF bit */
1977                 break;
1978         }
1979         ip->ip_p = IPPROTO_IPIP;
1980         if (plen + sizeof(struct ip) < IP_MAXPACKET)
1981                 ip->ip_len = htons(plen + sizeof(struct ip));
1982         else {
1983                 ipseclog((LOG_ERR, "IPv4 ipsec: size exceeds limit: "
1984                         "leave ip_len as is (invalid packet)\n"));
1985         }
1986 #ifdef RANDOM_IP_ID
1987         ip->ip_id = ip_randomid();
1988 #else
1989         ip->ip_id = htons(ip_id++);
1990 #endif
1991         bcopy(&((struct sockaddr_in *)&sav->sah->saidx.src)->sin_addr,
1992                 &ip->ip_src, sizeof(ip->ip_src));
1993         bcopy(&((struct sockaddr_in *)&sav->sah->saidx.dst)->sin_addr,
1994                 &ip->ip_dst, sizeof(ip->ip_dst));
1995         ip->ip_ttl = IPDEFTTL;
1996
1997         /* XXX Should ip_src be updated later ? */
1998
1999         return 0;
2000 }
2001 #endif /* INET */
2002
2003 #ifdef INET6
2004 static int
2005 ipsec6_encapsulate(struct mbuf *m, struct secasvar *sav)
2006 {
2007         struct ip6_hdr *oip6;
2008         struct ip6_hdr *ip6;
2009         size_t plen;
2010
2011         /* can't tunnel between different AFs */
2012         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2013                 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
2014          || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET6) {
2015                 m_freem(m);
2016                 return EINVAL;
2017         }
2018 #if 0
2019         /* XXX if the dst is myself, perform nothing. */
2020         if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
2021                 m_freem(m);
2022                 return EINVAL;
2023         }
2024 #endif
2025
2026         plen = m->m_pkthdr.len;
2027
2028         /*
2029          * grow the mbuf to accomodate the new IPv6 header.
2030          */
2031         if (m->m_len != sizeof(struct ip6_hdr))
2032                 panic("ipsec6_encapsulate: assumption failed (first mbuf length)");
2033         if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
2034                 struct mbuf *n;
2035                 MGET(n, MB_DONTWAIT, MT_DATA);
2036                 if (!n) {
2037                         m_freem(m);
2038                         return ENOBUFS;
2039                 }
2040                 n->m_len = sizeof(struct ip6_hdr);
2041                 n->m_next = m->m_next;
2042                 m->m_next = n;
2043                 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2044                 oip6 = mtod(n, struct ip6_hdr *);
2045         } else {
2046                 m->m_next->m_len += sizeof(struct ip6_hdr);
2047                 m->m_next->m_data -= sizeof(struct ip6_hdr);
2048                 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2049                 oip6 = mtod(m->m_next, struct ip6_hdr *);
2050         }
2051         ip6 = mtod(m, struct ip6_hdr *);
2052         ovbcopy((caddr_t)ip6, (caddr_t)oip6, sizeof(struct ip6_hdr));
2053
2054         /* Fake link-local scope-class addresses */
2055         if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
2056                 oip6->ip6_src.s6_addr16[1] = 0;
2057         if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
2058                 oip6->ip6_dst.s6_addr16[1] = 0;
2059
2060         /* construct new IPv6 header. see RFC 2401 5.1.2.2 */
2061         /* ECN consideration. */
2062         ip6_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &oip6->ip6_flow);
2063         if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
2064                 ip6->ip6_plen = htons(plen);
2065         else {
2066                 /* ip6->ip6_plen will be updated in ip6_output() */
2067         }
2068         ip6->ip6_nxt = IPPROTO_IPV6;
2069         bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.src)->sin6_addr,
2070                 &ip6->ip6_src, sizeof(ip6->ip6_src));
2071         bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.dst)->sin6_addr,
2072                 &ip6->ip6_dst, sizeof(ip6->ip6_dst));
2073         ip6->ip6_hlim = IPV6_DEFHLIM;
2074
2075         /* XXX Should ip6_src be updated later ? */
2076
2077         return 0;
2078 }
2079 #endif /* INET6 */
2080
2081 /*
2082  * Check the variable replay window.
2083  * ipsec_chkreplay() performs replay check before ICV verification.
2084  * ipsec_updatereplay() updates replay bitmap.  This must be called after
2085  * ICV verification (it also performs replay check, which is usually done
2086  * beforehand).
2087  * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
2088  *
2089  * based on RFC 2401.
2090  */
2091 int
2092 ipsec_chkreplay(u_int32_t seq, struct secasvar *sav)
2093 {
2094         const struct secreplay *replay;
2095         u_int32_t diff;
2096         int fr;
2097         u_int32_t wsizeb;       /* constant: bits of window size */
2098         int frlast;             /* constant: last frame */
2099
2100         /* sanity check */
2101         if (sav == NULL)
2102                 panic("ipsec_chkreplay: NULL pointer was passed.");
2103
2104         replay = sav->replay;
2105
2106         if (replay->wsize == 0)
2107                 return 1;       /* no need to check replay. */
2108
2109         /* constant */
2110         frlast = replay->wsize - 1;
2111         wsizeb = replay->wsize << 3;
2112
2113         /* sequence number of 0 is invalid */
2114         if (seq == 0)
2115                 return 0;
2116
2117         /* first time is always okay */
2118         if (replay->count == 0)
2119                 return 1;
2120
2121         if (seq > replay->lastseq) {
2122                 /* larger sequences are okay */
2123                 return 1;
2124         } else {
2125                 /* seq is equal or less than lastseq. */
2126                 diff = replay->lastseq - seq;
2127
2128                 /* over range to check, i.e. too old or wrapped */
2129                 if (diff >= wsizeb)
2130                         return 0;
2131
2132                 fr = frlast - diff / 8;
2133
2134                 /* this packet already seen ? */
2135                 if ((replay->bitmap)[fr] & (1 << (diff % 8)))
2136                         return 0;
2137
2138                 /* out of order but good */
2139                 return 1;
2140         }
2141 }
2142
2143 /*
2144  * check replay counter whether to update or not.
2145  * OUT: 0:      OK
2146  *      1:      NG
2147  */
2148 int
2149 ipsec_updatereplay(u_int32_t seq, struct secasvar *sav)
2150 {
2151         struct secreplay *replay;
2152         u_int32_t diff;
2153         int fr;
2154         u_int32_t wsizeb;       /* constant: bits of window size */
2155         int frlast;             /* constant: last frame */
2156
2157         /* sanity check */
2158         if (sav == NULL)
2159                 panic("ipsec_chkreplay: NULL pointer was passed.");
2160
2161         replay = sav->replay;
2162
2163         if (replay->wsize == 0)
2164                 goto ok;        /* no need to check replay. */
2165
2166         /* constant */
2167         frlast = replay->wsize - 1;
2168         wsizeb = replay->wsize << 3;
2169
2170         /* sequence number of 0 is invalid */
2171         if (seq == 0)
2172                 return 1;
2173
2174         /* first time */
2175         if (replay->count == 0) {
2176                 replay->lastseq = seq;
2177                 bzero(replay->bitmap, replay->wsize);
2178                 (replay->bitmap)[frlast] = 1;
2179                 goto ok;
2180         }
2181
2182         if (seq > replay->lastseq) {
2183                 /* seq is larger than lastseq. */
2184                 diff = seq - replay->lastseq;
2185
2186                 /* new larger sequence number */
2187                 if (diff < wsizeb) {
2188                         /* In window */
2189                         /* set bit for this packet */
2190                         vshiftl(replay->bitmap, diff, replay->wsize);
2191                         (replay->bitmap)[frlast] |= 1;
2192                 } else {
2193                         /* this packet has a "way larger" */
2194                         bzero(replay->bitmap, replay->wsize);
2195                         (replay->bitmap)[frlast] = 1;
2196                 }
2197                 replay->lastseq = seq;
2198
2199                 /* larger is good */
2200         } else {
2201                 /* seq is equal or less than lastseq. */
2202                 diff = replay->lastseq - seq;
2203
2204                 /* over range to check, i.e. too old or wrapped */
2205                 if (diff >= wsizeb)
2206                         return 1;
2207
2208                 fr = frlast - diff / 8;
2209
2210                 /* this packet already seen ? */
2211                 if ((replay->bitmap)[fr] & (1 << (diff % 8)))
2212                         return 1;
2213
2214                 /* mark as seen */
2215                 (replay->bitmap)[fr] |= (1 << (diff % 8));
2216
2217                 /* out of order but good */
2218         }
2219
2220 ok:
2221         if (replay->count == ~0) {
2222
2223                 /* set overflow flag */
2224                 replay->overflow++;
2225
2226                 /* don't increment, no more packets accepted */
2227                 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0)
2228                         return 1;
2229
2230                 ipseclog((LOG_WARNING, "replay counter made %d cycle. %s\n",
2231                     replay->overflow, ipsec_logsastr(sav)));
2232         }
2233
2234         replay->count++;
2235
2236         return 0;
2237 }
2238
2239 /*
2240  * shift variable length buffer to left.
2241  * IN:  bitmap: pointer to the buffer
2242  *      nbit:   the number of to shift.
2243  *      wsize:  buffer size (bytes).
2244  */
2245 static void
2246 vshiftl(unsigned char *bitmap, int nbit, int wsize)
2247 {
2248         int s, j, i;
2249         unsigned char over;
2250
2251         for (j = 0; j < nbit; j += 8) {
2252                 s = (nbit - j < 8) ? (nbit - j): 8;
2253                 bitmap[0] <<= s;
2254                 for (i = 1; i < wsize; i++) {
2255                         over = (bitmap[i] >> (8 - s));
2256                         bitmap[i] <<= s;
2257                         bitmap[i-1] |= over;
2258                 }
2259         }
2260
2261         return;
2262 }
2263
2264 const char *
2265 ipsec4_logpacketstr(struct ip *ip, u_int32_t spi)
2266 {
2267         static char buf[256];
2268         char *p;
2269         u_int8_t *s, *d;
2270
2271         s = (u_int8_t *)(&ip->ip_src);
2272         d = (u_int8_t *)(&ip->ip_dst);
2273
2274         p = buf;
2275         ksnprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
2276         while (p && *p)
2277                 p++;
2278         ksnprintf(p, sizeof(buf) - (p - buf), "src=%u.%u.%u.%u",
2279                 s[0], s[1], s[2], s[3]);
2280         while (p && *p)
2281                 p++;
2282         ksnprintf(p, sizeof(buf) - (p - buf), " dst=%u.%u.%u.%u",
2283                 d[0], d[1], d[2], d[3]);
2284         while (p && *p)
2285                 p++;
2286         ksnprintf(p, sizeof(buf) - (p - buf), ")");
2287
2288         return buf;
2289 }
2290
2291 #ifdef INET6
2292 const char *
2293 ipsec6_logpacketstr(struct ip6_hdr *ip6, u_int32_t spi)
2294 {
2295         static char buf[256];
2296         char *p;
2297
2298         p = buf;
2299         ksnprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
2300         while (p && *p)
2301                 p++;
2302         ksnprintf(p, sizeof(buf) - (p - buf), "src=%s",
2303                 ip6_sprintf(&ip6->ip6_src));
2304         while (p && *p)
2305                 p++;
2306         ksnprintf(p, sizeof(buf) - (p - buf), " dst=%s",
2307                 ip6_sprintf(&ip6->ip6_dst));
2308         while (p && *p)
2309                 p++;
2310         ksnprintf(p, sizeof(buf) - (p - buf), ")");
2311
2312         return buf;
2313 }
2314 #endif /* INET6 */
2315
2316 const char *
2317 ipsec_logsastr(struct secasvar *sav)
2318 {
2319         static char buf[256];
2320         char *p;
2321         struct secasindex *saidx = &sav->sah->saidx;
2322
2323         /* validity check */
2324         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2325                         != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family)
2326                 panic("ipsec_logsastr: family mismatched.");
2327
2328         p = buf;
2329         ksnprintf(buf, sizeof(buf), "SA(SPI=%u ", (u_int32_t)ntohl(sav->spi));
2330         while (p && *p)
2331                 p++;
2332         if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET) {
2333                 u_int8_t *s, *d;
2334                 s = (u_int8_t *)&((struct sockaddr_in *)&saidx->src)->sin_addr;
2335                 d = (u_int8_t *)&((struct sockaddr_in *)&saidx->dst)->sin_addr;
2336                 ksnprintf(p, sizeof(buf) - (p - buf),
2337                         "src=%d.%d.%d.%d dst=%d.%d.%d.%d",
2338                         s[0], s[1], s[2], s[3], d[0], d[1], d[2], d[3]);
2339         }
2340 #ifdef INET6
2341         else if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET6) {
2342                 ksnprintf(p, sizeof(buf) - (p - buf),
2343                         "src=%s",
2344                         ip6_sprintf(&((struct sockaddr_in6 *)&saidx->src)->sin6_addr));
2345                 while (p && *p)
2346                         p++;
2347                 ksnprintf(p, sizeof(buf) - (p - buf),
2348                         " dst=%s",
2349                         ip6_sprintf(&((struct sockaddr_in6 *)&saidx->dst)->sin6_addr));
2350         }
2351 #endif
2352         while (p && *p)
2353                 p++;
2354         ksnprintf(p, sizeof(buf) - (p - buf), ")");
2355
2356         return buf;
2357 }
2358
2359 void
2360 ipsec_dumpmbuf(struct mbuf *m)
2361 {
2362         int totlen;
2363         int i;
2364         u_char *p;
2365
2366         totlen = 0;
2367         kprintf("---\n");
2368         while (m) {
2369                 p = mtod(m, u_char *);
2370                 for (i = 0; i < m->m_len; i++) {
2371                         kprintf("%02x ", p[i]);
2372                         totlen++;
2373                         if (totlen % 16 == 0)
2374                                 kprintf("\n");
2375                 }
2376                 m = m->m_next;
2377         }
2378         if (totlen % 16 != 0)
2379                 kprintf("\n");
2380         kprintf("---\n");
2381 }
2382
2383 #ifdef INET
2384 /*
2385  * IPsec output logic for IPv4.
2386  */
2387 int
2388 ipsec4_output(struct ipsec_output_state *state, struct secpolicy *sp, int flags)
2389 {
2390         struct ip *ip = NULL;
2391         struct ipsecrequest *isr = NULL;
2392         struct secasindex saidx;
2393         int error;
2394         struct sockaddr_in *dst4;
2395         struct sockaddr_in *sin;
2396
2397         if (!state)
2398                 panic("state == NULL in ipsec4_output");
2399         if (!state->m)
2400                 panic("state->m == NULL in ipsec4_output");
2401         if (!state->ro)
2402                 panic("state->ro == NULL in ipsec4_output");
2403         if (!state->dst)
2404                 panic("state->dst == NULL in ipsec4_output");
2405
2406         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2407                 kprintf("ipsec4_output: applyed SP\n");
2408                 kdebug_secpolicy(sp));
2409
2410         for (isr = sp->req; isr != NULL; isr = isr->next) {
2411
2412 #if 0   /* give up to check restriction of transport mode */
2413         /* XXX but should be checked somewhere */
2414                 /*
2415                  * some of the IPsec operation must be performed only in
2416                  * originating case.
2417                  */
2418                 if (isr->saidx.mode == IPSEC_MODE_TRANSPORT
2419                  && (flags & IP_FORWARDING))
2420                         continue;
2421 #endif
2422
2423                 /* make SA index for search proper SA */
2424                 ip = mtod(state->m, struct ip *);
2425                 bcopy(&isr->saidx, &saidx, sizeof(saidx));
2426                 saidx.mode = isr->saidx.mode;
2427                 saidx.reqid = isr->saidx.reqid;
2428                 sin = (struct sockaddr_in *)&saidx.src;
2429                 if (sin->sin_len == 0) {
2430                         sin->sin_len = sizeof(*sin);
2431                         sin->sin_family = AF_INET;
2432                         sin->sin_port = IPSEC_PORT_ANY;
2433                         bcopy(&ip->ip_src, &sin->sin_addr,
2434                             sizeof(sin->sin_addr));
2435                 }
2436                 sin = (struct sockaddr_in *)&saidx.dst;
2437                 if (sin->sin_len == 0) {
2438                         sin->sin_len = sizeof(*sin);
2439                         sin->sin_family = AF_INET;
2440                         sin->sin_port = IPSEC_PORT_ANY;
2441                         bcopy(&ip->ip_dst, &sin->sin_addr,
2442                             sizeof(sin->sin_addr));
2443                 }
2444
2445                 if ((error = key_checkrequest(isr, &saidx)) != 0) {
2446                         /*
2447                          * IPsec processing is required, but no SA found.
2448                          * I assume that key_acquire() had been called
2449                          * to get/establish the SA. Here I discard
2450                          * this packet because it is responsibility for
2451                          * upper layer to retransmit the packet.
2452                          */
2453                         ipsecstat.out_nosa++;
2454                         goto bad;
2455                 }
2456
2457                 /* validity check */
2458                 if (isr->sav == NULL) {
2459                         switch (ipsec_get_reqlevel(isr)) {
2460                         case IPSEC_LEVEL_USE:
2461                                 continue;
2462                         case IPSEC_LEVEL_REQUIRE:
2463                                 /* must be not reached here. */
2464                                 panic("ipsec4_output: no SA found, but required.");
2465                         }
2466                 }
2467
2468                 /*
2469                  * If there is no valid SA, we give up to process any
2470                  * more.  In such a case, the SA's status is changed
2471                  * from DYING to DEAD after allocating.  If a packet
2472                  * send to the receiver by dead SA, the receiver can
2473                  * not decode a packet because SA has been dead.
2474                  */
2475                 if (isr->sav->state != SADB_SASTATE_MATURE
2476                  && isr->sav->state != SADB_SASTATE_DYING) {
2477                         ipsecstat.out_nosa++;
2478                         error = EINVAL;
2479                         goto bad;
2480                 }
2481
2482                 /*
2483                  * There may be the case that SA status will be changed when
2484                  * we are refering to one. So calling crit_enter().
2485                  */
2486                 crit_enter();
2487
2488                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2489                         /*
2490                          * build IPsec tunnel.
2491                          */
2492                         /* XXX should be processed with other familiy */
2493                         if (((struct sockaddr *)&isr->sav->sah->saidx.src)->sa_family != AF_INET) {
2494                                 ipseclog((LOG_ERR, "ipsec4_output: "
2495                                     "family mismatched between inner and outer spi=%u\n",
2496                                     (u_int32_t)ntohl(isr->sav->spi)));
2497                                 crit_exit();
2498                                 error = EAFNOSUPPORT;
2499                                 goto bad;
2500                         }
2501
2502                         state->m = ipsec4_splithdr(state->m);
2503                         if (!state->m) {
2504                                 crit_exit();
2505                                 error = ENOMEM;
2506                                 goto bad;
2507                         }
2508                         error = ipsec4_encapsulate(state->m, isr->sav);
2509                         crit_exit();
2510                         if (error) {
2511                                 state->m = NULL;
2512                                 goto bad;
2513                         }
2514                         ip = mtod(state->m, struct ip *);
2515
2516                         state->ro = &isr->sav->sah->sa_route;
2517                         state->dst = (struct sockaddr *)&state->ro->ro_dst;
2518                         dst4 = (struct sockaddr_in *)state->dst;
2519                         if (state->ro->ro_rt
2520                          && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
2521                           || dst4->sin_addr.s_addr != ip->ip_dst.s_addr)) {
2522                                 RTFREE(state->ro->ro_rt);
2523                                 state->ro->ro_rt = NULL;
2524                         }
2525                         if (state->ro->ro_rt == 0) {
2526                                 dst4->sin_family = AF_INET;
2527                                 dst4->sin_len = sizeof(*dst4);
2528                                 dst4->sin_addr = ip->ip_dst;
2529                                 rtalloc(state->ro);
2530                         }
2531                         if (state->ro->ro_rt == 0) {
2532                                 ipstat.ips_noroute++;
2533                                 error = EHOSTUNREACH;
2534                                 goto bad;
2535                         }
2536
2537                         /* adjust state->dst if tunnel endpoint is offlink */
2538                         if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
2539                                 state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
2540                                 dst4 = (struct sockaddr_in *)state->dst;
2541                         }
2542                 } else
2543                         crit_exit();
2544
2545                 state->m = ipsec4_splithdr(state->m);
2546                 if (!state->m) {
2547                         error = ENOMEM;
2548                         goto bad;
2549                 }
2550                 switch (isr->saidx.proto) {
2551                 case IPPROTO_ESP:
2552 #ifdef IPSEC_ESP
2553                         if ((error = esp4_output(state->m, isr)) != 0) {
2554                                 state->m = NULL;
2555                                 goto bad;
2556                         }
2557                         break;
2558 #else
2559                         m_freem(state->m);
2560                         state->m = NULL;
2561                         error = EINVAL;
2562                         goto bad;
2563 #endif
2564                 case IPPROTO_AH:
2565                         if ((error = ah4_output(state->m, isr)) != 0) {
2566                                 state->m = NULL;
2567                                 goto bad;
2568                         }
2569                         break;
2570                 case IPPROTO_IPCOMP:
2571                         if ((error = ipcomp4_output(state->m, isr)) != 0) {
2572                                 state->m = NULL;
2573                                 goto bad;
2574                         }
2575                         break;
2576                 default:
2577                         ipseclog((LOG_ERR,
2578                             "ipsec4_output: unknown ipsec protocol %d\n",
2579                             isr->saidx.proto));
2580                         m_freem(state->m);
2581                         state->m = NULL;
2582                         error = EINVAL;
2583                         goto bad;
2584                 }
2585
2586                 if (state->m == 0) {
2587                         error = ENOMEM;
2588                         goto bad;
2589                 }
2590                 ip = mtod(state->m, struct ip *);
2591         }
2592
2593         return 0;
2594
2595 bad:
2596         m_freem(state->m);
2597         state->m = NULL;
2598         return error;
2599 }
2600 #endif
2601
2602 #ifdef INET6
2603 /*
2604  * IPsec output logic for IPv6, transport mode.
2605  */
2606 int
2607 ipsec6_output_trans(struct ipsec_output_state *state, u_char *nexthdrp,
2608                     struct mbuf *mprev, struct secpolicy *sp, int flags,
2609                     int *tun)
2610 {
2611         struct ip6_hdr *ip6;
2612         struct ipsecrequest *isr = NULL;
2613         struct secasindex saidx;
2614         int error = 0;
2615         int plen;
2616         struct sockaddr_in6 *sin6;
2617
2618         if (!state)
2619                 panic("state == NULL in ipsec6_output_trans");
2620         if (!state->m)
2621                 panic("state->m == NULL in ipsec6_output_trans");
2622         if (!nexthdrp)
2623                 panic("nexthdrp == NULL in ipsec6_output_trans");
2624         if (!mprev)
2625                 panic("mprev == NULL in ipsec6_output_trans");
2626         if (!sp)
2627                 panic("sp == NULL in ipsec6_output_trans");
2628         if (!tun)
2629                 panic("tun == NULL in ipsec6_output_trans");
2630
2631         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2632                 kprintf("ipsec6_output_trans: applyed SP\n");
2633                 kdebug_secpolicy(sp));
2634
2635         *tun = 0;
2636         for (isr = sp->req; isr; isr = isr->next) {
2637                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2638                         /* the rest will be handled by ipsec6_output_tunnel() */
2639                         break;
2640                 }
2641
2642                 /* make SA index for search proper SA */
2643                 ip6 = mtod(state->m, struct ip6_hdr *);
2644                 bcopy(&isr->saidx, &saidx, sizeof(saidx));
2645                 saidx.mode = isr->saidx.mode;
2646                 saidx.reqid = isr->saidx.reqid;
2647                 sin6 = (struct sockaddr_in6 *)&saidx.src;
2648                 if (sin6->sin6_len == 0) {
2649                         sin6->sin6_len = sizeof(*sin6);
2650                         sin6->sin6_family = AF_INET6;
2651                         sin6->sin6_port = IPSEC_PORT_ANY;
2652                         bcopy(&ip6->ip6_src, &sin6->sin6_addr,
2653                             sizeof(ip6->ip6_src));
2654                         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
2655                                 /* fix scope id for comparing SPD */
2656                                 sin6->sin6_addr.s6_addr16[1] = 0;
2657                                 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
2658                         }
2659                 }
2660                 sin6 = (struct sockaddr_in6 *)&saidx.dst;
2661                 if (sin6->sin6_len == 0) {
2662                         sin6->sin6_len = sizeof(*sin6);
2663                         sin6->sin6_family = AF_INET6;
2664                         sin6->sin6_port = IPSEC_PORT_ANY;
2665                         bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
2666                             sizeof(ip6->ip6_dst));
2667                         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
2668                                 /* fix scope id for comparing SPD */
2669                                 sin6->sin6_addr.s6_addr16[1] = 0;
2670                                 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
2671                         }
2672                 }
2673
2674                 if (key_checkrequest(isr, &saidx) == ENOENT) {
2675                         /*
2676                          * IPsec processing is required, but no SA found.
2677                          * I assume that key_acquire() had been called
2678                          * to get/establish the SA. Here I discard
2679                          * this packet because it is responsibility for
2680                          * upper layer to retransmit the packet.
2681                          */
2682                         ipsec6stat.out_nosa++;
2683                         error = ENOENT;
2684
2685                         /*
2686                          * Notify the fact that the packet is discarded
2687                          * to ourselves. I believe this is better than
2688                          * just silently discarding. (jinmei@kame.net)
2689                          * XXX: should we restrict the error to TCP packets?
2690                          * XXX: should we directly notify sockets via
2691                          *      kpfctlinputs?
2692                          */
2693                         icmp6_error(state->m, ICMP6_DST_UNREACH,
2694                                     ICMP6_DST_UNREACH_ADMIN, 0);
2695                         state->m = NULL; /* icmp6_error freed the mbuf */
2696                         goto bad;
2697                 }
2698
2699                 /* validity check */
2700                 if (isr->sav == NULL) {
2701                         switch (ipsec_get_reqlevel(isr)) {
2702                         case IPSEC_LEVEL_USE:
2703                                 continue;
2704                         case IPSEC_LEVEL_REQUIRE:
2705                                 /* must be not reached here. */
2706                                 panic("ipsec6_output_trans: no SA found, but required.");
2707                         }
2708                 }
2709
2710                 /*
2711                  * If there is no valid SA, we give up to process.
2712                  * see same place at ipsec4_output().
2713                  */
2714                 if (isr->sav->state != SADB_SASTATE_MATURE
2715                  && isr->sav->state != SADB_SASTATE_DYING) {
2716                         ipsec6stat.out_nosa++;
2717                         error = EINVAL;
2718                         goto bad;
2719                 }
2720
2721                 switch (isr->saidx.proto) {
2722                 case IPPROTO_ESP:
2723 #ifdef IPSEC_ESP
2724                         error = esp6_output(state->m, nexthdrp, mprev->m_next, isr);
2725 #else
2726                         m_freem(state->m);
2727                         error = EINVAL;
2728 #endif
2729                         break;
2730                 case IPPROTO_AH:
2731                         error = ah6_output(state->m, nexthdrp, mprev->m_next, isr);
2732                         break;
2733                 case IPPROTO_IPCOMP:
2734                         error = ipcomp6_output(state->m, nexthdrp, mprev->m_next, isr);
2735                         break;
2736                 default:
2737                         ipseclog((LOG_ERR, "ipsec6_output_trans: "
2738                             "unknown ipsec protocol %d\n", isr->saidx.proto));
2739                         m_freem(state->m);
2740                         ipsec6stat.out_inval++;
2741                         error = EINVAL;
2742                         break;
2743                 }
2744                 if (error) {
2745                         state->m = NULL;
2746                         goto bad;
2747                 }
2748                 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
2749                 if (plen > IPV6_MAXPACKET) {
2750                         ipseclog((LOG_ERR, "ipsec6_output_trans: "
2751                             "IPsec with IPv6 jumbogram is not supported\n"));
2752                         ipsec6stat.out_inval++;
2753                         error = EINVAL; /* XXX */
2754                         goto bad;
2755                 }
2756                 ip6 = mtod(state->m, struct ip6_hdr *);
2757                 ip6->ip6_plen = htons(plen);
2758         }
2759
2760         /* if we have more to go, we need a tunnel mode processing */
2761         if (isr != NULL)
2762                 *tun = 1;
2763
2764         return 0;
2765
2766 bad:
2767         m_freem(state->m);
2768         state->m = NULL;
2769         return error;
2770 }
2771
2772 /*
2773  * IPsec output logic for IPv6, tunnel mode.
2774  */
2775 int
2776 ipsec6_output_tunnel(struct ipsec_output_state *state, struct secpolicy *sp,
2777                      int flags)
2778 {
2779         struct ip6_hdr *ip6;
2780         struct ipsecrequest *isr = NULL;
2781         struct secasindex saidx;
2782         int error = 0;
2783         int plen;
2784         struct sockaddr_in6* dst6;
2785
2786         if (!state)
2787                 panic("state == NULL in ipsec6_output_tunnel");
2788         if (!state->m)
2789                 panic("state->m == NULL in ipsec6_output_tunnel");
2790         if (!sp)
2791                 panic("sp == NULL in ipsec6_output_tunnel");
2792
2793         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2794                 kprintf("ipsec6_output_tunnel: applyed SP\n");
2795                 kdebug_secpolicy(sp));
2796
2797         /*
2798          * transport mode ipsec (before the 1st tunnel mode) is already
2799          * processed by ipsec6_output_trans().
2800          */
2801         for (isr = sp->req; isr; isr = isr->next) {
2802                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
2803                         break;
2804         }
2805
2806         for (/* already initialized */; isr; isr = isr->next) {
2807                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2808                         /* When tunnel mode, SA peers must be specified. */
2809                         bcopy(&isr->saidx, &saidx, sizeof(saidx));
2810                 } else {
2811                         /* make SA index to look for a proper SA */
2812                         struct sockaddr_in6 *sin6;
2813
2814                         bzero(&saidx, sizeof(saidx));
2815                         saidx.proto = isr->saidx.proto;
2816                         saidx.mode = isr->saidx.mode;
2817                         saidx.reqid = isr->saidx.reqid;
2818
2819                         ip6 = mtod(state->m, struct ip6_hdr *);
2820                         sin6 = (struct sockaddr_in6 *)&saidx.src;
2821                         if (sin6->sin6_len == 0) {
2822                                 sin6->sin6_len = sizeof(*sin6);
2823                                 sin6->sin6_family = AF_INET6;
2824                                 sin6->sin6_port = IPSEC_PORT_ANY;
2825                                 bcopy(&ip6->ip6_src, &sin6->sin6_addr,
2826                                     sizeof(ip6->ip6_src));
2827                                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
2828                                         /* fix scope id for comparing SPD */
2829                                         sin6->sin6_addr.s6_addr16[1] = 0;
2830                                         sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
2831                                 }
2832                         }
2833                         sin6 = (struct sockaddr_in6 *)&saidx.dst;
2834                         if (sin6->sin6_len == 0) {
2835                                 sin6->sin6_len = sizeof(*sin6);
2836                                 sin6->sin6_family = AF_INET6;
2837                                 sin6->sin6_port = IPSEC_PORT_ANY;
2838                                 bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
2839                                     sizeof(ip6->ip6_dst));
2840                                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
2841                                         /* fix scope id for comparing SPD */
2842                                         sin6->sin6_addr.s6_addr16[1] = 0;
2843                                         sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
2844                                 }
2845                         }
2846                 }
2847
2848                 if (key_checkrequest(isr, &saidx) == ENOENT) {
2849                         /*
2850                          * IPsec processing is required, but no SA found.
2851                          * I assume that key_acquire() had been called
2852                          * to get/establish the SA. Here I discard
2853                          * this packet because it is responsibility for
2854                          * upper layer to retransmit the packet.
2855                          */
2856                         ipsec6stat.out_nosa++;
2857                         error = ENOENT;
2858                         goto bad;
2859                 }
2860
2861                 /* validity check */
2862                 if (isr->sav == NULL) {
2863                         switch (ipsec_get_reqlevel(isr)) {
2864                         case IPSEC_LEVEL_USE:
2865                                 continue;
2866                         case IPSEC_LEVEL_REQUIRE:
2867                                 /* must be not reached here. */
2868                                 panic("ipsec6_output_tunnel: no SA found, but required.");
2869                         }
2870                 }
2871
2872                 /*
2873                  * If there is no valid SA, we give up to process.
2874                  * see same place at ipsec4_output().
2875                  */
2876                 if (isr->sav->state != SADB_SASTATE_MATURE
2877                  && isr->sav->state != SADB_SASTATE_DYING) {
2878                         ipsec6stat.out_nosa++;
2879                         error = EINVAL;
2880                         goto bad;
2881                 }
2882
2883                 /*
2884                  * There may be the case that SA status will be changed when
2885                  * we are refering to one. So calling crit_enter().
2886                  */
2887                 crit_enter();
2888
2889                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2890                         /*
2891                          * build IPsec tunnel.
2892                          */
2893                         /* XXX should be processed with other familiy */
2894                         if (((struct sockaddr *)&isr->sav->sah->saidx.src)->sa_family != AF_INET6) {
2895                                 ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
2896                                     "family mismatched between inner and outer, spi=%u\n",
2897                                     (u_int32_t)ntohl(isr->sav->spi)));
2898                                 crit_exit();
2899                                 ipsec6stat.out_inval++;
2900                                 error = EAFNOSUPPORT;
2901                                 goto bad;
2902                         }
2903
2904                         state->m = ipsec6_splithdr(state->m);
2905                         if (!state->m) {
2906                                 crit_exit();
2907                                 ipsec6stat.out_nomem++;
2908                                 error = ENOMEM;
2909                                 goto bad;
2910                         }
2911                         error = ipsec6_encapsulate(state->m, isr->sav);
2912                         crit_exit();
2913                         if (error) {
2914                                 state->m = 0;
2915                                 goto bad;
2916                         }
2917                         ip6 = mtod(state->m, struct ip6_hdr *);
2918
2919                         state->ro = &isr->sav->sah->sa_route;
2920                         state->dst = (struct sockaddr *)&state->ro->ro_dst;
2921                         dst6 = (struct sockaddr_in6 *)state->dst;
2922                         if (state->ro->ro_rt
2923                          && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
2924                           || !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst))) {
2925                                 RTFREE(state->ro->ro_rt);
2926                                 state->ro->ro_rt = NULL;
2927                         }
2928                         if (state->ro->ro_rt == 0) {
2929                                 bzero(dst6, sizeof(*dst6));
2930                                 dst6->sin6_family = AF_INET6;
2931                                 dst6->sin6_len = sizeof(*dst6);
2932                                 dst6->sin6_addr = ip6->ip6_dst;
2933                                 rtalloc(state->ro);
2934                         }
2935                         if (state->ro->ro_rt == 0) {
2936                                 ip6stat.ip6s_noroute++;
2937                                 ipsec6stat.out_noroute++;
2938                                 error = EHOSTUNREACH;
2939                                 goto bad;
2940                         }
2941
2942                         /* adjust state->dst if tunnel endpoint is offlink */
2943                         if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
2944                                 state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
2945                                 dst6 = (struct sockaddr_in6 *)state->dst;
2946                         }
2947                 } else
2948                         crit_exit();
2949
2950                 state->m = ipsec6_splithdr(state->m);
2951                 if (!state->m) {
2952                         ipsec6stat.out_nomem++;
2953                         error = ENOMEM;
2954                         goto bad;
2955                 }
2956                 ip6 = mtod(state->m, struct ip6_hdr *);
2957                 switch (isr->saidx.proto) {
2958                 case IPPROTO_ESP:
2959 #ifdef IPSEC_ESP
2960                         error = esp6_output(state->m, &ip6->ip6_nxt, state->m->m_next, isr);
2961 #else
2962                         m_freem(state->m);
2963                         error = EINVAL;
2964 #endif
2965                         break;
2966                 case IPPROTO_AH:
2967                         error = ah6_output(state->m, &ip6->ip6_nxt, state->m->m_next, isr);
2968                         break;
2969                 case IPPROTO_IPCOMP:
2970                         /* XXX code should be here */
2971                         /* FALLTHROUGH */
2972                 default:
2973                         ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
2974                             "unknown ipsec protocol %d\n", isr->saidx.proto));
2975                         m_freem(state->m);
2976                         ipsec6stat.out_inval++;
2977                         error = EINVAL;
2978                         break;
2979                 }
2980                 if (error) {
2981                         state->m = NULL;
2982                         goto bad;
2983                 }
2984                 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
2985                 if (plen > IPV6_MAXPACKET) {
2986                         ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
2987                             "IPsec with IPv6 jumbogram is not supported\n"));
2988                         ipsec6stat.out_inval++;
2989                         error = EINVAL; /* XXX */
2990                         goto bad;
2991                 }
2992                 ip6 = mtod(state->m, struct ip6_hdr *);
2993                 ip6->ip6_plen = htons(plen);
2994         }
2995
2996         return 0;
2997
2998 bad:
2999         m_freem(state->m);
3000         state->m = NULL;
3001         return error;
3002 }
3003 #endif /* INET6 */
3004
3005 #ifdef INET
3006 /*
3007  * Chop IP header and option off from the payload.
3008  */
3009 static struct mbuf *
3010 ipsec4_splithdr(struct mbuf *m)
3011 {
3012         struct mbuf *mh;
3013         struct ip *ip;
3014         int hlen;
3015
3016         if (m->m_len < sizeof(struct ip))
3017                 panic("ipsec4_splithdr: first mbuf too short");
3018         ip = mtod(m, struct ip *);
3019 #ifdef _IP_VHL
3020         hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
3021 #else
3022         hlen = ip->ip_hl << 2;
3023 #endif
3024         if (m->m_len > hlen) {
3025                 MGETHDR(mh, MB_DONTWAIT, MT_HEADER);
3026                 if (!mh) {
3027                         m_freem(m);
3028                         return NULL;
3029                 }
3030                 M_MOVE_PKTHDR(mh, m);
3031                 MH_ALIGN(mh, hlen);
3032                 m->m_len -= hlen;
3033                 m->m_data += hlen;
3034                 mh->m_next = m;
3035                 m = mh;
3036                 m->m_len = hlen;
3037                 bcopy((caddr_t)ip, mtod(m, caddr_t), hlen);
3038         } else if (m->m_len < hlen) {
3039                 m = m_pullup(m, hlen);
3040                 if (!m)
3041                         return NULL;
3042         }
3043         return m;
3044 }
3045 #endif
3046
3047 #ifdef INET6
3048 static struct mbuf *
3049 ipsec6_splithdr(struct mbuf *m)
3050 {
3051         struct mbuf *mh;
3052         struct ip6_hdr *ip6;
3053         int hlen;
3054
3055         if (m->m_len < sizeof(struct ip6_hdr))
3056                 panic("ipsec6_splithdr: first mbuf too short");
3057         ip6 = mtod(m, struct ip6_hdr *);
3058         hlen = sizeof(struct ip6_hdr);
3059         if (m->m_len > hlen) {
3060                 MGETHDR(mh, MB_DONTWAIT, MT_HEADER);
3061                 if (!mh) {
3062                         m_freem(m);
3063                         return NULL;
3064                 }
3065                 M_MOVE_PKTHDR(mh, m);
3066                 MH_ALIGN(mh, hlen);
3067                 m->m_len -= hlen;
3068                 m->m_data += hlen;
3069                 mh->m_next = m;
3070                 m = mh;
3071                 m->m_len = hlen;
3072                 bcopy((caddr_t)ip6, mtod(m, caddr_t), hlen);
3073         } else if (m->m_len < hlen) {
3074                 m = m_pullup(m, hlen);
3075                 if (!m)
3076                         return NULL;
3077         }
3078         return m;
3079 }
3080 #endif
3081
3082 /* validate inbound IPsec tunnel packet. */
3083 int
3084 ipsec4_tunnel_validate(struct mbuf *m, /* no pullup permitted, m->m_len >= ip */
3085                        int off, u_int nxt0, struct secasvar *sav)
3086 {
3087         u_int8_t nxt = nxt0 & 0xff;
3088         struct sockaddr_in *sin;
3089         struct sockaddr_in osrc, odst, isrc, idst;
3090         int hlen;
3091         struct secpolicy *sp;
3092         struct ip *oip;
3093
3094 #ifdef DIAGNOSTIC
3095         if (m->m_len < sizeof(struct ip))
3096                 panic("too short mbuf on ipsec4_tunnel_validate");
3097 #endif
3098         if (nxt != IPPROTO_IPV4)
3099                 return 0;
3100         if (m->m_pkthdr.len < off + sizeof(struct ip))
3101                 return 0;
3102         /* do not decapsulate if the SA is for transport mode only */
3103         if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
3104                 return 0;
3105
3106         oip = mtod(m, struct ip *);
3107 #ifdef _IP_VHL
3108         hlen = _IP_VHL_HL(oip->ip_vhl) << 2;
3109 #else
3110         hlen = oip->ip_hl << 2;
3111 #endif
3112         if (hlen != sizeof(struct ip))
3113                 return 0;
3114
3115         /* AF_INET6 should be supported, but at this moment we don't. */
3116         sin = (struct sockaddr_in *)&sav->sah->saidx.dst;
3117         if (sin->sin_family != AF_INET)
3118                 return 0;
3119         if (bcmp(&oip->ip_dst, &sin->sin_addr, sizeof(oip->ip_dst)) != 0)
3120                 return 0;
3121
3122         /* XXX slow */
3123         bzero(&osrc, sizeof(osrc));
3124         bzero(&odst, sizeof(odst));
3125         bzero(&isrc, sizeof(isrc));
3126         bzero(&idst, sizeof(idst));
3127         osrc.sin_family = odst.sin_family = isrc.sin_family = idst.sin_family =
3128             AF_INET;
3129         osrc.sin_len = odst.sin_len = isrc.sin_len = idst.sin_len =
3130             sizeof(struct sockaddr_in);
3131         osrc.sin_addr = oip->ip_src;
3132         odst.sin_addr = oip->ip_dst;
3133         m_copydata(m, off + offsetof(struct ip, ip_src), sizeof(isrc.sin_addr),
3134             (caddr_t)&isrc.sin_addr);
3135         m_copydata(m, off + offsetof(struct ip, ip_dst), sizeof(idst.sin_addr),
3136             (caddr_t)&idst.sin_addr);
3137
3138         /*
3139          * RFC2401 5.2.1 (b): (assume that we are using tunnel mode)
3140          * - if the inner destination is multicast address, there can be
3141          *   multiple permissible inner source address.  implementation
3142          *   may want to skip verification of inner source address against
3143          *   SPD selector.
3144          * - if the inner protocol is ICMP, the packet may be an error report
3145          *   from routers on the other side of the VPN cloud (R in the
3146          *   following diagram).  in this case, we cannot verify inner source
3147          *   address against SPD selector.
3148          *      me -- gw === gw -- R -- you
3149          *
3150          * we consider the first bullet to be users responsibility on SPD entry
3151          * configuration (if you need to encrypt multicast traffic, set
3152          * the source range of SPD selector to 0.0.0.0/0, or have explicit
3153          * address ranges for possible senders).
3154          * the second bullet is not taken care of (yet).
3155          *
3156          * therefore, we do not do anything special about inner source.
3157          */
3158
3159         sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
3160             (struct sockaddr *)&isrc, (struct sockaddr *)&idst);
3161         if (!sp)
3162                 return 0;
3163         key_freesp(sp);
3164
3165         return 1;
3166 }
3167
3168 #ifdef INET6
3169 /* validate inbound IPsec tunnel packet. */
3170 int
3171 ipsec6_tunnel_validate(struct mbuf *m, /* no pullup permitted, m->m_len >= ip */
3172                        int off, u_int nxt0, struct secasvar *sav)
3173 {
3174         u_int8_t nxt = nxt0 & 0xff;
3175         struct sockaddr_in6 *sin6;
3176         struct sockaddr_in6 osrc, odst, isrc, idst;
3177         struct secpolicy *sp;
3178         struct ip6_hdr *oip6;
3179
3180 #ifdef DIAGNOSTIC
3181         if (m->m_len < sizeof(struct ip6_hdr))
3182                 panic("too short mbuf on ipsec6_tunnel_validate");
3183 #endif
3184         if (nxt != IPPROTO_IPV6)
3185                 return 0;
3186         if (m->m_pkthdr.len < off + sizeof(struct ip6_hdr))
3187                 return 0;
3188         /* do not decapsulate if the SA is for transport mode only */
3189         if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
3190                 return 0;
3191
3192         oip6 = mtod(m, struct ip6_hdr *);
3193         /* AF_INET should be supported, but at this moment we don't. */
3194         sin6 = (struct sockaddr_in6 *)&sav->sah->saidx.dst;
3195         if (sin6->sin6_family != AF_INET6)
3196                 return 0;
3197         if (!IN6_ARE_ADDR_EQUAL(&oip6->ip6_dst, &sin6->sin6_addr))
3198                 return 0;
3199
3200         /* XXX slow */
3201         bzero(&osrc, sizeof(osrc));
3202         bzero(&odst, sizeof(odst));
3203         bzero(&isrc, sizeof(isrc));
3204         bzero(&idst, sizeof(idst));
3205         osrc.sin6_family = odst.sin6_family = isrc.sin6_family =
3206             idst.sin6_family = AF_INET6;
3207         osrc.sin6_len = odst.sin6_len = isrc.sin6_len = idst.sin6_len =
3208             sizeof(struct sockaddr_in6);
3209         osrc.sin6_addr = oip6->ip6_src;
3210         odst.sin6_addr = oip6->ip6_dst;
3211         m_copydata(m, off + offsetof(struct ip6_hdr, ip6_src),
3212             sizeof(isrc.sin6_addr), (caddr_t)&isrc.sin6_addr);
3213         m_copydata(m, off + offsetof(struct ip6_hdr, ip6_dst),
3214             sizeof(idst.sin6_addr), (caddr_t)&idst.sin6_addr);
3215
3216         /*
3217          * regarding to inner source address validation, see a long comment
3218          * in ipsec4_tunnel_validate.
3219          */
3220
3221         sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
3222             (struct sockaddr *)&isrc, (struct sockaddr *)&idst);
3223         /*
3224          * when there is no suitable inbound policy for the packet of the ipsec
3225          * tunnel mode, the kernel never decapsulate the tunneled packet
3226          * as the ipsec tunnel mode even when the system wide policy is "none".
3227          * then the kernel leaves the generic tunnel module to process this
3228          * packet.  if there is no rule of the generic tunnel, the packet
3229          * is rejected and the statistics will be counted up.
3230          */
3231         if (!sp)
3232                 return 0;
3233         key_freesp(sp);
3234
3235         return 1;
3236 }
3237 #endif
3238
3239 /*
3240  * Make a mbuf chain for encryption.
3241  * If the original mbuf chain contains a mbuf with a cluster,
3242  * allocate a new cluster and copy the data to the new cluster.
3243  * XXX: this hack is inefficient, but is necessary to handle cases
3244  * of TCP retransmission...
3245  */
3246 struct mbuf *
3247 ipsec_copypkt(struct mbuf *m)
3248 {
3249         struct mbuf *n, **mpp, *mnew;
3250
3251         for (n = m, mpp = &m; n; n = n->m_next) {
3252                 if (n->m_flags & M_EXT) {
3253                         /*
3254                          * Make a copy only if there are more than one
3255                          * references to the cluster.
3256                          * XXX: is this approach effective?
3257                          */
3258                         if (m_sharecount(n) > 1) {
3259                                 int remain, copied;
3260                                 struct mbuf *mm;
3261
3262                                 if (n->m_flags & M_PKTHDR) {
3263                                         MGETHDR(mnew, MB_DONTWAIT, MT_HEADER);
3264                                         if (mnew == NULL)
3265                                                 goto fail;
3266                                         if (!m_dup_pkthdr(mnew, n, MB_DONTWAIT)) {
3267                                                 m_free(mnew);
3268                                                 goto fail;
3269                                         }
3270                                 }
3271                                 else {
3272                                         MGET(mnew, MB_DONTWAIT, MT_DATA);
3273                                         if (mnew == NULL)
3274                                                 goto fail;
3275                                 }
3276                                 mnew->m_len = 0;
3277                                 mm = mnew;
3278
3279                                 /*
3280                                  * Copy data. If we don't have enough space to
3281                                  * store the whole data, allocate a cluster
3282                                  * or additional mbufs.
3283                                  * XXX: we don't use m_copyback(), since the
3284                                  * function does not use clusters and thus is
3285                                  * inefficient.
3286                                  */
3287                                 remain = n->m_len;
3288                                 copied = 0;
3289                                 while (1) {
3290                                         int len;
3291                                         struct mbuf *mn;
3292
3293                                         if (remain <= (mm->m_flags & M_PKTHDR ? MHLEN : MLEN))
3294                                                 len = remain;
3295                                         else { /* allocate a cluster */
3296                                                 MCLGET(mm, MB_DONTWAIT);
3297                                                 if (!(mm->m_flags & M_EXT)) {
3298                                                         m_free(mm);
3299                                                         goto fail;
3300                                                 }
3301                                                 len = remain < MCLBYTES ?
3302                                                         remain : MCLBYTES;
3303                                         }
3304
3305                                         bcopy(n->m_data + copied, mm->m_data,
3306                                               len);
3307
3308                                         copied += len;
3309                                         remain -= len;
3310                                         mm->m_len = len;
3311
3312                                         if (remain <= 0) /* completed? */
3313                                                 break;
3314
3315                                         /* need another mbuf */
3316                                         MGETHDR(mn, MB_DONTWAIT, MT_HEADER);
3317                                         if (mn == NULL)
3318                                                 goto fail;
3319                                         mn->m_pkthdr.rcvif = NULL;
3320                                         mm->m_next = mn;
3321                                         mm = mn;
3322                                 }
3323
3324                                 /* adjust chain */
3325                                 mm->m_next = m_free(n);
3326                                 n = mm;
3327                                 *mpp = mnew;
3328                                 mpp = &n->m_next;
3329
3330                                 continue;
3331                         }
3332                 }
3333                 *mpp = n;
3334                 mpp = &n->m_next;
3335         }
3336
3337         return (m);
3338 fail:
3339         m_freem(m);
3340         return (NULL);
3341 }
3342
3343 void
3344 ipsec_delaux(struct mbuf *m)
3345 {
3346         struct m_tag *tag;
3347
3348         while ((tag = m_tag_find(m, PACKET_TAG_IPSEC_HISTORY, NULL)) != NULL)
3349                 m_tag_delete(m, tag);
3350 }
3351
3352 int
3353 ipsec_addhist(struct mbuf *m, int proto, u_int32_t spi)
3354 {
3355         struct m_tag *tag;
3356         struct ipsec_history *p;
3357
3358         tag = m_tag_get(PACKET_TAG_IPSEC_HISTORY,
3359                         sizeof (struct ipsec_history), MB_DONTWAIT);
3360         if (tag == NULL)
3361                 return ENOBUFS;
3362         p = (struct ipsec_history *)m_tag_data(tag);
3363         bzero(p, sizeof(*p));
3364         p->ih_proto = proto;
3365         p->ih_spi = spi;
3366         m_tag_prepend(m, tag);
3367         return 0;
3368 }
3369
3370 struct ipsec_history *
3371 ipsec_gethist(struct mbuf *m, int *lenp)
3372 {
3373         struct m_tag *tag;
3374
3375         tag = m_tag_find(m, PACKET_TAG_IPSEC_HISTORY, NULL);
3376         if (tag == NULL)
3377                 return NULL;
3378         /* XXX NB: noone uses this so fake it */
3379         if (lenp)
3380                 *lenp = sizeof (struct ipsec_history);
3381         return ((struct ipsec_history *)(tag+1));
3382 }