sys/netinet6/ipsec.c

   1 /*      $FreeBSD$       */
   2 /*      $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
   3
   4 /*
   5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the name of the project nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * IPsec controller part.
  35  */
  36
  37 #include "opt_inet.h"
  38 #include "opt_inet6.h"
  39 #include "opt_ipsec.h"
  40
  41 #include <sys/param.h>
  42 #include <sys/systm.h>
  43 #include <sys/malloc.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/domain.h>
  46 #include <sys/protosw.h>
  47 #include <sys/socket.h>
  48 #include <sys/socketvar.h>
  49 #include <sys/errno.h>
  50 #include <sys/time.h>
  51 #include <sys/kernel.h>
  52 #include <sys/syslog.h>
  53 #include <sys/sysctl.h>
  54 #include <sys/proc.h>
  55
  56 #include <net/if.h>
  57 #include <net/route.h>
  58
  59 #include <netinet/in.h>
  60 #include <netinet/in_systm.h>
  61 #include <netinet/ip.h>
  62 #include <netinet/ip_var.h>
  63 #include <netinet/in_var.h>
  64 #include <netinet/udp.h>
  65 #include <netinet/udp_var.h>
  66 #include <netinet/ip_ecn.h>
  67 #ifdef INET6
  68 #include <netinet6/ip6_ecn.h>
  69 #endif
  70 #include <netinet/tcp.h>
  71 #include <netinet/udp.h>
  72
  73 #include <netinet/ip6.h>
  74 #ifdef INET6
  75 #include <netinet6/ip6_var.h>
  76 #endif
  77 #include <netinet/in_pcb.h>
  78 #ifdef INET6
  79 #include <netinet/icmp6.h>
  80 #endif
  81
  82 #include <netinet6/ipsec.h>
  83 #ifdef INET6
  84 #include <netinet6/ipsec6.h>
  85 #endif
  86 #include <netinet6/ah.h>
  87 #ifdef INET6
  88 #include <netinet6/ah6.h>
  89 #endif
  90 #ifdef IPSEC_ESP
  91 #include <netinet6/esp.h>
  92 #ifdef INET6
  93 #include <netinet6/esp6.h>
  94 #endif
  95 #endif
  96 #include <netinet6/ipcomp.h>
  97 #ifdef INET6
  98 #include <netinet6/ipcomp6.h>
  99 #endif
 100 #include <netkey/key.h>
 101 #include <netkey/keydb.h>
 102 #include <netkey/key_debug.h>
 103
 104 #include <machine/in_cksum.h>
 105
 106 #include <net/net_osdep.h>
 107
 108 #ifdef IPSEC_DEBUG
 109 int ipsec_debug = 1;
 110 #else
 111 int ipsec_debug = 0;
 112 #endif
 113
 114 struct ipsecstat ipsecstat;
 115 int ip4_ah_cleartos = 1;
 116 int ip4_ah_offsetmask = 0;      /* maybe IP_DF? */
 117 int ip4_ipsec_dfbit = 0;        /* DF bit on encap. 0: clear 1: set 2: copy */
 118 int ip4_esp_trans_deflev = IPSEC_LEVEL_USE;
 119 int ip4_esp_net_deflev = IPSEC_LEVEL_USE;
 120 int ip4_ah_trans_deflev = IPSEC_LEVEL_USE;
 121 int ip4_ah_net_deflev = IPSEC_LEVEL_USE;
 122 struct secpolicy ip4_def_policy;
 123 int ip4_ipsec_ecn = 0;          /* ECN ignore(-1)/forbidden(0)/allowed(1) */
 124 int ip4_esp_randpad = -1;
 125
 126 #ifdef SYSCTL_DECL
 127 SYSCTL_DECL(_net_inet_ipsec);
 128 #ifdef INET6
 129 SYSCTL_DECL(_net_inet6_ipsec6);
 130 #endif
 131 #endif
 132
 133 /* net.inet.ipsec */
 134 SYSCTL_STRUCT(_net_inet_ipsec, IPSECCTL_STATS,
 135         stats, CTLFLAG_RD,      &ipsecstat,     ipsecstat, "");
 136 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_POLICY,
 137         def_policy, CTLFLAG_RW, &ip4_def_policy.policy, 0, "");
 138 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
 139         CTLFLAG_RW, &ip4_esp_trans_deflev,      0, "");
 140 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
 141         CTLFLAG_RW, &ip4_esp_net_deflev,        0, "");
 142 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
 143         CTLFLAG_RW, &ip4_ah_trans_deflev,       0, "");
 144 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
 145         CTLFLAG_RW, &ip4_ah_net_deflev, 0, "");
 146 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS,
 147         ah_cleartos, CTLFLAG_RW,        &ip4_ah_cleartos,       0, "");
 148 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK,
 149         ah_offsetmask, CTLFLAG_RW,      &ip4_ah_offsetmask,     0, "");
 150 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT,
 151         dfbit, CTLFLAG_RW,      &ip4_ipsec_dfbit,       0, "");
 152 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN,
 153         ecn, CTLFLAG_RW,        &ip4_ipsec_ecn, 0, "");
 154 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG,
 155         debug, CTLFLAG_RW,      &ipsec_debug,   0, "");
 156 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD,
 157         esp_randpad, CTLFLAG_RW,        &ip4_esp_randpad,       0, "");
 158
 159 #ifdef INET6
 160 struct ipsecstat ipsec6stat;
 161 int ip6_esp_trans_deflev = IPSEC_LEVEL_USE;
 162 int ip6_esp_net_deflev = IPSEC_LEVEL_USE;
 163 int ip6_ah_trans_deflev = IPSEC_LEVEL_USE;
 164 int ip6_ah_net_deflev = IPSEC_LEVEL_USE;
 165 struct secpolicy ip6_def_policy;
 166 int ip6_ipsec_ecn = 0;          /* ECN ignore(-1)/forbidden(0)/allowed(1) */
 167 int ip6_esp_randpad = -1;
 168
 169 /* net.inet6.ipsec6 */
 170 SYSCTL_STRUCT(_net_inet6_ipsec6, IPSECCTL_STATS,
 171         stats, CTLFLAG_RD, &ipsec6stat, ipsecstat, "");
 172 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY,
 173         def_policy, CTLFLAG_RW, &ip6_def_policy.policy, 0, "");
 174 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
 175         CTLFLAG_RW, &ip6_esp_trans_deflev,      0, "");
 176 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
 177         CTLFLAG_RW, &ip6_esp_net_deflev,        0, "");
 178 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
 179         CTLFLAG_RW, &ip6_ah_trans_deflev,       0, "");
 180 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
 181         CTLFLAG_RW, &ip6_ah_net_deflev, 0, "");
 182 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN,
 183         ecn, CTLFLAG_RW,        &ip6_ipsec_ecn, 0, "");
 184 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG,
 185         debug, CTLFLAG_RW,      &ipsec_debug,   0, "");
 186 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD,
 187         esp_randpad, CTLFLAG_RW,        &ip6_esp_randpad,       0, "");
 188 #endif /* INET6 */
 189
 190 static int ipsec_setspidx_mbuf
 191         __P((struct secpolicyindex *, u_int, u_int, struct mbuf *, int));
 192 static int ipsec4_setspidx_inpcb __P((struct mbuf *, struct inpcb *pcb));
 193 #ifdef INET6
 194 static int ipsec6_setspidx_in6pcb __P((struct mbuf *, struct in6pcb *pcb));
 195 #endif
 196 static int ipsec_setspidx __P((struct mbuf *, struct secpolicyindex *, int));
 197 static void ipsec4_get_ulp __P((struct mbuf *m, struct secpolicyindex *, int));
 198 static int ipsec4_setspidx_ipaddr __P((struct mbuf *, struct secpolicyindex *));
 199 #ifdef INET6
 200 static void ipsec6_get_ulp __P((struct mbuf *m, struct secpolicyindex *, int));
 201 static int ipsec6_setspidx_ipaddr __P((struct mbuf *, struct secpolicyindex *));
 202 #endif
 203 static struct inpcbpolicy *ipsec_newpcbpolicy __P((void));
 204 static void ipsec_delpcbpolicy __P((struct inpcbpolicy *));
 205 static struct secpolicy *ipsec_deepcopy_policy __P((struct secpolicy *src));
 206 static int ipsec_set_policy __P((struct secpolicy **pcb_sp,
 207         int optname, caddr_t request, size_t len, int priv));
 208 static int ipsec_get_policy __P((struct secpolicy *pcb_sp, struct mbuf **mp));
 209 static void vshiftl __P((unsigned char *, int, int));
 210 static int ipsec_in_reject __P((struct secpolicy *, struct mbuf *));
 211 static size_t ipsec_hdrsiz __P((struct secpolicy *));
 212 #ifdef INET
 213 static struct mbuf *ipsec4_splithdr __P((struct mbuf *));
 214 #endif
 215 #ifdef INET6
 216 static struct mbuf *ipsec6_splithdr __P((struct mbuf *));
 217 #endif
 218 #ifdef INET
 219 static int ipsec4_encapsulate __P((struct mbuf *, struct secasvar *));
 220 #endif
 221 #ifdef INET6
 222 static int ipsec6_encapsulate __P((struct mbuf *, struct secasvar *));
 223 #endif
 224 static struct mbuf *ipsec_addaux __P((struct mbuf *));
 225 static struct mbuf *ipsec_findaux __P((struct mbuf *));
 226 static void ipsec_optaux __P((struct mbuf *, struct mbuf *));
 227
 228 /*
 229  * For OUTBOUND packet having a socket. Searching SPD for packet,
 230  * and return a pointer to SP.
 231  * OUT: NULL:   no apropreate SP found, the following value is set to error.
 232  *              0       : bypass
 233  *              EACCES  : discard packet.
 234  *              ENOENT  : ipsec_acquire() in progress, maybe.
 235  *              others  : error occured.
 236  *      others: a pointer to SP
 237  *
 238  * NOTE: IPv6 mapped adddress concern is implemented here.
 239  */
 240 struct secpolicy *
 241 ipsec4_getpolicybysock(m, dir, so, error)
 242         struct mbuf *m;
 243         u_int dir;
 244         struct socket *so;
 245         int *error;
 246 {
 247         struct inpcbpolicy *pcbsp = NULL;
 248         struct secpolicy *currsp = NULL;        /* policy on socket */
 249         struct secpolicy *kernsp = NULL;        /* policy on kernel */
 250
 251         /* sanity check */
 252         if (m == NULL || so == NULL || error == NULL)
 253                 panic("ipsec4_getpolicybysock: NULL pointer was passed.\n");
 254
 255         switch (so->so_proto->pr_domain->dom_family) {
 256         case AF_INET:
 257                 /* set spidx in pcb */
 258                 *error = ipsec4_setspidx_inpcb(m, sotoinpcb(so));
 259                 break;
 260 #ifdef INET6
 261         case AF_INET6:
 262                 /* set spidx in pcb */
 263                 *error = ipsec6_setspidx_in6pcb(m, sotoin6pcb(so));
 264                 break;
 265 #endif
 266         default:
 267                 panic("ipsec4_getpolicybysock: unsupported address family\n");
 268         }
 269         if (*error)
 270                 return NULL;
 271         switch (so->so_proto->pr_domain->dom_family) {
 272         case AF_INET:
 273                 pcbsp = sotoinpcb(so)->inp_sp;
 274                 break;
 275 #ifdef INET6
 276         case AF_INET6:
 277                 pcbsp = sotoin6pcb(so)->in6p_sp;
 278                 break;
 279 #endif
 280         }
 281
 282         /* sanity check */
 283         if (pcbsp == NULL)
 284                 panic("ipsec4_getpolicybysock: pcbsp is NULL.\n");
 285
 286         switch (dir) {
 287         case IPSEC_DIR_INBOUND:
 288                 currsp = pcbsp->sp_in;
 289                 break;
 290         case IPSEC_DIR_OUTBOUND:
 291                 currsp = pcbsp->sp_out;
 292                 break;
 293         default:
 294                 panic("ipsec4_getpolicybysock: illegal direction.\n");
 295         }
 296
 297         /* sanity check */
 298         if (currsp == NULL)
 299                 panic("ipsec4_getpolicybysock: currsp is NULL.\n");
 300
 301         /* when privilieged socket */
 302         if (pcbsp->priv) {
 303                 switch (currsp->policy) {
 304                 case IPSEC_POLICY_BYPASS:
 305                         currsp->refcnt++;
 306                         *error = 0;
 307                         return currsp;
 308
 309                 case IPSEC_POLICY_ENTRUST:
 310                         /* look for a policy in SPD */
 311                         kernsp = key_allocsp(&currsp->spidx, dir);
 312
 313                         /* SP found */
 314                         if (kernsp != NULL) {
 315                                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 316                                         printf("DP ipsec4_getpolicybysock called "
 317                                                "to allocate SP:%p\n", kernsp));
 318                                 *error = 0;
 319                                 return kernsp;
 320                         }
 321
 322                         /* no SP found */
 323                         if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 324                          && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 325                                 ipseclog((LOG_INFO,
 326                                     "fixed system default policy: %d->%d\n",
 327                                     ip4_def_policy.policy, IPSEC_POLICY_NONE));
 328                                 ip4_def_policy.policy = IPSEC_POLICY_NONE;
 329                         }
 330                         ip4_def_policy.refcnt++;
 331                         *error = 0;
 332                         return &ip4_def_policy;
 333
 334                 case IPSEC_POLICY_IPSEC:
 335                         currsp->refcnt++;
 336                         *error = 0;
 337                         return currsp;
 338
 339                 default:
 340                         ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 341                               "Invalid policy for PCB %d\n", currsp->policy));
 342                         *error = EINVAL;
 343                         return NULL;
 344                 }
 345                 /* NOTREACHED */
 346         }
 347
 348         /* when non-privilieged socket */
 349         /* look for a policy in SPD */
 350         kernsp = key_allocsp(&currsp->spidx, dir);
 351
 352         /* SP found */
 353         if (kernsp != NULL) {
 354                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 355                         printf("DP ipsec4_getpolicybysock called "
 356                                "to allocate SP:%p\n", kernsp));
 357                 *error = 0;
 358                 return kernsp;
 359         }
 360
 361         /* no SP found */
 362         switch (currsp->policy) {
 363         case IPSEC_POLICY_BYPASS:
 364                 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 365                        "Illegal policy for non-priviliged defined %d\n",
 366                         currsp->policy));
 367                 *error = EINVAL;
 368                 return NULL;
 369
 370         case IPSEC_POLICY_ENTRUST:
 371                 if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 372                  && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 373                         ipseclog((LOG_INFO,
 374                             "fixed system default policy: %d->%d\n",
 375                             ip4_def_policy.policy, IPSEC_POLICY_NONE));
 376                         ip4_def_policy.policy = IPSEC_POLICY_NONE;
 377                 }
 378                 ip4_def_policy.refcnt++;
 379                 *error = 0;
 380                 return &ip4_def_policy;
 381
 382         case IPSEC_POLICY_IPSEC:
 383                 currsp->refcnt++;
 384                 *error = 0;
 385                 return currsp;
 386
 387         default:
 388                 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
 389                    "Invalid policy for PCB %d\n", currsp->policy));
 390                 *error = EINVAL;
 391                 return NULL;
 392         }
 393         /* NOTREACHED */
 394 }
 395
 396 /*
 397  * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
 398  * and return a pointer to SP.
 399  * OUT: positive: a pointer to the entry for security policy leaf matched.
 400  *      NULL:   no apropreate SP found, the following value is set to error.
 401  *              0       : bypass
 402  *              EACCES  : discard packet.
 403  *              ENOENT  : ipsec_acquire() in progress, maybe.
 404  *              others  : error occured.
 405  */
 406 struct secpolicy *
 407 ipsec4_getpolicybyaddr(m, dir, flag, error)
 408         struct mbuf *m;
 409         u_int dir;
 410         int flag;
 411         int *error;
 412 {
 413         struct secpolicy *sp = NULL;
 414
 415         /* sanity check */
 416         if (m == NULL || error == NULL)
 417                 panic("ipsec4_getpolicybyaddr: NULL pointer was passed.\n");
 418
 419     {
 420         struct secpolicyindex spidx;
 421
 422         bzero(&spidx, sizeof(spidx));
 423
 424         /* make a index to look for a policy */
 425         *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET, m,
 426             (flag & IP_FORWARDING) ? 0 : 1);
 427
 428         if (*error != 0)
 429                 return NULL;
 430
 431         sp = key_allocsp(&spidx, dir);
 432     }
 433
 434         /* SP found */
 435         if (sp != NULL) {
 436                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 437                         printf("DP ipsec4_getpolicybyaddr called "
 438                                "to allocate SP:%p\n", sp));
 439                 *error = 0;
 440                 return sp;
 441         }
 442
 443         /* no SP found */
 444         if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
 445          && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
 446                 ipseclog((LOG_INFO, "fixed system default policy:%d->%d\n",
 447                         ip4_def_policy.policy,
 448                         IPSEC_POLICY_NONE));
 449                 ip4_def_policy.policy = IPSEC_POLICY_NONE;
 450         }
 451         ip4_def_policy.refcnt++;
 452         *error = 0;
 453         return &ip4_def_policy;
 454 }
 455
 456 #ifdef INET6
 457 /*
 458  * For OUTBOUND packet having a socket. Searching SPD for packet,
 459  * and return a pointer to SP.
 460  * OUT: NULL:   no apropreate SP found, the following value is set to error.
 461  *              0       : bypass
 462  *              EACCES  : discard packet.
 463  *              ENOENT  : ipsec_acquire() in progress, maybe.
 464  *              others  : error occured.
 465  *      others: a pointer to SP
 466  */
 467 struct secpolicy *
 468 ipsec6_getpolicybysock(m, dir, so, error)
 469         struct mbuf *m;
 470         u_int dir;
 471         struct socket *so;
 472         int *error;
 473 {
 474         struct inpcbpolicy *pcbsp = NULL;
 475         struct secpolicy *currsp = NULL;        /* policy on socket */
 476         struct secpolicy *kernsp = NULL;        /* policy on kernel */
 477
 478         /* sanity check */
 479         if (m == NULL || so == NULL || error == NULL)
 480                 panic("ipsec6_getpolicybysock: NULL pointer was passed.\n");
 481
 482 #ifdef DIAGNOSTIC
 483         if (so->so_proto->pr_domain->dom_family != AF_INET6)
 484                 panic("ipsec6_getpolicybysock: socket domain != inet6\n");
 485 #endif
 486
 487         /* set spidx in pcb */
 488         ipsec6_setspidx_in6pcb(m, sotoin6pcb(so));
 489
 490         pcbsp = sotoin6pcb(so)->in6p_sp;
 491
 492         /* sanity check */
 493         if (pcbsp == NULL)
 494                 panic("ipsec6_getpolicybysock: pcbsp is NULL.\n");
 495
 496         switch (dir) {
 497         case IPSEC_DIR_INBOUND:
 498                 currsp = pcbsp->sp_in;
 499                 break;
 500         case IPSEC_DIR_OUTBOUND:
 501                 currsp = pcbsp->sp_out;
 502                 break;
 503         default:
 504                 panic("ipsec6_getpolicybysock: illegal direction.\n");
 505         }
 506
 507         /* sanity check */
 508         if (currsp == NULL)
 509                 panic("ipsec6_getpolicybysock: currsp is NULL.\n");
 510
 511         /* when privilieged socket */
 512         if (pcbsp->priv) {
 513                 switch (currsp->policy) {
 514                 case IPSEC_POLICY_BYPASS:
 515                         currsp->refcnt++;
 516                         *error = 0;
 517                         return currsp;
 518
 519                 case IPSEC_POLICY_ENTRUST:
 520                         /* look for a policy in SPD */
 521                         kernsp = key_allocsp(&currsp->spidx, dir);
 522
 523                         /* SP found */
 524                         if (kernsp != NULL) {
 525                                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 526                                         printf("DP ipsec6_getpolicybysock called "
 527                                                "to allocate SP:%p\n", kernsp));
 528                                 *error = 0;
 529                                 return kernsp;
 530                         }
 531
 532                         /* no SP found */
 533                         if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 534                          && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 535                                 ipseclog((LOG_INFO,
 536                                     "fixed system default policy: %d->%d\n",
 537                                     ip6_def_policy.policy, IPSEC_POLICY_NONE));
 538                                 ip6_def_policy.policy = IPSEC_POLICY_NONE;
 539                         }
 540                         ip6_def_policy.refcnt++;
 541                         *error = 0;
 542                         return &ip6_def_policy;
 543
 544                 case IPSEC_POLICY_IPSEC:
 545                         currsp->refcnt++;
 546                         *error = 0;
 547                         return currsp;
 548
 549                 default:
 550                         ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
 551                             "Invalid policy for PCB %d\n", currsp->policy));
 552                         *error = EINVAL;
 553                         return NULL;
 554                 }
 555                 /* NOTREACHED */
 556         }
 557
 558         /* when non-privilieged socket */
 559         /* look for a policy in SPD */
 560         kernsp = key_allocsp(&currsp->spidx, dir);
 561
 562         /* SP found */
 563         if (kernsp != NULL) {
 564                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 565                         printf("DP ipsec6_getpolicybysock called "
 566                                "to allocate SP:%p\n", kernsp));
 567                 *error = 0;
 568                 return kernsp;
 569         }
 570
 571         /* no SP found */
 572         switch (currsp->policy) {
 573         case IPSEC_POLICY_BYPASS:
 574                 ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
 575                     "Illegal policy for non-priviliged defined %d\n",
 576                     currsp->policy));
 577                 *error = EINVAL;
 578                 return NULL;
 579
 580         case IPSEC_POLICY_ENTRUST:
 581                 if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 582                  && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 583                         ipseclog((LOG_INFO,
 584                             "fixed system default policy: %d->%d\n",
 585                             ip6_def_policy.policy, IPSEC_POLICY_NONE));
 586                         ip6_def_policy.policy = IPSEC_POLICY_NONE;
 587                 }
 588                 ip6_def_policy.refcnt++;
 589                 *error = 0;
 590                 return &ip6_def_policy;
 591
 592         case IPSEC_POLICY_IPSEC:
 593                 currsp->refcnt++;
 594                 *error = 0;
 595                 return currsp;
 596
 597         default:
 598                 ipseclog((LOG_ERR,
 599                     "ipsec6_policybysock: Invalid policy for PCB %d\n",
 600                     currsp->policy));
 601                 *error = EINVAL;
 602                 return NULL;
 603         }
 604         /* NOTREACHED */
 605 }
 606
 607 /*
 608  * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
 609  * and return a pointer to SP.
 610  * `flag' means that packet is to be forwarded whether or not.
 611  *      flag = 1: forwad
 612  * OUT: positive: a pointer to the entry for security policy leaf matched.
 613  *      NULL:   no apropreate SP found, the following value is set to error.
 614  *              0       : bypass
 615  *              EACCES  : discard packet.
 616  *              ENOENT  : ipsec_acquire() in progress, maybe.
 617  *              others  : error occured.
 618  */
 619 #ifndef IP_FORWARDING
 620 #define IP_FORWARDING 1
 621 #endif
 622
 623 struct secpolicy *
 624 ipsec6_getpolicybyaddr(m, dir, flag, error)
 625         struct mbuf *m;
 626         u_int dir;
 627         int flag;
 628         int *error;
 629 {
 630         struct secpolicy *sp = NULL;
 631
 632         /* sanity check */
 633         if (m == NULL || error == NULL)
 634                 panic("ipsec6_getpolicybyaddr: NULL pointer was passed.\n");
 635
 636     {
 637         struct secpolicyindex spidx;
 638
 639         bzero(&spidx, sizeof(spidx));
 640
 641         /* make a index to look for a policy */
 642         *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET6, m,
 643             (flag & IP_FORWARDING) ? 0 : 1);
 644
 645         if (*error != 0)
 646                 return NULL;
 647
 648         sp = key_allocsp(&spidx, dir);
 649     }
 650
 651         /* SP found */
 652         if (sp != NULL) {
 653                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 654                         printf("DP ipsec6_getpolicybyaddr called "
 655                                "to allocate SP:%p\n", sp));
 656                 *error = 0;
 657                 return sp;
 658         }
 659
 660         /* no SP found */
 661         if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
 662          && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
 663                 ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n",
 664                     ip6_def_policy.policy, IPSEC_POLICY_NONE));
 665                 ip6_def_policy.policy = IPSEC_POLICY_NONE;
 666         }
 667         ip6_def_policy.refcnt++;
 668         *error = 0;
 669         return &ip6_def_policy;
 670 }
 671 #endif /* INET6 */
 672
 673 /*
 674  * set IP address into spidx from mbuf.
 675  * When Forwarding packet and ICMP echo reply, this function is used.
 676  *
 677  * IN:  get the followings from mbuf.
 678  *      protocol family, src, dst, next protocol
 679  * OUT:
 680  *      0:      success.
 681  *      other:  failure, and set errno.
 682  */
 683 int
 684 ipsec_setspidx_mbuf(spidx, dir, family, m, needport)
 685         struct secpolicyindex *spidx;
 686         u_int dir, family;
 687         struct mbuf *m;
 688         int needport;
 689 {
 690         int error;
 691
 692         /* sanity check */
 693         if (spidx == NULL || m == NULL)
 694                 panic("ipsec_setspidx_mbuf: NULL pointer was passed.\n");
 695
 696         bzero(spidx, sizeof(*spidx));
 697
 698         error = ipsec_setspidx(m, spidx, needport);
 699         if (error)
 700                 goto bad;
 701         spidx->dir = dir;
 702
 703         return 0;
 704
 705     bad:
 706         /* XXX initialize */
 707         bzero(spidx, sizeof(*spidx));
 708         return EINVAL;
 709 }
 710
 711 static int
 712 ipsec4_setspidx_inpcb(m, pcb)
 713         struct mbuf *m;
 714         struct inpcb *pcb;
 715 {
 716         struct secpolicyindex *spidx;
 717         int error;
 718
 719         /* sanity check */
 720         if (pcb == NULL)
 721                 panic("ipsec4_setspidx_inpcb: no PCB found.\n");
 722         if (pcb->inp_sp == NULL)
 723                 panic("ipsec4_setspidx_inpcb: no inp_sp found.\n");
 724         if (pcb->inp_sp->sp_out == NULL || pcb->inp_sp->sp_in == NULL)
 725                 panic("ipsec4_setspidx_inpcb: no sp_in/out found.\n");
 726
 727         bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
 728         bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
 729
 730         spidx = &pcb->inp_sp->sp_in->spidx;
 731         error = ipsec_setspidx(m, spidx, 1);
 732         if (error)
 733                 goto bad;
 734         spidx->dir = IPSEC_DIR_INBOUND;
 735
 736         spidx = &pcb->inp_sp->sp_out->spidx;
 737         error = ipsec_setspidx(m, spidx, 1);
 738         if (error)
 739                 goto bad;
 740         spidx->dir = IPSEC_DIR_OUTBOUND;
 741
 742         return 0;
 743
 744 bad:
 745         bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
 746         bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
 747         return error;
 748 }
 749
 750 #ifdef INET6
 751 static int
 752 ipsec6_setspidx_in6pcb(m, pcb)
 753         struct mbuf *m;
 754         struct in6pcb *pcb;
 755 {
 756         struct secpolicyindex *spidx;
 757         int error;
 758
 759         /* sanity check */
 760         if (pcb == NULL)
 761                 panic("ipsec6_setspidx_in6pcb: no PCB found.\n");
 762         if (pcb->in6p_sp == NULL)
 763                 panic("ipsec6_setspidx_in6pcb: no in6p_sp found.\n");
 764         if (pcb->in6p_sp->sp_out == NULL || pcb->in6p_sp->sp_in == NULL)
 765                 panic("ipsec6_setspidx_in6pcb: no sp_in/out found.\n");
 766
 767         bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
 768         bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
 769
 770         spidx = &pcb->in6p_sp->sp_in->spidx;
 771         error = ipsec_setspidx(m, spidx, 1);
 772         if (error)
 773                 goto bad;
 774         spidx->dir = IPSEC_DIR_INBOUND;
 775
 776         spidx = &pcb->in6p_sp->sp_out->spidx;
 777         error = ipsec_setspidx(m, spidx, 1);
 778         if (error)
 779                 goto bad;
 780         spidx->dir = IPSEC_DIR_OUTBOUND;
 781
 782         return 0;
 783
 784 bad:
 785         bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
 786         bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
 787         return error;
 788 }
 789 #endif
 790
 791 /*
 792  * configure security policy index (src/dst/proto/sport/dport)
 793  * by looking at the content of mbuf.
 794  * the caller is responsible for error recovery (like clearing up spidx).
 795  */
 796 static int
 797 ipsec_setspidx(m, spidx, needport)
 798         struct mbuf *m;
 799         struct secpolicyindex *spidx;
 800         int needport;
 801 {
 802         struct ip *ip = NULL;
 803         struct ip ipbuf;
 804         u_int v;
 805         struct mbuf *n;
 806         int len;
 807         int error;
 808
 809         if (m == NULL)
 810                 panic("ipsec_setspidx: m == 0 passed.\n");
 811
 812         /*
 813          * validate m->m_pkthdr.len.  we see incorrect length if we
 814          * mistakenly call this function with inconsistent mbuf chain
 815          * (like 4.4BSD tcp/udp processing).  XXX should we panic here?
 816          */
 817         len = 0;
 818         for (n = m; n; n = n->m_next)
 819                 len += n->m_len;
 820         if (m->m_pkthdr.len != len) {
 821                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 822                         printf("ipsec_setspidx: "
 823                                "total of m_len(%d) != pkthdr.len(%d), "
 824                                "ignored.\n",
 825                                 len, m->m_pkthdr.len));
 826                 return EINVAL;
 827         }
 828
 829         if (m->m_pkthdr.len < sizeof(struct ip)) {
 830                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 831                         printf("ipsec_setspidx: "
 832                             "pkthdr.len(%d) < sizeof(struct ip), ignored.\n",
 833                             m->m_pkthdr.len));
 834                 return EINVAL;
 835         }
 836
 837         if (m->m_len >= sizeof(*ip))
 838                 ip = mtod(m, struct ip *);
 839         else {
 840                 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
 841                 ip = &ipbuf;
 842         }
 843 #ifdef _IP_VHL
 844         v = _IP_VHL_V(ip->ip_vhl);
 845 #else
 846         v = ip->ip_v;
 847 #endif
 848         switch (v) {
 849         case 4:
 850                 error = ipsec4_setspidx_ipaddr(m, spidx);
 851                 if (error)
 852                         return error;
 853                 ipsec4_get_ulp(m, spidx, needport);
 854                 return 0;
 855 #ifdef INET6
 856         case 6:
 857                 if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) {
 858                         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 859                                 printf("ipsec_setspidx: "
 860                                     "pkthdr.len(%d) < sizeof(struct ip6_hdr), "
 861                                     "ignored.\n", m->m_pkthdr.len));
 862                         return EINVAL;
 863                 }
 864                 error = ipsec6_setspidx_ipaddr(m, spidx);
 865                 if (error)
 866                         return error;
 867                 ipsec6_get_ulp(m, spidx, needport);
 868                 return 0;
 869 #endif
 870         default:
 871                 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
 872                         printf("ipsec_setspidx: "
 873                             "unknown IP version %u, ignored.\n", v));
 874                 return EINVAL;
 875         }
 876 }
 877
 878 static void
 879 ipsec4_get_ulp(m, spidx, needport)
 880         struct mbuf *m;
 881         struct secpolicyindex *spidx;
 882         int needport;
 883 {
 884         struct ip ip;
 885         struct ip6_ext ip6e;
 886         u_int8_t nxt;
 887         int off;
 888         struct tcphdr th;
 889         struct udphdr uh;
 890
 891         /* sanity check */
 892         if (m == NULL)
 893                 panic("ipsec4_get_ulp: NULL pointer was passed.\n");
 894         if (m->m_pkthdr.len < sizeof(ip))
 895                 panic("ipsec4_get_ulp: too short\n");
 896
 897         /* set default */
 898         spidx->ul_proto = IPSEC_ULPROTO_ANY;
 899         ((struct sockaddr_in *)&spidx->src)->sin_port = IPSEC_PORT_ANY;
 900         ((struct sockaddr_in *)&spidx->dst)->sin_port = IPSEC_PORT_ANY;
 901
 902         m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
 903         /* ip_input() flips it into host endian XXX need more checking */
 904         if (ip.ip_off & (IP_MF | IP_OFFMASK))
 905                 return;
 906
 907         nxt = ip.ip_p;
 908 #ifdef _IP_VHL
 909         off = _IP_VHL_HL(ip->ip_vhl) << 2;
 910 #else
 911         off = ip.ip_hl << 2;
 912 #endif
 913         while (off < m->m_pkthdr.len) {
 914                 switch (nxt) {
 915                 case IPPROTO_TCP:
 916                         spidx->ul_proto = nxt;
 917                         if (!needport)
 918                                 return;
 919                         if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
 920                                 return;
 921                         m_copydata(m, off, sizeof(th), (caddr_t)&th);
 922                         ((struct sockaddr_in *)&spidx->src)->sin_port =
 923                             th.th_sport;
 924                         ((struct sockaddr_in *)&spidx->dst)->sin_port =
 925                             th.th_dport;
 926                         return;
 927                 case IPPROTO_UDP:
 928                         spidx->ul_proto = nxt;
 929                         if (!needport)
 930                                 return;
 931                         if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
 932                                 return;
 933                         m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
 934                         ((struct sockaddr_in *)&spidx->src)->sin_port =
 935                             uh.uh_sport;
 936                         ((struct sockaddr_in *)&spidx->dst)->sin_port =
 937                             uh.uh_dport;
 938                         return;
 939                 case IPPROTO_AH:
 940                         if (m->m_pkthdr.len > off + sizeof(ip6e))
 941                                 return;
 942                         m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
 943                         off += (ip6e.ip6e_len + 2) << 2;
 944                         nxt = ip6e.ip6e_nxt;
 945                         break;
 946                 case IPPROTO_ICMP:
 947                 default:
 948                         /* XXX intermediate headers??? */
 949                         spidx->ul_proto = nxt;
 950                         return;
 951                 }
 952         }
 953 }
 954
 955 /* assumes that m is sane */
 956 static int
 957 ipsec4_setspidx_ipaddr(m, spidx)
 958         struct mbuf *m;
 959         struct secpolicyindex *spidx;
 960 {
 961         struct ip *ip = NULL;
 962         struct ip ipbuf;
 963         struct sockaddr_in *sin;
 964
 965         if (m->m_len >= sizeof(*ip))
 966                 ip = mtod(m, struct ip *);
 967         else {
 968                 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
 969                 ip = &ipbuf;
 970         }
 971
 972         sin = (struct sockaddr_in *)&spidx->src;
 973         bzero(sin, sizeof(*sin));
 974         sin->sin_family = AF_INET;
 975         sin->sin_len = sizeof(struct sockaddr_in);
 976         bcopy(&ip->ip_src, &sin->sin_addr, sizeof(ip->ip_src));
 977         spidx->prefs = sizeof(struct in_addr) << 3;
 978
 979         sin = (struct sockaddr_in *)&spidx->dst;
 980         bzero(sin, sizeof(*sin));
 981         sin->sin_family = AF_INET;
 982         sin->sin_len = sizeof(struct sockaddr_in);
 983         bcopy(&ip->ip_dst, &sin->sin_addr, sizeof(ip->ip_dst));
 984         spidx->prefd = sizeof(struct in_addr) << 3;
 985         return 0;
 986 }
 987
 988 #ifdef INET6
 989 static void
 990 ipsec6_get_ulp(m, spidx, needport)
 991         struct mbuf *m;
 992         struct secpolicyindex *spidx;
 993         int needport;
 994 {
 995         int off, nxt;
 996         struct tcphdr th;
 997         struct udphdr uh;
 998
 999         /* sanity check */
1000         if (m == NULL)
1001                 panic("ipsec6_get_ulp: NULL pointer was passed.\n");
1002
1003         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1004                 printf("ipsec6_get_ulp:\n"); kdebug_mbuf(m));
1005
1006         /* set default */
1007         spidx->ul_proto = IPSEC_ULPROTO_ANY;
1008         ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY;
1009         ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY;
1010
1011         nxt = -1;
1012         off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
1013         if (off < 0 || m->m_pkthdr.len < off)
1014                 return;
1015
1016         switch (nxt) {
1017         case IPPROTO_TCP:
1018                 spidx->ul_proto = nxt;
1019                 if (!needport)
1020                         break;
1021                 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
1022                         break;
1023                 m_copydata(m, off, sizeof(th), (caddr_t)&th);
1024                 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport;
1025                 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport;
1026                 break;
1027         case IPPROTO_UDP:
1028                 spidx->ul_proto = nxt;
1029                 if (!needport)
1030                         break;
1031                 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
1032                         break;
1033                 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
1034                 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport;
1035                 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport;
1036                 break;
1037         case IPPROTO_ICMPV6:
1038         default:
1039                 /* XXX intermediate headers??? */
1040                 spidx->ul_proto = nxt;
1041                 break;
1042         }
1043 }
1044
1045 /* assumes that m is sane */
1046 static int
1047 ipsec6_setspidx_ipaddr(m, spidx)
1048         struct mbuf *m;
1049         struct secpolicyindex *spidx;
1050 {
1051         struct ip6_hdr *ip6 = NULL;
1052         struct ip6_hdr ip6buf;
1053         struct sockaddr_in6 *sin6;
1054
1055         if (m->m_len >= sizeof(*ip6))
1056                 ip6 = mtod(m, struct ip6_hdr *);
1057         else {
1058                 m_copydata(m, 0, sizeof(ip6buf), (caddr_t)&ip6buf);
1059                 ip6 = &ip6buf;
1060         }
1061
1062         sin6 = (struct sockaddr_in6 *)&spidx->src;
1063         bzero(sin6, sizeof(*sin6));
1064         sin6->sin6_family = AF_INET6;
1065         sin6->sin6_len = sizeof(struct sockaddr_in6);
1066         bcopy(&ip6->ip6_src, &sin6->sin6_addr, sizeof(ip6->ip6_src));
1067         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
1068                 sin6->sin6_addr.s6_addr16[1] = 0;
1069                 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
1070         }
1071         spidx->prefs = sizeof(struct in6_addr) << 3;
1072
1073         sin6 = (struct sockaddr_in6 *)&spidx->dst;
1074         bzero(sin6, sizeof(*sin6));
1075         sin6->sin6_family = AF_INET6;
1076         sin6->sin6_len = sizeof(struct sockaddr_in6);
1077         bcopy(&ip6->ip6_dst, &sin6->sin6_addr, sizeof(ip6->ip6_dst));
1078         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
1079                 sin6->sin6_addr.s6_addr16[1] = 0;
1080                 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
1081         }
1082         spidx->prefd = sizeof(struct in6_addr) << 3;
1083
1084         return 0;
1085 }
1086 #endif
1087
1088 static struct inpcbpolicy *
1089 ipsec_newpcbpolicy()
1090 {
1091         struct inpcbpolicy *p;
1092
1093         p = (struct inpcbpolicy *)malloc(sizeof(*p), M_SECA, M_NOWAIT);
1094         return p;
1095 }
1096
1097 static void
1098 ipsec_delpcbpolicy(p)
1099         struct inpcbpolicy *p;
1100 {
1101         free(p, M_SECA);
1102 }
1103
1104 /* initialize policy in PCB */
1105 int
1106 ipsec_init_policy(so, pcb_sp)
1107         struct socket *so;
1108         struct inpcbpolicy **pcb_sp;
1109 {
1110         struct inpcbpolicy *new;
1111
1112         /* sanity check. */
1113         if (so == NULL || pcb_sp == NULL)
1114                 panic("ipsec_init_policy: NULL pointer was passed.\n");
1115
1116         new = ipsec_newpcbpolicy();
1117         if (new == NULL) {
1118                 ipseclog((LOG_DEBUG, "ipsec_init_policy: No more memory.\n"));
1119                 return ENOBUFS;
1120         }
1121         bzero(new, sizeof(*new));
1122
1123         if (so->so_cred != 0 && so->so_cred->cr_uid == 0)
1124                 new->priv = 1;
1125         else
1126                 new->priv = 0;
1127
1128         if ((new->sp_in = key_newsp()) == NULL) {
1129                 ipsec_delpcbpolicy(new);
1130                 return ENOBUFS;
1131         }
1132         new->sp_in->state = IPSEC_SPSTATE_ALIVE;
1133         new->sp_in->policy = IPSEC_POLICY_ENTRUST;
1134
1135         if ((new->sp_out = key_newsp()) == NULL) {
1136                 key_freesp(new->sp_in);
1137                 ipsec_delpcbpolicy(new);
1138                 return ENOBUFS;
1139         }
1140         new->sp_out->state = IPSEC_SPSTATE_ALIVE;
1141         new->sp_out->policy = IPSEC_POLICY_ENTRUST;
1142
1143         *pcb_sp = new;
1144
1145         return 0;
1146 }
1147
1148 /* copy old ipsec policy into new */
1149 int
1150 ipsec_copy_policy(old, new)
1151         struct inpcbpolicy *old, *new;
1152 {
1153         struct secpolicy *sp;
1154
1155         sp = ipsec_deepcopy_policy(old->sp_in);
1156         if (sp) {
1157                 key_freesp(new->sp_in);
1158                 new->sp_in = sp;
1159         } else
1160                 return ENOBUFS;
1161
1162         sp = ipsec_deepcopy_policy(old->sp_out);
1163         if (sp) {
1164                 key_freesp(new->sp_out);
1165                 new->sp_out = sp;
1166         } else
1167                 return ENOBUFS;
1168
1169         new->priv = old->priv;
1170
1171         return 0;
1172 }
1173
1174 /* deep-copy a policy in PCB */
1175 static struct secpolicy *
1176 ipsec_deepcopy_policy(src)
1177         struct secpolicy *src;
1178 {
1179         struct ipsecrequest *newchain = NULL;
1180         struct ipsecrequest *p;
1181         struct ipsecrequest **q;
1182         struct ipsecrequest *r;
1183         struct secpolicy *dst;
1184
1185         dst = key_newsp();
1186         if (src == NULL || dst == NULL)
1187                 return NULL;
1188
1189         /*
1190          * deep-copy IPsec request chain.  This is required since struct
1191          * ipsecrequest is not reference counted.
1192          */
1193         q = &newchain;
1194         for (p = src->req; p; p = p->next) {
1195                 *q = (struct ipsecrequest *)malloc(sizeof(struct ipsecrequest),
1196                         M_SECA, M_NOWAIT);
1197                 if (*q == NULL)
1198                         goto fail;
1199                 bzero(*q, sizeof(**q));
1200                 (*q)->next = NULL;
1201
1202                 (*q)->saidx.proto = p->saidx.proto;
1203                 (*q)->saidx.mode = p->saidx.mode;
1204                 (*q)->level = p->level;
1205                 (*q)->saidx.reqid = p->saidx.reqid;
1206
1207                 bcopy(&p->saidx.src, &(*q)->saidx.src, sizeof((*q)->saidx.src));
1208                 bcopy(&p->saidx.dst, &(*q)->saidx.dst, sizeof((*q)->saidx.dst));
1209
1210                 (*q)->sav = NULL;
1211                 (*q)->sp = dst;
1212
1213                 q = &((*q)->next);
1214         }
1215
1216         dst->req = newchain;
1217         dst->state = src->state;
1218         dst->policy = src->policy;
1219         /* do not touch the refcnt fields */
1220
1221         return dst;
1222
1223 fail:
1224         for (p = newchain; p; p = r) {
1225                 r = p->next;
1226                 free(p, M_SECA);
1227                 p = NULL;
1228         }
1229         return NULL;
1230 }
1231
1232 /* set policy and ipsec request if present. */
1233 static int
1234 ipsec_set_policy(pcb_sp, optname, request, len, priv)
1235         struct secpolicy **pcb_sp;
1236         int optname;
1237         caddr_t request;
1238         size_t len;
1239         int priv;
1240 {
1241         struct sadb_x_policy *xpl;
1242         struct secpolicy *newsp = NULL;
1243         int error;
1244
1245         /* sanity check. */
1246         if (pcb_sp == NULL || *pcb_sp == NULL || request == NULL)
1247                 return EINVAL;
1248         if (len < sizeof(*xpl))
1249                 return EINVAL;
1250         xpl = (struct sadb_x_policy *)request;
1251
1252         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1253                 printf("ipsec_set_policy: passed policy\n");
1254                 kdebug_sadb_x_policy((struct sadb_ext *)xpl));
1255
1256         /* check policy type */
1257         /* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */
1258         if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD
1259          || xpl->sadb_x_policy_type == IPSEC_POLICY_NONE)
1260                 return EINVAL;
1261
1262         /* check privileged socket */
1263         if (priv == 0 && xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS)
1264                 return EACCES;
1265
1266         /* allocation new SP entry */
1267         if ((newsp = key_msg2sp(xpl, len, &error)) == NULL)
1268                 return error;
1269
1270         newsp->state = IPSEC_SPSTATE_ALIVE;
1271
1272         /* clear old SP and set new SP */
1273         key_freesp(*pcb_sp);
1274         *pcb_sp = newsp;
1275         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1276                 printf("ipsec_set_policy: new policy\n");
1277                 kdebug_secpolicy(newsp));
1278
1279         return 0;
1280 }
1281
1282 static int
1283 ipsec_get_policy(pcb_sp, mp)
1284         struct secpolicy *pcb_sp;
1285         struct mbuf **mp;
1286 {
1287
1288         /* sanity check. */
1289         if (pcb_sp == NULL || mp == NULL)
1290                 return EINVAL;
1291
1292         *mp = key_sp2msg(pcb_sp);
1293         if (!*mp) {
1294                 ipseclog((LOG_DEBUG, "ipsec_get_policy: No more memory.\n"));
1295                 return ENOBUFS;
1296         }
1297
1298         (*mp)->m_type = MT_DATA;
1299         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1300                 printf("ipsec_get_policy:\n");
1301                 kdebug_mbuf(*mp));
1302
1303         return 0;
1304 }
1305
1306 int
1307 ipsec4_set_policy(inp, optname, request, len, priv)
1308         struct inpcb *inp;
1309         int optname;
1310         caddr_t request;
1311         size_t len;
1312         int priv;
1313 {
1314         struct sadb_x_policy *xpl;
1315         struct secpolicy **pcb_sp;
1316
1317         /* sanity check. */
1318         if (inp == NULL || request == NULL)
1319                 return EINVAL;
1320         if (len < sizeof(*xpl))
1321                 return EINVAL;
1322         xpl = (struct sadb_x_policy *)request;
1323
1324         /* select direction */
1325         switch (xpl->sadb_x_policy_dir) {
1326         case IPSEC_DIR_INBOUND:
1327                 pcb_sp = &inp->inp_sp->sp_in;
1328                 break;
1329         case IPSEC_DIR_OUTBOUND:
1330                 pcb_sp = &inp->inp_sp->sp_out;
1331                 break;
1332         default:
1333                 ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1334                         xpl->sadb_x_policy_dir));
1335                 return EINVAL;
1336         }
1337
1338         return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1339 }
1340
1341 int
1342 ipsec4_get_policy(inp, request, len, mp)
1343         struct inpcb *inp;
1344         caddr_t request;
1345         size_t len;
1346         struct mbuf **mp;
1347 {
1348         struct sadb_x_policy *xpl;
1349         struct secpolicy *pcb_sp;
1350
1351         /* sanity check. */
1352         if (inp == NULL || request == NULL || mp == NULL)
1353                 return EINVAL;
1354         if (inp->inp_sp == NULL)
1355                 panic("policy in PCB is NULL\n");
1356         if (len < sizeof(*xpl))
1357                 return EINVAL;
1358         xpl = (struct sadb_x_policy *)request;
1359
1360         /* select direction */
1361         switch (xpl->sadb_x_policy_dir) {
1362         case IPSEC_DIR_INBOUND:
1363                 pcb_sp = inp->inp_sp->sp_in;
1364                 break;
1365         case IPSEC_DIR_OUTBOUND:
1366                 pcb_sp = inp->inp_sp->sp_out;
1367                 break;
1368         default:
1369                 ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1370                         xpl->sadb_x_policy_dir));
1371                 return EINVAL;
1372         }
1373
1374         return ipsec_get_policy(pcb_sp, mp);
1375 }
1376
1377 /* delete policy in PCB */
1378 int
1379 ipsec4_delete_pcbpolicy(inp)
1380         struct inpcb *inp;
1381 {
1382         /* sanity check. */
1383         if (inp == NULL)
1384                 panic("ipsec4_delete_pcbpolicy: NULL pointer was passed.\n");
1385
1386         if (inp->inp_sp == NULL)
1387                 return 0;
1388
1389         if (inp->inp_sp->sp_in != NULL) {
1390                 key_freesp(inp->inp_sp->sp_in);
1391                 inp->inp_sp->sp_in = NULL;
1392         }
1393
1394         if (inp->inp_sp->sp_out != NULL) {
1395                 key_freesp(inp->inp_sp->sp_out);
1396                 inp->inp_sp->sp_out = NULL;
1397         }
1398
1399         ipsec_delpcbpolicy(inp->inp_sp);
1400         inp->inp_sp = NULL;
1401
1402         return 0;
1403 }
1404
1405 #ifdef INET6
1406 int
1407 ipsec6_set_policy(in6p, optname, request, len, priv)
1408         struct in6pcb *in6p;
1409         int optname;
1410         caddr_t request;
1411         size_t len;
1412         int priv;
1413 {
1414         struct sadb_x_policy *xpl;
1415         struct secpolicy **pcb_sp;
1416
1417         /* sanity check. */
1418         if (in6p == NULL || request == NULL)
1419                 return EINVAL;
1420         if (len < sizeof(*xpl))
1421                 return EINVAL;
1422         xpl = (struct sadb_x_policy *)request;
1423
1424         /* select direction */
1425         switch (xpl->sadb_x_policy_dir) {
1426         case IPSEC_DIR_INBOUND:
1427                 pcb_sp = &in6p->in6p_sp->sp_in;
1428                 break;
1429         case IPSEC_DIR_OUTBOUND:
1430                 pcb_sp = &in6p->in6p_sp->sp_out;
1431                 break;
1432         default:
1433                 ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1434                         xpl->sadb_x_policy_dir));
1435                 return EINVAL;
1436         }
1437
1438         return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1439 }
1440
1441 int
1442 ipsec6_get_policy(in6p, request, len, mp)
1443         struct in6pcb *in6p;
1444         caddr_t request;
1445         size_t len;
1446         struct mbuf **mp;
1447 {
1448         struct sadb_x_policy *xpl;
1449         struct secpolicy *pcb_sp;
1450
1451         /* sanity check. */
1452         if (in6p == NULL || request == NULL || mp == NULL)
1453                 return EINVAL;
1454         if (in6p->in6p_sp == NULL)
1455                 panic("policy in PCB is NULL\n");
1456         if (len < sizeof(*xpl))
1457                 return EINVAL;
1458         xpl = (struct sadb_x_policy *)request;
1459
1460         /* select direction */
1461         switch (xpl->sadb_x_policy_dir) {
1462         case IPSEC_DIR_INBOUND:
1463                 pcb_sp = in6p->in6p_sp->sp_in;
1464                 break;
1465         case IPSEC_DIR_OUTBOUND:
1466                 pcb_sp = in6p->in6p_sp->sp_out;
1467                 break;
1468         default:
1469                 ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1470                         xpl->sadb_x_policy_dir));
1471                 return EINVAL;
1472         }
1473
1474         return ipsec_get_policy(pcb_sp, mp);
1475 }
1476
1477 int
1478 ipsec6_delete_pcbpolicy(in6p)
1479         struct in6pcb *in6p;
1480 {
1481         /* sanity check. */
1482         if (in6p == NULL)
1483                 panic("ipsec6_delete_pcbpolicy: NULL pointer was passed.\n");
1484
1485         if (in6p->in6p_sp == NULL)
1486                 return 0;
1487
1488         if (in6p->in6p_sp->sp_in != NULL) {
1489                 key_freesp(in6p->in6p_sp->sp_in);
1490                 in6p->in6p_sp->sp_in = NULL;
1491         }
1492
1493         if (in6p->in6p_sp->sp_out != NULL) {
1494                 key_freesp(in6p->in6p_sp->sp_out);
1495                 in6p->in6p_sp->sp_out = NULL;
1496         }
1497
1498         ipsec_delpcbpolicy(in6p->in6p_sp);
1499         in6p->in6p_sp = NULL;
1500
1501         return 0;
1502 }
1503 #endif
1504
1505 /*
1506  * return current level.
1507  * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
1508  */
1509 u_int
1510 ipsec_get_reqlevel(isr)
1511         struct ipsecrequest *isr;
1512 {
1513         u_int level = 0;
1514         u_int esp_trans_deflev, esp_net_deflev, ah_trans_deflev, ah_net_deflev;
1515
1516         /* sanity check */
1517         if (isr == NULL || isr->sp == NULL)
1518                 panic("ipsec_get_reqlevel: NULL pointer is passed.\n");
1519         if (((struct sockaddr *)&isr->sp->spidx.src)->sa_family
1520                         != ((struct sockaddr *)&isr->sp->spidx.dst)->sa_family)
1521                 panic("ipsec_get_reqlevel: family mismatched.\n");
1522
1523 /* XXX note that we have ipseclog() expanded here - code sync issue */
1524 #define IPSEC_CHECK_DEFAULT(lev) \
1525         (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE            \
1526                         && (lev) != IPSEC_LEVEL_UNIQUE)                       \
1527                 ? (ipsec_debug                                                \
1528                         ? log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
1529                                 (lev), IPSEC_LEVEL_REQUIRE)                   \
1530                         : 0),                                                 \
1531                         (lev) = IPSEC_LEVEL_REQUIRE,                          \
1532                         (lev)                                                 \
1533                 : (lev))
1534
1535         /* set default level */
1536         switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) {
1537 #ifdef INET
1538         case AF_INET:
1539                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev);
1540                 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev);
1541                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev);
1542                 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev);
1543                 break;
1544 #endif
1545 #ifdef INET6
1546         case AF_INET6:
1547                 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev);
1548                 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev);
1549                 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev);
1550                 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev);
1551                 break;
1552 #endif /* INET6 */
1553         default:
1554                 panic("key_get_reqlevel: Unknown family. %d\n",
1555                         ((struct sockaddr *)&isr->sp->spidx.src)->sa_family);
1556         }
1557
1558 #undef IPSEC_CHECK_DEFAULT
1559
1560         /* set level */
1561         switch (isr->level) {
1562         case IPSEC_LEVEL_DEFAULT:
1563                 switch (isr->saidx.proto) {
1564                 case IPPROTO_ESP:
1565                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1566                                 level = esp_net_deflev;
1567                         else
1568                                 level = esp_trans_deflev;
1569                         break;
1570                 case IPPROTO_AH:
1571                         if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1572                                 level = ah_net_deflev;
1573                         else
1574                                 level = ah_trans_deflev;
1575                 case IPPROTO_IPCOMP:
1576                         /*
1577                          * we don't really care, as IPcomp document says that
1578                          * we shouldn't compress small packets
1579                          */
1580                         level = IPSEC_LEVEL_USE;
1581                         break;
1582                 default:
1583                         panic("ipsec_get_reqlevel: "
1584                                 "Illegal protocol defined %u\n",
1585                                 isr->saidx.proto);
1586                 }
1587                 break;
1588
1589         case IPSEC_LEVEL_USE:
1590         case IPSEC_LEVEL_REQUIRE:
1591                 level = isr->level;
1592                 break;
1593         case IPSEC_LEVEL_UNIQUE:
1594                 level = IPSEC_LEVEL_REQUIRE;
1595                 break;
1596
1597         default:
1598                 panic("ipsec_get_reqlevel: Illegal IPsec level %u\n",
1599                         isr->level);
1600         }
1601
1602         return level;
1603 }
1604
1605 /*
1606  * Check AH/ESP integrity.
1607  * OUT:
1608  *      0: valid
1609  *      1: invalid
1610  */
1611 static int
1612 ipsec_in_reject(sp, m)
1613         struct secpolicy *sp;
1614         struct mbuf *m;
1615 {
1616         struct ipsecrequest *isr;
1617         u_int level;
1618         int need_auth, need_conf, need_icv;
1619
1620         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1621                 printf("ipsec_in_reject: using SP\n");
1622                 kdebug_secpolicy(sp));
1623
1624         /* check policy */
1625         switch (sp->policy) {
1626         case IPSEC_POLICY_DISCARD:
1627                 return 1;
1628         case IPSEC_POLICY_BYPASS:
1629         case IPSEC_POLICY_NONE:
1630                 return 0;
1631
1632         case IPSEC_POLICY_IPSEC:
1633                 break;
1634
1635         case IPSEC_POLICY_ENTRUST:
1636         default:
1637                 panic("ipsec_hdrsiz: Invalid policy found. %d\n", sp->policy);
1638         }
1639
1640         need_auth = 0;
1641         need_conf = 0;
1642         need_icv = 0;
1643
1644         /* XXX should compare policy against ipsec header history */
1645
1646         for (isr = sp->req; isr != NULL; isr = isr->next) {
1647
1648                 /* get current level */
1649                 level = ipsec_get_reqlevel(isr);
1650
1651                 switch (isr->saidx.proto) {
1652                 case IPPROTO_ESP:
1653                         if (level == IPSEC_LEVEL_REQUIRE) {
1654                                 need_conf++;
1655
1656                                 if (isr->sav != NULL
1657                                  && isr->sav->flags == SADB_X_EXT_NONE
1658                                  && isr->sav->alg_auth != SADB_AALG_NONE)
1659                                         need_icv++;
1660                         }
1661                         break;
1662                 case IPPROTO_AH:
1663                         if (level == IPSEC_LEVEL_REQUIRE) {
1664                                 need_auth++;
1665                                 need_icv++;
1666                         }
1667                         break;
1668                 case IPPROTO_IPCOMP:
1669                         /*
1670                          * we don't really care, as IPcomp document says that
1671                          * we shouldn't compress small packets, IPComp policy
1672                          * should always be treated as being in "use" level.
1673                          */
1674                         break;
1675                 }
1676         }
1677
1678         KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1679                 printf("ipsec_in_reject: auth:%d conf:%d icv:%d m_flags:%x\n",
1680                         need_auth, need_conf, need_icv, m->m_flags));
1681
1682         if ((need_conf && !(m->m_flags & M_DECRYPTED))
1683          || (!need_auth && need_icv && !(m->m_flags & M_AUTHIPDGM))
1684          || (need_auth && !(m->m_flags & M_AUTHIPHDR)))
1685                 return 1;
1686
1687         return 0;
1688 }
1689
1690 /*
1691  * Check AH/ESP integrity.
1692  * This function is called from tcp_input(), udp_input(),
1693  * and {ah,esp}4_input for tunnel mode
1694  */
1695 int
1696 ipsec4_in_reject_so(m, so)
1697         struct mbuf *m;
1698         struct socket *so;
1699 {
1700         struct secpolicy *sp = NULL;
1701         int error;
1702         int result;
1703
1704         /* sanity check */
1705         if (m == NULL)
1706                 return 0;       /* XXX should be panic ? */
1707
1708         /* get SP for this packet.
1709          * When we are called from ip_forward(), we call
1710          * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
1711          */
1712         if (so == NULL)
1713                 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
1714         else
1715                 sp = ipsec4_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
1716
1717         if (sp == NULL)
1718                 return 0;       /* XXX should be panic ?
1719                                  * -> No, there may be error. */
1720
1721         result = ipsec_in_reject(sp, m);
1722         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1723                 printf("DP ipsec4_in_reject_so call free SP:%p\n", sp));
1724         key_freesp(sp);
1725
1726         return result;
1727 }
1728
1729 int
1730 ipsec4_in_reject(m, inp)
1731         struct mbuf *m;
1732         struct inpcb *inp;
1733 {
1734         if (inp == NULL)
1735                 return ipsec4_in_reject_so(m, NULL);
1736         if (inp->inp_socket)
1737                 return ipsec4_in_reject_so(m, inp->inp_socket);
1738         else
1739                 panic("ipsec4_in_reject: invalid inpcb/socket");
1740 }
1741
1742 #ifdef INET6
1743 /*
1744  * Check AH/ESP integrity.
1745  * This function is called from tcp6_input(), udp6_input(),
1746  * and {ah,esp}6_input for tunnel mode
1747  */
1748 int
1749 ipsec6_in_reject_so(m, so)
1750         struct mbuf *m;
1751         struct socket *so;
1752 {
1753         struct secpolicy *sp = NULL;
1754         int error;
1755         int result;
1756
1757         /* sanity check */
1758         if (m == NULL)
1759                 return 0;       /* XXX should be panic ? */
1760
1761         /* get SP for this packet.
1762          * When we are called from ip_forward(), we call
1763          * ipsec6_getpolicybyaddr() with IP_FORWARDING flag.
1764          */
1765         if (so == NULL)
1766                 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
1767         else
1768                 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
1769
1770         if (sp == NULL)
1771                 return 0;       /* XXX should be panic ? */
1772
1773         result = ipsec_in_reject(sp, m);
1774         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1775                 printf("DP ipsec6_in_reject_so call free SP:%p\n", sp));
1776         key_freesp(sp);
1777
1778         return result;
1779 }
1780
1781 int
1782 ipsec6_in_reject(m, in6p)
1783         struct mbuf *m;
1784         struct in6pcb *in6p;
1785 {
1786         if (in6p == NULL)
1787                 return ipsec6_in_reject_so(m, NULL);
1788         if (in6p->in6p_socket)
1789                 return ipsec6_in_reject_so(m, in6p->in6p_socket);
1790         else
1791                 panic("ipsec6_in_reject: invalid in6p/socket");
1792 }
1793 #endif
1794
1795 /*
1796  * compute the byte size to be occupied by IPsec header.
1797  * in case it is tunneled, it includes the size of outer IP header.
1798  * NOTE: SP passed is free in this function.
1799  */
1800 static size_t
1801 ipsec_hdrsiz(sp)
1802         struct secpolicy *sp;
1803 {
1804         struct ipsecrequest *isr;
1805         size_t siz, clen;
1806
1807         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1808                 printf("ipsec_in_reject: using SP\n");
1809                 kdebug_secpolicy(sp));
1810
1811         /* check policy */
1812         switch (sp->policy) {
1813         case IPSEC_POLICY_DISCARD:
1814         case IPSEC_POLICY_BYPASS:
1815         case IPSEC_POLICY_NONE:
1816                 return 0;
1817
1818         case IPSEC_POLICY_IPSEC:
1819                 break;
1820
1821         case IPSEC_POLICY_ENTRUST:
1822         default:
1823                 panic("ipsec_hdrsiz: Invalid policy found. %d\n", sp->policy);
1824         }
1825
1826         siz = 0;
1827
1828         for (isr = sp->req; isr != NULL; isr = isr->next) {
1829
1830                 clen = 0;
1831
1832                 switch (isr->saidx.proto) {
1833                 case IPPROTO_ESP:
1834 #ifdef IPSEC_ESP
1835                         clen = esp_hdrsiz(isr);
1836 #else
1837                         clen = 0;       /*XXX*/
1838 #endif
1839                         break;
1840                 case IPPROTO_AH:
1841                         clen = ah_hdrsiz(isr);
1842                         break;
1843                 case IPPROTO_IPCOMP:
1844                         clen = sizeof(struct ipcomp);
1845                         break;
1846                 }
1847
1848                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
1849                         switch (((struct sockaddr *)&isr->saidx.dst)->sa_family) {
1850                         case AF_INET:
1851                                 clen += sizeof(struct ip);
1852                                 break;
1853 #ifdef INET6
1854                         case AF_INET6:
1855                                 clen += sizeof(struct ip6_hdr);
1856                                 break;
1857 #endif
1858                         default:
1859                                 ipseclog((LOG_ERR, "ipsec_hdrsiz: "
1860                                     "unknown AF %d in IPsec tunnel SA\n",
1861                                     ((struct sockaddr *)&isr->saidx.dst)->sa_family));
1862                                 break;
1863                         }
1864                 }
1865                 siz += clen;
1866         }
1867
1868         return siz;
1869 }
1870
1871 /* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */
1872 size_t
1873 ipsec4_hdrsiz(m, dir, inp)
1874         struct mbuf *m;
1875         u_int dir;
1876         struct inpcb *inp;
1877 {
1878         struct secpolicy *sp = NULL;
1879         int error;
1880         size_t size;
1881
1882         /* sanity check */
1883         if (m == NULL)
1884                 return 0;       /* XXX should be panic ? */
1885         if (inp != NULL && inp->inp_socket == NULL)
1886                 panic("ipsec4_hdrsize: why is socket NULL but there is PCB.");
1887
1888         /* get SP for this packet.
1889          * When we are called from ip_forward(), we call
1890          * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
1891          */
1892         if (inp == NULL)
1893                 sp = ipsec4_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1894         else
1895                 sp = ipsec4_getpolicybysock(m, dir, inp->inp_socket, &error);
1896
1897         if (sp == NULL)
1898                 return 0;       /* XXX should be panic ? */
1899
1900         size = ipsec_hdrsiz(sp);
1901         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1902                 printf("DP ipsec4_hdrsiz call free SP:%p\n", sp));
1903         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1904                 printf("ipsec4_hdrsiz: size:%lu.\n", (unsigned long)size));
1905         key_freesp(sp);
1906
1907         return size;
1908 }
1909
1910 #ifdef INET6
1911 /* This function is called from ipsec6_hdrsize_tcp(),
1912  * and maybe from ip6_forward.()
1913  */
1914 size_t
1915 ipsec6_hdrsiz(m, dir, in6p)
1916         struct mbuf *m;
1917         u_int dir;
1918         struct in6pcb *in6p;
1919 {
1920         struct secpolicy *sp = NULL;
1921         int error;
1922         size_t size;
1923
1924         /* sanity check */
1925         if (m == NULL)
1926                 return 0;       /* XXX shoud be panic ? */
1927         if (in6p != NULL && in6p->in6p_socket == NULL)
1928                 panic("ipsec6_hdrsize: why is socket NULL but there is PCB.");
1929
1930         /* get SP for this packet */
1931         /* XXX Is it right to call with IP_FORWARDING. */
1932         if (in6p == NULL)
1933                 sp = ipsec6_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1934         else
1935                 sp = ipsec6_getpolicybysock(m, dir, in6p->in6p_socket, &error);
1936
1937         if (sp == NULL)
1938                 return 0;
1939         size = ipsec_hdrsiz(sp);
1940         KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1941                 printf("DP ipsec6_hdrsiz call free SP:%p\n", sp));
1942         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1943                 printf("ipsec6_hdrsiz: size:%lu.\n", (unsigned long)size));
1944         key_freesp(sp);
1945
1946         return size;
1947 }
1948 #endif /*INET6*/
1949
1950 #ifdef INET
1951 /*
1952  * encapsulate for ipsec tunnel.
1953  * ip->ip_src must be fixed later on.
1954  */
1955 static int
1956 ipsec4_encapsulate(m, sav)
1957         struct mbuf *m;
1958         struct secasvar *sav;
1959 {
1960         struct ip *oip;
1961         struct ip *ip;
1962         size_t hlen;
1963         size_t plen;
1964
1965         /* can't tunnel between different AFs */
1966         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
1967                 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
1968          || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET) {
1969                 m_freem(m);
1970                 return EINVAL;
1971         }
1972 #if 0
1973         /* XXX if the dst is myself, perform nothing. */
1974         if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
1975                 m_freem(m);
1976                 return EINVAL;
1977         }
1978 #endif
1979
1980         if (m->m_len < sizeof(*ip))
1981                 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
1982
1983         ip = mtod(m, struct ip *);
1984 #ifdef _IP_VHL
1985         hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
1986 #else
1987         hlen = ip->ip_hl << 2;
1988 #endif
1989
1990         if (m->m_len != hlen)
1991                 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
1992
1993         /* generate header checksum */
1994         ip->ip_sum = 0;
1995 #ifdef _IP_VHL
1996         if (ip->ip_vhl == IP_VHL_BORING)
1997                 ip->ip_sum = in_cksum_hdr(ip);
1998         else
1999                 ip->ip_sum = in_cksum(m, hlen);
2000 #else
2001         ip->ip_sum = in_cksum(m, hlen);
2002 #endif
2003
2004         plen = m->m_pkthdr.len;
2005
2006         /*
2007          * grow the mbuf to accomodate the new IPv4 header.
2008          * NOTE: IPv4 options will never be copied.
2009          */
2010         if (M_LEADINGSPACE(m->m_next) < hlen) {
2011                 struct mbuf *n;
2012                 MGET(n, M_DONTWAIT, MT_DATA);
2013                 if (!n) {
2014                         m_freem(m);
2015                         return ENOBUFS;
2016                 }
2017                 n->m_len = hlen;
2018                 n->m_next = m->m_next;
2019                 m->m_next = n;
2020                 m->m_pkthdr.len += hlen;
2021                 oip = mtod(n, struct ip *);
2022         } else {
2023                 m->m_next->m_len += hlen;
2024                 m->m_next->m_data -= hlen;
2025                 m->m_pkthdr.len += hlen;
2026                 oip = mtod(m->m_next, struct ip *);
2027         }
2028         ip = mtod(m, struct ip *);
2029         ovbcopy((caddr_t)ip, (caddr_t)oip, hlen);
2030         m->m_len = sizeof(struct ip);
2031         m->m_pkthdr.len -= (hlen - sizeof(struct ip));
2032
2033         /* construct new IPv4 header. see RFC 2401 5.1.2.1 */
2034         /* ECN consideration. */
2035         ip_ecn_ingress(ip4_ipsec_ecn, &ip->ip_tos, &oip->ip_tos);
2036 #ifdef _IP_VHL
2037         ip->ip_vhl = IP_MAKE_VHL(IPVERSION, sizeof(struct ip) >> 2);
2038 #else
2039         ip->ip_hl = sizeof(struct ip) >> 2;
2040 #endif
2041         ip->ip_off &= htons(~IP_OFFMASK);
2042         ip->ip_off &= htons(~IP_MF);
2043         switch (ip4_ipsec_dfbit) {
2044         case 0: /*clear DF bit*/
2045                 ip->ip_off &= htons(~IP_DF);
2046                 break;
2047         case 1: /*set DF bit*/
2048                 ip->ip_off |= htons(IP_DF);
2049                 break;
2050         default:        /*copy DF bit*/
2051                 break;
2052         }
2053         ip->ip_p = IPPROTO_IPIP;
2054         if (plen + sizeof(struct ip) < IP_MAXPACKET)
2055                 ip->ip_len = htons(plen + sizeof(struct ip));
2056         else {
2057                 ipseclog((LOG_ERR, "IPv4 ipsec: size exceeds limit: "
2058                         "leave ip_len as is (invalid packet)\n"));
2059         }
2060 #ifdef RANDOM_IP_ID
2061         ip->ip_id = ip_randomid();
2062 #else
2063         ip->ip_id = htons(ip_id++);
2064 #endif
2065         bcopy(&((struct sockaddr_in *)&sav->sah->saidx.src)->sin_addr,
2066                 &ip->ip_src, sizeof(ip->ip_src));
2067         bcopy(&((struct sockaddr_in *)&sav->sah->saidx.dst)->sin_addr,
2068                 &ip->ip_dst, sizeof(ip->ip_dst));
2069         ip->ip_ttl = IPDEFTTL;
2070
2071         /* XXX Should ip_src be updated later ? */
2072
2073         return 0;
2074 }
2075 #endif /*INET*/
2076
2077 #ifdef INET6
2078 static int
2079 ipsec6_encapsulate(m, sav)
2080         struct mbuf *m;
2081         struct secasvar *sav;
2082 {
2083         struct ip6_hdr *oip6;
2084         struct ip6_hdr *ip6;
2085         size_t plen;
2086
2087         /* can't tunnel between different AFs */
2088         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2089                 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
2090          || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET6) {
2091                 m_freem(m);
2092                 return EINVAL;
2093         }
2094 #if 0
2095         /* XXX if the dst is myself, perform nothing. */
2096         if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
2097                 m_freem(m);
2098                 return EINVAL;
2099         }
2100 #endif
2101
2102         plen = m->m_pkthdr.len;
2103
2104         /*
2105          * grow the mbuf to accomodate the new IPv6 header.
2106          */
2107         if (m->m_len != sizeof(struct ip6_hdr))
2108                 panic("ipsec6_encapsulate: assumption failed (first mbuf length)");
2109         if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
2110                 struct mbuf *n;
2111                 MGET(n, M_DONTWAIT, MT_DATA);
2112                 if (!n) {
2113                         m_freem(m);
2114                         return ENOBUFS;
2115                 }
2116                 n->m_len = sizeof(struct ip6_hdr);
2117                 n->m_next = m->m_next;
2118                 m->m_next = n;
2119                 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2120                 oip6 = mtod(n, struct ip6_hdr *);
2121         } else {
2122                 m->m_next->m_len += sizeof(struct ip6_hdr);
2123                 m->m_next->m_data -= sizeof(struct ip6_hdr);
2124                 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2125                 oip6 = mtod(m->m_next, struct ip6_hdr *);
2126         }
2127         ip6 = mtod(m, struct ip6_hdr *);
2128         ovbcopy((caddr_t)ip6, (caddr_t)oip6, sizeof(struct ip6_hdr));
2129
2130         /* Fake link-local scope-class addresses */
2131         if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
2132                 oip6->ip6_src.s6_addr16[1] = 0;
2133         if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
2134                 oip6->ip6_dst.s6_addr16[1] = 0;
2135
2136         /* construct new IPv6 header. see RFC 2401 5.1.2.2 */
2137         /* ECN consideration. */
2138         ip6_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &oip6->ip6_flow);
2139         if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
2140                 ip6->ip6_plen = htons(plen);
2141         else {
2142                 /* ip6->ip6_plen will be updated in ip6_output() */
2143         }
2144         ip6->ip6_nxt = IPPROTO_IPV6;
2145         bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.src)->sin6_addr,
2146                 &ip6->ip6_src, sizeof(ip6->ip6_src));
2147         bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.dst)->sin6_addr,
2148                 &ip6->ip6_dst, sizeof(ip6->ip6_dst));
2149         ip6->ip6_hlim = IPV6_DEFHLIM;
2150
2151         /* XXX Should ip6_src be updated later ? */
2152
2153         return 0;
2154 }
2155 #endif /*INET6*/
2156
2157 /*
2158  * Check the variable replay window.
2159  * ipsec_chkreplay() performs replay check before ICV verification.
2160  * ipsec_updatereplay() updates replay bitmap.  This must be called after
2161  * ICV verification (it also performs replay check, which is usually done
2162  * beforehand).
2163  * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
2164  *
2165  * based on RFC 2401.
2166  */
2167 int
2168 ipsec_chkreplay(seq, sav)
2169         u_int32_t seq;
2170         struct secasvar *sav;
2171 {
2172         const struct secreplay *replay;
2173         u_int32_t diff;
2174         int fr;
2175         u_int32_t wsizeb;       /* constant: bits of window size */
2176         int frlast;             /* constant: last frame */
2177
2178         /* sanity check */
2179         if (sav == NULL)
2180                 panic("ipsec_chkreplay: NULL pointer was passed.\n");
2181
2182         replay = sav->replay;
2183
2184         if (replay->wsize == 0)
2185                 return 1;       /* no need to check replay. */
2186
2187         /* constant */
2188         frlast = replay->wsize - 1;
2189         wsizeb = replay->wsize << 3;
2190
2191         /* sequence number of 0 is invalid */
2192         if (seq == 0)
2193                 return 0;
2194
2195         /* first time is always okay */
2196         if (replay->count == 0)
2197                 return 1;
2198
2199         if (seq > replay->lastseq) {
2200                 /* larger sequences are okay */
2201                 return 1;
2202         } else {
2203                 /* seq is equal or less than lastseq. */
2204                 diff = replay->lastseq - seq;
2205
2206                 /* over range to check, i.e. too old or wrapped */
2207                 if (diff >= wsizeb)
2208                         return 0;
2209
2210                 fr = frlast - diff / 8;
2211
2212                 /* this packet already seen ? */
2213                 if ((replay->bitmap)[fr] & (1 << (diff % 8)))
2214                         return 0;
2215
2216                 /* out of order but good */
2217                 return 1;
2218         }
2219 }
2220
2221 /*
2222  * check replay counter whether to update or not.
2223  * OUT: 0:      OK
2224  *      1:      NG
2225  */
2226 int
2227 ipsec_updatereplay(seq, sav)
2228         u_int32_t seq;
2229         struct secasvar *sav;
2230 {
2231         struct secreplay *replay;
2232         u_int32_t diff;
2233         int fr;
2234         u_int32_t wsizeb;       /* constant: bits of window size */
2235         int frlast;             /* constant: last frame */
2236
2237         /* sanity check */
2238         if (sav == NULL)
2239                 panic("ipsec_chkreplay: NULL pointer was passed.\n");
2240
2241         replay = sav->replay;
2242
2243         if (replay->wsize == 0)
2244                 goto ok;        /* no need to check replay. */
2245
2246         /* constant */
2247         frlast = replay->wsize - 1;
2248         wsizeb = replay->wsize << 3;
2249
2250         /* sequence number of 0 is invalid */
2251         if (seq == 0)
2252                 return 1;
2253
2254         /* first time */
2255         if (replay->count == 0) {
2256                 replay->lastseq = seq;
2257                 bzero(replay->bitmap, replay->wsize);
2258                 (replay->bitmap)[frlast] = 1;
2259                 goto ok;
2260         }
2261
2262         if (seq > replay->lastseq) {
2263                 /* seq is larger than lastseq. */
2264                 diff = seq - replay->lastseq;
2265
2266                 /* new larger sequence number */
2267                 if (diff < wsizeb) {
2268                         /* In window */
2269                         /* set bit for this packet */
2270                         vshiftl(replay->bitmap, diff, replay->wsize);
2271                         (replay->bitmap)[frlast] |= 1;
2272                 } else {
2273                         /* this packet has a "way larger" */
2274                         bzero(replay->bitmap, replay->wsize);
2275                         (replay->bitmap)[frlast] = 1;
2276                 }
2277                 replay->lastseq = seq;
2278
2279                 /* larger is good */
2280         } else {
2281                 /* seq is equal or less than lastseq. */
2282                 diff = replay->lastseq - seq;
2283
2284                 /* over range to check, i.e. too old or wrapped */
2285                 if (diff >= wsizeb)
2286                         return 1;
2287
2288                 fr = frlast - diff / 8;
2289
2290                 /* this packet already seen ? */
2291                 if ((replay->bitmap)[fr] & (1 << (diff % 8)))
2292                         return 1;
2293
2294                 /* mark as seen */
2295                 (replay->bitmap)[fr] |= (1 << (diff % 8));
2296
2297                 /* out of order but good */
2298         }
2299
2300 ok:
2301         if (replay->count == ~0) {
2302
2303                 /* set overflow flag */
2304                 replay->overflow++;
2305
2306                 /* don't increment, no more packets accepted */
2307                 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0)
2308                         return 1;
2309
2310                 ipseclog((LOG_WARNING, "replay counter made %d cycle. %s\n",
2311                     replay->overflow, ipsec_logsastr(sav)));
2312         }
2313
2314         replay->count++;
2315
2316         return 0;
2317 }
2318
2319 /*
2320  * shift variable length bunffer to left.
2321  * IN:  bitmap: pointer to the buffer
2322  *      nbit:   the number of to shift.
2323  *      wsize:  buffer size (bytes).
2324  */
2325 static void
2326 vshiftl(bitmap, nbit, wsize)
2327         unsigned char *bitmap;
2328         int nbit, wsize;
2329 {
2330         int s, j, i;
2331         unsigned char over;
2332
2333         for (j = 0; j < nbit; j += 8) {
2334                 s = (nbit - j < 8) ? (nbit - j): 8;
2335                 bitmap[0] <<= s;
2336                 for (i = 1; i < wsize; i++) {
2337                         over = (bitmap[i] >> (8 - s));
2338                         bitmap[i] <<= s;
2339                         bitmap[i-1] |= over;
2340                 }
2341         }
2342
2343         return;
2344 }
2345
2346 const char *
2347 ipsec4_logpacketstr(ip, spi)
2348         struct ip *ip;
2349         u_int32_t spi;
2350 {
2351         static char buf[256];
2352         char *p;
2353         u_int8_t *s, *d;
2354
2355         s = (u_int8_t *)(&ip->ip_src);
2356         d = (u_int8_t *)(&ip->ip_dst);
2357
2358         p = buf;
2359         snprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
2360         while (p && *p)
2361                 p++;
2362         snprintf(p, sizeof(buf) - (p - buf), "src=%u.%u.%u.%u",
2363                 s[0], s[1], s[2], s[3]);
2364         while (p && *p)
2365                 p++;
2366         snprintf(p, sizeof(buf) - (p - buf), " dst=%u.%u.%u.%u",
2367                 d[0], d[1], d[2], d[3]);
2368         while (p && *p)
2369                 p++;
2370         snprintf(p, sizeof(buf) - (p - buf), ")");
2371
2372         return buf;
2373 }
2374
2375 #ifdef INET6
2376 const char *
2377 ipsec6_logpacketstr(ip6, spi)
2378         struct ip6_hdr *ip6;
2379         u_int32_t spi;
2380 {
2381         static char buf[256];
2382         char *p;
2383
2384         p = buf;
2385         snprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
2386         while (p && *p)
2387                 p++;
2388         snprintf(p, sizeof(buf) - (p - buf), "src=%s",
2389                 ip6_sprintf(&ip6->ip6_src));
2390         while (p && *p)
2391                 p++;
2392         snprintf(p, sizeof(buf) - (p - buf), " dst=%s",
2393                 ip6_sprintf(&ip6->ip6_dst));
2394         while (p && *p)
2395                 p++;
2396         snprintf(p, sizeof(buf) - (p - buf), ")");
2397
2398         return buf;
2399 }
2400 #endif /*INET6*/
2401
2402 const char *
2403 ipsec_logsastr(sav)
2404         struct secasvar *sav;
2405 {
2406         static char buf[256];
2407         char *p;
2408         struct secasindex *saidx = &sav->sah->saidx;
2409
2410         /* validity check */
2411         if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2412                         != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family)
2413                 panic("ipsec_logsastr: family mismatched.\n");
2414
2415         p = buf;
2416         snprintf(buf, sizeof(buf), "SA(SPI=%u ", (u_int32_t)ntohl(sav->spi));
2417         while (p && *p)
2418                 p++;
2419         if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET) {
2420                 u_int8_t *s, *d;
2421                 s = (u_int8_t *)&((struct sockaddr_in *)&saidx->src)->sin_addr;
2422                 d = (u_int8_t *)&((struct sockaddr_in *)&saidx->dst)->sin_addr;
2423                 snprintf(p, sizeof(buf) - (p - buf),
2424                         "src=%d.%d.%d.%d dst=%d.%d.%d.%d",
2425                         s[0], s[1], s[2], s[3], d[0], d[1], d[2], d[3]);
2426         }
2427 #ifdef INET6
2428         else if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET6) {
2429                 snprintf(p, sizeof(buf) - (p - buf),
2430                         "src=%s",
2431                         ip6_sprintf(&((struct sockaddr_in6 *)&saidx->src)->sin6_addr));
2432                 while (p && *p)
2433                         p++;
2434                 snprintf(p, sizeof(buf) - (p - buf),
2435                         " dst=%s",
2436                         ip6_sprintf(&((struct sockaddr_in6 *)&saidx->dst)->sin6_addr));
2437         }
2438 #endif
2439         while (p && *p)
2440                 p++;
2441         snprintf(p, sizeof(buf) - (p - buf), ")");
2442
2443         return buf;
2444 }
2445
2446 void
2447 ipsec_dumpmbuf(m)
2448         struct mbuf *m;
2449 {
2450         int totlen;
2451         int i;
2452         u_char *p;
2453
2454         totlen = 0;
2455         printf("---\n");
2456         while (m) {
2457                 p = mtod(m, u_char *);
2458                 for (i = 0; i < m->m_len; i++) {
2459                         printf("%02x ", p[i]);
2460                         totlen++;
2461                         if (totlen % 16 == 0)
2462                                 printf("\n");
2463                 }
2464                 m = m->m_next;
2465         }
2466         if (totlen % 16 != 0)
2467                 printf("\n");
2468         printf("---\n");
2469 }
2470
2471 #ifdef INET
2472 /*
2473  * IPsec output logic for IPv4.
2474  */
2475 int
2476 ipsec4_output(state, sp, flags)
2477         struct ipsec_output_state *state;
2478         struct secpolicy *sp;
2479         int flags;
2480 {
2481         struct ip *ip = NULL;
2482         struct ipsecrequest *isr = NULL;
2483         struct secasindex saidx;
2484         int s;
2485         int error;
2486         struct sockaddr_in *dst4;
2487         struct sockaddr_in *sin;
2488
2489         if (!state)
2490                 panic("state == NULL in ipsec4_output");
2491         if (!state->m)
2492                 panic("state->m == NULL in ipsec4_output");
2493         if (!state->ro)
2494                 panic("state->ro == NULL in ipsec4_output");
2495         if (!state->dst)
2496                 panic("state->dst == NULL in ipsec4_output");
2497
2498         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2499                 printf("ipsec4_output: applyed SP\n");
2500                 kdebug_secpolicy(sp));
2501
2502         for (isr = sp->req; isr != NULL; isr = isr->next) {
2503
2504 #if 0   /* give up to check restriction of transport mode */
2505         /* XXX but should be checked somewhere */
2506                 /*
2507                  * some of the IPsec operation must be performed only in
2508                  * originating case.
2509                  */
2510                 if (isr->saidx.mode == IPSEC_MODE_TRANSPORT
2511                  && (flags & IP_FORWARDING))
2512                         continue;
2513 #endif
2514
2515                 /* make SA index for search proper SA */
2516                 ip = mtod(state->m, struct ip *);
2517                 bcopy(&isr->saidx, &saidx, sizeof(saidx));
2518                 saidx.mode = isr->saidx.mode;
2519                 saidx.reqid = isr->saidx.reqid;
2520                 sin = (struct sockaddr_in *)&saidx.src;
2521                 if (sin->sin_len == 0) {
2522                         sin->sin_len = sizeof(*sin);
2523                         sin->sin_family = AF_INET;
2524                         sin->sin_port = IPSEC_PORT_ANY;
2525                         bcopy(&ip->ip_src, &sin->sin_addr,
2526                             sizeof(sin->sin_addr));
2527                 }
2528                 sin = (struct sockaddr_in *)&saidx.dst;
2529                 if (sin->sin_len == 0) {
2530                         sin->sin_len = sizeof(*sin);
2531                         sin->sin_family = AF_INET;
2532                         sin->sin_port = IPSEC_PORT_ANY;
2533                         bcopy(&ip->ip_dst, &sin->sin_addr,
2534                             sizeof(sin->sin_addr));
2535                 }
2536
2537                 if ((error = key_checkrequest(isr, &saidx)) != 0) {
2538                         /*
2539                          * IPsec processing is required, but no SA found.
2540                          * I assume that key_acquire() had been called
2541                          * to get/establish the SA. Here I discard
2542                          * this packet because it is responsibility for
2543                          * upper layer to retransmit the packet.
2544                          */
2545                         ipsecstat.out_nosa++;
2546                         goto bad;
2547                 }
2548
2549                 /* validity check */
2550                 if (isr->sav == NULL) {
2551                         switch (ipsec_get_reqlevel(isr)) {
2552                         case IPSEC_LEVEL_USE:
2553                                 continue;
2554                         case IPSEC_LEVEL_REQUIRE:
2555                                 /* must be not reached here. */
2556                                 panic("ipsec4_output: no SA found, but required.");
2557                         }
2558                 }
2559
2560                 /*
2561                  * If there is no valid SA, we give up to process any
2562                  * more.  In such a case, the SA's status is changed
2563                  * from DYING to DEAD after allocating.  If a packet
2564                  * send to the receiver by dead SA, the receiver can
2565                  * not decode a packet because SA has been dead.
2566                  */
2567                 if (isr->sav->state != SADB_SASTATE_MATURE
2568                  && isr->sav->state != SADB_SASTATE_DYING) {
2569                         ipsecstat.out_nosa++;
2570                         error = EINVAL;
2571                         goto bad;
2572                 }
2573
2574                 /*
2575                  * There may be the case that SA status will be changed when
2576                  * we are refering to one. So calling splsoftnet().
2577                  */
2578                 s = splnet();
2579
2580                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2581                         /*
2582                          * build IPsec tunnel.
2583                          */
2584                         /* XXX should be processed with other familiy */
2585                         if (((struct sockaddr *)&isr->sav->sah->saidx.src)->sa_family != AF_INET) {
2586                                 ipseclog((LOG_ERR, "ipsec4_output: "
2587                                     "family mismatched between inner and outer spi=%u\n",
2588                                     (u_int32_t)ntohl(isr->sav->spi)));
2589                                 splx(s);
2590                                 error = EAFNOSUPPORT;
2591                                 goto bad;
2592                         }
2593
2594                         state->m = ipsec4_splithdr(state->m);
2595                         if (!state->m) {
2596                                 splx(s);
2597                                 error = ENOMEM;
2598                                 goto bad;
2599                         }
2600                         error = ipsec4_encapsulate(state->m, isr->sav);
2601                         splx(s);
2602                         if (error) {
2603                                 state->m = NULL;
2604                                 goto bad;
2605                         }
2606                         ip = mtod(state->m, struct ip *);
2607
2608                         state->ro = &isr->sav->sah->sa_route;
2609                         state->dst = (struct sockaddr *)&state->ro->ro_dst;
2610                         dst4 = (struct sockaddr_in *)state->dst;
2611                         if (state->ro->ro_rt
2612                          && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
2613                           || dst4->sin_addr.s_addr != ip->ip_dst.s_addr)) {
2614                                 RTFREE(state->ro->ro_rt);
2615                                 state->ro->ro_rt = NULL;
2616                         }
2617                         if (state->ro->ro_rt == 0) {
2618                                 dst4->sin_family = AF_INET;
2619                                 dst4->sin_len = sizeof(*dst4);
2620                                 dst4->sin_addr = ip->ip_dst;
2621                                 rtalloc(state->ro);
2622                         }
2623                         if (state->ro->ro_rt == 0) {
2624                                 ipstat.ips_noroute++;
2625                                 error = EHOSTUNREACH;
2626                                 goto bad;
2627                         }
2628
2629                         /* adjust state->dst if tunnel endpoint is offlink */
2630                         if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
2631                                 state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
2632                                 dst4 = (struct sockaddr_in *)state->dst;
2633                         }
2634                 } else
2635                         splx(s);
2636
2637                 state->m = ipsec4_splithdr(state->m);
2638                 if (!state->m) {
2639                         error = ENOMEM;
2640                         goto bad;
2641                 }
2642                 switch (isr->saidx.proto) {
2643                 case IPPROTO_ESP:
2644 #ifdef IPSEC_ESP
2645                         if ((error = esp4_output(state->m, isr)) != 0) {
2646                                 state->m = NULL;
2647                                 goto bad;
2648                         }
2649                         break;
2650 #else
2651                         m_freem(state->m);
2652                         state->m = NULL;
2653                         error = EINVAL;
2654                         goto bad;
2655 #endif
2656                 case IPPROTO_AH:
2657                         if ((error = ah4_output(state->m, isr)) != 0) {
2658                                 state->m = NULL;
2659                                 goto bad;
2660                         }
2661                         break;
2662                 case IPPROTO_IPCOMP:
2663                         if ((error = ipcomp4_output(state->m, isr)) != 0) {
2664                                 state->m = NULL;
2665                                 goto bad;
2666                         }
2667                         break;
2668                 default:
2669                         ipseclog((LOG_ERR,
2670                             "ipsec4_output: unknown ipsec protocol %d\n",
2671                             isr->saidx.proto));
2672                         m_freem(state->m);
2673                         state->m = NULL;
2674                         error = EINVAL;
2675                         goto bad;
2676                 }
2677
2678                 if (state->m == 0) {
2679                         error = ENOMEM;
2680                         goto bad;
2681                 }
2682                 ip = mtod(state->m, struct ip *);
2683         }
2684
2685         return 0;
2686
2687 bad:
2688         m_freem(state->m);
2689         state->m = NULL;
2690         return error;
2691 }
2692 #endif
2693
2694 #ifdef INET6
2695 /*
2696  * IPsec output logic for IPv6, transport mode.
2697  */
2698 int
2699 ipsec6_output_trans(state, nexthdrp, mprev, sp, flags, tun)
2700         struct ipsec_output_state *state;
2701         u_char *nexthdrp;
2702         struct mbuf *mprev;
2703         struct secpolicy *sp;
2704         int flags;
2705         int *tun;
2706 {
2707         struct ip6_hdr *ip6;
2708         struct ipsecrequest *isr = NULL;
2709         struct secasindex saidx;
2710         int error = 0;
2711         int plen;
2712         struct sockaddr_in6 *sin6;
2713
2714         if (!state)
2715                 panic("state == NULL in ipsec6_output");
2716         if (!state->m)
2717                 panic("state->m == NULL in ipsec6_output");
2718         if (!nexthdrp)
2719                 panic("nexthdrp == NULL in ipsec6_output");
2720         if (!mprev)
2721                 panic("mprev == NULL in ipsec6_output");
2722         if (!sp)
2723                 panic("sp == NULL in ipsec6_output");
2724         if (!tun)
2725                 panic("tun == NULL in ipsec6_output");
2726
2727         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2728                 printf("ipsec6_output_trans: applyed SP\n");
2729                 kdebug_secpolicy(sp));
2730
2731         *tun = 0;
2732         for (isr = sp->req; isr; isr = isr->next) {
2733                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2734                         /* the rest will be handled by ipsec6_output_tunnel() */
2735                         break;
2736                 }
2737
2738                 /* make SA index for search proper SA */
2739                 ip6 = mtod(state->m, struct ip6_hdr *);
2740                 bcopy(&isr->saidx, &saidx, sizeof(saidx));
2741                 saidx.mode = isr->saidx.mode;
2742                 saidx.reqid = isr->saidx.reqid;
2743                 sin6 = (struct sockaddr_in6 *)&saidx.src;
2744                 if (sin6->sin6_len == 0) {
2745                         sin6->sin6_len = sizeof(*sin6);
2746                         sin6->sin6_family = AF_INET6;
2747                         sin6->sin6_port = IPSEC_PORT_ANY;
2748                         bcopy(&ip6->ip6_src, &sin6->sin6_addr,
2749                             sizeof(ip6->ip6_src));
2750                         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
2751                                 /* fix scope id for comparing SPD */
2752                                 sin6->sin6_addr.s6_addr16[1] = 0;
2753                                 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
2754                         }
2755                 }
2756                 sin6 = (struct sockaddr_in6 *)&saidx.dst;
2757                 if (sin6->sin6_len == 0) {
2758                         sin6->sin6_len = sizeof(*sin6);
2759                         sin6->sin6_family = AF_INET6;
2760                         sin6->sin6_port = IPSEC_PORT_ANY;
2761                         bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
2762                             sizeof(ip6->ip6_dst));
2763                         if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
2764                                 /* fix scope id for comparing SPD */
2765                                 sin6->sin6_addr.s6_addr16[1] = 0;
2766                                 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
2767                         }
2768                 }
2769
2770                 if (key_checkrequest(isr, &saidx) == ENOENT) {
2771                         /*
2772                          * IPsec processing is required, but no SA found.
2773                          * I assume that key_acquire() had been called
2774                          * to get/establish the SA. Here I discard
2775                          * this packet because it is responsibility for
2776                          * upper layer to retransmit the packet.
2777                          */
2778                         ipsec6stat.out_nosa++;
2779                         error = ENOENT;
2780
2781                         /*
2782                          * Notify the fact that the packet is discarded
2783                          * to ourselves. I believe this is better than
2784                          * just silently discarding. (jinmei@kame.net)
2785                          * XXX: should we restrict the error to TCP packets?
2786                          * XXX: should we directly notify sockets via
2787                          *      pfctlinputs?
2788                          */
2789                         icmp6_error(state->m, ICMP6_DST_UNREACH,
2790                                     ICMP6_DST_UNREACH_ADMIN, 0);
2791                         state->m = NULL; /* icmp6_error freed the mbuf */
2792                         goto bad;
2793                 }
2794
2795                 /* validity check */
2796                 if (isr->sav == NULL) {
2797                         switch (ipsec_get_reqlevel(isr)) {
2798                         case IPSEC_LEVEL_USE:
2799                                 continue;
2800                         case IPSEC_LEVEL_REQUIRE:
2801                                 /* must be not reached here. */
2802                                 panic("ipsec6_output_trans: no SA found, but required.");
2803                         }
2804                 }
2805
2806                 /*
2807                  * If there is no valid SA, we give up to process.
2808                  * see same place at ipsec4_output().
2809                  */
2810                 if (isr->sav->state != SADB_SASTATE_MATURE
2811                  && isr->sav->state != SADB_SASTATE_DYING) {
2812                         ipsec6stat.out_nosa++;
2813                         error = EINVAL;
2814                         goto bad;
2815                 }
2816
2817                 switch (isr->saidx.proto) {
2818                 case IPPROTO_ESP:
2819 #ifdef IPSEC_ESP
2820                         error = esp6_output(state->m, nexthdrp, mprev->m_next, isr);
2821 #else
2822                         m_freem(state->m);
2823                         error = EINVAL;
2824 #endif
2825                         break;
2826                 case IPPROTO_AH:
2827                         error = ah6_output(state->m, nexthdrp, mprev->m_next, isr);
2828                         break;
2829                 case IPPROTO_IPCOMP:
2830                         error = ipcomp6_output(state->m, nexthdrp, mprev->m_next, isr);
2831                         break;
2832                 default:
2833                         ipseclog((LOG_ERR, "ipsec6_output_trans: "
2834                             "unknown ipsec protocol %d\n", isr->saidx.proto));
2835                         m_freem(state->m);
2836                         ipsec6stat.out_inval++;
2837                         error = EINVAL;
2838                         break;
2839                 }
2840                 if (error) {
2841                         state->m = NULL;
2842                         goto bad;
2843                 }
2844                 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
2845                 if (plen > IPV6_MAXPACKET) {
2846                         ipseclog((LOG_ERR, "ipsec6_output_trans: "
2847                             "IPsec with IPv6 jumbogram is not supported\n"));
2848                         ipsec6stat.out_inval++;
2849                         error = EINVAL; /*XXX*/
2850                         goto bad;
2851                 }
2852                 ip6 = mtod(state->m, struct ip6_hdr *);
2853                 ip6->ip6_plen = htons(plen);
2854         }
2855
2856         /* if we have more to go, we need a tunnel mode processing */
2857         if (isr != NULL)
2858                 *tun = 1;
2859
2860         return 0;
2861
2862 bad:
2863         m_freem(state->m);
2864         state->m = NULL;
2865         return error;
2866 }
2867
2868 /*
2869  * IPsec output logic for IPv6, tunnel mode.
2870  */
2871 int
2872 ipsec6_output_tunnel(state, sp, flags)
2873         struct ipsec_output_state *state;
2874         struct secpolicy *sp;
2875         int flags;
2876 {
2877         struct ip6_hdr *ip6;
2878         struct ipsecrequest *isr = NULL;
2879         struct secasindex saidx;
2880         int error = 0;
2881         int plen;
2882         struct sockaddr_in6* dst6;
2883         int s;
2884
2885         if (!state)
2886                 panic("state == NULL in ipsec6_output");
2887         if (!state->m)
2888                 panic("state->m == NULL in ipsec6_output");
2889         if (!sp)
2890                 panic("sp == NULL in ipsec6_output");
2891
2892         KEYDEBUG(KEYDEBUG_IPSEC_DATA,
2893                 printf("ipsec6_output_tunnel: applyed SP\n");
2894                 kdebug_secpolicy(sp));
2895
2896         /*
2897          * transport mode ipsec (before the 1st tunnel mode) is already
2898          * processed by ipsec6_output_trans().
2899          */
2900         for (isr = sp->req; isr; isr = isr->next) {
2901                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
2902                         break;
2903         }
2904
2905         for (/* already initialized */; isr; isr = isr->next) {
2906                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2907                         /* When tunnel mode, SA peers must be specified. */
2908                         bcopy(&isr->saidx, &saidx, sizeof(saidx));
2909                 } else {
2910                         /* make SA index to look for a proper SA */
2911                         struct sockaddr_in6 *sin6;
2912
2913                         bzero(&saidx, sizeof(saidx));
2914                         saidx.proto = isr->saidx.proto;
2915                         saidx.mode = isr->saidx.mode;
2916                         saidx.reqid = isr->saidx.reqid;
2917
2918                         ip6 = mtod(state->m, struct ip6_hdr *);
2919                         sin6 = (struct sockaddr_in6 *)&saidx.src;
2920                         if (sin6->sin6_len == 0) {
2921                                 sin6->sin6_len = sizeof(*sin6);
2922                                 sin6->sin6_family = AF_INET6;
2923                                 sin6->sin6_port = IPSEC_PORT_ANY;
2924                                 bcopy(&ip6->ip6_src, &sin6->sin6_addr,
2925                                     sizeof(ip6->ip6_src));
2926                                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
2927                                         /* fix scope id for comparing SPD */
2928                                         sin6->sin6_addr.s6_addr16[1] = 0;
2929                                         sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
2930                                 }
2931                         }
2932                         sin6 = (struct sockaddr_in6 *)&saidx.dst;
2933                         if (sin6->sin6_len == 0) {
2934                                 sin6->sin6_len = sizeof(*sin6);
2935                                 sin6->sin6_family = AF_INET6;
2936                                 sin6->sin6_port = IPSEC_PORT_ANY;
2937                                 bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
2938                                     sizeof(ip6->ip6_dst));
2939                                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
2940                                         /* fix scope id for comparing SPD */
2941                                         sin6->sin6_addr.s6_addr16[1] = 0;
2942                                         sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
2943                                 }
2944                         }
2945                 }
2946
2947                 if (key_checkrequest(isr, &saidx) == ENOENT) {
2948                         /*
2949                          * IPsec processing is required, but no SA found.
2950                          * I assume that key_acquire() had been called
2951                          * to get/establish the SA. Here I discard
2952                          * this packet because it is responsibility for
2953                          * upper layer to retransmit the packet.
2954                          */
2955                         ipsec6stat.out_nosa++;
2956                         error = ENOENT;
2957                         goto bad;
2958                 }
2959
2960                 /* validity check */
2961                 if (isr->sav == NULL) {
2962                         switch (ipsec_get_reqlevel(isr)) {
2963                         case IPSEC_LEVEL_USE:
2964                                 continue;
2965                         case IPSEC_LEVEL_REQUIRE:
2966                                 /* must be not reached here. */
2967                                 panic("ipsec6_output_tunnel: no SA found, but required.");
2968                         }
2969                 }
2970
2971                 /*
2972                  * If there is no valid SA, we give up to process.
2973                  * see same place at ipsec4_output().
2974                  */
2975                 if (isr->sav->state != SADB_SASTATE_MATURE
2976                  && isr->sav->state != SADB_SASTATE_DYING) {
2977                         ipsec6stat.out_nosa++;
2978                         error = EINVAL;
2979                         goto bad;
2980                 }
2981
2982                 /*
2983                  * There may be the case that SA status will be changed when
2984                  * we are refering to one. So calling splsoftnet().
2985                  */
2986                 s = splnet();
2987
2988                 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2989                         /*
2990                          * build IPsec tunnel.
2991                          */
2992                         /* XXX should be processed with other familiy */
2993                         if (((struct sockaddr *)&isr->sav->sah->saidx.src)->sa_family != AF_INET6) {
2994                                 ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
2995                                     "family mismatched between inner and outer, spi=%u\n",
2996                                     (u_int32_t)ntohl(isr->sav->spi)));
2997                                 splx(s);
2998                                 ipsec6stat.out_inval++;
2999                                 error = EAFNOSUPPORT;
3000                                 goto bad;
3001                         }
3002
3003                         state->m = ipsec6_splithdr(state->m);
3004                         if (!state->m) {
3005                                 splx(s);
3006                                 ipsec6stat.out_nomem++;
3007                                 error = ENOMEM;
3008                                 goto bad;
3009                         }
3010                         error = ipsec6_encapsulate(state->m, isr->sav);
3011                         splx(s);
3012                         if (error) {
3013                                 state->m = 0;
3014                                 goto bad;
3015                         }
3016                         ip6 = mtod(state->m, struct ip6_hdr *);
3017
3018                         state->ro = &isr->sav->sah->sa_route;
3019                         state->dst = (struct sockaddr *)&state->ro->ro_dst;
3020                         dst6 = (struct sockaddr_in6 *)state->dst;
3021                         if (state->ro->ro_rt
3022                          && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
3023                           || !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst))) {
3024                                 RTFREE(state->ro->ro_rt);
3025                                 state->ro->ro_rt = NULL;
3026                         }
3027                         if (state->ro->ro_rt == 0) {
3028                                 bzero(dst6, sizeof(*dst6));
3029                                 dst6->sin6_family = AF_INET6;
3030                                 dst6->sin6_len = sizeof(*dst6);
3031                                 dst6->sin6_addr = ip6->ip6_dst;
3032                                 rtalloc(state->ro);
3033                         }
3034                         if (state->ro->ro_rt == 0) {
3035                                 ip6stat.ip6s_noroute++;
3036                                 ipsec6stat.out_noroute++;
3037                                 error = EHOSTUNREACH;
3038                                 goto bad;
3039                         }
3040
3041                         /* adjust state->dst if tunnel endpoint is offlink */
3042                         if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
3043                                 state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
3044                                 dst6 = (struct sockaddr_in6 *)state->dst;
3045                         }
3046                 } else
3047                         splx(s);
3048
3049                 state->m = ipsec6_splithdr(state->m);
3050                 if (!state->m) {
3051                         ipsec6stat.out_nomem++;
3052                         error = ENOMEM;
3053                         goto bad;
3054                 }
3055                 ip6 = mtod(state->m, struct ip6_hdr *);
3056                 switch (isr->saidx.proto) {
3057                 case IPPROTO_ESP:
3058 #ifdef IPSEC_ESP
3059                         error = esp6_output(state->m, &ip6->ip6_nxt, state->m->m_next, isr);
3060 #else
3061                         m_freem(state->m);
3062                         error = EINVAL;
3063 #endif
3064                         break;
3065                 case IPPROTO_AH:
3066                         error = ah6_output(state->m, &ip6->ip6_nxt, state->m->m_next, isr);
3067                         break;
3068                 case IPPROTO_IPCOMP:
3069                         /* XXX code should be here */
3070                         /*FALLTHROUGH*/
3071                 default:
3072                         ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
3073                             "unknown ipsec protocol %d\n", isr->saidx.proto));
3074                         m_freem(state->m);
3075                         ipsec6stat.out_inval++;
3076                         error = EINVAL;
3077                         break;
3078                 }
3079                 if (error) {
3080                         state->m = NULL;
3081                         goto bad;
3082                 }
3083                 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
3084                 if (plen > IPV6_MAXPACKET) {
3085                         ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
3086                             "IPsec with IPv6 jumbogram is not supported\n"));
3087                         ipsec6stat.out_inval++;
3088                         error = EINVAL; /*XXX*/
3089                         goto bad;
3090                 }
3091                 ip6 = mtod(state->m, struct ip6_hdr *);
3092                 ip6->ip6_plen = htons(plen);
3093         }
3094
3095         return 0;
3096
3097 bad:
3098         m_freem(state->m);
3099         state->m = NULL;
3100         return error;
3101 }
3102 #endif /*INET6*/
3103
3104 #ifdef INET
3105 /*
3106  * Chop IP header and option off from the payload.
3107  */
3108 static struct mbuf *
3109 ipsec4_splithdr(m)
3110         struct mbuf *m;
3111 {
3112         struct mbuf *mh;
3113         struct ip *ip;
3114         int hlen;
3115
3116         if (m->m_len < sizeof(struct ip))
3117                 panic("ipsec4_splithdr: first mbuf too short");
3118         ip = mtod(m, struct ip *);
3119 #ifdef _IP_VHL
3120         hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
3121 #else
3122         hlen = ip->ip_hl << 2;
3123 #endif
3124         if (m->m_len > hlen) {
3125                 MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3126                 if (!mh) {
3127                         m_freem(m);
3128                         return NULL;
3129                 }
3130                 M_COPY_PKTHDR(mh, m);
3131                 MH_ALIGN(mh, hlen);
3132                 m->m_flags &= ~M_PKTHDR;
3133                 m->m_len -= hlen;
3134                 m->m_data += hlen;
3135                 mh->m_next = m;
3136                 m = mh;
3137                 m->m_len = hlen;
3138                 bcopy((caddr_t)ip, mtod(m, caddr_t), hlen);
3139         } else if (m->m_len < hlen) {
3140                 m = m_pullup(m, hlen);
3141                 if (!m)
3142                         return NULL;
3143         }
3144         return m;
3145 }
3146 #endif
3147
3148 #ifdef INET6
3149 static struct mbuf *
3150 ipsec6_splithdr(m)
3151         struct mbuf *m;
3152 {
3153         struct mbuf *mh;
3154         struct ip6_hdr *ip6;
3155         int hlen;
3156
3157         if (m->m_len < sizeof(struct ip6_hdr))
3158                 panic("ipsec6_splithdr: first mbuf too short");
3159         ip6 = mtod(m, struct ip6_hdr *);
3160         hlen = sizeof(struct ip6_hdr);
3161         if (m->m_len > hlen) {
3162                 MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3163                 if (!mh) {
3164                         m_freem(m);
3165                         return NULL;
3166                 }
3167                 M_COPY_PKTHDR(mh, m);
3168                 MH_ALIGN(mh, hlen);
3169                 m->m_flags &= ~M_PKTHDR;
3170                 m->m_len -= hlen;
3171                 m->m_data += hlen;
3172                 mh->m_next = m;
3173                 m = mh;
3174                 m->m_len = hlen;
3175                 bcopy((caddr_t)ip6, mtod(m, caddr_t), hlen);
3176         } else if (m->m_len < hlen) {
3177                 m = m_pullup(m, hlen);
3178                 if (!m)
3179                         return NULL;
3180         }
3181         return m;
3182 }
3183 #endif
3184
3185 /* validate inbound IPsec tunnel packet. */
3186 int
3187 ipsec4_tunnel_validate(m, off, nxt0, sav)
3188         struct mbuf *m;         /* no pullup permitted, m->m_len >= ip */
3189         int off;
3190         u_int nxt0;
3191         struct secasvar *sav;
3192 {
3193         u_int8_t nxt = nxt0 & 0xff;
3194         struct sockaddr_in *sin;
3195         struct sockaddr_in osrc, odst, isrc, idst;
3196         int hlen;
3197         struct secpolicy *sp;
3198         struct ip *oip;
3199
3200 #ifdef DIAGNOSTIC
3201         if (m->m_len < sizeof(struct ip))
3202                 panic("too short mbuf on ipsec4_tunnel_validate");
3203 #endif
3204         if (nxt != IPPROTO_IPV4)
3205                 return 0;
3206         if (m->m_pkthdr.len < off + sizeof(struct ip))
3207                 return 0;
3208         /* do not decapsulate if the SA is for transport mode only */
3209         if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
3210                 return 0;
3211
3212         oip = mtod(m, struct ip *);
3213 #ifdef _IP_VHL
3214         hlen = _IP_VHL_HL(oip->ip_vhl) << 2;
3215 #else
3216         hlen = oip->ip_hl << 2;
3217 #endif
3218         if (hlen != sizeof(struct ip))
3219                 return 0;
3220
3221         /* AF_INET6 should be supported, but at this moment we don't. */
3222         sin = (struct sockaddr_in *)&sav->sah->saidx.dst;
3223         if (sin->sin_family != AF_INET)
3224                 return 0;
3225         if (bcmp(&oip->ip_dst, &sin->sin_addr, sizeof(oip->ip_dst)) != 0)
3226                 return 0;
3227
3228         /* XXX slow */
3229         bzero(&osrc, sizeof(osrc));
3230         bzero(&odst, sizeof(odst));
3231         bzero(&isrc, sizeof(isrc));
3232         bzero(&idst, sizeof(idst));
3233         osrc.sin_family = odst.sin_family = isrc.sin_family = idst.sin_family =
3234             AF_INET;
3235         osrc.sin_len = odst.sin_len = isrc.sin_len = idst.sin_len =
3236             sizeof(struct sockaddr_in);
3237         osrc.sin_addr = oip->ip_src;
3238         odst.sin_addr = oip->ip_dst;
3239         m_copydata(m, off + offsetof(struct ip, ip_src), sizeof(isrc.sin_addr),
3240             (caddr_t)&isrc.sin_addr);
3241         m_copydata(m, off + offsetof(struct ip, ip_dst), sizeof(idst.sin_addr),
3242             (caddr_t)&idst.sin_addr);
3243
3244         /*
3245          * RFC2401 5.2.1 (b): (assume that we are using tunnel mode)
3246          * - if the inner destination is multicast address, there can be
3247          *   multiple permissible inner source address.  implementation
3248          *   may want to skip verification of inner source address against
3249          *   SPD selector.
3250          * - if the inner protocol is ICMP, the packet may be an error report
3251          *   from routers on the other side of the VPN cloud (R in the
3252          *   following diagram).  in this case, we cannot verify inner source
3253          *   address against SPD selector.
3254          *      me -- gw === gw -- R -- you
3255          *
3256          * we consider the first bullet to be users responsibility on SPD entry
3257          * configuration (if you need to encrypt multicast traffic, set
3258          * the source range of SPD selector to 0.0.0.0/0, or have explicit
3259          * address ranges for possible senders).
3260          * the second bullet is not taken care of (yet).
3261          *
3262          * therefore, we do not do anything special about inner source.
3263          */
3264
3265         sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
3266             (struct sockaddr *)&isrc, (struct sockaddr *)&idst);
3267         if (!sp)
3268                 return 0;
3269         key_freesp(sp);
3270
3271         return 1;
3272 }
3273
3274 #ifdef INET6
3275 /* validate inbound IPsec tunnel packet. */
3276 int
3277 ipsec6_tunnel_validate(m, off, nxt0, sav)
3278         struct mbuf *m;         /* no pullup permitted, m->m_len >= ip */
3279         int off;
3280         u_int nxt0;
3281         struct secasvar *sav;
3282 {
3283         u_int8_t nxt = nxt0 & 0xff;
3284         struct sockaddr_in6 *sin6;
3285         struct sockaddr_in6 osrc, odst, isrc, idst;
3286         struct secpolicy *sp;
3287         struct ip6_hdr *oip6;
3288
3289 #ifdef DIAGNOSTIC
3290         if (m->m_len < sizeof(struct ip6_hdr))
3291                 panic("too short mbuf on ipsec6_tunnel_validate");
3292 #endif
3293         if (nxt != IPPROTO_IPV6)
3294                 return 0;
3295         if (m->m_pkthdr.len < off + sizeof(struct ip6_hdr))
3296                 return 0;
3297         /* do not decapsulate if the SA is for transport mode only */
3298         if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
3299                 return 0;
3300
3301         oip6 = mtod(m, struct ip6_hdr *);
3302         /* AF_INET should be supported, but at this moment we don't. */
3303         sin6 = (struct sockaddr_in6 *)&sav->sah->saidx.dst;
3304         if (sin6->sin6_family != AF_INET6)
3305                 return 0;
3306         if (!IN6_ARE_ADDR_EQUAL(&oip6->ip6_dst, &sin6->sin6_addr))
3307                 return 0;
3308
3309         /* XXX slow */
3310         bzero(&osrc, sizeof(osrc));
3311         bzero(&odst, sizeof(odst));
3312         bzero(&isrc, sizeof(isrc));
3313         bzero(&idst, sizeof(idst));
3314         osrc.sin6_family = odst.sin6_family = isrc.sin6_family =
3315             idst.sin6_family = AF_INET6;
3316         osrc.sin6_len = odst.sin6_len = isrc.sin6_len = idst.sin6_len =
3317             sizeof(struct sockaddr_in6);
3318         osrc.sin6_addr = oip6->ip6_src;
3319         odst.sin6_addr = oip6->ip6_dst;
3320         m_copydata(m, off + offsetof(struct ip6_hdr, ip6_src),
3321             sizeof(isrc.sin6_addr), (caddr_t)&isrc.sin6_addr);
3322         m_copydata(m, off + offsetof(struct ip6_hdr, ip6_dst),
3323             sizeof(idst.sin6_addr), (caddr_t)&idst.sin6_addr);
3324
3325         /*
3326          * regarding to inner source address validation, see a long comment
3327          * in ipsec4_tunnel_validate.
3328          */
3329
3330         sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
3331             (struct sockaddr *)&isrc, (struct sockaddr *)&idst);
3332         /*
3333          * when there is no suitable inbound policy for the packet of the ipsec
3334          * tunnel mode, the kernel never decapsulate the tunneled packet
3335          * as the ipsec tunnel mode even when the system wide policy is "none".
3336          * then the kernel leaves the generic tunnel module to process this
3337          * packet.  if there is no rule of the generic tunnel, the packet
3338          * is rejected and the statistics will be counted up.
3339          */
3340         if (!sp)
3341                 return 0;
3342         key_freesp(sp);
3343
3344         return 1;
3345 }
3346 #endif
3347
3348 /*
3349  * Make a mbuf chain for encryption.
3350  * If the original mbuf chain contains a mbuf with a cluster,
3351  * allocate a new cluster and copy the data to the new cluster.
3352  * XXX: this hack is inefficient, but is necessary to handle cases
3353  * of TCP retransmission...
3354  */
3355 struct mbuf *
3356 ipsec_copypkt(m)
3357         struct mbuf *m;
3358 {
3359         struct mbuf *n, **mpp, *mnew;
3360
3361         for (n = m, mpp = &m; n; n = n->m_next) {
3362                 if (n->m_flags & M_EXT) {
3363                         /*
3364                          * Make a copy only if there are more than one
3365                          * references to the cluster.
3366                          * XXX: is this approach effective?
3367                          */
3368                         if (n->m_ext.ext_type != EXT_CLUSTER || MEXT_IS_REF(n))
3369                         {
3370                                 int remain, copied;
3371                                 struct mbuf *mm;
3372
3373                                 if (n->m_flags & M_PKTHDR) {
3374                                         MGETHDR(mnew, M_DONTWAIT, MT_HEADER);
3375                                         if (mnew == NULL)
3376                                                 goto fail;
3377                                         mnew->m_pkthdr = n->m_pkthdr;
3378 #if 0
3379                                         if (n->m_pkthdr.aux) {
3380                                                 mnew->m_pkthdr.aux =
3381                                                     m_copym(n->m_pkthdr.aux,
3382                                                     0, M_COPYALL, M_DONTWAIT);
3383                                         }
3384 #endif
3385                                         M_COPY_PKTHDR(mnew, n);
3386                                         mnew->m_flags = n->m_flags & M_COPYFLAGS;
3387                                 }
3388                                 else {
3389                                         MGET(mnew, M_DONTWAIT, MT_DATA);
3390                                         if (mnew == NULL)
3391                                                 goto fail;
3392                                 }
3393                                 mnew->m_len = 0;
3394                                 mm = mnew;
3395
3396                                 /*
3397                                  * Copy data. If we don't have enough space to
3398                                  * store the whole data, allocate a cluster
3399                                  * or additional mbufs.
3400                                  * XXX: we don't use m_copyback(), since the
3401                                  * function does not use clusters and thus is
3402                                  * inefficient.
3403                                  */
3404                                 remain = n->m_len;
3405                                 copied = 0;
3406                                 while (1) {
3407                                         int len;
3408                                         struct mbuf *mn;
3409
3410                                         if (remain <= (mm->m_flags & M_PKTHDR ? MHLEN : MLEN))
3411                                                 len = remain;
3412                                         else { /* allocate a cluster */
3413                                                 MCLGET(mm, M_DONTWAIT);
3414                                                 if (!(mm->m_flags & M_EXT)) {
3415                                                         m_free(mm);
3416                                                         goto fail;
3417                                                 }
3418                                                 len = remain < MCLBYTES ?
3419                                                         remain : MCLBYTES;
3420                                         }
3421
3422                                         bcopy(n->m_data + copied, mm->m_data,
3423                                               len);
3424
3425                                         copied += len;
3426                                         remain -= len;
3427                                         mm->m_len = len;
3428
3429                                         if (remain <= 0) /* completed? */
3430                                                 break;
3431
3432                                         /* need another mbuf */
3433                                         MGETHDR(mn, M_DONTWAIT, MT_HEADER);
3434                                         if (mn == NULL)
3435                                                 goto fail;
3436                                         mn->m_pkthdr.rcvif = NULL;
3437                                         mm->m_next = mn;
3438                                         mm = mn;
3439                                 }
3440
3441                                 /* adjust chain */
3442                                 mm->m_next = m_free(n);
3443                                 n = mm;
3444                                 *mpp = mnew;
3445                                 mpp = &n->m_next;
3446
3447                                 continue;
3448                         }
3449                 }
3450                 *mpp = n;
3451                 mpp = &n->m_next;
3452         }
3453
3454         return(m);
3455   fail:
3456         m_freem(m);
3457         return(NULL);
3458 }
3459
3460 static struct mbuf *
3461 ipsec_addaux(m)
3462         struct mbuf *m;
3463 {
3464         struct mbuf *n;
3465
3466         n = m_aux_find(m, AF_INET, IPPROTO_ESP);
3467         if (!n)
3468                 n = m_aux_add(m, AF_INET, IPPROTO_ESP);
3469         if (!n)
3470                 return n;       /* ENOBUFS */
3471         n->m_len = sizeof(struct socket *);
3472         bzero(mtod(n, void *), n->m_len);
3473         return n;
3474 }
3475
3476 static struct mbuf *
3477 ipsec_findaux(m)
3478         struct mbuf *m;
3479 {
3480         struct mbuf *n;
3481
3482         n = m_aux_find(m, AF_INET, IPPROTO_ESP);
3483 #ifdef DIAGNOSTIC
3484         if (n && n->m_len < sizeof(struct socket *))
3485                 panic("invalid ipsec m_aux");
3486 #endif
3487         return n;
3488 }
3489
3490 void
3491 ipsec_delaux(m)
3492         struct mbuf *m;
3493 {
3494         struct mbuf *n;
3495
3496         n = m_aux_find(m, AF_INET, IPPROTO_ESP);
3497         if (n)
3498                 m_aux_delete(m, n);
3499 }
3500
3501 /* if the aux buffer is unnecessary, nuke it. */
3502 static void
3503 ipsec_optaux(m, n)
3504         struct mbuf *m;
3505         struct mbuf *n;
3506 {
3507
3508         if (!n)
3509                 return;
3510         if (n->m_len == sizeof(struct socket *) && !*mtod(n, struct socket **))
3511                 ipsec_delaux(m);
3512 }
3513
3514 int
3515 ipsec_setsocket(m, so)
3516         struct mbuf *m;
3517         struct socket *so;
3518 {
3519         struct mbuf *n;
3520
3521         /* if so == NULL, don't insist on getting the aux mbuf */
3522         if (so) {
3523                 n = ipsec_addaux(m);
3524                 if (!n)
3525                         return ENOBUFS;
3526         } else
3527                 n = ipsec_findaux(m);
3528         if (n && n->m_len >= sizeof(struct socket *))
3529                 *mtod(n, struct socket **) = so;
3530         ipsec_optaux(m, n);
3531         return 0;
3532 }
3533
3534 struct socket *
3535 ipsec_getsocket(m)
3536         struct mbuf *m;
3537 {
3538         struct mbuf *n;
3539
3540         n = ipsec_findaux(m);
3541         if (n && n->m_len >= sizeof(struct socket *))
3542                 return *mtod(n, struct socket **);
3543         else
3544                 return NULL;
3545 }
3546
3547 int
3548 ipsec_addhist(m, proto, spi)
3549         struct mbuf *m;
3550         int proto;
3551         u_int32_t spi;
3552 {
3553         struct mbuf *n;
3554         struct ipsec_history *p;
3555
3556         n = ipsec_addaux(m);
3557         if (!n)
3558                 return ENOBUFS;
3559         if (M_TRAILINGSPACE(n) < sizeof(*p))
3560                 return ENOSPC;  /*XXX*/
3561         p = (struct ipsec_history *)(mtod(n, caddr_t) + n->m_len);
3562         n->m_len += sizeof(*p);
3563         bzero(p, sizeof(*p));
3564         p->ih_proto = proto;
3565         p->ih_spi = spi;
3566         return 0;
3567 }
3568
3569 struct ipsec_history *
3570 ipsec_gethist(m, lenp)
3571         struct mbuf *m;
3572         int *lenp;
3573 {
3574         struct mbuf *n;
3575         int l;
3576
3577         n = ipsec_findaux(m);
3578         if (!n)
3579                 return NULL;
3580         l = n->m_len;
3581         if (sizeof(struct socket *) > l)
3582                 return NULL;
3583         if ((l - sizeof(struct socket *)) % sizeof(struct ipsec_history))
3584                 return NULL;
3585         /* XXX does it make more sense to divide by sizeof(ipsec_history)? */
3586         if (lenp)
3587                 *lenp = l - sizeof(struct socket *);
3588         return (struct ipsec_history *)
3589             (mtod(n, caddr_t) + sizeof(struct socket *));
3590 }
3591
3592 void
3593 ipsec_clearhist(m)
3594         struct mbuf *m;
3595 {
3596         struct mbuf *n;
3597
3598         n = ipsec_findaux(m);
3599         if ((n) && n->m_len > sizeof(struct socket *))
3600                 n->m_len = sizeof(struct socket *);
3601         ipsec_optaux(m, n);
3602 }