2 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
5 * SPDX-License-Identifier: BSD-3-Clause
7 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the project nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * IPsec controller part.
40 #include "opt_inet6.h"
41 #include "opt_ipsec.h"
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/malloc.h>
47 #include <sys/domain.h>
49 #include <sys/protosw.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/errno.h>
53 #include <sys/hhook.h>
55 #include <sys/kernel.h>
56 #include <sys/syslog.h>
57 #include <sys/sysctl.h>
61 #include <net/if_enc.h>
62 #include <net/if_var.h>
65 #include <netinet/in.h>
66 #include <netinet/in_systm.h>
67 #include <netinet/ip.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/in_var.h>
70 #include <netinet/udp.h>
71 #include <netinet/udp_var.h>
72 #include <netinet/tcp.h>
73 #include <netinet/udp.h>
75 #include <netinet/ip6.h>
77 #include <netinet6/ip6_var.h>
79 #include <netinet/in_pcb.h>
81 #include <netinet/icmp6.h>
84 #include <sys/types.h>
85 #include <netipsec/ipsec.h>
87 #include <netipsec/ipsec6.h>
89 #include <netipsec/ah_var.h>
90 #include <netipsec/esp_var.h>
91 #include <netipsec/ipcomp.h> /*XXX*/
92 #include <netipsec/ipcomp_var.h>
93 #include <netipsec/ipsec_support.h>
95 #include <netipsec/key.h>
96 #include <netipsec/keydb.h>
97 #include <netipsec/key_debug.h>
99 #include <netipsec/xform.h>
101 #include <machine/in_cksum.h>
103 #include <opencrypto/cryptodev.h>
105 /* NB: name changed so netstat doesn't use it. */
106 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec4stat);
107 VNET_PCPUSTAT_SYSINIT(ipsec4stat);
110 VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
113 /* DF bit on encap. 0: clear 1: set 2: copy */
114 VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
115 VNET_DEFINE(int, ip4_ipsec_min_pmtu) = 576;
116 VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE;
117 VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE;
118 VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE;
119 VNET_DEFINE(int, ip4_ah_net_deflev) = IPSEC_LEVEL_USE;
120 /* ECN ignore(-1)/forbidden(0)/allowed(1) */
121 VNET_DEFINE(int, ip4_ipsec_ecn) = 0;
123 VNET_DEFINE_STATIC(int, ip4_filtertunnel) = 0;
124 #define V_ip4_filtertunnel VNET(ip4_filtertunnel)
125 VNET_DEFINE_STATIC(int, check_policy_history) = 0;
126 #define V_check_policy_history VNET(check_policy_history)
127 VNET_DEFINE_STATIC(struct secpolicy *, def_policy) = NULL;
128 #define V_def_policy VNET(def_policy)
130 sysctl_def_policy(SYSCTL_HANDLER_ARGS)
134 value = V_def_policy->policy;
135 error = sysctl_handle_int(oidp, &value, 0, req);
137 if (value != IPSEC_POLICY_DISCARD &&
138 value != IPSEC_POLICY_NONE)
140 V_def_policy->policy = value;
146 * Crypto support requirements:
148 * 1 require hardware support
149 * -1 require software support
152 VNET_DEFINE(int, crypto_support) = CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE;
155 * Use asynchronous mode to parallelize crypto jobs:
160 VNET_DEFINE(int, async_crypto) = 0;
163 * TCP/UDP checksum handling policy for transport mode NAT-T (RFC3948)
165 * 0 - auto: incrementally recompute, when checksum delta is known;
166 * if checksum delta isn't known, reset checksum to zero for UDP,
167 * and mark csum_flags as valid for TCP.
168 * 1 - fully recompute TCP/UDP checksum.
170 VNET_DEFINE(int, natt_cksum_policy) = 0;
172 FEATURE(ipsec, "Internet Protocol Security (IPsec)");
173 FEATURE(ipsec_natt, "UDP Encapsulation of IPsec ESP Packets ('NAT-T')");
175 SYSCTL_DECL(_net_inet_ipsec);
178 SYSCTL_PROC(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy,
179 CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
180 0, 0, sysctl_def_policy, "I",
181 "IPsec default policy.");
182 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
183 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_trans_deflev), 0,
184 "Default ESP transport mode level");
185 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
186 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_esp_net_deflev), 0,
187 "Default ESP tunnel mode level.");
188 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
189 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_trans_deflev), 0,
190 "AH transfer mode default level.");
191 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
192 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ah_net_deflev), 0,
193 "AH tunnel mode default level.");
194 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos,
195 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ah_cleartos), 0,
196 "If set, clear type-of-service field when doing AH computation.");
197 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit,
198 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0,
199 "Do not fragment bit on encap.");
200 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_MIN_PMTU, min_pmtu,
201 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_min_pmtu), 0,
202 "Lowest acceptable PMTU value.");
203 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn,
204 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0,
205 "Explicit Congestion Notification handling.");
206 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, crypto_support,
207 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(crypto_support), 0,
208 "Crypto driver selection.");
209 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, async_crypto,
210 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_crypto), 0,
211 "Use asynchronous mode to parallelize crypto jobs.");
212 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, check_policy_history,
213 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(check_policy_history), 0,
214 "Use strict check of inbound packets to security policy compliance.");
215 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, natt_cksum_policy,
216 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(natt_cksum_policy), 0,
217 "Method to fix TCP/UDP checksum for transport mode IPsec after NAT.");
218 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, filtertunnel,
219 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_filtertunnel), 0,
220 "If set, filter packets from an IPsec tunnel.");
221 SYSCTL_VNET_PCPUSTAT(_net_inet_ipsec, OID_AUTO, ipsecstats, struct ipsecstat,
222 ipsec4stat, "IPsec IPv4 statistics.");
226 * When set to 1, IPsec will send packets with the same sequence number.
227 * This allows to verify if the other side has proper replay attacks detection.
229 VNET_DEFINE(int, ipsec_replay) = 0;
230 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_replay,
231 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_replay), 0,
232 "Emulate replay attack");
234 * When set 1, IPsec will send packets with corrupted HMAC.
235 * This allows to verify if the other side properly detects modified packets.
237 VNET_DEFINE(int, ipsec_integrity) = 0;
238 SYSCTL_INT(_net_inet_ipsec, OID_AUTO, test_integrity,
239 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ipsec_integrity), 0,
240 "Emulate man-in-the-middle attack");
244 VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec6stat);
245 VNET_PCPUSTAT_SYSINIT(ipsec6stat);
248 VNET_PCPUSTAT_SYSUNINIT(ipsec6stat);
251 VNET_DEFINE(int, ip6_esp_trans_deflev) = IPSEC_LEVEL_USE;
252 VNET_DEFINE(int, ip6_esp_net_deflev) = IPSEC_LEVEL_USE;
253 VNET_DEFINE(int, ip6_ah_trans_deflev) = IPSEC_LEVEL_USE;
254 VNET_DEFINE(int, ip6_ah_net_deflev) = IPSEC_LEVEL_USE;
255 VNET_DEFINE(int, ip6_ipsec_ecn) = 0; /* ECN ignore(-1)/forbidden(0)/allowed(1) */
257 VNET_DEFINE_STATIC(int, ip6_filtertunnel) = 0;
258 #define V_ip6_filtertunnel VNET(ip6_filtertunnel)
260 SYSCTL_DECL(_net_inet6_ipsec6);
262 /* net.inet6.ipsec6 */
263 SYSCTL_PROC(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy,
264 CTLTYPE_INT | CTLFLAG_VNET | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
265 0, 0, sysctl_def_policy, "I",
266 "IPsec default policy.");
267 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
268 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_trans_deflev), 0,
269 "Default ESP transport mode level.");
270 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
271 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_esp_net_deflev), 0,
272 "Default ESP tunnel mode level.");
273 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
274 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_trans_deflev), 0,
275 "AH transfer mode default level.");
276 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
277 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ah_net_deflev), 0,
278 "AH tunnel mode default level.");
279 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN, ecn,
280 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_ipsec_ecn), 0,
281 "Explicit Congestion Notification handling.");
282 SYSCTL_INT(_net_inet6_ipsec6, OID_AUTO, filtertunnel,
283 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_filtertunnel), 0,
284 "If set, filter packets from an IPsec tunnel.");
285 SYSCTL_VNET_PCPUSTAT(_net_inet6_ipsec6, IPSECCTL_STATS, ipsecstats,
286 struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics.");
289 static int ipsec_in_reject(struct secpolicy *, struct inpcb *,
290 const struct mbuf *);
293 static void ipsec4_get_ulp(const struct mbuf *, struct secpolicyindex *, int);
294 static void ipsec4_setspidx_ipaddr(const struct mbuf *,
295 struct secpolicyindex *);
298 static void ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *, int);
299 static void ipsec6_setspidx_ipaddr(const struct mbuf *,
300 struct secpolicyindex *);
304 * Return a held reference to the default SP.
306 static struct secpolicy *
307 key_allocsp_default(void)
310 key_addref(V_def_policy);
311 return (V_def_policy);
315 ipsec_invalidate_cache(struct inpcb *inp, u_int dir)
317 struct secpolicy *sp;
319 INP_WLOCK_ASSERT(inp);
320 if (dir == IPSEC_DIR_OUTBOUND) {
321 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
323 sp = inp->inp_sp->sp_in;
324 inp->inp_sp->sp_in = NULL;
326 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
328 sp = inp->inp_sp->sp_out;
329 inp->inp_sp->sp_out = NULL;
332 key_freesp(&sp); /* release extra reference */
336 ipsec_cachepolicy(struct inpcb *inp, struct secpolicy *sp, u_int dir)
341 INP_LOCK_ASSERT(inp);
343 if (dir == IPSEC_DIR_OUTBOUND) {
344 /* Do we have configured PCB policy? */
345 if (inp->inp_sp->flags & INP_OUTBOUND_POLICY)
347 /* Another thread has already set cached policy */
348 if (inp->inp_sp->sp_out != NULL)
351 * Do not cache OUTBOUND policy if PCB isn't connected,
352 * i.e. foreign address is INADDR_ANY/UNSPECIFIED.
355 if ((inp->inp_vflag & INP_IPV4) != 0 &&
356 inp->inp_faddr.s_addr == INADDR_ANY)
360 if ((inp->inp_vflag & INP_IPV6) != 0 &&
361 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
365 /* Do we have configured PCB policy? */
366 if (inp->inp_sp->flags & INP_INBOUND_POLICY)
368 /* Another thread has already set cached policy */
369 if (inp->inp_sp->sp_in != NULL)
372 * Do not cache INBOUND policy for listen socket,
373 * that is bound to INADDR_ANY/UNSPECIFIED address.
376 if ((inp->inp_vflag & INP_IPV4) != 0 &&
377 inp->inp_faddr.s_addr == INADDR_ANY)
381 if ((inp->inp_vflag & INP_IPV6) != 0 &&
382 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
387 if (!INP_WLOCKED(inp)) {
388 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
391 if (dir == IPSEC_DIR_OUTBOUND)
392 inp->inp_sp->sp_out = sp;
394 inp->inp_sp->sp_in = sp;
396 * SP is already referenced by the lookup code.
397 * We take extra reference here to avoid race in the
398 * ipsec_getpcbpolicy() function - SP will not be freed in the
399 * time between we take SP pointer from the cache and key_addref()
403 genid = key_getspgen();
404 if (genid != inp->inp_sp->genid) {
405 ipsec_invalidate_cache(inp, dir);
406 inp->inp_sp->genid = genid;
409 printf("%s: PCB(%p): cached %s SP(%p)\n",
410 __func__, inp, dir == IPSEC_DIR_OUTBOUND ? "OUTBOUND":
416 static struct secpolicy *
417 ipsec_checkpolicy(struct secpolicy *sp, struct inpcb *inp, int *error)
420 /* Save found OUTBOUND policy into PCB SP cache. */
421 if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_out == NULL)
422 ipsec_cachepolicy(inp, sp, IPSEC_DIR_OUTBOUND);
424 switch (sp->policy) {
426 printf("%s: invalid policy %u\n", __func__, sp->policy);
428 case IPSEC_POLICY_DISCARD:
429 *error = -EINVAL; /* Packet is discarded by caller. */
431 case IPSEC_POLICY_BYPASS:
432 case IPSEC_POLICY_NONE:
434 sp = NULL; /* NB: force NULL result. */
436 case IPSEC_POLICY_IPSEC:
437 /* XXXAE: handle LARVAL SP */
441 printf("%s: get SP(%p), error %d\n", __func__, sp, *error));
445 static struct secpolicy *
446 ipsec_getpcbpolicy(struct inpcb *inp, u_int dir)
448 struct secpolicy *sp;
449 int flags, downgrade;
451 if (inp == NULL || inp->inp_sp == NULL)
454 INP_LOCK_ASSERT(inp);
456 flags = inp->inp_sp->flags;
457 if (dir == IPSEC_DIR_OUTBOUND) {
458 sp = inp->inp_sp->sp_out;
459 flags &= INP_OUTBOUND_POLICY;
461 sp = inp->inp_sp->sp_in;
462 flags &= INP_INBOUND_POLICY;
465 * Check flags. If we have PCB SP, just return it.
466 * Otherwise we need to check that cached SP entry isn't stale.
471 if (inp->inp_sp->genid != key_getspgen()) {
472 /* Invalidate the cache. */
474 if (!INP_WLOCKED(inp)) {
475 if ((downgrade = INP_TRY_UPGRADE(inp)) == 0)
478 ipsec_invalidate_cache(inp, IPSEC_DIR_OUTBOUND);
479 ipsec_invalidate_cache(inp, IPSEC_DIR_INBOUND);
485 printf("%s: PCB(%p): cache hit SP(%p)\n",
487 /* Return referenced cached policy */
495 ipsec4_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
502 IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip),
503 ("packet too short"));
505 if (m->m_len >= sizeof (struct ip)) {
506 const struct ip *ip = mtod(m, const struct ip *);
507 if (ip->ip_off & htons(IP_MF | IP_OFFMASK))
509 off = ip->ip_hl << 2;
514 m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih);
515 if (ih.ip_off & htons(IP_MF | IP_OFFMASK))
521 while (off < m->m_pkthdr.len) {
528 spidx->ul_proto = nxt;
531 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
533 m_copydata(m, off, sizeof (th), (caddr_t) &th);
534 spidx->src.sin.sin_port = th.th_sport;
535 spidx->dst.sin.sin_port = th.th_dport;
538 spidx->ul_proto = nxt;
541 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
543 m_copydata(m, off, sizeof (uh), (caddr_t) &uh);
544 spidx->src.sin.sin_port = uh.uh_sport;
545 spidx->dst.sin.sin_port = uh.uh_dport;
548 if (off + sizeof(ip6e) > m->m_pkthdr.len)
550 /* XXX Sigh, this works but is totally bogus. */
551 m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e);
552 off += (ip6e.ip6e_len + 2) << 2;
557 /* XXX Intermediate headers??? */
558 spidx->ul_proto = nxt;
563 spidx->ul_proto = IPSEC_ULPROTO_ANY;
565 spidx->src.sin.sin_port = IPSEC_PORT_ANY;
566 spidx->dst.sin.sin_port = IPSEC_PORT_ANY;
568 printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
572 ipsec4_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
575 ipsec4_setsockaddrs(m, &spidx->src, &spidx->dst);
576 spidx->prefs = sizeof(struct in_addr) << 3;
577 spidx->prefd = sizeof(struct in_addr) << 3;
580 static struct secpolicy *
581 ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir,
584 struct secpolicyindex spidx;
585 struct secpolicy *sp;
587 sp = ipsec_getpcbpolicy(inp, dir);
588 if (sp == NULL && key_havesp(dir)) {
589 /* Make an index to look for a policy. */
590 ipsec4_setspidx_ipaddr(m, &spidx);
591 ipsec4_get_ulp(m, &spidx, needport);
593 sp = key_allocsp(&spidx, dir);
595 if (sp == NULL) /* No SP found, use system default. */
596 sp = key_allocsp_default();
601 * Check security policy for *OUTBOUND* IPv4 packet.
604 ipsec4_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error,
607 struct secpolicy *sp;
610 sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport);
612 sp = ipsec_checkpolicy(sp, inp, error);
615 case 0: /* No IPsec required: BYPASS or NONE */
618 IPSECSTAT_INC(ips_out_polvio);
621 IPSECSTAT_INC(ips_out_inval);
625 printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
627 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
632 * Check IPv4 packet against *INBOUND* security policy.
633 * This function is called from tcp_input(), udp_input(),
634 * rip_input() and sctp_input().
637 ipsec4_in_reject(const struct mbuf *m, struct inpcb *inp)
639 struct secpolicy *sp;
642 sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0);
643 result = ipsec_in_reject(sp, inp, m);
646 IPSECSTAT_INC(ips_in_polvio);
651 * IPSEC_CAP() method implementation for IPv4.
654 ipsec4_capability(struct mbuf *m, u_int cap)
658 case IPSEC_CAP_BYPASS_FILTER:
660 * Bypass packet filtering for packets previously handled
663 if (!V_ip4_filtertunnel &&
664 m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
667 case IPSEC_CAP_OPERABLE:
668 /* Do we have active security policies? */
669 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
670 key_havesp(IPSEC_DIR_OUTBOUND) != 0)
681 ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx,
689 IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip6_hdr),
690 ("packet too short"));
693 spidx->ul_proto = IPSEC_ULPROTO_ANY;
694 spidx->src.sin6.sin6_port = IPSEC_PORT_ANY;
695 spidx->dst.sin6.sin6_port = IPSEC_PORT_ANY;
698 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
699 if (off < 0 || m->m_pkthdr.len < off)
704 spidx->ul_proto = nxt;
707 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
709 m_copydata(m, off, sizeof(th), (caddr_t)&th);
710 spidx->src.sin6.sin6_port = th.th_sport;
711 spidx->dst.sin6.sin6_port = th.th_dport;
714 spidx->ul_proto = nxt;
717 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
719 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
720 spidx->src.sin6.sin6_port = uh.uh_sport;
721 spidx->dst.sin6.sin6_port = uh.uh_dport;
724 spidx->ul_proto = nxt;
725 if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len)
727 m_copydata(m, off, sizeof(ih), (caddr_t)&ih);
728 spidx->src.sin6.sin6_port = htons((uint16_t)ih.icmp6_type);
729 spidx->dst.sin6.sin6_port = htons((uint16_t)ih.icmp6_code);
732 /* XXX Intermediate headers??? */
733 spidx->ul_proto = nxt;
737 printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL));
741 ipsec6_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
744 ipsec6_setsockaddrs(m, &spidx->src, &spidx->dst);
745 spidx->prefs = sizeof(struct in6_addr) << 3;
746 spidx->prefd = sizeof(struct in6_addr) << 3;
749 static struct secpolicy *
750 ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir,
753 struct secpolicyindex spidx;
754 struct secpolicy *sp;
756 sp = ipsec_getpcbpolicy(inp, dir);
757 if (sp == NULL && key_havesp(dir)) {
758 /* Make an index to look for a policy. */
759 ipsec6_setspidx_ipaddr(m, &spidx);
760 ipsec6_get_ulp(m, &spidx, needport);
762 sp = key_allocsp(&spidx, dir);
764 if (sp == NULL) /* No SP found, use system default. */
765 sp = key_allocsp_default();
770 * Check security policy for *OUTBOUND* IPv6 packet.
773 ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error,
776 struct secpolicy *sp;
779 sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport);
781 sp = ipsec_checkpolicy(sp, inp, error);
784 case 0: /* No IPsec required: BYPASS or NONE */
787 IPSEC6STAT_INC(ips_out_polvio);
790 IPSEC6STAT_INC(ips_out_inval);
794 printf("%s: using SP(%p), error %d\n", __func__, sp, *error));
796 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
801 * Check IPv6 packet against inbound security policy.
802 * This function is called from tcp6_input(), udp6_input(),
803 * rip6_input() and sctp_input().
806 ipsec6_in_reject(const struct mbuf *m, struct inpcb *inp)
808 struct secpolicy *sp;
811 sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0);
812 result = ipsec_in_reject(sp, inp, m);
815 IPSEC6STAT_INC(ips_in_polvio);
820 * IPSEC_CAP() method implementation for IPv6.
823 ipsec6_capability(struct mbuf *m, u_int cap)
827 case IPSEC_CAP_BYPASS_FILTER:
829 * Bypass packet filtering for packets previously handled
832 if (!V_ip6_filtertunnel &&
833 m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
836 case IPSEC_CAP_OPERABLE:
837 /* Do we have active security policies? */
838 if (key_havesp(IPSEC_DIR_INBOUND) != 0 ||
839 key_havesp(IPSEC_DIR_OUTBOUND) != 0)
848 ipsec_run_hhooks(struct ipsec_ctx_data *ctx, int type)
855 idx = HHOOK_IPSEC_INET;
860 idx = HHOOK_IPSEC_INET6;
864 return (EPFNOSUPPORT);
866 if (type == HHOOK_TYPE_IPSEC_IN)
867 HHOOKS_RUN_IF(V_ipsec_hhh_in[idx], ctx, NULL);
869 HHOOKS_RUN_IF(V_ipsec_hhh_out[idx], ctx, NULL);
870 if (*ctx->mp == NULL)
876 * Return current level.
877 * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
880 ipsec_get_reqlevel(struct secpolicy *sp, u_int idx)
882 struct ipsecrequest *isr;
883 u_int esp_trans_deflev, esp_net_deflev;
884 u_int ah_trans_deflev, ah_net_deflev;
887 IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
888 /* XXX Note that we have ipseclog() expanded here - code sync issue. */
889 #define IPSEC_CHECK_DEFAULT(lev) \
890 (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE && \
891 (lev) != IPSEC_LEVEL_UNIQUE) \
893 log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
894 (lev), IPSEC_LEVEL_REQUIRE) : 0), \
895 (lev) = IPSEC_LEVEL_REQUIRE, (lev) : (lev))
898 * IPsec VTI uses unique security policy with fake spidx filled
899 * with zeroes. Just return IPSEC_LEVEL_REQUIRE instead of doing
900 * full level lookup for such policies.
902 if (sp->state == IPSEC_SPSTATE_IFNET) {
903 IPSEC_ASSERT(sp->req[idx]->level == IPSEC_LEVEL_UNIQUE,
904 ("Wrong IPsec request level %d", sp->req[idx]->level));
905 return (IPSEC_LEVEL_REQUIRE);
908 /* Set default level. */
909 switch (sp->spidx.src.sa.sa_family) {
912 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_trans_deflev);
913 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_net_deflev);
914 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_trans_deflev);
915 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_net_deflev);
920 esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_trans_deflev);
921 esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_net_deflev);
922 ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_trans_deflev);
923 ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_net_deflev);
927 panic("%s: unknown af %u",
928 __func__, sp->spidx.src.sa.sa_family);
931 #undef IPSEC_CHECK_DEFAULT
935 switch (isr->level) {
936 case IPSEC_LEVEL_DEFAULT:
937 switch (isr->saidx.proto) {
939 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
940 level = esp_net_deflev;
942 level = esp_trans_deflev;
945 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
946 level = ah_net_deflev;
948 level = ah_trans_deflev;
952 * We don't really care, as IPcomp document says that
953 * we shouldn't compress small packets.
955 level = IPSEC_LEVEL_USE;
958 panic("%s: Illegal protocol defined %u\n", __func__,
963 case IPSEC_LEVEL_USE:
964 case IPSEC_LEVEL_REQUIRE:
967 case IPSEC_LEVEL_UNIQUE:
968 level = IPSEC_LEVEL_REQUIRE;
972 panic("%s: Illegal IPsec level %u\n", __func__, isr->level);
979 ipsec_check_history(const struct mbuf *m, struct secpolicy *sp, u_int idx)
981 struct xform_history *xh;
985 while ((mtag = m_tag_find(__DECONST(struct mbuf *, m),
986 PACKET_TAG_IPSEC_IN_DONE, mtag)) != NULL) {
987 xh = (struct xform_history *)(mtag + 1);
989 char buf[IPSEC_ADDRSTRLEN];
990 printf("%s: mode %s proto %u dst %s\n", __func__,
991 kdebug_secasindex_mode(xh->mode), xh->proto,
992 ipsec_address(&xh->dst, buf, sizeof(buf))));
993 if (xh->proto != sp->req[idx]->saidx.proto)
995 /* If SA had IPSEC_MODE_ANY, consider this as match. */
996 if (xh->mode != sp->req[idx]->saidx.mode &&
997 xh->mode != IPSEC_MODE_ANY)
1000 * For transport mode IPsec request doesn't contain
1001 * addresses. We need to use address from spidx.
1003 if (sp->req[idx]->saidx.mode == IPSEC_MODE_TRANSPORT) {
1004 if (key_sockaddrcmp_withmask(&xh->dst.sa,
1005 &sp->spidx.dst.sa, sp->spidx.prefd) != 0)
1008 if (key_sockaddrcmp(&xh->dst.sa,
1009 &sp->req[idx]->saidx.dst.sa, 0) != 0)
1012 return (0); /* matched */
1018 * Check security policy requirements against the actual
1019 * packet contents. Return one if the packet should be
1020 * reject as "invalid"; otherwiser return zero to have the
1021 * packet treated as "valid".
1028 ipsec_in_reject(struct secpolicy *sp, struct inpcb *inp, const struct mbuf *m)
1033 printf("%s: PCB(%p): using SP(%p)\n", __func__, inp, sp));
1034 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
1036 if (inp != NULL && inp->inp_sp != NULL && inp->inp_sp->sp_in == NULL)
1037 ipsec_cachepolicy(inp, sp, IPSEC_DIR_INBOUND);
1040 switch (sp->policy) {
1041 case IPSEC_POLICY_DISCARD:
1043 case IPSEC_POLICY_BYPASS:
1044 case IPSEC_POLICY_NONE:
1048 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1049 ("invalid policy %u", sp->policy));
1052 * ipsec[46]_common_input_cb after each transform adds
1053 * PACKET_TAG_IPSEC_IN_DONE mbuf tag. It contains SPI, proto, mode
1054 * and destination address from saidx. We can compare info from
1055 * these tags with requirements in SP.
1057 for (i = 0; i < sp->tcount; i++) {
1059 * Do not check IPcomp, since IPcomp document
1060 * says that we shouldn't compress small packets.
1061 * IPComp policy should always be treated as being
1064 if (sp->req[i]->saidx.proto == IPPROTO_IPCOMP ||
1065 ipsec_get_reqlevel(sp, i) != IPSEC_LEVEL_REQUIRE)
1067 if (V_check_policy_history != 0 &&
1068 ipsec_check_history(m, sp, i) != 0)
1070 else switch (sp->req[i]->saidx.proto) {
1072 if ((m->m_flags & M_DECRYPTED) == 0) {
1074 printf("%s: ESP m_flags:%x\n", __func__,
1080 if ((m->m_flags & M_AUTHIPHDR) == 0) {
1082 printf("%s: AH m_flags:%x\n", __func__,
1089 return (0); /* Valid. */
1093 * Compute the byte size to be occupied by IPsec header.
1094 * In case it is tunnelled, it includes the size of outer IP header.
1097 ipsec_hdrsiz_internal(struct secpolicy *sp)
1102 KEYDBG(IPSEC_STAMP, printf("%s: using SP(%p)\n", __func__, sp));
1103 KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp));
1105 switch (sp->policy) {
1106 case IPSEC_POLICY_DISCARD:
1107 case IPSEC_POLICY_BYPASS:
1108 case IPSEC_POLICY_NONE:
1112 IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1113 ("invalid policy %u", sp->policy));
1116 * XXX: for each transform we need to lookup suitable SA
1117 * and use info from SA to calculate headers size.
1118 * XXX: for NAT-T we need to cosider UDP header size.
1121 for (i = 0; i < sp->tcount; i++) {
1122 switch (sp->req[i]->saidx.proto) {
1124 size += esp_hdrsiz(NULL);
1127 size += ah_hdrsiz(NULL);
1129 case IPPROTO_IPCOMP:
1130 size += sizeof(struct ipcomp);
1134 if (sp->req[i]->saidx.mode == IPSEC_MODE_TUNNEL) {
1135 switch (sp->req[i]->saidx.dst.sa.sa_family) {
1138 size += sizeof(struct ip);
1143 size += sizeof(struct ip6_hdr);
1147 ipseclog((LOG_ERR, "%s: unknown AF %d in "
1148 "IPsec tunnel SA\n", __func__,
1149 sp->req[i]->saidx.dst.sa.sa_family));
1158 * Compute ESP/AH header size for protocols with PCB, including
1159 * outer IP header. Currently only tcp_output() uses it.
1162 ipsec_hdrsiz_inpcb(struct inpcb *inp)
1164 struct secpolicyindex spidx;
1165 struct secpolicy *sp;
1168 sp = ipsec_getpcbpolicy(inp, IPSEC_DIR_OUTBOUND);
1169 if (sp == NULL && key_havesp(IPSEC_DIR_OUTBOUND)) {
1170 ipsec_setspidx_inpcb(inp, &spidx, IPSEC_DIR_OUTBOUND);
1171 sp = key_allocsp(&spidx, IPSEC_DIR_OUTBOUND);
1174 sp = key_allocsp_default();
1175 sz = ipsec_hdrsiz_internal(sp);
1181 #define IPSEC_BITMAP_INDEX_MASK(w) (w - 1)
1182 #define IPSEC_REDUNDANT_BIT_SHIFTS 5
1183 #define IPSEC_REDUNDANT_BITS (1 << IPSEC_REDUNDANT_BIT_SHIFTS)
1184 #define IPSEC_BITMAP_LOC_MASK (IPSEC_REDUNDANT_BITS - 1)
1187 * Functions below are responsible for checking and updating bitmap.
1188 * These are used to separate ipsec_chkreplay() and ipsec_updatereplay()
1189 * from window implementation
1191 * Based on RFC 6479. Blocks are 32 bits unsigned integers
1195 check_window(const struct secreplay *replay, uint64_t seq)
1197 int index, bit_location;
1199 SECREPLAY_ASSERT(replay);
1201 bit_location = seq & IPSEC_BITMAP_LOC_MASK;
1202 index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS)
1203 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
1205 /* This packet already seen? */
1206 return ((replay->bitmap)[index] & (1 << bit_location));
1210 advance_window(const struct secreplay *replay, uint64_t seq)
1213 uint64_t index, index_cur, diff;
1215 SECREPLAY_ASSERT(replay);
1217 index_cur = replay->last >> IPSEC_REDUNDANT_BIT_SHIFTS;
1218 index = seq >> IPSEC_REDUNDANT_BIT_SHIFTS;
1219 diff = index - index_cur;
1221 if (diff > replay->bitmap_size) {
1222 /* something unusual in this case */
1223 diff = replay->bitmap_size;
1226 for (i = 0; i < diff; i++) {
1227 replay->bitmap[(i + index_cur + 1)
1228 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size)] = 0;
1233 set_window(const struct secreplay *replay, uint64_t seq)
1235 int index, bit_location;
1237 SECREPLAY_ASSERT(replay);
1239 bit_location = seq & IPSEC_BITMAP_LOC_MASK;
1240 index = (seq >> IPSEC_REDUNDANT_BIT_SHIFTS)
1241 & IPSEC_BITMAP_INDEX_MASK(replay->bitmap_size);
1243 replay->bitmap[index] |= (1 << bit_location);
1247 * Check the variable replay window.
1248 * ipsec_chkreplay() performs replay check before ICV verification.
1249 * ipsec_updatereplay() updates replay bitmap. This must be called after
1250 * ICV verification (it also performs replay check, which is usually done
1252 * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
1258 ipsec_chkreplay(uint32_t seq, uint32_t *seqhigh, struct secasvar *sav)
1261 struct secreplay *replay;
1263 uint32_t tl, th, bl;
1266 IPSEC_ASSERT(sav != NULL, ("Null SA"));
1267 IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
1269 replay = sav->replay;
1271 /* No need to check replay if disabled. */
1272 if (replay->wsize == 0) {
1276 SECREPLAY_LOCK(replay);
1278 /* Zero sequence number is not allowed. */
1279 if (seq == 0 && replay->last == 0) {
1280 SECREPLAY_UNLOCK(replay);
1284 window = replay->wsize << 3; /* Size of window */
1285 tl = (uint32_t)replay->last; /* Top of window, lower part */
1286 th = (uint32_t)(replay->last >> 32); /* Top of window, high part */
1287 bl = tl - window + 1; /* Bottom of window, lower part */
1290 * We keep the high part intact when:
1291 * 1) the seq is within [bl, 0xffffffff] and the whole window is
1292 * within one subspace;
1293 * 2) the seq is within [0, bl) and window spans two subspaces.
1295 if ((tl >= window - 1 && seq >= bl) ||
1296 (tl < window - 1 && seq < bl)) {
1299 /* Sequence number inside window - check against replay */
1300 if (check_window(replay, seq)) {
1301 SECREPLAY_UNLOCK(replay);
1306 SECREPLAY_UNLOCK(replay);
1307 /* Sequence number above top of window or not found in bitmap */
1312 * If ESN is not enabled and packet with highest sequence number
1313 * was received we should report overflow
1315 if (tl == 0xffffffff && !(sav->flags & SADB_X_SAFLAGS_ESN)) {
1316 /* Set overflow flag. */
1319 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
1320 if (sav->sah->saidx.proto == IPPROTO_ESP)
1321 ESPSTAT_INC(esps_wrap);
1322 else if (sav->sah->saidx.proto == IPPROTO_AH)
1323 AHSTAT_INC(ahs_wrap);
1324 SECREPLAY_UNLOCK(replay);
1328 ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n",
1329 __func__, replay->overflow,
1330 ipsec_sa2str(sav, buf, sizeof(buf))));
1334 * Seq is within [bl, 0xffffffff] and bl is within
1335 * [0xffffffff-window, 0xffffffff]. This means we got a seq
1336 * which is within our replay window, but in the previous
1339 if (tl < window - 1 && seq >= bl) {
1344 if (check_window(replay, seq)) {
1345 SECREPLAY_UNLOCK(replay);
1348 SECREPLAY_UNLOCK(replay);
1353 * Seq is within [0, bl) but the whole window is within one subspace.
1354 * This means that seq has wrapped and is in next subspace
1359 /* Don't let high part wrap. */
1361 /* Set overflow flag. */
1364 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
1365 if (sav->sah->saidx.proto == IPPROTO_ESP)
1366 ESPSTAT_INC(esps_wrap);
1367 else if (sav->sah->saidx.proto == IPPROTO_AH)
1368 AHSTAT_INC(ahs_wrap);
1369 SECREPLAY_UNLOCK(replay);
1373 ipseclog((LOG_WARNING, "%s: replay counter made %d cycle. %s\n",
1374 __func__, replay->overflow,
1375 ipsec_sa2str(sav, buf, sizeof(buf))));
1378 SECREPLAY_UNLOCK(replay);
1383 * Check replay counter whether to update or not.
1388 ipsec_updatereplay(uint32_t seq, struct secasvar *sav)
1390 struct secreplay *replay;
1392 uint32_t tl, th, bl;
1395 IPSEC_ASSERT(sav != NULL, ("Null SA"));
1396 IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));
1398 replay = sav->replay;
1400 /* No need to check replay if disabled. */
1401 if (replay->wsize == 0)
1404 SECREPLAY_LOCK(replay);
1406 /* Zero sequence number is not allowed. */
1407 if (seq == 0 && replay->last == 0) {
1408 SECREPLAY_UNLOCK(replay);
1412 window = replay->wsize << 3; /* Size of window */
1413 tl = (uint32_t)replay->last; /* Top of window, lower part */
1414 th = (uint32_t)(replay->last >> 32); /* Top of window, high part */
1415 bl = tl - window + 1; /* Bottom of window, lower part */
1418 * We keep the high part intact when:
1419 * 1) the seq is within [bl, 0xffffffff] and the whole window is
1420 * within one subspace;
1421 * 2) the seq is within [0, bl) and window spans two subspaces.
1423 if ((tl >= window - 1 && seq >= bl) ||
1424 (tl < window - 1 && seq < bl)) {
1427 /* Sequence number inside window - check against replay */
1428 if (check_window(replay, seq)) {
1429 SECREPLAY_UNLOCK(replay);
1432 set_window(replay, seq);
1434 advance_window(replay, ((uint64_t)seqh << 32) | seq);
1435 set_window(replay, seq);
1436 replay->last = ((uint64_t)seqh << 32) | seq;
1439 /* Sequence number above top of window or not found in bitmap */
1441 SECREPLAY_UNLOCK(replay);
1445 if (!(sav->flags & SADB_X_SAFLAGS_ESN)) {
1446 SECREPLAY_UNLOCK(replay);
1451 * Seq is within [bl, 0xffffffff] and bl is within
1452 * [0xffffffff-window, 0xffffffff]. This means we got a seq
1453 * which is within our replay window, but in the previous
1456 if (tl < window - 1 && seq >= bl) {
1458 SECREPLAY_UNLOCK(replay);
1461 if (check_window(replay, seq)) {
1462 SECREPLAY_UNLOCK(replay);
1466 set_window(replay, seq);
1468 SECREPLAY_UNLOCK(replay);
1473 * Seq is within [0, bl) but the whole window is within one subspace.
1474 * This means that seq has wrapped and is in next subspace
1478 /* Don't let high part wrap. */
1480 SECREPLAY_UNLOCK(replay);
1484 advance_window(replay, ((uint64_t)seqh << 32) | seq);
1485 set_window(replay, seq);
1486 replay->last = ((uint64_t)seqh << 32) | seq;
1489 SECREPLAY_UNLOCK(replay);
1493 ipsec_updateid(struct secasvar *sav, crypto_session_t *new,
1494 crypto_session_t *old)
1496 crypto_session_t tmp;
1499 * tdb_cryptoid is initialized by xform_init().
1500 * Then it can be changed only when some crypto error occurred or
1501 * when SA is deleted. We stored used cryptoid in the xform_data
1502 * structure. In case when crypto error occurred and crypto
1503 * subsystem has reinited the session, it returns new cryptoid
1504 * and EAGAIN error code.
1506 * This function will be called when we got EAGAIN from crypto
1508 * *new is cryptoid that was returned by crypto subsystem in
1510 * *old is the original cryptoid that we stored in xform_data.
1512 * For first failed request *old == sav->tdb_cryptoid, then
1513 * we update sav->tdb_cryptoid and redo crypto_dispatch().
1514 * For next failed request *old != sav->tdb_cryptoid, then
1515 * we store cryptoid from first request into the *new variable
1516 * and crp_sid from this second session will be returned via
1517 * *old pointer, so caller can release second session.
1519 * XXXAE: check this more carefully.
1522 printf("%s: SA(%p) moves cryptoid %p -> %p\n",
1523 __func__, sav, *old, *new));
1524 KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
1525 SECASVAR_WLOCK(sav);
1526 if (sav->tdb_cryptoid != *old) {
1527 /* cryptoid was already updated */
1529 *new = sav->tdb_cryptoid;
1531 SECASVAR_WUNLOCK(sav);
1534 sav->tdb_cryptoid = *new;
1535 SECASVAR_WUNLOCK(sav);
1540 ipsec_initialized(void)
1543 return (V_def_policy != NULL);
1547 def_policy_init(const void *unused __unused)
1550 V_def_policy = key_newsp();
1551 if (V_def_policy != NULL) {
1552 V_def_policy->policy = IPSEC_POLICY_NONE;
1553 /* Force INPCB SP cache invalidation */
1556 printf("%s: failed to initialize default policy\n", __func__);
1560 def_policy_uninit(const void *unused __unused)
1563 if (V_def_policy != NULL) {
1564 key_freesp(&V_def_policy);
1569 VNET_SYSINIT(def_policy_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
1570 def_policy_init, NULL);
1571 VNET_SYSUNINIT(def_policy_uninit, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
1572 def_policy_uninit, NULL);