xref: /netbsd-src/sys/netipsec/ipsec_output.c (revision 267197ec1eebfcb9810ea27a89625b6ddf68e3e7)
1 /*	$NetBSD: ipsec_output.c,v 1.26 2007/12/29 16:43:17 degroote Exp $	*/
2 
3 /*-
4  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  *
28  * $FreeBSD: /repoman/r/ncvs/src/sys/netipsec/ipsec_output.c,v 1.3.2.2 2003/03/28 20:32:53 sam Exp $
29  */
30 
31 #include <sys/cdefs.h>
32 __KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.26 2007/12/29 16:43:17 degroote Exp $");
33 
34 /*
35  * IPsec output processing.
36  */
37 #include "opt_inet.h"
38 #ifdef __FreeBSD__
39 #include "opt_inet6.h"
40 #endif
41 #include "opt_ipsec.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/mbuf.h>
46 #include <sys/domain.h>
47 #include <sys/protosw.h>
48 #include <sys/socket.h>
49 #include <sys/errno.h>
50 #include <sys/syslog.h>
51 
52 #include <net/if.h>
53 #include <net/route.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/ip.h>
58 #include <netinet/ip_var.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip_ecn.h>
61 #ifdef INET6
62 #  ifdef __FreeBSD__
63 #  include <netinet6/ip6_ecn.h>
64 #  endif
65 #endif
66 
67 #include <netinet/ip6.h>
68 #ifdef INET6
69 #include <netinet6/ip6_var.h>
70 #endif
71 #include <netinet/in_pcb.h>
72 #ifdef INET6
73 #include <netinet/icmp6.h>
74 #endif
75 #ifdef IPSEC_NAT_T
76 #include <netinet/udp.h>
77 #endif
78 
79 #include <netipsec/ipsec.h>
80 #include <netipsec/ipsec_var.h>
81 #ifdef INET6
82 #include <netipsec/ipsec6.h>
83 #endif
84 #include <netipsec/ah_var.h>
85 #include <netipsec/esp_var.h>
86 #include <netipsec/ipcomp_var.h>
87 
88 #include <netipsec/xform.h>
89 
90 #include <netipsec/key.h>
91 #include <netipsec/keydb.h>
92 #include <netipsec/key_debug.h>
93 #include <netipsec/ipsec_osdep.h>
94 
95 #include <net/net_osdep.h>		/* ovbcopy() in ipsec6_encapsulate() */
96 
97 
98 /*
99  * Add a IPSEC_OUT_DONE tag to mark that we have finished the ipsec processing
100  * It will be used by ip{,6}_output to check if we have already or not
101  * processed this packet.
102  */
103 static int
104 ipsec_register_done(struct mbuf *m, int * error)
105 {
106 	struct m_tag *mtag;
107 
108 	mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE, 0, M_NOWAIT);
109 	if (mtag == NULL) {
110 		DPRINTF(("ipsec_register_done: could not get packet tag\n"));
111 		*error = ENOMEM;
112 		return -1;
113 	}
114 
115 	m_tag_prepend(m, mtag);
116 	return 0;
117 }
118 
119 static int
120 ipsec_reinject_ipstack(struct mbuf *m, int af)
121 {
122 #ifdef INET
123 	struct ip * ip;
124 #endif /* INET */
125 
126 	switch (af) {
127 #ifdef INET
128 	case AF_INET:
129 		ip = mtod(m, struct ip *);
130 #ifdef __FreeBSD__
131 		/* FreeBSD ip_output() expects ip_len, ip_off in host endian */
132 		ip->ip_len = ntohs(ip->ip_len);
133 		ip->ip_off = ntohs(ip->ip_off);
134 #endif /* __FreeBSD_ */
135 		return ip_output(m, NULL, NULL, IP_RAWOUTPUT,
136 		    (struct ip_moptions *)NULL, (struct socket *)NULL);
137 
138 #endif /* INET */
139 #ifdef INET6
140 	case AF_INET6:
141 		/*
142 		 * We don't need massage, IPv6 header fields are always in
143 		 * net endian.
144 		 */
145 		return ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
146 #endif /* INET6 */
147 	}
148 
149 	panic("ipsec_reinject_ipstack : iunknown protocol family %u\n", af);
150 	return -1; /* NOTREACHED */
151 }
152 
153 int
154 ipsec_process_done(struct mbuf *m, struct ipsecrequest *isr)
155 {
156 	struct secasvar *sav;
157 	struct secasindex *saidx;
158 	int error;
159 #ifdef INET
160 	struct ip * ip;
161 #endif /* INET */
162 #ifdef INET6
163 	struct ip6_hdr * ip6;
164 #endif /* INET6 */
165 #ifdef IPSEC_NAT_T
166 	struct mbuf * mo;
167 	struct udphdr *udp = NULL;
168 	uint64_t * data = NULL;
169 	int hlen, roff;
170 #endif /* IPSEC_NAT_T */
171 
172 	IPSEC_SPLASSERT_SOFTNET("ipsec_process_done");
173 
174 	IPSEC_ASSERT(m != NULL, ("ipsec_process_done: null mbuf"));
175 	IPSEC_ASSERT(isr != NULL, ("ipsec_process_done: null ISR"));
176 	sav = isr->sav;
177 	IPSEC_ASSERT(sav != NULL, ("ipsec_process_done: null SA"));
178 	IPSEC_ASSERT(sav->sah != NULL, ("ipsec_process_done: null SAH"));
179 
180 	saidx = &sav->sah->saidx;
181 
182 #ifdef IPSEC_NAT_T
183 	if(sav->natt_type != 0) {
184 		ip = mtod(m, struct ip *);
185 
186 		hlen = sizeof(struct udphdr);
187 		if (sav->natt_type == UDP_ENCAP_ESPINUDP_NON_IKE)
188 			hlen += sizeof(uint64_t);
189 
190 		mo = m_makespace(m, sizeof(struct ip), hlen, &roff);
191 		if (mo == NULL) {
192 			DPRINTF(("ipsec_process_done : failed to inject"
193 				 "%u byte UDP for SA %s/%08lx\n",
194 					 hlen, ipsec_address(&saidx->dst),
195 					 (u_long) ntohl(sav->spi)));
196 			error = ENOBUFS;
197 			goto bad;
198 		}
199 
200 		udp = (struct udphdr*) (mtod(mo, char*) + roff);
201 		data = (uint64_t*) (udp + 1);
202 
203 		if (sav->natt_type == UDP_ENCAP_ESPINUDP_NON_IKE)
204 			*data = 0; /* NON-IKE Marker */
205 
206 		if (sav->natt_type == UDP_ENCAP_ESPINUDP_NON_IKE)
207 			udp->uh_sport = htons(UDP_ENCAP_ESPINUDP_PORT);
208 		else
209 			udp->uh_sport = key_portfromsaddr(&saidx->src);
210 
211 		udp->uh_dport = key_portfromsaddr(&saidx->dst);
212 		udp->uh_sum = 0;
213        	udp->uh_ulen = htons(m->m_pkthdr.len - (ip->ip_hl << 2));
214 	}
215 #endif /* IPSEC_NAT_T */
216 
217 	switch (saidx->dst.sa.sa_family) {
218 #ifdef INET
219 	case AF_INET:
220 		/* Fix the header length, for AH processing. */
221 		ip = mtod(m, struct ip *);
222 		ip->ip_len = htons(m->m_pkthdr.len);
223 #ifdef IPSEC_NAT_T
224 		if (sav->natt_type != 0)
225 			ip->ip_p = IPPROTO_UDP;
226 #endif /* IPSEC_NAT_T */
227 		break;
228 #endif /* INET */
229 #ifdef INET6
230 	case AF_INET6:
231 		/* Fix the header length, for AH processing. */
232 		if (m->m_pkthdr.len < sizeof (struct ip6_hdr)) {
233 			error = ENXIO;
234 			goto bad;
235 		}
236 		if (m->m_pkthdr.len - sizeof (struct ip6_hdr) > IPV6_MAXPACKET) {
237 			/* No jumbogram support. */
238 			error = ENXIO;	/*?*/
239 			goto bad;
240 		}
241 		ip6 = mtod(m, struct ip6_hdr *);
242 		ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
243 #ifdef IPSEC_NAT_T
244 		if (sav->natt_type != 0)
245 			ip6->ip6_nxt = IPPROTO_UDP;
246 #endif /* IPSEC_NAT_T */
247 		break;
248 #endif /* INET6 */
249 	default:
250 		DPRINTF(("ipsec_process_done: unknown protocol family %u\n",
251 		    saidx->dst.sa.sa_family));
252 		error = ENXIO;
253 		goto bad;
254 	}
255 
256 	/*
257 	 * If there's another (bundled) SA to apply, do so.
258 	 * Note that this puts a burden on the kernel stack size.
259 	 * If this is a problem we'll need to introduce a queue
260 	 * to set the packet on so we can unwind the stack before
261 	 * doing further processing.
262 	 */
263 	if (isr->next) {
264 		newipsecstat.ips_out_bundlesa++;
265         switch ( saidx->dst.sa.sa_family ) {
266 #ifdef INET
267         case AF_INET:
268 			return ipsec4_process_packet(m, isr->next, 0,0);
269 #endif /* INET */
270 #ifdef INET6
271 		case AF_INET6:
272         	return ipsec6_process_packet(m,isr->next);
273 #endif /* INET6 */
274 		default :
275 			DPRINTF(("ipsec_process_done: unknown protocol family %u\n",
276                                saidx->dst.sa.sa_family));
277 			error = ENXIO;
278 			goto bad;
279         }
280 	}
281 
282 	/*
283 	 * We're done with IPsec processing,
284 	 * mark that we have already processed the packet
285 	 * transmit it packet using the appropriate network protocol (IP or IPv6).
286 	 */
287 
288 	if (ipsec_register_done(m, &error) < 0)
289 		goto bad;
290 
291 	return ipsec_reinject_ipstack(m, saidx->dst.sa.sa_family);
292 bad:
293 	m_freem(m);
294 	KEY_FREESAV(&sav);
295 	return (error);
296 }
297 
298 /*
299  * ipsec_nextisr can return :
300  * - isr == NULL and error != 0 => something is bad : the packet must be
301  *   discarded
302  * - isr == NULL and error == 0 => no more rules to apply, ipsec processing
303  *   is done, reinject it in ip stack
304  * - isr != NULL (error == 0) => we need to apply one rule to the packet
305  */
306 static struct ipsecrequest *
307 ipsec_nextisr(
308 	struct mbuf *m,
309 	struct ipsecrequest *isr,
310 	int af,
311 	struct secasindex *saidx,
312 	int *error
313 )
314 {
315 #define IPSEC_OSTAT(x,y,z) (isr->saidx.proto == IPPROTO_ESP ? (x)++ : \
316 			    isr->saidx.proto == IPPROTO_AH ? (y)++ : (z)++)
317 	struct secasvar *sav;
318 
319 	IPSEC_SPLASSERT_SOFTNET("ipsec_nextisr");
320 	IPSEC_ASSERT(af == AF_INET || af == AF_INET6,
321 		("ipsec_nextisr: invalid address family %u", af));
322 again:
323 	/*
324 	 * Craft SA index to search for proper SA.  Note that
325 	 * we only fillin unspecified SA peers for transport
326 	 * mode; for tunnel mode they must already be filled in.
327 	 */
328 	*saidx = isr->saidx;
329 	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
330 		/* Fillin unspecified SA peers only for transport mode */
331 		if (af == AF_INET) {
332 			struct sockaddr_in *sin;
333 			struct ip *ip = mtod(m, struct ip *);
334 
335 			if (saidx->src.sa.sa_len == 0) {
336 				sin = &saidx->src.sin;
337 				sin->sin_len = sizeof(*sin);
338 				sin->sin_family = AF_INET;
339 				sin->sin_port = IPSEC_PORT_ANY;
340 				sin->sin_addr = ip->ip_src;
341 			}
342 			if (saidx->dst.sa.sa_len == 0) {
343 				sin = &saidx->dst.sin;
344 				sin->sin_len = sizeof(*sin);
345 				sin->sin_family = AF_INET;
346 				sin->sin_port = IPSEC_PORT_ANY;
347 				sin->sin_addr = ip->ip_dst;
348 			}
349 		} else {
350 			struct sockaddr_in6 *sin6;
351 			struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
352 
353 			if (saidx->src.sin6.sin6_len == 0) {
354 				sin6 = (struct sockaddr_in6 *)&saidx->src;
355 				sin6->sin6_len = sizeof(*sin6);
356 				sin6->sin6_family = AF_INET6;
357 				sin6->sin6_port = IPSEC_PORT_ANY;
358 				sin6->sin6_addr = ip6->ip6_src;
359 				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
360 					/* fix scope id for comparing SPD */
361 					sin6->sin6_addr.s6_addr16[1] = 0;
362 					sin6->sin6_scope_id =
363 					    ntohs(ip6->ip6_src.s6_addr16[1]);
364 				}
365 			}
366 			if (saidx->dst.sin6.sin6_len == 0) {
367 				sin6 = (struct sockaddr_in6 *)&saidx->dst;
368 				sin6->sin6_len = sizeof(*sin6);
369 				sin6->sin6_family = AF_INET6;
370 				sin6->sin6_port = IPSEC_PORT_ANY;
371 				sin6->sin6_addr = ip6->ip6_dst;
372 				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
373 					/* fix scope id for comparing SPD */
374 					sin6->sin6_addr.s6_addr16[1] = 0;
375 					sin6->sin6_scope_id =
376 					    ntohs(ip6->ip6_dst.s6_addr16[1]);
377 				}
378 			}
379 		}
380 	}
381 
382 	/*
383 	 * Lookup SA and validate it.
384 	 */
385 	*error = key_checkrequest(isr, saidx);
386 	if (*error != 0) {
387 		/*
388 		 * IPsec processing is required, but no SA found.
389 		 * I assume that key_acquire() had been called
390 		 * to get/establish the SA. Here I discard
391 		 * this packet because it is responsibility for
392 		 * upper layer to retransmit the packet.
393 		 */
394 		newipsecstat.ips_out_nosa++;
395 		goto bad;
396 	}
397 	sav = isr->sav;
398 	/* sav may be NULL here if we have an USE rule */
399 	if (sav == NULL) {
400 		IPSEC_ASSERT(ipsec_get_reqlevel(isr) == IPSEC_LEVEL_USE,
401 			("ipsec_nextisr: no SA found, but required; level %u",
402 			ipsec_get_reqlevel(isr)));
403 		isr = isr->next;
404 		/*
405 		 * No more rules to apply, return NULL isr and no error
406 		 * It can happen when the last rules are USE rules
407 		 * */
408 		if (isr == NULL) {
409 			*error = 0;
410 			return isr;
411 		}
412 		goto again;
413 	}
414 
415 	/*
416 	 * Check system global policy controls.
417 	 */
418 	if ((isr->saidx.proto == IPPROTO_ESP && !esp_enable) ||
419 	    (isr->saidx.proto == IPPROTO_AH && !ah_enable) ||
420 	    (isr->saidx.proto == IPPROTO_IPCOMP && !ipcomp_enable)) {
421 		DPRINTF(("ipsec_nextisr: IPsec outbound packet dropped due"
422 			" to policy (check your sysctls)\n"));
423 		IPSEC_OSTAT(espstat.esps_pdrops, ahstat.ahs_pdrops,
424 		    ipcompstat.ipcomps_pdrops);
425 		*error = EHOSTUNREACH;
426 		goto bad;
427 	}
428 
429 	/*
430 	 * Sanity check the SA contents for the caller
431 	 * before they invoke the xform output method.
432 	 */
433 	if (sav->tdb_xform == NULL) {
434 		DPRINTF(("ipsec_nextisr: no transform for SA\n"));
435 		IPSEC_OSTAT(espstat.esps_noxform, ahstat.ahs_noxform,
436 		    ipcompstat.ipcomps_noxform);
437 		*error = EHOSTUNREACH;
438 		goto bad;
439 	}
440 	return isr;
441 bad:
442 	IPSEC_ASSERT(*error != 0, ("ipsec_nextisr: error return w/ no error code"));
443 	return NULL;
444 #undef IPSEC_OSTAT
445 }
446 
447 #ifdef INET
448 /*
449  * IPsec output logic for IPv4.
450  */
451 int
452 ipsec4_process_packet(
453     struct mbuf *m,
454     struct ipsecrequest *isr,
455     int flags,
456     int tunalready
457 )
458 {
459 	struct secasindex saidx;
460 	struct secasvar *sav;
461 	struct ip *ip;
462 	int s, error, i, off;
463 
464 	IPSEC_ASSERT(m != NULL, ("ipsec4_process_packet: null mbuf"));
465 	IPSEC_ASSERT(isr != NULL, ("ipsec4_process_packet: null isr"));
466 
467 	s = splsoftnet();			/* insure SA contents don't change */
468 
469 	isr = ipsec_nextisr(m, isr, AF_INET, &saidx, &error);
470 	if (isr == NULL) {
471 		if (error != 0) {
472 			goto bad;
473 		} else {
474 			if (ipsec_register_done(m, &error) < 0)
475 				goto bad;
476 
477 			splx(s);
478 			return ipsec_reinject_ipstack(m, AF_INET);
479 		}
480 	}
481 
482 	sav = isr->sav;
483 	if (!tunalready) {
484 		union sockaddr_union *dst = &sav->sah->saidx.dst;
485 		int setdf;
486 
487 		/*
488 		 * Collect IP_DF state from the outer header.
489 		 */
490 		if (dst->sa.sa_family == AF_INET) {
491 			if (m->m_len < sizeof (struct ip) &&
492 			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
493 				error = ENOBUFS;
494 				goto bad;
495 			}
496 			ip = mtod(m, struct ip *);
497 			/* Honor system-wide control of how to handle IP_DF */
498 			switch (ip4_ipsec_dfbit) {
499 			case 0:			/* clear in outer header */
500 			case 1:			/* set in outer header */
501 				setdf = ip4_ipsec_dfbit;
502 				break;
503 			default:		/* propagate to outer header */
504 				setdf = ip->ip_off;
505 #ifndef __FreeBSD__
506 		/* On FreeBSD, ip_off and ip_len assumed in host endian. */
507 				setdf = ntohs(setdf);
508 #endif
509 				setdf = htons(setdf & IP_DF);
510 				break;
511 			}
512 		} else {
513 			ip = NULL;		/* keep compiler happy */
514 			setdf = 0;
515 		}
516 		/* Do the appropriate encapsulation, if necessary */
517 		if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
518 		    dst->sa.sa_family != AF_INET ||	    /* PF mismatch */
519 #if 0
520 		    (sav->flags & SADB_X_SAFLAGS_TUNNEL) || /* Tunnel requ'd */
521 		    sav->tdb_xform->xf_type == XF_IP4 ||    /* ditto */
522 #endif
523 		    (dst->sa.sa_family == AF_INET &&	    /* Proxy */
524 		     dst->sin.sin_addr.s_addr != INADDR_ANY &&
525 		     dst->sin.sin_addr.s_addr != ip->ip_dst.s_addr)) {
526 			struct mbuf *mp;
527 
528 			/* Fix IPv4 header checksum and length */
529 			if (m->m_len < sizeof (struct ip) &&
530 			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
531 				error = ENOBUFS;
532 				goto bad;
533 			}
534 			ip = mtod(m, struct ip *);
535 			ip->ip_len = htons(m->m_pkthdr.len);
536 			ip->ip_sum = 0;
537 			ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
538 
539 			/* Encapsulate the packet */
540 			error = ipip_output(m, isr, &mp, 0, 0);
541 			if (mp == NULL && !error) {
542 				/* Should never happen. */
543 				DPRINTF(("ipsec4_process_packet: ipip_output "
544 					"returns no mbuf and no error!"));
545 				error = EFAULT;
546 			}
547 			if (error) {
548 				if (mp) {
549 					/* XXX: Should never happen! */
550 					m_freem(mp);
551 				}
552 				m = NULL; /* ipip_output() already freed it */
553 				goto bad;
554 			}
555 			m = mp, mp = NULL;
556 			/*
557 			 * ipip_output clears IP_DF in the new header.  If
558 			 * we need to propagate IP_DF from the outer header,
559 			 * then we have to do it here.
560 			 *
561 			 * XXX shouldn't assume what ipip_output does.
562 			 */
563 			if (dst->sa.sa_family == AF_INET && setdf) {
564 				if (m->m_len < sizeof (struct ip) &&
565 				    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
566 					error = ENOBUFS;
567 					goto bad;
568 				}
569 				ip = mtod(m, struct ip *);
570 				ip->ip_off |= IP_OFF_CONVERT(IP_DF);
571 			}
572 		}
573 	}
574 
575 	/*
576 	 * Dispatch to the appropriate IPsec transform logic.  The
577 	 * packet will be returned for transmission after crypto
578 	 * processing, etc. are completed.  For encapsulation we
579 	 * bypass this call because of the explicit call done above
580 	 * (necessary to deal with IP_DF handling for IPv4).
581 	 *
582 	 * NB: m & sav are ``passed to caller'' who's reponsible for
583 	 *     for reclaiming their resources.
584 	 */
585 	if (sav->tdb_xform->xf_type != XF_IP4) {
586 		ip = mtod(m, struct ip *);
587 		i = ip->ip_hl << 2;
588 		off = offsetof(struct ip, ip_p);
589 		error = (*sav->tdb_xform->xf_output)(m, isr, NULL, i, off);
590 	} else {
591 		error = ipsec_process_done(m, isr);
592 	}
593 	splx(s);
594 	return error;
595 bad:
596 	splx(s);
597 	if (m)
598 		m_freem(m);
599 	return error;
600 }
601 #endif
602 
603 #ifdef INET6
604 int
605 ipsec6_process_packet(
606 	struct mbuf *m,
607  	struct ipsecrequest *isr
608     )
609 {
610 	struct secasindex saidx;
611 	struct secasvar *sav;
612 	struct ip6_hdr *ip6;
613 	int s, error, i, off;
614 
615 	IPSEC_ASSERT(m != NULL, ("ipsec6_process_packet: null mbuf"));
616 	IPSEC_ASSERT(isr != NULL, ("ipsec6_process_packet: null isr"));
617 
618 	s = splsoftnet();   /* insure SA contents don't change */
619 	isr = ipsec_nextisr(m, isr, AF_INET6, &saidx, &error);
620 	if (isr == NULL) {
621 		if (error != 0) {
622 			// XXX Should we send a notification ?
623 			goto bad;
624 		} else {
625 			if (ipsec_register_done(m, &error) < 0)
626 				goto bad;
627 
628 			splx(s);
629 			return ipsec_reinject_ipstack(m, AF_INET);
630 		}
631 	}
632 
633 	sav = isr->sav;
634 	if (sav->tdb_xform->xf_type != XF_IP4) {
635 		i = sizeof(struct ip6_hdr);
636 		off = offsetof(struct ip6_hdr, ip6_nxt);
637 		error = (*sav->tdb_xform->xf_output)(m, isr, NULL, i, off);
638        } else {
639 		union sockaddr_union *dst = &sav->sah->saidx.dst;
640 
641         ip6 = mtod(m, struct ip6_hdr *);
642 
643 		/* Do the appropriate encapsulation, if necessary */
644 		if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
645                dst->sa.sa_family != AF_INET6 ||        /* PF mismatch */
646             ((dst->sa.sa_family == AF_INET6) &&
647                 (!IN6_IS_ADDR_UNSPECIFIED(&dst->sin6.sin6_addr)) &&
648                 (!IN6_ARE_ADDR_EQUAL(&dst->sin6.sin6_addr,
649                 &ip6->ip6_dst)))
650             )
651 		{
652 			struct mbuf *mp;
653             /* Fix IPv6 header payload length. */
654             if (m->m_len < sizeof(struct ip6_hdr))
655                 if ((m = m_pullup(m,sizeof(struct ip6_hdr))) == NULL)
656                    return ENOBUFS;
657 
658             if (m->m_pkthdr.len - sizeof(*ip6) > IPV6_MAXPACKET) {
659                 /* No jumbogram support. */
660                 m_freem(m);
661                 return ENXIO;   /*XXX*/
662             }
663             ip6 = mtod(m, struct ip6_hdr *);
664             ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
665 
666 			/* Encapsulate the packet */
667 			error = ipip_output(m, isr, &mp, 0, 0);
668 			if (mp == NULL && !error) {
669 				/* Should never happen. */
670 				DPRINTF(("ipsec6_process_packet: ipip_output "
671 						 "returns no mbuf and no error!"));
672 				 error = EFAULT;
673 			}
674 
675 			if (error) {
676 				if (mp) {
677 					/* XXX: Should never happen! */
678 					m_freem(mp);
679 				}
680 				m = NULL; /* ipip_output() already freed it */
681 				goto bad;
682 			}
683 
684 			m = mp;
685 			mp = NULL;
686 		}
687 
688 		error = ipsec_process_done(m,isr);
689 		}
690 		splx(s);
691 		return error;
692 bad:
693 	splx(s);
694 	if (m)
695 		m_freem(m);
696 	return error;
697 }
698 #endif /*INET6*/
699