xref: /netbsd-src/sys/netipsec/ipsecif.c (revision deb6f0161a9109e7de9b519dc8dfb9478668dcdd)
1 /*	$NetBSD: ipsecif.c,v 1.12 2018/12/07 09:11:04 knakahara Exp $  */
2 
3 /*
4  * Copyright (c) 2017 Internet Initiative Japan Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __KERNEL_RCSID(0, "$NetBSD: ipsecif.c,v 1.12 2018/12/07 09:11:04 knakahara Exp $");
31 
32 #ifdef _KERNEL_OPT
33 #include "opt_inet.h"
34 #include "opt_ipsec.h"
35 #endif
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/socket.h>
40 #include <sys/sockio.h>
41 #include <sys/mbuf.h>
42 #include <sys/errno.h>
43 #include <sys/ioctl.h>
44 #include <sys/syslog.h>
45 #include <sys/kernel.h>
46 
47 #include <net/if.h>
48 #include <net/route.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #include <netinet/in_var.h>
55 #include <netinet/ip_encap.h>
56 #include <netinet/ip_ecn.h>
57 #include <netinet/ip_private.h>
58 #include <netinet/udp.h>
59 
60 #ifdef INET6
61 #include <netinet/ip6.h>
62 #include <netinet6/ip6_var.h>
63 #include <netinet6/ip6_private.h>
64 #include <netinet6/in6_var.h>
65 #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */
66 #include <netinet/ip_ecn.h>
67 #endif
68 
69 #include <netipsec/key.h>
70 #include <netipsec/ipsecif.h>
71 
72 #include <net/if_ipsec.h>
73 
74 static void ipsecif4_input(struct mbuf *, int, int, void *);
75 static int ipsecif4_output(struct ipsec_variant *, int, struct mbuf *);
76 static int ipsecif4_filter4(const struct ip *, struct ipsec_variant *,
77 	struct ifnet *);
78 
79 #ifdef INET6
80 static int ipsecif6_input(struct mbuf **, int *, int, void *);
81 static int ipsecif6_output(struct ipsec_variant *, int, struct mbuf *);
82 static int ipsecif6_filter6(const struct ip6_hdr *, struct ipsec_variant *,
83 	struct ifnet *);
84 #endif
85 
86 static int ip_ipsec_ttl = IPSEC_TTL;
87 static int ip_ipsec_copy_tos = 0;
88 #ifdef INET6
89 static int ip6_ipsec_hlim = IPSEC_HLIM;
90 static int ip6_ipsec_pmtu = 0; /* XXX: per interface configuration?? */
91 static int ip6_ipsec_copy_tos = 0;
92 #endif
93 
94 static const struct encapsw ipsecif4_encapsw = {
95 	.encapsw4 = {
96 		.pr_input = ipsecif4_input,
97 		.pr_ctlinput = NULL,
98 	}
99 };
100 
101 #ifdef INET6
102 static const struct encapsw ipsecif6_encapsw;
103 #endif
104 
105 static struct mbuf *
106 ipsecif4_prepend_hdr(struct ipsec_variant *var, struct mbuf *m,
107     uint8_t proto, uint8_t tos)
108 {
109 	struct ip *ip;
110 	struct sockaddr_in *src, *dst;
111 
112 	src = satosin(var->iv_psrc);
113 	dst = satosin(var->iv_pdst);
114 
115 	if (in_nullhost(src->sin_addr) || in_nullhost(src->sin_addr) ||
116 	    src->sin_addr.s_addr == INADDR_BROADCAST ||
117 	    dst->sin_addr.s_addr == INADDR_BROADCAST) {
118 		m_freem(m);
119 		return NULL;
120 	}
121 	m->m_flags &= ~M_BCAST;
122 
123 	if (IN_MULTICAST(src->sin_addr.s_addr) ||
124 	    IN_MULTICAST(dst->sin_addr.s_addr)) {
125 		m_freem(m);
126 		return NULL;
127 	}
128 
129 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
130 	if (m && M_UNWRITABLE(m, sizeof(struct ip)))
131 		m = m_pullup(m, sizeof(struct ip));
132 	if (m == NULL)
133 		return NULL;
134 
135 	ip = mtod(m, struct ip *);
136 	ip->ip_v = IPVERSION;
137 	ip->ip_off = htons(0);
138 	if (m->m_pkthdr.len < IP_MINFRAGSIZE)
139 		ip->ip_id = 0;
140 	else
141 		ip->ip_id = ip_newid(NULL);
142 	ip->ip_hl = sizeof(*ip) >> 2;
143 	if (ip_ipsec_copy_tos)
144 		ip->ip_tos = tos;
145 	else
146 		ip->ip_tos = 0;
147 	ip->ip_sum = 0;
148 	ip->ip_src = src->sin_addr;
149 	ip->ip_dst = dst->sin_addr;
150 	ip->ip_p = proto;
151 	ip->ip_ttl = ip_ipsec_ttl;
152 	ip->ip_len = htons(m->m_pkthdr.len);
153 #ifndef IPSEC_TX_TOS_CLEAR
154 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
155 	if (ifp->if_flags & IFF_ECN)
156 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
157 	else
158 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
159 #endif
160 
161 	return m;
162 }
163 
164 static int
165 ipsecif4_needfrag(struct mbuf *m, struct ipsecrequest *isr)
166 {
167 	struct ip ip0;
168 	struct ip *ip;
169 	int mtu;
170 	struct secasvar *sav;
171 
172 	sav = key_lookup_sa_bysaidx(&isr->saidx);
173 	if (sav == NULL)
174 		return 0;
175 
176 	if (!(sav->natt_type & UDP_ENCAP_ESPINUDP)) {
177 		mtu = 0;
178 		goto out;
179 	}
180 
181 	if (m->m_len < sizeof(struct ip)) {
182 		m_copydata(m, 0, sizeof(ip0), &ip0);
183 		ip = &ip0;
184 	} else {
185 		ip = mtod(m, struct ip *);
186 	}
187 	mtu = sav->esp_frag;
188 	if (ntohs(ip->ip_len) <= mtu)
189 		mtu = 0;
190 
191 out:
192 	KEY_SA_UNREF(&sav);
193 	return mtu;
194 }
195 
196 static struct mbuf *
197 ipsecif4_flowinfo(struct mbuf *m, int family, int *proto0, u_int8_t *tos0)
198 {
199 	const struct ip *ip;
200 	int proto;
201 	int tos;
202 
203 	KASSERT(proto0 != NULL);
204 	KASSERT(tos0 != NULL);
205 
206 	switch (family) {
207 	case AF_INET:
208 		proto = IPPROTO_IPV4;
209 		if (m->m_len < sizeof(*ip)) {
210 			m = m_pullup(m, sizeof(*ip));
211 			if (m == NULL) {
212 				*tos0 = 0;
213 				*proto0 = 0;
214 				return NULL;
215 			}
216 		}
217 		ip = mtod(m, const struct ip *);
218 		tos = ip->ip_tos;
219 		/* TODO: support ALTQ for innner packet */
220 		break;
221 #ifdef INET6
222 	case AF_INET6: {
223 		const struct ip6_hdr *ip6;
224 		proto = IPPROTO_IPV6;
225 		if (m->m_len < sizeof(*ip6)) {
226 			m = m_pullup(m, sizeof(*ip6));
227 			if (m == NULL) {
228 				*tos0 = 0;
229 				*proto0 = 0;
230 				return NULL;
231 			}
232 		}
233 		ip6 = mtod(m, const struct ip6_hdr *);
234 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
235 		/* TODO: support ALTQ for innner packet */
236 		break;
237 	}
238 #endif /* INET6 */
239 	default:
240 		*tos0 = 0;
241 		*proto0 = 0;
242 		return NULL;
243 	}
244 
245 	*proto0 = proto;
246 	*tos0 = tos;
247 	return m;
248 }
249 
250 static int
251 ipsecif4_fragout(struct ipsec_variant *var, int family, struct mbuf *m, int mtu)
252 {
253 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
254 	struct mbuf *next;
255 	struct m_tag *mtag;
256 	int error;
257 
258 	KASSERT(if_ipsec_heldref_variant(var));
259 
260 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS);
261 	if (mtag)
262 		m_tag_delete(m, mtag);
263 
264 	/* consider new IP header prepended in ipsecif4_output() */
265 	if (mtu <= sizeof(struct ip)) {
266 		m_freem(m);
267 		return ENETUNREACH;
268 	}
269 	m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
270 	error = ip_fragment(m, ifp, mtu - sizeof(struct ip));
271 	if (error)
272 		return error;
273 
274 	for (error = 0; m; m = next) {
275 		next = m->m_nextpkt;
276 		m->m_nextpkt = NULL;
277 		if (error) {
278 			m_freem(m);
279 			continue;
280 		}
281 
282 		error = ipsecif4_output(var, family, m);
283 	}
284 	if (error == 0)
285 		IP_STATINC(IP_STAT_FRAGMENTED);
286 
287 	return error;
288 }
289 
290 int
291 ipsecif4_encap_func(struct mbuf *m, struct ip *ip, struct ipsec_variant *var)
292 {
293 	struct m_tag *mtag;
294 	struct sockaddr_in *src, *dst;
295 	u_int16_t src_port = 0;
296 	u_int16_t dst_port = 0;
297 
298 	KASSERT(var != NULL);
299 
300 	src = satosin(var->iv_psrc);
301 	dst = satosin(var->iv_pdst);
302 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS);
303 	if (mtag) {
304 		u_int16_t *ports;
305 
306 		ports = (u_int16_t *)(mtag + 1);
307 		src_port = ports[0];
308 		dst_port = ports[1];
309 	}
310 
311 	/* address match */
312 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
313 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
314 		return 0;
315 
316 	/* UDP encap? */
317 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
318 		goto match;
319 
320 	/* port match */
321 	if (src_port != var->iv_dport ||
322 	    dst_port != var->iv_sport) {
323 #ifdef DEBUG
324 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
325 		    __func__, ntohs(src_port), ntohs(dst_port),
326 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
327 #endif
328 		return 0;
329 	}
330 
331 match:
332 	/*
333 	 * hide NAT-T information from encapsulated traffics.
334 	 * they don't know about IPsec.
335 	 */
336 	if (mtag)
337 		m_tag_delete(m, mtag);
338 	return sizeof(src->sin_addr) + sizeof(dst->sin_addr);
339 }
340 
341 static int
342 ipsecif4_output(struct ipsec_variant *var, int family, struct mbuf *m)
343 {
344 	struct secpolicy *sp = NULL;
345 	u_int8_t tos;
346 	int proto;
347 	int error;
348 	int mtu;
349 	u_long sa_mtu = 0;
350 
351 	KASSERT(if_ipsec_heldref_variant(var));
352 	KASSERT(if_ipsec_variant_is_configured(var));
353 	KASSERT(var->iv_psrc->sa_family == AF_INET);
354 	KASSERT(var->iv_pdst->sa_family == AF_INET);
355 
356 	sp = IV_SP_OUT(var);
357 	KASSERT(sp != NULL);
358 	/*
359 	 * The SPs in ipsec_variant are prevented from freed by
360 	 * ipsec_variant->iv_psref. So, KEY_SP_REF() is unnecessary here.
361 	 */
362 
363 	KASSERT(sp->policy != IPSEC_POLICY_NONE);
364 	KASSERT(sp->policy != IPSEC_POLICY_ENTRUST);
365 	KASSERT(sp->policy != IPSEC_POLICY_BYPASS);
366 	if (sp->policy != IPSEC_POLICY_IPSEC) {
367 		m_freem(m);
368 		error = ENETUNREACH;
369 		goto done;
370 	}
371 
372 	/* get flowinfo */
373 	m = ipsecif4_flowinfo(m, family, &proto, &tos);
374 	if (m == NULL) {
375 		error = ENETUNREACH;
376 		goto done;
377 	}
378 
379 	/* prepend new IP header */
380 	m = ipsecif4_prepend_hdr(var, m, proto, tos);
381 	if (m == NULL) {
382 		error = ENETUNREACH;
383 		goto done;
384 	}
385 
386 	/*
387 	 * Normal netipsec's NAT-T fragmentation is done in ip_output().
388 	 * See "natt_frag" processing.
389 	 * However, ipsec(4) interface's one is not done in the same way,
390 	 * so we must do NAT-T fragmentation by own code.
391 	 */
392 	/* NAT-T ESP fragmentation */
393 	mtu = ipsecif4_needfrag(m, sp->req);
394 	if (mtu > 0)
395 		return ipsecif4_fragout(var, family, m, mtu);
396 
397 	/* IPsec output */
398 	IP_STATINC(IP_STAT_LOCALOUT);
399 	error = ipsec4_process_packet(m, sp->req, &sa_mtu);
400 	if (error == ENOENT)
401 		error = 0;
402 	/*
403 	 * frangmentation is already done in ipsecif4_fragout(),
404 	 * so ipsec4_process_packet() must not do fragmentation here.
405 	 */
406 	KASSERT(sa_mtu == 0);
407 
408 done:
409 	return error;
410 }
411 
412 #ifdef INET6
413 int
414 ipsecif6_encap_func(struct mbuf *m, struct ip6_hdr *ip6, struct ipsec_variant *var)
415 {
416 	struct m_tag *mtag;
417 	struct sockaddr_in6 *src, *dst;
418 	u_int16_t src_port = 0;
419 	u_int16_t dst_port = 0;
420 
421 	KASSERT(var != NULL);
422 
423 	src = satosin6(var->iv_psrc);
424 	dst = satosin6(var->iv_pdst);
425 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS);
426 	if (mtag) {
427 		u_int16_t *ports;
428 
429 		ports = (u_int16_t *)(mtag + 1);
430 		src_port = ports[0];
431 		dst_port = ports[1];
432 	}
433 
434 	/* address match */
435 	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
436 	    !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
437 		return 0;
438 
439 	/* UDP encap? */
440 	if (mtag == NULL && var->iv_sport == 0 && var->iv_dport == 0)
441 		goto match;
442 
443 	/* port match */
444 	if (src_port != var->iv_dport ||
445 	    dst_port != var->iv_sport) {
446 #ifdef DEBUG
447 		printf("%s: port mismatch: pkt(%u, %u), if(%u, %u)\n",
448 		    __func__, ntohs(src_port), ntohs(dst_port),
449 		    ntohs(var->iv_sport), ntohs(var->iv_dport));
450 #endif
451 		return 0;
452 	}
453 
454 match:
455 	/*
456 	 * hide NAT-T information from encapsulated traffics.
457 	 * they don't know about IPsec.
458 	 */
459 	if (mtag)
460 		m_tag_delete(m, mtag);
461 	return sizeof(src->sin6_addr) + sizeof(dst->sin6_addr);
462 }
463 
464 static int
465 ipsecif6_output(struct ipsec_variant *var, int family, struct mbuf *m)
466 {
467 	struct ifnet *ifp = &var->iv_softc->ipsec_if;
468 	struct ipsec_softc *sc = ifp->if_softc;
469 	struct ipsec_ro *iro;
470 	struct rtentry *rt;
471 	struct sockaddr_in6 *sin6_src;
472 	struct sockaddr_in6 *sin6_dst;
473 	struct ip6_hdr *ip6;
474 	int proto, error;
475 	u_int8_t itos, otos;
476 	union {
477 		struct sockaddr		dst;
478 		struct sockaddr_in6	dst6;
479 	} u;
480 
481 	KASSERT(if_ipsec_heldref_variant(var));
482 	KASSERT(if_ipsec_variant_is_configured(var));
483 
484 	sin6_src = satosin6(var->iv_psrc);
485 	sin6_dst = satosin6(var->iv_pdst);
486 
487 	KASSERT(sin6_src->sin6_family == AF_INET6);
488 	KASSERT(sin6_dst->sin6_family == AF_INET6);
489 
490 	switch (family) {
491 #ifdef INET
492 	case AF_INET:
493 	    {
494 		struct ip *ip;
495 
496 		proto = IPPROTO_IPV4;
497 		if (m->m_len < sizeof(*ip)) {
498 			m = m_pullup(m, sizeof(*ip));
499 			if (m == NULL)
500 				return ENOBUFS;
501 		}
502 		ip = mtod(m, struct ip *);
503 		itos = ip->ip_tos;
504 		/* TODO: support ALTQ for innner packet */
505 		break;
506 	    }
507 #endif /* INET */
508 	case AF_INET6:
509 	    {
510 		struct ip6_hdr *xip6;
511 		proto = IPPROTO_IPV6;
512 		if (m->m_len < sizeof(*xip6)) {
513 			m = m_pullup(m, sizeof(*xip6));
514 			if (m == NULL)
515 				return ENOBUFS;
516 		}
517 		xip6 = mtod(m, struct ip6_hdr *);
518 		itos = (ntohl(xip6->ip6_flow) >> 20) & 0xff;
519 		/* TODO: support ALTQ for innner packet */
520 		break;
521 	    }
522 	default:
523 		m_freem(m);
524 		return EAFNOSUPPORT;
525 	}
526 
527 	/* prepend new IP header */
528 	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
529 	if (m && M_UNWRITABLE(m, sizeof(struct ip6_hdr)))
530 		m = m_pullup(m, sizeof(struct ip6_hdr));
531 	if (m == NULL)
532 		return ENOBUFS;
533 
534 	ip6 = mtod(m, struct ip6_hdr *);
535 	ip6->ip6_flow	= 0;
536 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
537 	ip6->ip6_vfc	|= IPV6_VERSION;
538 #if 0	/* ip6->ip6_plen will be filled by ip6_output */
539 	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len - sizeof(*ip6));
540 #endif
541 	ip6->ip6_nxt	= proto;
542 	ip6->ip6_hlim	= ip6_ipsec_hlim;
543 	ip6->ip6_src	= sin6_src->sin6_addr;
544 	/* bidirectional configured tunnel mode */
545 	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
546 		ip6->ip6_dst = sin6_dst->sin6_addr;
547 	} else  {
548 		m_freem(m);
549 		return ENETUNREACH;
550 	}
551 #ifndef IPSEC_TX_TOS_CLEAR
552 	if (ifp->if_flags & IFF_ECN)
553 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
554 	else
555 		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
556 
557 	if (!ip6_ipsec_copy_tos)
558 		otos = 0;
559 #else
560 	if (ip6_ipsec_copy_tos)
561 		otos = itos;
562 	else
563 		otos = 0;
564 #endif
565 	ip6->ip6_flow &= ~ntohl(0xff00000);
566 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
567 
568 	sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
569 
570 	iro = percpu_getref(sc->ipsec_ro_percpu);
571 	mutex_enter(iro->ir_lock);
572 	if ((rt = rtcache_lookup(&iro->ir_ro, &u.dst)) == NULL) {
573 		mutex_exit(iro->ir_lock);
574 		percpu_putref(sc->ipsec_ro_percpu);
575 		m_freem(m);
576 		return ENETUNREACH;
577 	}
578 
579 	if (rt->rt_ifp == ifp) {
580 		rtcache_unref(rt, &iro->ir_ro);
581 		rtcache_free(&iro->ir_ro);
582 		mutex_exit(iro->ir_lock);
583 		percpu_putref(sc->ipsec_ro_percpu);
584 		m_freem(m);
585 		return ENETUNREACH;
586 	}
587 	rtcache_unref(rt, &iro->ir_ro);
588 
589 	/*
590 	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
591 	 * it is too painful to ask for resend of inner packet, to achieve
592 	 * path MTU discovery for encapsulated packets.
593 	 */
594 	error = ip6_output(m, 0, &iro->ir_ro,
595 	    ip6_ipsec_pmtu ? 0 : IPV6_MINMTU, 0, NULL, NULL);
596 	if (error)
597 		rtcache_free(&iro->ir_ro);
598 
599 	mutex_exit(iro->ir_lock);
600 	percpu_putref(sc->ipsec_ro_percpu);
601 
602 	return error;
603 }
604 #endif /* INET6 */
605 
606 static void
607 ipsecif4_input(struct mbuf *m, int off, int proto, void *eparg)
608 {
609 	struct ifnet *ipsecp;
610 	struct ipsec_softc *sc = eparg;
611 	struct ipsec_variant *var;
612 	const struct ip *ip;
613 	int af;
614 #ifndef IPSEC_TX_TOS_CLEAR
615 	u_int8_t otos;
616 #endif
617 	struct psref psref_rcvif;
618 	struct psref psref_var;
619 	struct ifnet *rcvif;
620 
621 	KASSERT(sc != NULL);
622 
623 	ipsecp = &sc->ipsec_if;
624 	if ((ipsecp->if_flags & IFF_UP) == 0) {
625 		m_freem(m);
626 		ip_statinc(IP_STAT_NOIPSEC);
627 		return;
628 	}
629 
630 	var = if_ipsec_getref_variant(sc, &psref_var);
631 	if (if_ipsec_variant_is_unconfigured(var)) {
632 		if_ipsec_putref_variant(var, &psref_var);
633 		m_freem(m);
634 		ip_statinc(IP_STAT_NOIPSEC);
635 		return;
636 	}
637 
638 	ip = mtod(m, const struct ip *);
639 
640 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
641 	if (rcvif == NULL || !ipsecif4_filter4(ip, var, rcvif)) {
642 		m_put_rcvif_psref(rcvif, &psref_rcvif);
643 		if_ipsec_putref_variant(var, &psref_var);
644 		m_freem(m);
645 		ip_statinc(IP_STAT_NOIPSEC);
646 		return;
647 	}
648 	m_put_rcvif_psref(rcvif, &psref_rcvif);
649 	if_ipsec_putref_variant(var, &psref_var);
650 #ifndef IPSEC_TX_TOS_CLEAR
651 	otos = ip->ip_tos;
652 #endif
653 	m_adj(m, off);
654 
655 	switch (proto) {
656 	case IPPROTO_IPV4:
657 	    {
658 		struct ip *xip;
659 		af = AF_INET;
660 		if (M_UNWRITABLE(m, sizeof(*xip))) {
661 			m = m_pullup(m, sizeof(*xip));
662 			if (m == NULL)
663 				return;
664 		}
665 		xip = mtod(m, struct ip *);
666 #ifndef IPSEC_TX_TOS_CLEAR
667 		if (ipsecp->if_flags & IFF_ECN)
668 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
669 		else
670 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
671 #endif
672 		break;
673 	    }
674 #ifdef INET6
675 	case IPPROTO_IPV6:
676 	    {
677 		struct ip6_hdr *ip6;
678 		u_int8_t itos;
679 		af = AF_INET6;
680 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
681 			m = m_pullup(m, sizeof(*ip6));
682 			if (m == NULL)
683 				return;
684 		}
685 		ip6 = mtod(m, struct ip6_hdr *);
686 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
687 #ifndef IPSEC_TX_TOS_CLEAR
688 		if (ipsecp->if_flags & IFF_ECN)
689 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
690 		else
691 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
692 #endif
693 		ip6->ip6_flow &= ~htonl(0xff << 20);
694 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
695 		break;
696 	    }
697 #endif /* INET6 */
698 	default:
699 		ip_statinc(IP_STAT_NOIPSEC);
700 		m_freem(m);
701 		return;
702 	}
703 	if_ipsec_input(m, af, ipsecp);
704 
705 	return;
706 }
707 
708 /*
709  * validate and filter the pakcet
710  */
711 static int
712 ipsecif4_filter4(const struct ip *ip, struct ipsec_variant *var,
713     struct ifnet *ifp)
714 {
715 	struct sockaddr_in *src, *dst;
716 
717 	src = satosin(var->iv_psrc);
718 	dst = satosin(var->iv_pdst);
719 
720 	return in_tunnel_validate(ip, src->sin_addr, dst->sin_addr);
721 }
722 
723 #ifdef INET6
724 static int
725 ipsecif6_input(struct mbuf **mp, int *offp, int proto, void *eparg)
726 {
727 	struct mbuf *m = *mp;
728 	struct ifnet *ipsecp;
729 	struct ipsec_softc *sc = eparg;
730 	struct ipsec_variant *var;
731 	struct ip6_hdr *ip6;
732 	int af = 0;
733 #ifndef IPSEC_TX_TOS_CLEAR
734 	u_int32_t otos;
735 #endif
736 	struct psref psref_rcvif;
737 	struct psref psref_var;
738 	struct ifnet *rcvif;
739 
740 	KASSERT(eparg != NULL);
741 
742 	ipsecp = &sc->ipsec_if;
743 	if ((ipsecp->if_flags & IFF_UP) == 0) {
744 		m_freem(m);
745 		IP6_STATINC(IP6_STAT_NOIPSEC);
746 		return IPPROTO_DONE;
747 	}
748 
749 	var = if_ipsec_getref_variant(sc, &psref_var);
750 	if (if_ipsec_variant_is_unconfigured(var)) {
751 		if_ipsec_putref_variant(var, &psref_var);
752 		m_freem(m);
753 		IP6_STATINC(IP6_STAT_NOIPSEC);
754 		return IPPROTO_DONE;
755 	}
756 
757 	ip6 = mtod(m, struct ip6_hdr *);
758 
759 	rcvif = m_get_rcvif_psref(m, &psref_rcvif);
760 	if (rcvif == NULL || !ipsecif6_filter6(ip6, var, rcvif)) {
761 		m_put_rcvif_psref(rcvif, &psref_rcvif);
762 		if_ipsec_putref_variant(var, &psref_var);
763 		m_freem(m);
764 		IP6_STATINC(IP6_STAT_NOIPSEC);
765 		return IPPROTO_DONE;
766 	}
767 	m_put_rcvif_psref(rcvif, &psref_rcvif);
768 	if_ipsec_putref_variant(var, &psref_var);
769 
770 #ifndef IPSEC_TX_TOS_CLEAR
771 	otos = ip6->ip6_flow;
772 #endif
773 	m_adj(m, *offp);
774 
775 	switch (proto) {
776 #ifdef INET
777 	case IPPROTO_IPV4:
778 	    {
779 		af = AF_INET;
780 #ifndef IPSEC_TX_TOS_CLEAR
781 		struct ip *ip;
782 		u_int8_t otos8;
783 		otos8 = (ntohl(otos) >> 20) & 0xff;
784 
785 		if (M_UNWRITABLE(m, sizeof(*ip))) {
786 			m = m_pullup(m, sizeof(*ip));
787 			if (m == NULL)
788 				return IPPROTO_DONE;
789 		}
790 		ip = mtod(m, struct ip *);
791 		if (ipsecp->if_flags & IFF_ECN)
792 			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
793 		else
794 			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
795 #endif
796 		break;
797 	    }
798 #endif /* INET */
799 	case IPPROTO_IPV6:
800 	    {
801 		af = AF_INET6;
802 #ifndef IPSEC_TX_TOS_CLEAR
803 		struct ip6_hdr *xip6;
804 
805 		if (M_UNWRITABLE(m, sizeof(*xip6))) {
806 			m = m_pullup(m, sizeof(*xip6));
807 			if (m == NULL)
808 				return IPPROTO_DONE;
809 		}
810 		xip6 = mtod(m, struct ip6_hdr *);
811 		if (ipsecp->if_flags & IFF_ECN)
812 			ip6_ecn_egress(ECN_ALLOWED, &otos, &xip6->ip6_flow);
813 		else
814 			ip6_ecn_egress(ECN_NOCARE, &otos, &xip6->ip6_flow);
815 		break;
816 #endif
817 	    }
818 	default:
819 		IP6_STATINC(IP6_STAT_NOIPSEC);
820 		m_freem(m);
821 		return IPPROTO_DONE;
822 	}
823 
824 	if_ipsec_input(m, af, ipsecp);
825 	return IPPROTO_DONE;
826 }
827 
828 /*
829  * validate and filter the packet.
830  */
831 static int
832 ipsecif6_filter6(const struct ip6_hdr *ip6, struct ipsec_variant *var,
833     struct ifnet *ifp)
834 {
835 	struct sockaddr_in6 *src, *dst;
836 
837 	src = satosin6(var->iv_psrc);
838 	dst = satosin6(var->iv_pdst);
839 
840 	return in6_tunnel_validate(ip6, &src->sin6_addr, &dst->sin6_addr);
841 }
842 #endif /* INET6 */
843 
844 int
845 ipsecif4_attach(struct ipsec_variant *var)
846 {
847 	struct ipsec_softc *sc = var->iv_softc;
848 
849 	KASSERT(if_ipsec_variant_is_configured(var));
850 
851 	if (var->iv_encap_cookie4 != NULL)
852 		return EALREADY;
853 	var->iv_encap_cookie4 = encap_attach_func(AF_INET, -1, if_ipsec_encap_func,
854 	    &ipsecif4_encapsw, sc);
855 	if (var->iv_encap_cookie4 == NULL)
856 		return EEXIST;
857 
858 	var->iv_output = ipsecif4_output;
859 	return 0;
860 }
861 
862 int
863 ipsecif4_detach(struct ipsec_variant *var)
864 {
865 	int error;
866 
867 	if (var->iv_encap_cookie4 == NULL)
868 		return 0;
869 
870 	var->iv_output = NULL;
871 	error = encap_detach(var->iv_encap_cookie4);
872 	if (error == 0)
873 		var->iv_encap_cookie4 = NULL;
874 
875 	return error;
876 }
877 
878 #ifdef INET6
879 int
880 ipsecif6_attach(struct ipsec_variant *var)
881 {
882 	struct sockaddr_in6 mask6;
883 	struct ipsec_softc *sc = var->iv_softc;
884 
885 	KASSERT(if_ipsec_variant_is_configured(var));
886 	KASSERT(var->iv_encap_cookie6 == NULL);
887 
888 	memset(&mask6, 0, sizeof(mask6));
889 	mask6.sin6_len = sizeof(struct sockaddr_in6);
890 	mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] =
891 	mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0;
892 
893 	var->iv_encap_cookie6 = encap_attach_func(AF_INET6, -1, if_ipsec_encap_func,
894 	    &ipsecif6_encapsw, sc);
895 	if (var->iv_encap_cookie6 == NULL)
896 		return EEXIST;
897 
898 	var->iv_output = ipsecif6_output;
899 	return 0;
900 }
901 
902 static void
903 ipsecif6_rtcache_free_pc(void *p, void *arg __unused, struct cpu_info *ci __unused)
904 {
905 	struct ipsec_ro *iro = p;
906 
907 	mutex_enter(iro->ir_lock);
908 	rtcache_free(&iro->ir_ro);
909 	mutex_exit(iro->ir_lock);
910 }
911 
912 int
913 ipsecif6_detach(struct ipsec_variant *var)
914 {
915 	struct ipsec_softc *sc = var->iv_softc;
916 	int error;
917 
918 	KASSERT(var->iv_encap_cookie6 != NULL);
919 
920 	percpu_foreach(sc->ipsec_ro_percpu, ipsecif6_rtcache_free_pc, NULL);
921 
922 	var->iv_output = NULL;
923 	error = encap_detach(var->iv_encap_cookie6);
924 	if (error == 0)
925 		var->iv_encap_cookie6 = NULL;
926 	return error;
927 }
928 
929 void *
930 ipsecif6_ctlinput(int cmd, const struct sockaddr *sa, void *d, void *eparg)
931 {
932 	struct ipsec_softc *sc = eparg;
933 	struct ip6ctlparam *ip6cp = NULL;
934 	struct ip6_hdr *ip6;
935 	const struct sockaddr_in6 *dst6;
936 	struct ipsec_ro *iro;
937 
938 	if (sa->sa_family != AF_INET6 ||
939 	    sa->sa_len != sizeof(struct sockaddr_in6))
940 		return NULL;
941 
942 	if ((unsigned)cmd >= PRC_NCMDS)
943 		return NULL;
944 	if (cmd == PRC_HOSTDEAD)
945 		d = NULL;
946 	else if (inet6ctlerrmap[cmd] == 0)
947 		return NULL;
948 
949 	/* if the parameter is from icmp6, decode it. */
950 	if (d != NULL) {
951 		ip6cp = (struct ip6ctlparam *)d;
952 		ip6 = ip6cp->ip6c_ip6;
953 	} else {
954 		ip6 = NULL;
955 	}
956 
957 	if (!ip6)
958 		return NULL;
959 
960 	iro = percpu_getref(sc->ipsec_ro_percpu);
961 	mutex_enter(iro->ir_lock);
962 	dst6 = satocsin6(rtcache_getdst(&iro->ir_ro));
963 	/* XXX scope */
964 	if (dst6 == NULL)
965 		;
966 	else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
967 		/* flush route cache */
968 		rtcache_free(&iro->ir_ro);
969 
970 	mutex_exit(iro->ir_lock);
971 	percpu_putref(sc->ipsec_ro_percpu);
972 
973 	return NULL;
974 }
975 
976 ENCAP_PR_WRAP_CTLINPUT(ipsecif6_ctlinput)
977 #define	ipsecif6_ctlinput	ipsecif6_ctlinput_wrapper
978 
979 static const struct encapsw ipsecif6_encapsw = {
980 	.encapsw6 = {
981 		.pr_input = ipsecif6_input,
982 		.pr_ctlinput = ipsecif6_ctlinput,
983 	}
984 };
985 #endif /* INET6 */
986