ipsec_output.c revision 117056
1112758Ssam/*-
2112758Ssam * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3112758Ssam * All rights reserved.
4112758Ssam *
5112758Ssam * Redistribution and use in source and binary forms, with or without
6112758Ssam * modification, are permitted provided that the following conditions
7112758Ssam * are met:
8112758Ssam * 1. Redistributions of source code must retain the above copyright
9112758Ssam *    notice, this list of conditions and the following disclaimer.
10112758Ssam * 2. Redistributions in binary form must reproduce the above copyright
11112758Ssam *    notice, this list of conditions and the following disclaimer in the
12112758Ssam *    documentation and/or other materials provided with the distribution.
13112758Ssam *
14112758Ssam * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15112758Ssam * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16112758Ssam * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17112758Ssam * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18112758Ssam * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19112758Ssam * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20112758Ssam * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21112758Ssam * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22112758Ssam * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23112758Ssam * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24112758Ssam * SUCH DAMAGE.
25112758Ssam *
26112758Ssam * $FreeBSD: head/sys/netipsec/ipsec_output.c 117056 2003-06-30 05:05:19Z sam $
27112758Ssam */
28105197Ssam
29105197Ssam/*
30105197Ssam * IPsec output processing.
31105197Ssam */
32105197Ssam#include "opt_inet.h"
33105197Ssam#include "opt_inet6.h"
34105197Ssam#include "opt_ipsec.h"
35105197Ssam
36105197Ssam#include <sys/param.h>
37105197Ssam#include <sys/systm.h>
38105197Ssam#include <sys/mbuf.h>
39105197Ssam#include <sys/domain.h>
40105197Ssam#include <sys/protosw.h>
41105197Ssam#include <sys/socket.h>
42105197Ssam#include <sys/errno.h>
43105197Ssam#include <sys/syslog.h>
44105197Ssam
45105197Ssam#include <net/if.h>
46105197Ssam#include <net/route.h>
47105197Ssam
48105197Ssam#include <netinet/in.h>
49105197Ssam#include <netinet/in_systm.h>
50105197Ssam#include <netinet/ip.h>
51105197Ssam#include <netinet/ip_var.h>
52105197Ssam#include <netinet/in_var.h>
53105197Ssam#include <netinet/ip_ecn.h>
54105197Ssam#ifdef INET6
55105197Ssam#include <netinet6/ip6_ecn.h>
56105197Ssam#endif
57105197Ssam
58105197Ssam#include <netinet/ip6.h>
59105197Ssam#ifdef INET6
60105197Ssam#include <netinet6/ip6_var.h>
61105197Ssam#endif
62105197Ssam#include <netinet/in_pcb.h>
63105197Ssam#ifdef INET6
64105197Ssam#include <netinet/icmp6.h>
65105197Ssam#endif
66105197Ssam
67105197Ssam#include <netipsec/ipsec.h>
68105197Ssam#ifdef INET6
69105197Ssam#include <netipsec/ipsec6.h>
70105197Ssam#endif
71105197Ssam#include <netipsec/ah_var.h>
72105197Ssam#include <netipsec/esp_var.h>
73105197Ssam#include <netipsec/ipcomp_var.h>
74105197Ssam
75105197Ssam#include <netipsec/xform.h>
76105197Ssam
77105197Ssam#include <netipsec/key.h>
78105197Ssam#include <netipsec/keydb.h>
79105197Ssam#include <netipsec/key_debug.h>
80105197Ssam
81105197Ssam#include <machine/in_cksum.h>
82105197Ssam
83105197Ssamint
84105197Ssamipsec_process_done(struct mbuf *m, struct ipsecrequest *isr)
85105197Ssam{
86105197Ssam	struct tdb_ident *tdbi;
87105197Ssam	struct m_tag *mtag;
88105197Ssam	struct secasvar *sav;
89105197Ssam	struct secasindex *saidx;
90105197Ssam	int error;
91105197Ssam
92105197Ssam#if 0
93105197Ssam	SPLASSERT(net, "ipsec_process_done");
94105197Ssam#endif
95105197Ssam
96105197Ssam	KASSERT(m != NULL, ("ipsec_process_done: null mbuf"));
97105197Ssam	KASSERT(isr != NULL, ("ipsec_process_done: null ISR"));
98105197Ssam	sav = isr->sav;
99105197Ssam	KASSERT(sav != NULL, ("ipsec_process_done: null SA"));
100105197Ssam	KASSERT(sav->sah != NULL, ("ipsec_process_done: null SAH"));
101105197Ssam
102105197Ssam	saidx = &sav->sah->saidx;
103105197Ssam	switch (saidx->dst.sa.sa_family) {
104105197Ssam#ifdef INET
105105197Ssam	case AF_INET:
106105197Ssam		/* Fix the header length, for AH processing. */
107105197Ssam		mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
108105197Ssam		break;
109105197Ssam#endif /* INET */
110105197Ssam#ifdef INET6
111105197Ssam	case AF_INET6:
112105197Ssam		/* Fix the header length, for AH processing. */
113105197Ssam		if (m->m_pkthdr.len < sizeof (struct ip6_hdr)) {
114105197Ssam			error = ENXIO;
115105197Ssam			goto bad;
116105197Ssam		}
117105197Ssam		if (m->m_pkthdr.len - sizeof (struct ip6_hdr) > IPV6_MAXPACKET) {
118105197Ssam			/* No jumbogram support. */
119105197Ssam			error = ENXIO;	/*?*/
120105197Ssam			goto bad;
121105197Ssam		}
122105197Ssam		mtod(m, struct ip6_hdr *)->ip6_plen =
123105197Ssam			htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
124105197Ssam		break;
125105197Ssam#endif /* INET6 */
126105197Ssam	default:
127105197Ssam		DPRINTF(("ipsec_process_done: unknown protocol family %u\n",
128105197Ssam		    saidx->dst.sa.sa_family));
129105197Ssam		error = ENXIO;
130105197Ssam		goto bad;
131105197Ssam	}
132105197Ssam
133105197Ssam	/*
134105197Ssam	 * Add a record of what we've done or what needs to be done to the
135105197Ssam	 * packet.
136105197Ssam	 */
137105197Ssam	mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE,
138105197Ssam			sizeof(struct tdb_ident), M_NOWAIT);
139105197Ssam	if (mtag == NULL) {
140105197Ssam		DPRINTF(("ipsec_process_done: could not get packet tag\n"));
141105197Ssam		error = ENOMEM;
142105197Ssam		goto bad;
143105197Ssam	}
144105197Ssam
145105197Ssam	tdbi = (struct tdb_ident *)(mtag + 1);
146105197Ssam	tdbi->dst = saidx->dst;
147105197Ssam	tdbi->proto = saidx->proto;
148105197Ssam	tdbi->spi = sav->spi;
149105197Ssam	m_tag_prepend(m, mtag);
150105197Ssam
151105197Ssam	/*
152105197Ssam	 * If there's another (bundled) SA to apply, do so.
153105197Ssam	 * Note that this puts a burden on the kernel stack size.
154105197Ssam	 * If this is a problem we'll need to introduce a queue
155105197Ssam	 * to set the packet on so we can unwind the stack before
156105197Ssam	 * doing further processing.
157105197Ssam	 */
158105197Ssam	if (isr->next) {
159105197Ssam		newipsecstat.ips_out_bundlesa++;
160105197Ssam		return ipsec4_process_packet(m, isr->next, 0, 0);
161105197Ssam	}
162117056Ssam	key_sa_recordxfer(sav, m);		/* record data transfer */
163105197Ssam
164105197Ssam	/*
165105197Ssam	 * We're done with IPsec processing, transmit the packet using the
166105197Ssam	 * appropriate network protocol (IP or IPv6). SPD lookup will be
167105197Ssam	 * performed again there.
168105197Ssam	 */
169105197Ssam	switch (saidx->dst.sa.sa_family) {
170105197Ssam#ifdef INET
171105197Ssam	struct ip *ip;
172105197Ssam	case AF_INET:
173105197Ssam		ip = mtod(m, struct ip *);
174105197Ssam		ip->ip_len = ntohs(ip->ip_len);
175105197Ssam		ip->ip_off = ntohs(ip->ip_off);
176105197Ssam
177105197Ssam		return ip_output(m, NULL, NULL, IP_RAWOUTPUT, NULL, NULL);
178105197Ssam#endif /* INET */
179105197Ssam#ifdef INET6
180105197Ssam	case AF_INET6:
181105197Ssam		/*
182105197Ssam		 * We don't need massage, IPv6 header fields are always in
183105197Ssam		 * net endian.
184105197Ssam		 */
185105197Ssam		return ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
186105197Ssam#endif /* INET6 */
187105197Ssam	}
188105197Ssam	panic("ipsec_process_done");
189105197Ssambad:
190105197Ssam	m_freem(m);
191105197Ssam	KEY_FREESAV(&sav);
192105197Ssam	return (error);
193105197Ssam}
194105197Ssam
195105197Ssamstatic struct ipsecrequest *
196105197Ssamipsec_nextisr(
197105197Ssam	struct mbuf *m,
198105197Ssam	struct ipsecrequest *isr,
199105197Ssam	int af,
200105197Ssam	struct secasindex *saidx,
201105197Ssam	int *error
202105197Ssam)
203105197Ssam{
204105197Ssam#define IPSEC_OSTAT(x,y,z) (isr->saidx.proto == IPPROTO_ESP ? (x)++ : \
205105197Ssam			    isr->saidx.proto == IPPROTO_AH ? (y)++ : (z)++)
206105197Ssam	struct secasvar *sav;
207105197Ssam
208105197Ssam#if 0
209105197Ssam	SPLASSERT(net, "ipsec_nextisr");
210105197Ssam#endif
211105197Ssam	KASSERT(af == AF_INET || af == AF_INET6,
212105197Ssam		("ipsec_nextisr: invalid address family %u", af));
213105197Ssamagain:
214105197Ssam	/*
215105197Ssam	 * Craft SA index to search for proper SA.  Note that
216105197Ssam	 * we only fillin unspecified SA peers for transport
217105197Ssam	 * mode; for tunnel mode they must already be filled in.
218105197Ssam	 */
219105197Ssam	*saidx = isr->saidx;
220105197Ssam	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
221105197Ssam		/* Fillin unspecified SA peers only for transport mode */
222105197Ssam		if (af == AF_INET) {
223105197Ssam			struct sockaddr_in *sin;
224105197Ssam			struct ip *ip = mtod(m, struct ip *);
225105197Ssam
226105197Ssam			if (saidx->src.sa.sa_len == 0) {
227105197Ssam				sin = &saidx->src.sin;
228105197Ssam				sin->sin_len = sizeof(*sin);
229105197Ssam				sin->sin_family = AF_INET;
230105197Ssam				sin->sin_port = IPSEC_PORT_ANY;
231105197Ssam				sin->sin_addr = ip->ip_src;
232105197Ssam			}
233105197Ssam			if (saidx->dst.sa.sa_len == 0) {
234105197Ssam				sin = &saidx->dst.sin;
235105197Ssam				sin->sin_len = sizeof(*sin);
236105197Ssam				sin->sin_family = AF_INET;
237105197Ssam				sin->sin_port = IPSEC_PORT_ANY;
238105197Ssam				sin->sin_addr = ip->ip_dst;
239105197Ssam			}
240105197Ssam		} else {
241105197Ssam			struct sockaddr_in6 *sin6;
242105197Ssam			struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
243105197Ssam
244105197Ssam			if (saidx->src.sin6.sin6_len == 0) {
245105197Ssam				sin6 = (struct sockaddr_in6 *)&saidx->src;
246105197Ssam				sin6->sin6_len = sizeof(*sin6);
247105197Ssam				sin6->sin6_family = AF_INET6;
248105197Ssam				sin6->sin6_port = IPSEC_PORT_ANY;
249105197Ssam				sin6->sin6_addr = ip6->ip6_src;
250105197Ssam				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
251105197Ssam					/* fix scope id for comparing SPD */
252105197Ssam					sin6->sin6_addr.s6_addr16[1] = 0;
253105197Ssam					sin6->sin6_scope_id =
254105197Ssam					    ntohs(ip6->ip6_src.s6_addr16[1]);
255105197Ssam				}
256105197Ssam			}
257105197Ssam			if (saidx->dst.sin6.sin6_len == 0) {
258105197Ssam				sin6 = (struct sockaddr_in6 *)&saidx->dst;
259105197Ssam				sin6->sin6_len = sizeof(*sin6);
260105197Ssam				sin6->sin6_family = AF_INET6;
261105197Ssam				sin6->sin6_port = IPSEC_PORT_ANY;
262105197Ssam				sin6->sin6_addr = ip6->ip6_dst;
263105197Ssam				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
264105197Ssam					/* fix scope id for comparing SPD */
265105197Ssam					sin6->sin6_addr.s6_addr16[1] = 0;
266105197Ssam					sin6->sin6_scope_id =
267105197Ssam					    ntohs(ip6->ip6_dst.s6_addr16[1]);
268105197Ssam				}
269105197Ssam			}
270105197Ssam		}
271105197Ssam	}
272105197Ssam
273105197Ssam	/*
274105197Ssam	 * Lookup SA and validate it.
275105197Ssam	 */
276105197Ssam	*error = key_checkrequest(isr, saidx);
277105197Ssam	if (*error != 0) {
278105197Ssam		/*
279105197Ssam		 * IPsec processing is required, but no SA found.
280105197Ssam		 * I assume that key_acquire() had been called
281105197Ssam		 * to get/establish the SA. Here I discard
282105197Ssam		 * this packet because it is responsibility for
283105197Ssam		 * upper layer to retransmit the packet.
284105197Ssam		 */
285105197Ssam		newipsecstat.ips_out_nosa++;
286105197Ssam		goto bad;
287105197Ssam	}
288105197Ssam	sav = isr->sav;
289105197Ssam	if (sav == NULL) {		/* XXX valid return */
290105197Ssam		KASSERT(ipsec_get_reqlevel(isr) == IPSEC_LEVEL_USE,
291105197Ssam			("ipsec_nextisr: no SA found, but required; level %u",
292105197Ssam			ipsec_get_reqlevel(isr)));
293105197Ssam		isr = isr->next;
294105197Ssam		if (isr == NULL) {
295105197Ssam			/*XXXstatistic??*/
296105197Ssam			*error = EINVAL;		/*XXX*/
297105197Ssam			return isr;
298105197Ssam		}
299105197Ssam		goto again;
300105197Ssam	}
301105197Ssam
302105197Ssam	/*
303105197Ssam	 * Check system global policy controls.
304105197Ssam	 */
305105197Ssam	if ((isr->saidx.proto == IPPROTO_ESP && !esp_enable) ||
306105197Ssam	    (isr->saidx.proto == IPPROTO_AH && !ah_enable) ||
307105197Ssam	    (isr->saidx.proto == IPPROTO_IPCOMP && !ipcomp_enable)) {
308105197Ssam		DPRINTF(("ipsec_nextisr: IPsec outbound packet dropped due"
309105197Ssam			" to policy (check your sysctls)\n"));
310105197Ssam		IPSEC_OSTAT(espstat.esps_pdrops, ahstat.ahs_pdrops,
311105197Ssam		    ipcompstat.ipcomps_pdrops);
312105197Ssam		*error = EHOSTUNREACH;
313105197Ssam		goto bad;
314105197Ssam	}
315105197Ssam
316105197Ssam	/*
317105197Ssam	 * Sanity check the SA contents for the caller
318105197Ssam	 * before they invoke the xform output method.
319105197Ssam	 */
320105197Ssam	if (sav->tdb_xform == NULL) {
321105197Ssam		DPRINTF(("ipsec_nextisr: no transform for SA\n"));
322105197Ssam		IPSEC_OSTAT(espstat.esps_noxform, ahstat.ahs_noxform,
323105197Ssam		    ipcompstat.ipcomps_noxform);
324105197Ssam		*error = EHOSTUNREACH;
325105197Ssam		goto bad;
326105197Ssam	}
327105197Ssam	return isr;
328105197Ssambad:
329105197Ssam	KASSERT(*error != 0, ("ipsec_nextisr: error return w/ no error code"));
330105197Ssam	return NULL;
331105197Ssam#undef IPSEC_OSTAT
332105197Ssam}
333105197Ssam
334105197Ssam#ifdef INET
335105197Ssam/*
336105197Ssam * IPsec output logic for IPv4.
337105197Ssam */
338105197Ssamint
339105197Ssamipsec4_process_packet(
340105197Ssam	struct mbuf *m,
341105197Ssam	struct ipsecrequest *isr,
342105197Ssam	int flags,
343105197Ssam	int tunalready)
344105197Ssam{
345105197Ssam	struct secasindex saidx;
346105197Ssam	struct secasvar *sav;
347105197Ssam	struct ip *ip;
348105197Ssam	int s, error, i, off;
349105197Ssam
350105197Ssam	KASSERT(m != NULL, ("ipsec4_process_packet: null mbuf"));
351105197Ssam	KASSERT(isr != NULL, ("ipsec4_process_packet: null isr"));
352105197Ssam
353105197Ssam	s = splnet();			/* insure SA contents don't change */
354105197Ssam
355105197Ssam	isr = ipsec_nextisr(m, isr, AF_INET, &saidx, &error);
356105197Ssam	if (isr == NULL)
357105197Ssam		goto bad;
358105197Ssam
359105197Ssam	sav = isr->sav;
360105197Ssam	if (!tunalready) {
361105197Ssam		union sockaddr_union *dst = &sav->sah->saidx.dst;
362105197Ssam		int setdf;
363105197Ssam
364105197Ssam		/*
365105197Ssam		 * Collect IP_DF state from the outer header.
366105197Ssam		 */
367105197Ssam		if (dst->sa.sa_family == AF_INET) {
368105197Ssam			if (m->m_len < sizeof (struct ip) &&
369105197Ssam			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
370105197Ssam				error = ENOBUFS;
371105197Ssam				goto bad;
372105197Ssam			}
373105197Ssam			ip = mtod(m, struct ip *);
374105197Ssam			/* Honor system-wide control of how to handle IP_DF */
375105197Ssam			switch (ip4_ipsec_dfbit) {
376105197Ssam			case 0:			/* clear in outer header */
377105197Ssam			case 1:			/* set in outer header */
378105197Ssam				setdf = ip4_ipsec_dfbit;
379105197Ssam				break;
380105197Ssam			default:		/* propagate to outer header */
381105197Ssam				setdf = ntohs(ip->ip_off & IP_DF);
382105197Ssam				break;
383105197Ssam			}
384105197Ssam		} else {
385105197Ssam			ip = NULL;		/* keep compiler happy */
386105197Ssam			setdf = 0;
387105197Ssam		}
388105197Ssam		/* Do the appropriate encapsulation, if necessary */
389105197Ssam		if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
390105197Ssam		    dst->sa.sa_family != AF_INET ||	    /* PF mismatch */
391105197Ssam#if 0
392105197Ssam		    (sav->flags & SADB_X_SAFLAGS_TUNNEL) || /* Tunnel requ'd */
393105197Ssam		    sav->tdb_xform->xf_type == XF_IP4 ||    /* ditto */
394105197Ssam#endif
395105197Ssam		    (dst->sa.sa_family == AF_INET &&	    /* Proxy */
396105197Ssam		     dst->sin.sin_addr.s_addr != INADDR_ANY &&
397105197Ssam		     dst->sin.sin_addr.s_addr != ip->ip_dst.s_addr)) {
398105197Ssam			struct mbuf *mp;
399105197Ssam
400105197Ssam			/* Fix IPv4 header checksum and length */
401105197Ssam			if (m->m_len < sizeof (struct ip) &&
402105197Ssam			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
403105197Ssam				error = ENOBUFS;
404105197Ssam				goto bad;
405105197Ssam			}
406105197Ssam			ip = mtod(m, struct ip *);
407105197Ssam			ip->ip_len = htons(m->m_pkthdr.len);
408105197Ssam			ip->ip_sum = 0;
409105197Ssam#ifdef _IP_VHL
410105197Ssam			if (ip->ip_vhl == IP_VHL_BORING)
411105197Ssam				ip->ip_sum = in_cksum_hdr(ip);
412105197Ssam			else
413105197Ssam				ip->ip_sum = in_cksum(m,
414105197Ssam					_IP_VHL_HL(ip->ip_vhl) << 2);
415105197Ssam#else
416105197Ssam			ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
417105197Ssam#endif
418105197Ssam
419105197Ssam			/* Encapsulate the packet */
420105197Ssam			error = ipip_output(m, isr, &mp, 0, 0);
421105197Ssam			if (mp == NULL && !error) {
422105197Ssam				/* Should never happen. */
423105197Ssam				DPRINTF(("ipsec4_process_packet: ipip_output "
424105197Ssam					"returns no mbuf and no error!"));
425105197Ssam				error = EFAULT;
426105197Ssam			}
427105197Ssam			if (error) {
428105197Ssam				if (mp)
429105197Ssam					m_freem(mp);
430105197Ssam				goto bad;
431105197Ssam			}
432105197Ssam			m = mp, mp = NULL;
433105197Ssam			/*
434105197Ssam			 * ipip_output clears IP_DF in the new header.  If
435105197Ssam			 * we need to propagate IP_DF from the outer header,
436105197Ssam			 * then we have to do it here.
437105197Ssam			 *
438105197Ssam			 * XXX shouldn't assume what ipip_output does.
439105197Ssam			 */
440105197Ssam			if (dst->sa.sa_family == AF_INET && setdf) {
441105197Ssam				if (m->m_len < sizeof (struct ip) &&
442105197Ssam				    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
443105197Ssam					error = ENOBUFS;
444105197Ssam					goto bad;
445105197Ssam				}
446105197Ssam				ip = mtod(m, struct ip *);
447105197Ssam				ip->ip_off = ntohs(ip->ip_off);
448105197Ssam				ip->ip_off |= IP_DF;
449105197Ssam				ip->ip_off = htons(ip->ip_off);
450105197Ssam			}
451105197Ssam		}
452105197Ssam	}
453105197Ssam
454105197Ssam	/*
455105197Ssam	 * Dispatch to the appropriate IPsec transform logic.  The
456105197Ssam	 * packet will be returned for transmission after crypto
457105197Ssam	 * processing, etc. are completed.  For encapsulation we
458105197Ssam	 * bypass this call because of the explicit call done above
459105197Ssam	 * (necessary to deal with IP_DF handling for IPv4).
460105197Ssam	 *
461105197Ssam	 * NB: m & sav are ``passed to caller'' who's reponsible for
462105197Ssam	 *     for reclaiming their resources.
463105197Ssam	 */
464105197Ssam	if (sav->tdb_xform->xf_type != XF_IP4) {
465105197Ssam		ip = mtod(m, struct ip *);
466105197Ssam		i = ip->ip_hl << 2;
467105197Ssam		off = offsetof(struct ip, ip_p);
468105197Ssam		error = (*sav->tdb_xform->xf_output)(m, isr, NULL, i, off);
469105197Ssam	} else {
470105197Ssam		error = ipsec_process_done(m, isr);
471105197Ssam	}
472105197Ssam	splx(s);
473105197Ssam	return error;
474105197Ssambad:
475105197Ssam	splx(s);
476105197Ssam	if (m)
477105197Ssam		m_freem(m);
478105197Ssam	return error;
479105197Ssam}
480105197Ssam#endif
481105197Ssam
482105197Ssam#ifdef INET6
483105197Ssam/*
484105197Ssam * Chop IP6 header from the payload.
485105197Ssam */
486105197Ssamstatic struct mbuf *
487105197Ssamipsec6_splithdr(struct mbuf *m)
488105197Ssam{
489105197Ssam	struct mbuf *mh;
490105197Ssam	struct ip6_hdr *ip6;
491105197Ssam	int hlen;
492105197Ssam
493105197Ssam	KASSERT(m->m_len >= sizeof (struct ip6_hdr),
494105197Ssam		("ipsec6_splithdr: first mbuf too short, len %u", m->m_len));
495105197Ssam	ip6 = mtod(m, struct ip6_hdr *);
496105197Ssam	hlen = sizeof(struct ip6_hdr);
497105197Ssam	if (m->m_len > hlen) {
498111119Simp		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
499105197Ssam		if (!mh) {
500105197Ssam			m_freem(m);
501105197Ssam			return NULL;
502105197Ssam		}
503108466Ssam		M_MOVE_PKTHDR(mh, m);
504105197Ssam		MH_ALIGN(mh, hlen);
505105197Ssam		m->m_len -= hlen;
506105197Ssam		m->m_data += hlen;
507105197Ssam		mh->m_next = m;
508105197Ssam		m = mh;
509105197Ssam		m->m_len = hlen;
510105197Ssam		bcopy((caddr_t)ip6, mtod(m, caddr_t), hlen);
511105197Ssam	} else if (m->m_len < hlen) {
512105197Ssam		m = m_pullup(m, hlen);
513105197Ssam		if (!m)
514105197Ssam			return NULL;
515105197Ssam	}
516105197Ssam	return m;
517105197Ssam}
518105197Ssam
519105197Ssam/*
520105197Ssam * IPsec output logic for IPv6, transport mode.
521105197Ssam */
522105197Ssamint
523105197Ssamipsec6_output_trans(
524105197Ssam	struct ipsec_output_state *state,
525105197Ssam	u_char *nexthdrp,
526105197Ssam	struct mbuf *mprev,
527105197Ssam	struct secpolicy *sp,
528105197Ssam	int flags,
529105197Ssam	int *tun)
530105197Ssam{
531105197Ssam	struct ipsecrequest *isr;
532105197Ssam	struct secasindex saidx;
533105197Ssam	int error = 0;
534105197Ssam	struct mbuf *m;
535105197Ssam
536105197Ssam	KASSERT(state != NULL, ("ipsec6_output: null state"));
537105197Ssam	KASSERT(state->m != NULL, ("ipsec6_output: null m"));
538105197Ssam	KASSERT(nexthdrp != NULL, ("ipsec6_output: null nexthdrp"));
539105197Ssam	KASSERT(mprev != NULL, ("ipsec6_output: null mprev"));
540105197Ssam	KASSERT(sp != NULL, ("ipsec6_output: null sp"));
541105197Ssam	KASSERT(tun != NULL, ("ipsec6_output: null tun"));
542105197Ssam
543105197Ssam	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
544105197Ssam		printf("ipsec6_output_trans: applyed SP\n");
545105197Ssam		kdebug_secpolicy(sp));
546105197Ssam
547105197Ssam	isr = sp->req;
548105197Ssam	if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
549105197Ssam		/* the rest will be handled by ipsec6_output_tunnel() */
550105197Ssam		*tun = 1;		/* need tunnel-mode processing */
551105197Ssam		return 0;
552105197Ssam	}
553105197Ssam
554105197Ssam	*tun = 0;
555105197Ssam	m = state->m;
556105197Ssam
557105197Ssam	isr = ipsec_nextisr(m, isr, AF_INET6, &saidx, &error);
558105197Ssam	if (isr == NULL) {
559105197Ssam#ifdef notdef
560105197Ssam		/* XXX should notification be done for all errors ? */
561105197Ssam		/*
562105197Ssam		 * Notify the fact that the packet is discarded
563105197Ssam		 * to ourselves. I believe this is better than
564105197Ssam		 * just silently discarding. (jinmei@kame.net)
565105197Ssam		 * XXX: should we restrict the error to TCP packets?
566105197Ssam		 * XXX: should we directly notify sockets via
567105197Ssam		 *      pfctlinputs?
568105197Ssam		 */
569105197Ssam		icmp6_error(m, ICMP6_DST_UNREACH,
570105197Ssam			    ICMP6_DST_UNREACH_ADMIN, 0);
571105197Ssam		m = NULL;	/* NB: icmp6_error frees mbuf */
572105197Ssam#endif
573105197Ssam		goto bad;
574105197Ssam	}
575105197Ssam
576105197Ssam	return (*isr->sav->tdb_xform->xf_output)(m, isr, NULL,
577105197Ssam		sizeof (struct ip6_hdr),
578105197Ssam		offsetof(struct ip6_hdr, ip6_nxt));
579105197Ssambad:
580105197Ssam	if (m)
581105197Ssam		m_freem(m);
582105197Ssam	state->m = NULL;
583105197Ssam	return error;
584105197Ssam}
585105197Ssam
586105197Ssamstatic int
587105197Ssamipsec6_encapsulate(struct mbuf *m, struct secasvar *sav)
588105197Ssam{
589105197Ssam	struct ip6_hdr *oip6;
590105197Ssam	struct ip6_hdr *ip6;
591105197Ssam	size_t plen;
592105197Ssam
593105197Ssam	/* can't tunnel between different AFs */
594105197Ssam	if (sav->sah->saidx.src.sa.sa_family != AF_INET6 ||
595105197Ssam	    sav->sah->saidx.dst.sa.sa_family != AF_INET6) {
596105197Ssam		m_freem(m);
597105197Ssam		return EINVAL;
598105197Ssam	}
599105197Ssam	KASSERT(m->m_len != sizeof (struct ip6_hdr),
600105197Ssam		("ipsec6_encapsulate: mbuf wrong size; len %u", m->m_len));
601105197Ssam
602105197Ssam
603105197Ssam	/*
604105197Ssam	 * grow the mbuf to accomodate the new IPv6 header.
605105197Ssam	 */
606105197Ssam	plen = m->m_pkthdr.len;
607105197Ssam	if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
608105197Ssam		struct mbuf *n;
609111119Simp		MGET(n, M_DONTWAIT, MT_DATA);
610105197Ssam		if (!n) {
611105197Ssam			m_freem(m);
612105197Ssam			return ENOBUFS;
613105197Ssam		}
614105197Ssam		n->m_len = sizeof(struct ip6_hdr);
615105197Ssam		n->m_next = m->m_next;
616105197Ssam		m->m_next = n;
617105197Ssam		m->m_pkthdr.len += sizeof(struct ip6_hdr);
618105197Ssam		oip6 = mtod(n, struct ip6_hdr *);
619105197Ssam	} else {
620105197Ssam		m->m_next->m_len += sizeof(struct ip6_hdr);
621105197Ssam		m->m_next->m_data -= sizeof(struct ip6_hdr);
622105197Ssam		m->m_pkthdr.len += sizeof(struct ip6_hdr);
623105197Ssam		oip6 = mtod(m->m_next, struct ip6_hdr *);
624105197Ssam	}
625105197Ssam	ip6 = mtod(m, struct ip6_hdr *);
626113076Sdes	bcopy((caddr_t)ip6, (caddr_t)oip6, sizeof(struct ip6_hdr));
627105197Ssam
628105197Ssam	/* Fake link-local scope-class addresses */
629105197Ssam	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
630105197Ssam		oip6->ip6_src.s6_addr16[1] = 0;
631105197Ssam	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
632105197Ssam		oip6->ip6_dst.s6_addr16[1] = 0;
633105197Ssam
634105197Ssam	/* construct new IPv6 header. see RFC 2401 5.1.2.2 */
635105197Ssam	/* ECN consideration. */
636105197Ssam	ip6_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &oip6->ip6_flow);
637105197Ssam	if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
638105197Ssam		ip6->ip6_plen = htons(plen);
639105197Ssam	else {
640105197Ssam		/* ip6->ip6_plen will be updated in ip6_output() */
641105197Ssam	}
642105197Ssam	ip6->ip6_nxt = IPPROTO_IPV6;
643105197Ssam	sav->sah->saidx.src.sin6.sin6_addr = ip6->ip6_src;
644105197Ssam	sav->sah->saidx.dst.sin6.sin6_addr = ip6->ip6_dst;
645105197Ssam	ip6->ip6_hlim = IPV6_DEFHLIM;
646105197Ssam
647105197Ssam	/* XXX Should ip6_src be updated later ? */
648105197Ssam
649105197Ssam	return 0;
650105197Ssam}
651105197Ssam
652105197Ssam/*
653105197Ssam * IPsec output logic for IPv6, tunnel mode.
654105197Ssam */
655105197Ssamint
656105197Ssamipsec6_output_tunnel(struct ipsec_output_state *state, struct secpolicy *sp, int flags)
657105197Ssam{
658105197Ssam	struct ip6_hdr *ip6;
659105197Ssam	struct ipsecrequest *isr;
660105197Ssam	struct secasindex saidx;
661105197Ssam	int error;
662105197Ssam	struct sockaddr_in6* dst6;
663105197Ssam	struct mbuf *m;
664105197Ssam
665105197Ssam	KASSERT(state != NULL, ("ipsec6_output: null state"));
666105197Ssam	KASSERT(state->m != NULL, ("ipsec6_output: null m"));
667105197Ssam	KASSERT(sp != NULL, ("ipsec6_output: null sp"));
668105197Ssam
669105197Ssam	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
670105197Ssam		printf("ipsec6_output_tunnel: applyed SP\n");
671105197Ssam		kdebug_secpolicy(sp));
672105197Ssam
673105197Ssam	m = state->m;
674105197Ssam	/*
675105197Ssam	 * transport mode ipsec (before the 1st tunnel mode) is already
676105197Ssam	 * processed by ipsec6_output_trans().
677105197Ssam	 */
678105197Ssam	for (isr = sp->req; isr; isr = isr->next) {
679105197Ssam		if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
680105197Ssam			break;
681105197Ssam	}
682105197Ssam	isr = ipsec_nextisr(m, isr, AF_INET6, &saidx, &error);
683105197Ssam	if (isr == NULL)
684105197Ssam		goto bad;
685105197Ssam
686105197Ssam	/*
687105197Ssam	 * There may be the case that SA status will be changed when
688105197Ssam	 * we are refering to one. So calling splsoftnet().
689105197Ssam	 */
690105197Ssam	if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
691105197Ssam		/*
692105197Ssam		 * build IPsec tunnel.
693105197Ssam		 */
694105197Ssam		/* XXX should be processed with other familiy */
695105197Ssam		if (isr->sav->sah->saidx.src.sa.sa_family != AF_INET6) {
696105197Ssam			ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
697105197Ssam			    "family mismatched between inner and outer, spi=%u\n",
698105197Ssam			    ntohl(isr->sav->spi)));
699105197Ssam			newipsecstat.ips_out_inval++;
700105197Ssam			error = EAFNOSUPPORT;
701105197Ssam			goto bad;
702105197Ssam		}
703105197Ssam
704105197Ssam		m = ipsec6_splithdr(m);
705105197Ssam		if (!m) {
706105197Ssam			newipsecstat.ips_out_nomem++;
707105197Ssam			error = ENOMEM;
708105197Ssam			goto bad;
709105197Ssam		}
710105197Ssam		error = ipsec6_encapsulate(m, isr->sav);
711105197Ssam		if (error) {
712105197Ssam			m = NULL;
713105197Ssam			goto bad;
714105197Ssam		}
715105197Ssam		ip6 = mtod(m, struct ip6_hdr *);
716105197Ssam
717105197Ssam		state->ro = &isr->sav->sah->sa_route;
718105197Ssam		state->dst = (struct sockaddr *)&state->ro->ro_dst;
719105197Ssam		dst6 = (struct sockaddr_in6 *)state->dst;
720105197Ssam		if (state->ro->ro_rt
721105197Ssam		 && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
722105197Ssam		  || !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst))) {
723105197Ssam			RTFREE(state->ro->ro_rt);
724105197Ssam			state->ro->ro_rt = NULL;
725105197Ssam		}
726105197Ssam		if (state->ro->ro_rt == 0) {
727105197Ssam			bzero(dst6, sizeof(*dst6));
728105197Ssam			dst6->sin6_family = AF_INET6;
729105197Ssam			dst6->sin6_len = sizeof(*dst6);
730105197Ssam			dst6->sin6_addr = ip6->ip6_dst;
731105197Ssam			rtalloc(state->ro);
732105197Ssam		}
733105197Ssam		if (state->ro->ro_rt == 0) {
734105197Ssam			ip6stat.ip6s_noroute++;
735105197Ssam			newipsecstat.ips_out_noroute++;
736105197Ssam			error = EHOSTUNREACH;
737105197Ssam			goto bad;
738105197Ssam		}
739105197Ssam
740105197Ssam		/* adjust state->dst if tunnel endpoint is offlink */
741105197Ssam		if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
742105197Ssam			state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
743105197Ssam			dst6 = (struct sockaddr_in6 *)state->dst;
744105197Ssam		}
745105197Ssam	}
746105197Ssam
747105197Ssam	m = ipsec6_splithdr(m);
748105197Ssam	if (!m) {
749105197Ssam		newipsecstat.ips_out_nomem++;
750105197Ssam		error = ENOMEM;
751105197Ssam		goto bad;
752105197Ssam	}
753105197Ssam	ip6 = mtod(m, struct ip6_hdr *);
754105197Ssam	return (*isr->sav->tdb_xform->xf_output)(m, isr, NULL,
755105197Ssam		sizeof (struct ip6_hdr),
756105197Ssam		offsetof(struct ip6_hdr, ip6_nxt));
757105197Ssambad:
758105197Ssam	if (m)
759105197Ssam		m_freem(m);
760105197Ssam	state->m = NULL;
761105197Ssam	return error;
762105197Ssam}
763105197Ssam#endif /*INET6*/
764