ipsec_output.c revision 171133
1/*-
2 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 * $FreeBSD: head/sys/netipsec/ipsec_output.c 171133 2007-07-01 11:41:27Z gnn $
27 */
28
29/*
30 * IPsec output processing.
31 */
32#include "opt_inet.h"
33#include "opt_inet6.h"
34#include "opt_ipsec.h"
35#include "opt_enc.h"
36
37#include <sys/param.h>
38#include <sys/systm.h>
39#include <sys/mbuf.h>
40#include <sys/domain.h>
41#include <sys/protosw.h>
42#include <sys/socket.h>
43#include <sys/errno.h>
44#include <sys/syslog.h>
45
46#include <net/if.h>
47#include <net/route.h>
48
49#include <netinet/in.h>
50#include <netinet/in_systm.h>
51#include <netinet/ip.h>
52#include <netinet/ip_var.h>
53#include <netinet/in_var.h>
54#include <netinet/ip_ecn.h>
55#ifdef INET6
56#include <netinet6/ip6_ecn.h>
57#endif
58
59#include <netinet/ip6.h>
60#ifdef INET6
61#include <netinet6/ip6_var.h>
62#endif
63#include <netinet/in_pcb.h>
64#ifdef INET6
65#include <netinet/icmp6.h>
66#endif
67
68#include <netipsec/ipsec.h>
69#ifdef INET6
70#include <netipsec/ipsec6.h>
71#endif
72#include <netipsec/ah_var.h>
73#include <netipsec/esp_var.h>
74#include <netipsec/ipcomp_var.h>
75
76#include <netipsec/xform.h>
77
78#include <netipsec/key.h>
79#include <netipsec/keydb.h>
80#include <netipsec/key_debug.h>
81
82#include <machine/in_cksum.h>
83
84int
85ipsec_process_done(struct mbuf *m, struct ipsecrequest *isr)
86{
87	struct tdb_ident *tdbi;
88	struct m_tag *mtag;
89	struct secasvar *sav;
90	struct secasindex *saidx;
91	int error;
92
93	IPSEC_SPLASSERT_SOFTNET(__func__);
94
95	IPSEC_ASSERT(m != NULL, ("null mbuf"));
96	IPSEC_ASSERT(isr != NULL, ("null ISR"));
97	sav = isr->sav;
98	IPSEC_ASSERT(sav != NULL, ("null SA"));
99	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
100
101	saidx = &sav->sah->saidx;
102	switch (saidx->dst.sa.sa_family) {
103#ifdef INET
104	case AF_INET:
105		/* Fix the header length, for AH processing. */
106		mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
107		break;
108#endif /* INET */
109#ifdef INET6
110	case AF_INET6:
111		/* Fix the header length, for AH processing. */
112		if (m->m_pkthdr.len < sizeof (struct ip6_hdr)) {
113			error = ENXIO;
114			goto bad;
115		}
116		if (m->m_pkthdr.len - sizeof (struct ip6_hdr) > IPV6_MAXPACKET) {
117			/* No jumbogram support. */
118			error = ENXIO;	/*?*/
119			goto bad;
120		}
121		mtod(m, struct ip6_hdr *)->ip6_plen =
122			htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
123		break;
124#endif /* INET6 */
125	default:
126		DPRINTF(("%s: unknown protocol family %u\n", __func__,
127		    saidx->dst.sa.sa_family));
128		error = ENXIO;
129		goto bad;
130	}
131
132	/*
133	 * Add a record of what we've done or what needs to be done to the
134	 * packet.
135	 */
136	mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE,
137			sizeof(struct tdb_ident), M_NOWAIT);
138	if (mtag == NULL) {
139		DPRINTF(("%s: could not get packet tag\n", __func__));
140		error = ENOMEM;
141		goto bad;
142	}
143
144	tdbi = (struct tdb_ident *)(mtag + 1);
145	tdbi->dst = saidx->dst;
146	tdbi->proto = saidx->proto;
147	tdbi->spi = sav->spi;
148	m_tag_prepend(m, mtag);
149
150	/*
151	 * If there's another (bundled) SA to apply, do so.
152	 * Note that this puts a burden on the kernel stack size.
153	 * If this is a problem we'll need to introduce a queue
154	 * to set the packet on so we can unwind the stack before
155	 * doing further processing.
156	 */
157	if (isr->next) {
158		ipsec4stat.ips_out_bundlesa++;
159		return ipsec4_process_packet(m, isr->next, 0, 0);
160	}
161	key_sa_recordxfer(sav, m);		/* record data transfer */
162
163	/*
164	 * We're done with IPsec processing, transmit the packet using the
165	 * appropriate network protocol (IP or IPv6). SPD lookup will be
166	 * performed again there.
167	 */
168	switch (saidx->dst.sa.sa_family) {
169#ifdef INET
170	struct ip *ip;
171	case AF_INET:
172		ip = mtod(m, struct ip *);
173		ip->ip_len = ntohs(ip->ip_len);
174		ip->ip_off = ntohs(ip->ip_off);
175
176		return ip_output(m, NULL, NULL, IP_RAWOUTPUT, NULL, NULL);
177#endif /* INET */
178#ifdef INET6
179	case AF_INET6:
180		/*
181		 * We don't need massage, IPv6 header fields are always in
182		 * net endian.
183		 */
184		return ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
185#endif /* INET6 */
186	}
187	panic("ipsec_process_done");
188bad:
189	m_freem(m);
190	KEY_FREESAV(&sav);
191	return (error);
192}
193
194static struct ipsecrequest *
195ipsec_nextisr(
196	struct mbuf *m,
197	struct ipsecrequest *isr,
198	int af,
199	struct secasindex *saidx,
200	int *error
201)
202{
203#define IPSEC_OSTAT(x,y,z) (isr->saidx.proto == IPPROTO_ESP ? (x)++ : \
204			    isr->saidx.proto == IPPROTO_AH ? (y)++ : (z)++)
205	struct secasvar *sav;
206
207	IPSEC_SPLASSERT_SOFTNET(__func__);
208	IPSECREQUEST_LOCK_ASSERT(isr);
209
210	IPSEC_ASSERT(af == AF_INET || af == AF_INET6,
211		("invalid address family %u", af));
212again:
213	/*
214	 * Craft SA index to search for proper SA.  Note that
215	 * we only fillin unspecified SA peers for transport
216	 * mode; for tunnel mode they must already be filled in.
217	 */
218	*saidx = isr->saidx;
219	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
220		/* Fillin unspecified SA peers only for transport mode */
221		if (af == AF_INET) {
222			struct sockaddr_in *sin;
223			struct ip *ip = mtod(m, struct ip *);
224
225			if (saidx->src.sa.sa_len == 0) {
226				sin = &saidx->src.sin;
227				sin->sin_len = sizeof(*sin);
228				sin->sin_family = AF_INET;
229				sin->sin_port = IPSEC_PORT_ANY;
230				sin->sin_addr = ip->ip_src;
231			}
232			if (saidx->dst.sa.sa_len == 0) {
233				sin = &saidx->dst.sin;
234				sin->sin_len = sizeof(*sin);
235				sin->sin_family = AF_INET;
236				sin->sin_port = IPSEC_PORT_ANY;
237				sin->sin_addr = ip->ip_dst;
238			}
239		} else {
240			struct sockaddr_in6 *sin6;
241			struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
242
243			if (saidx->src.sin6.sin6_len == 0) {
244				sin6 = (struct sockaddr_in6 *)&saidx->src;
245				sin6->sin6_len = sizeof(*sin6);
246				sin6->sin6_family = AF_INET6;
247				sin6->sin6_port = IPSEC_PORT_ANY;
248				sin6->sin6_addr = ip6->ip6_src;
249				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
250					/* fix scope id for comparing SPD */
251					sin6->sin6_addr.s6_addr16[1] = 0;
252					sin6->sin6_scope_id =
253					    ntohs(ip6->ip6_src.s6_addr16[1]);
254				}
255			}
256			if (saidx->dst.sin6.sin6_len == 0) {
257				sin6 = (struct sockaddr_in6 *)&saidx->dst;
258				sin6->sin6_len = sizeof(*sin6);
259				sin6->sin6_family = AF_INET6;
260				sin6->sin6_port = IPSEC_PORT_ANY;
261				sin6->sin6_addr = ip6->ip6_dst;
262				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
263					/* fix scope id for comparing SPD */
264					sin6->sin6_addr.s6_addr16[1] = 0;
265					sin6->sin6_scope_id =
266					    ntohs(ip6->ip6_dst.s6_addr16[1]);
267				}
268			}
269		}
270	}
271
272	/*
273	 * Lookup SA and validate it.
274	 */
275	*error = key_checkrequest(isr, saidx);
276	if (*error != 0) {
277		/*
278		 * IPsec processing is required, but no SA found.
279		 * I assume that key_acquire() had been called
280		 * to get/establish the SA. Here I discard
281		 * this packet because it is responsibility for
282		 * upper layer to retransmit the packet.
283		 */
284		ipsec4stat.ips_out_nosa++;
285		goto bad;
286	}
287	sav = isr->sav;
288	if (sav == NULL) {		/* XXX valid return */
289		IPSEC_ASSERT(ipsec_get_reqlevel(isr) == IPSEC_LEVEL_USE,
290			("no SA found, but required; level %u",
291			ipsec_get_reqlevel(isr)));
292		IPSECREQUEST_UNLOCK(isr);
293		isr = isr->next;
294		if (isr == NULL) {
295			/*XXXstatistic??*/
296			*error = EINVAL;		/*XXX*/
297			return isr;
298		}
299		IPSECREQUEST_LOCK(isr);
300		goto again;
301	}
302
303	/*
304	 * Check system global policy controls.
305	 */
306	if ((isr->saidx.proto == IPPROTO_ESP && !esp_enable) ||
307	    (isr->saidx.proto == IPPROTO_AH && !ah_enable) ||
308	    (isr->saidx.proto == IPPROTO_IPCOMP && !ipcomp_enable)) {
309		DPRINTF(("%s: IPsec outbound packet dropped due"
310			" to policy (check your sysctls)\n", __func__));
311		IPSEC_OSTAT(espstat.esps_pdrops, ahstat.ahs_pdrops,
312		    ipcompstat.ipcomps_pdrops);
313		*error = EHOSTUNREACH;
314		goto bad;
315	}
316
317	/*
318	 * Sanity check the SA contents for the caller
319	 * before they invoke the xform output method.
320	 */
321	if (sav->tdb_xform == NULL) {
322		DPRINTF(("%s: no transform for SA\n", __func__));
323		IPSEC_OSTAT(espstat.esps_noxform, ahstat.ahs_noxform,
324		    ipcompstat.ipcomps_noxform);
325		*error = EHOSTUNREACH;
326		goto bad;
327	}
328	return isr;
329bad:
330	IPSEC_ASSERT(*error != 0, ("error return w/ no error code"));
331	IPSECREQUEST_UNLOCK(isr);
332	return NULL;
333#undef IPSEC_OSTAT
334}
335
336#ifdef INET
337/*
338 * IPsec output logic for IPv4.
339 */
340int
341ipsec4_process_packet(
342	struct mbuf *m,
343	struct ipsecrequest *isr,
344	int flags,
345	int tunalready)
346{
347	struct secasindex saidx;
348	struct secasvar *sav;
349	struct ip *ip;
350	int error, i, off;
351
352	IPSEC_ASSERT(m != NULL, ("null mbuf"));
353	IPSEC_ASSERT(isr != NULL, ("null isr"));
354
355	IPSECREQUEST_LOCK(isr);		/* insure SA contents don't change */
356
357	isr = ipsec_nextisr(m, isr, AF_INET, &saidx, &error);
358	if (isr == NULL)
359		goto bad;
360
361	sav = isr->sav;
362
363#ifdef DEV_ENC
364	/* pass the mbuf to enc0 for packet filtering */
365	if ((error = ipsec_filter(&m, 2)) != 0)
366		goto bad;
367#endif
368
369	if (!tunalready) {
370		union sockaddr_union *dst = &sav->sah->saidx.dst;
371		int setdf;
372
373		/*
374		 * Collect IP_DF state from the outer header.
375		 */
376		if (dst->sa.sa_family == AF_INET) {
377			if (m->m_len < sizeof (struct ip) &&
378			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
379				error = ENOBUFS;
380				goto bad;
381			}
382			ip = mtod(m, struct ip *);
383			/* Honor system-wide control of how to handle IP_DF */
384			switch (ip4_ipsec_dfbit) {
385			case 0:			/* clear in outer header */
386			case 1:			/* set in outer header */
387				setdf = ip4_ipsec_dfbit;
388				break;
389			default:		/* propagate to outer header */
390				setdf = ntohs(ip->ip_off & IP_DF);
391				break;
392			}
393		} else {
394			ip = NULL;		/* keep compiler happy */
395			setdf = 0;
396		}
397		/* Do the appropriate encapsulation, if necessary */
398		if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
399		    dst->sa.sa_family != AF_INET ||	    /* PF mismatch */
400#if 0
401		    (sav->flags & SADB_X_SAFLAGS_TUNNEL) || /* Tunnel requ'd */
402		    sav->tdb_xform->xf_type == XF_IP4 ||    /* ditto */
403#endif
404		    (dst->sa.sa_family == AF_INET &&	    /* Proxy */
405		     dst->sin.sin_addr.s_addr != INADDR_ANY &&
406		     dst->sin.sin_addr.s_addr != ip->ip_dst.s_addr)) {
407			struct mbuf *mp;
408
409			/* Fix IPv4 header checksum and length */
410			if (m->m_len < sizeof (struct ip) &&
411			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
412				error = ENOBUFS;
413				goto bad;
414			}
415			ip = mtod(m, struct ip *);
416			ip->ip_len = htons(m->m_pkthdr.len);
417			ip->ip_sum = 0;
418#ifdef _IP_VHL
419			if (ip->ip_vhl == IP_VHL_BORING)
420				ip->ip_sum = in_cksum_hdr(ip);
421			else
422				ip->ip_sum = in_cksum(m,
423					_IP_VHL_HL(ip->ip_vhl) << 2);
424#else
425			ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
426#endif
427
428			/* Encapsulate the packet */
429			error = ipip_output(m, isr, &mp, 0, 0);
430			if (mp == NULL && !error) {
431				/* Should never happen. */
432				DPRINTF(("%s: ipip_output returns no mbuf and "
433					"no error!", __func__));
434				error = EFAULT;
435			}
436			if (error) {
437				if (mp) {
438					/* XXX: Should never happen! */
439					m_freem(mp);
440				}
441				m = NULL; /* ipip_output() already freed it */
442				goto bad;
443			}
444			m = mp, mp = NULL;
445			/*
446			 * ipip_output clears IP_DF in the new header.  If
447			 * we need to propagate IP_DF from the outer header,
448			 * then we have to do it here.
449			 *
450			 * XXX shouldn't assume what ipip_output does.
451			 */
452			if (dst->sa.sa_family == AF_INET && setdf) {
453				if (m->m_len < sizeof (struct ip) &&
454				    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
455					error = ENOBUFS;
456					goto bad;
457				}
458				ip = mtod(m, struct ip *);
459				ip->ip_off = ntohs(ip->ip_off);
460				ip->ip_off |= IP_DF;
461				ip->ip_off = htons(ip->ip_off);
462			}
463		}
464	}
465
466#ifdef DEV_ENC
467	/* pass the mbuf to enc0 for bpf processing */
468	ipsec_bpf(m, sav, AF_INET);
469#endif
470
471	/*
472	 * Dispatch to the appropriate IPsec transform logic.  The
473	 * packet will be returned for transmission after crypto
474	 * processing, etc. are completed.  For encapsulation we
475	 * bypass this call because of the explicit call done above
476	 * (necessary to deal with IP_DF handling for IPv4).
477	 *
478	 * NB: m & sav are ``passed to caller'' who's reponsible for
479	 *     for reclaiming their resources.
480	 */
481	if (sav->tdb_xform->xf_type != XF_IP4) {
482		ip = mtod(m, struct ip *);
483		i = ip->ip_hl << 2;
484		off = offsetof(struct ip, ip_p);
485		error = (*sav->tdb_xform->xf_output)(m, isr, NULL, i, off);
486	} else {
487		error = ipsec_process_done(m, isr);
488	}
489	IPSECREQUEST_UNLOCK(isr);
490	return error;
491bad:
492	if (isr)
493		IPSECREQUEST_UNLOCK(isr);
494	if (m)
495		m_freem(m);
496	return error;
497}
498#endif
499
500#ifdef INET6
501/*
502 * Chop IP6 header from the payload.
503 */
504static struct mbuf *
505ipsec6_splithdr(struct mbuf *m)
506{
507	struct mbuf *mh;
508	struct ip6_hdr *ip6;
509	int hlen;
510
511	IPSEC_ASSERT(m->m_len >= sizeof (struct ip6_hdr),
512		("first mbuf too short, len %u", m->m_len));
513	ip6 = mtod(m, struct ip6_hdr *);
514	hlen = sizeof(struct ip6_hdr);
515	if (m->m_len > hlen) {
516		MGETHDR(mh, M_DONTWAIT, MT_DATA);
517		if (!mh) {
518			m_freem(m);
519			return NULL;
520		}
521		M_MOVE_PKTHDR(mh, m);
522		MH_ALIGN(mh, hlen);
523		m->m_len -= hlen;
524		m->m_data += hlen;
525		mh->m_next = m;
526		m = mh;
527		m->m_len = hlen;
528		bcopy((caddr_t)ip6, mtod(m, caddr_t), hlen);
529	} else if (m->m_len < hlen) {
530		m = m_pullup(m, hlen);
531		if (!m)
532			return NULL;
533	}
534	return m;
535}
536
537/*
538 * IPsec output logic for IPv6, transport mode.
539 */
540int
541ipsec6_output_trans(
542	struct ipsec_output_state *state,
543	u_char *nexthdrp,
544	struct mbuf *mprev,
545	struct secpolicy *sp,
546	int flags,
547	int *tun)
548{
549	struct ipsecrequest *isr;
550	struct secasindex saidx;
551	int error = 0;
552	struct mbuf *m;
553
554	IPSEC_ASSERT(state != NULL, ("null state"));
555	IPSEC_ASSERT(state->m != NULL, ("null m"));
556	IPSEC_ASSERT(nexthdrp != NULL, ("null nexthdrp"));
557	IPSEC_ASSERT(mprev != NULL, ("null mprev"));
558	IPSEC_ASSERT(sp != NULL, ("null sp"));
559	IPSEC_ASSERT(tun != NULL, ("null tun"));
560
561	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
562		printf("%s: applied SP\n", __func__);
563		kdebug_secpolicy(sp));
564
565	isr = sp->req;
566	if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
567		/* the rest will be handled by ipsec6_output_tunnel() */
568		*tun = 1;		/* need tunnel-mode processing */
569		return 0;
570	}
571
572	*tun = 0;
573	m = state->m;
574
575	IPSECREQUEST_LOCK(isr);		/* insure SA contents don't change */
576	isr = ipsec_nextisr(m, isr, AF_INET6, &saidx, &error);
577	if (isr == NULL) {
578#ifdef notdef
579		/* XXX should notification be done for all errors ? */
580		/*
581		 * Notify the fact that the packet is discarded
582		 * to ourselves. I believe this is better than
583		 * just silently discarding. (jinmei@kame.net)
584		 * XXX: should we restrict the error to TCP packets?
585		 * XXX: should we directly notify sockets via
586		 *      pfctlinputs?
587		 */
588		icmp6_error(m, ICMP6_DST_UNREACH,
589			    ICMP6_DST_UNREACH_ADMIN, 0);
590		m = NULL;	/* NB: icmp6_error frees mbuf */
591#endif
592		goto bad;
593	}
594
595	error = (*isr->sav->tdb_xform->xf_output)(m, isr, NULL,
596						  sizeof (struct ip6_hdr),
597						  offsetof(struct ip6_hdr,
598							   ip6_nxt));
599	IPSECREQUEST_UNLOCK(isr);
600	return error;
601bad:
602	if (isr)
603		IPSECREQUEST_UNLOCK(isr);
604	if (m)
605		m_freem(m);
606	state->m = NULL;
607	return error;
608}
609
610static int
611ipsec6_encapsulate(struct mbuf *m, struct secasvar *sav)
612{
613	struct ip6_hdr *oip6;
614	struct ip6_hdr *ip6;
615	size_t plen;
616
617	/* can't tunnel between different AFs */
618	if (sav->sah->saidx.src.sa.sa_family != AF_INET6 ||
619	    sav->sah->saidx.dst.sa.sa_family != AF_INET6) {
620		m_freem(m);
621		return EINVAL;
622	}
623	IPSEC_ASSERT(m->m_len == sizeof (struct ip6_hdr),
624		("mbuf wrong size; len %u", m->m_len));
625
626
627	/*
628	 * grow the mbuf to accomodate the new IPv6 header.
629	 */
630	plen = m->m_pkthdr.len;
631	if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
632		struct mbuf *n;
633		MGET(n, M_DONTWAIT, MT_DATA);
634		if (!n) {
635			m_freem(m);
636			return ENOBUFS;
637		}
638		n->m_len = sizeof(struct ip6_hdr);
639		n->m_next = m->m_next;
640		m->m_next = n;
641		m->m_pkthdr.len += sizeof(struct ip6_hdr);
642		oip6 = mtod(n, struct ip6_hdr *);
643	} else {
644		m->m_next->m_len += sizeof(struct ip6_hdr);
645		m->m_next->m_data -= sizeof(struct ip6_hdr);
646		m->m_pkthdr.len += sizeof(struct ip6_hdr);
647		oip6 = mtod(m->m_next, struct ip6_hdr *);
648	}
649	ip6 = mtod(m, struct ip6_hdr *);
650	bcopy((caddr_t)ip6, (caddr_t)oip6, sizeof(struct ip6_hdr));
651
652	/* Fake link-local scope-class addresses */
653	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
654		oip6->ip6_src.s6_addr16[1] = 0;
655	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
656		oip6->ip6_dst.s6_addr16[1] = 0;
657
658	/* construct new IPv6 header. see RFC 2401 5.1.2.2 */
659	/* ECN consideration. */
660	ip6_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &oip6->ip6_flow);
661	if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
662		ip6->ip6_plen = htons(plen);
663	else {
664		/* ip6->ip6_plen will be updated in ip6_output() */
665	}
666	ip6->ip6_nxt = IPPROTO_IPV6;
667	ip6->ip6_src = sav->sah->saidx.src.sin6.sin6_addr;
668	ip6->ip6_dst = sav->sah->saidx.dst.sin6.sin6_addr;
669	ip6->ip6_hlim = IPV6_DEFHLIM;
670
671	/* XXX Should ip6_src be updated later ? */
672
673	return 0;
674}
675
676/*
677 * IPsec output logic for IPv6, tunnel mode.
678 */
679int
680ipsec6_output_tunnel(struct ipsec_output_state *state, struct secpolicy *sp, int flags)
681{
682	struct ip6_hdr *ip6;
683	struct ipsecrequest *isr;
684	struct secasindex saidx;
685	int error;
686	struct sockaddr_in6* dst6;
687	struct mbuf *m;
688
689	IPSEC_ASSERT(state != NULL, ("null state"));
690	IPSEC_ASSERT(state->m != NULL, ("null m"));
691	IPSEC_ASSERT(sp != NULL, ("null sp"));
692
693	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
694		printf("%s: applied SP\n", __func__);
695		kdebug_secpolicy(sp));
696
697	m = state->m;
698	/*
699	 * transport mode ipsec (before the 1st tunnel mode) is already
700	 * processed by ipsec6_output_trans().
701	 */
702	for (isr = sp->req; isr; isr = isr->next) {
703		if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
704			break;
705	}
706
707	IPSECREQUEST_LOCK(isr);		/* insure SA contents don't change */
708	isr = ipsec_nextisr(m, isr, AF_INET6, &saidx, &error);
709	if (isr == NULL)
710		goto bad;
711
712	/*
713	 * There may be the case that SA status will be changed when
714	 * we are refering to one. So calling splsoftnet().
715	 */
716	if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
717		/*
718		 * build IPsec tunnel.
719		 */
720		/* XXX should be processed with other familiy */
721		if (isr->sav->sah->saidx.src.sa.sa_family != AF_INET6) {
722			ipseclog((LOG_ERR, "%s: family mismatched between "
723			    "inner and outer, spi=%u\n", __func__,
724			    ntohl(isr->sav->spi)));
725			ipsec6stat.ips_out_inval++;
726			error = EAFNOSUPPORT;
727			goto bad;
728		}
729
730		m = ipsec6_splithdr(m);
731		if (!m) {
732			ipsec6stat.ips_out_nomem++;
733			error = ENOMEM;
734			goto bad;
735		}
736		error = ipsec6_encapsulate(m, isr->sav);
737		if (error) {
738			m = NULL;
739			goto bad;
740		}
741		ip6 = mtod(m, struct ip6_hdr *);
742
743		state->ro = &isr->sav->sah->sa_route;
744		state->dst = (struct sockaddr *)&state->ro->ro_dst;
745		dst6 = (struct sockaddr_in6 *)state->dst;
746		if (state->ro->ro_rt
747		 && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
748		  || !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst))) {
749			RTFREE(state->ro->ro_rt);
750			state->ro->ro_rt = NULL;
751		}
752		if (state->ro->ro_rt == 0) {
753			bzero(dst6, sizeof(*dst6));
754			dst6->sin6_family = AF_INET6;
755			dst6->sin6_len = sizeof(*dst6);
756			dst6->sin6_addr = ip6->ip6_dst;
757			rtalloc(state->ro);
758		}
759		if (state->ro->ro_rt == 0) {
760			ip6stat.ip6s_noroute++;
761			ipsec6stat.ips_out_noroute++;
762			error = EHOSTUNREACH;
763			goto bad;
764		}
765
766		/* adjust state->dst if tunnel endpoint is offlink */
767		if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
768			state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
769			dst6 = (struct sockaddr_in6 *)state->dst;
770		}
771	}
772
773	m = ipsec6_splithdr(m);
774	if (!m) {
775		ipsec6stat.ips_out_nomem++;
776		error = ENOMEM;
777		goto bad;
778	}
779	ip6 = mtod(m, struct ip6_hdr *);
780	error = (*isr->sav->tdb_xform->xf_output)(m, isr, NULL,
781		sizeof (struct ip6_hdr),
782		offsetof(struct ip6_hdr, ip6_nxt));
783	IPSECREQUEST_UNLOCK(isr);
784	return error;
785bad:
786	if (isr)
787		IPSECREQUEST_UNLOCK(isr);
788	if (m)
789		m_freem(m);
790	state->m = NULL;
791	return error;
792}
793#endif /*INET6*/
794