1 /* $NetBSD: xform_ipip.c,v 1.37 2016/01/26 06:00:10 knakahara Exp $ */ 2 /* $FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $ */ 3 /* $OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */ 4 5 /* 6 * The authors of this code are John Ioannidis (ji@tla.org), 7 * Angelos D. Keromytis (kermit@csd.uch.gr) and 8 * Niels Provos (provos@physnet.uni-hamburg.de). 9 * 10 * The original version of this code was written by John Ioannidis 11 * for BSD/OS in Athens, Greece, in November 1995. 12 * 13 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 14 * by Angelos D. Keromytis. 15 * 16 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 17 * and Niels Provos. 18 * 19 * Additional features in 1999 by Angelos D. Keromytis. 20 * 21 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 22 * Angelos D. Keromytis and Niels Provos. 23 * Copyright (c) 2001, Angelos D. Keromytis. 24 * 25 * Permission to use, copy, and modify this software with or without fee 26 * is hereby granted, provided that this entire notice is included in 27 * all copies of any software which is or includes a copy or 28 * modification of this software. 29 * You may use this code under the GNU public license if you so wish. Please 30 * contribute changes back to the authors under this freer than GPL license 31 * so that we may further the use of strong encryption without limitations to 32 * all. 33 * 34 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 35 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 36 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 37 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 38 * PURPOSE. 39 */ 40 41 #include <sys/cdefs.h> 42 __KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.37 2016/01/26 06:00:10 knakahara Exp $"); 43 44 /* 45 * IP-inside-IP processing 46 */ 47 #include "opt_inet.h" 48 #ifdef __FreeBSD__ 49 #include "opt_inet6.h" 50 #include "opt_random_ip_id.h" 51 #endif /* __FreeBSD__ */ 52 53 54 #include <sys/param.h> 55 #include <sys/systm.h> 56 #include <sys/mbuf.h> 57 #include <sys/socket.h> 58 #include <sys/kernel.h> 59 #include <sys/protosw.h> 60 #include <sys/sysctl.h> 61 62 #include <net/if.h> 63 #include <net/route.h> 64 #include <net/netisr.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/in_var.h> 69 #include <netinet/ip.h> 70 #include <netinet/ip_ecn.h> 71 #include <netinet/ip_var.h> 72 #include <netinet/ip_encap.h> 73 #ifdef __FreeBSD__ 74 #include <netinet/ipprotosw.h> 75 #endif 76 77 #include <netipsec/ipsec.h> 78 #include <netipsec/ipsec_private.h> 79 #include <netipsec/xform.h> 80 81 #include <netipsec/ipip_var.h> 82 83 #ifdef MROUTING 84 #include <netinet/ip_mroute.h> 85 #endif 86 87 #ifdef INET6 88 #include <netinet/ip6.h> 89 #include <netipsec/ipsec6.h> 90 # ifdef __FreeBSD__ 91 # include <netinet6/ip6_ecn.h> 92 # endif 93 #include <netinet6/in6_var.h> 94 #include <netinet6/ip6protosw.h> 95 #endif 96 97 #include <netipsec/key.h> 98 #include <netipsec/key_debug.h> 99 #include <netipsec/ipsec_osdep.h> 100 101 #ifdef __FreeBSD__ 102 typedef void pr_in_input_t (struct mbuf *, int, int); /* XXX FIX THIS */ 103 #else 104 typedef void pr_in_input_t (struct mbuf *m, ...); 105 #endif 106 107 /* 108 * We can control the acceptance of IP4 packets by altering the sysctl 109 * net.inet.ipip.allow value. Zero means drop them, all else is acceptance. 110 */ 111 int ipip_allow = 0; 112 113 percpu_t *ipipstat_percpu; 114 115 #ifdef SYSCTL_DECL 116 SYSCTL_DECL(_net_inet_ipip); 117 118 SYSCTL_INT(_net_inet_ipip, OID_AUTO, 119 ipip_allow, CTLFLAG_RW, &ipip_allow, 0, ""); 120 SYSCTL_STRUCT(_net_inet_ipip, IPSECCTL_STATS, 121 stats, CTLFLAG_RD, &ipipstat, ipipstat, ""); 122 123 #endif 124 125 #ifdef __FreeBSD__ 126 static 127 #endif 128 void ipe4_attach(void); 129 130 131 /* XXX IPCOMP */ 132 #define M_IPSEC (M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED) 133 134 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp); 135 136 #ifdef INET6 137 /* 138 * Really only a wrapper for ipip_input(), for use with IPv6. 139 */ 140 int 141 ip4_input6(struct mbuf **m, int *offp, int proto) 142 { 143 #if 0 144 /* If we do not accept IP-in-IP explicitly, drop. */ 145 if (!ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) { 146 DPRINTF(("ip4_input6: dropped due to policy\n")); 147 IPIP_STATINC(IPIP_STAT_PDROPS); 148 m_freem(*m); 149 return IPPROTO_DONE; 150 } 151 #endif 152 _ipip_input(*m, *offp, NULL); 153 return IPPROTO_DONE; 154 } 155 #endif /* INET6 */ 156 157 #ifdef INET 158 /* 159 * Really only a wrapper for ipip_input(), for use with IPv4. 160 */ 161 void 162 ip4_input(struct mbuf *m, int off, int proto) 163 { 164 165 #if 0 166 /* If we do not accept IP-in-IP explicitly, drop. */ 167 if (!ipip_allow && (m->m_flags & M_IPSEC) == 0) { 168 DPRINTF(("ip4_input: dropped due to policy\n")); 169 IPIP_STATINC(IPIP_STAT_PDROPS); 170 m_freem(m); 171 return; 172 } 173 #endif 174 175 _ipip_input(m, off, NULL); 176 } 177 #endif /* INET */ 178 179 /* 180 * ipip_input gets called when we receive an IP{46} encapsulated packet, 181 * either because we got it at a real interface, or because AH or ESP 182 * were being used in tunnel mode (in which case the rcvif element will 183 * contain the address of the encX interface associated with the tunnel. 184 */ 185 186 static void 187 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp) 188 { 189 register struct sockaddr_in *sin; 190 register struct ifnet *ifp; 191 register struct ifaddr *ifa; 192 pktqueue_t *pktq = NULL; 193 struct ip *ipo; 194 #ifdef INET6 195 register struct sockaddr_in6 *sin6; 196 struct ip6_hdr *ip6 = NULL; 197 u_int8_t itos; 198 #endif 199 u_int8_t otos; 200 u_int8_t v; 201 int hlen; 202 203 IPIP_STATINC(IPIP_STAT_IPACKETS); 204 205 m_copydata(m, 0, 1, &v); 206 207 switch (v >> 4) { 208 #ifdef INET 209 case 4: 210 hlen = sizeof(struct ip); 211 break; 212 #endif /* INET */ 213 #ifdef INET6 214 case 6: 215 hlen = sizeof(struct ip6_hdr); 216 break; 217 #endif 218 default: 219 DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) " 220 "for outer header\n", v, v>>4)); 221 IPIP_STATINC(IPIP_STAT_FAMILY); 222 m_freem(m); 223 return /* EAFNOSUPPORT */; 224 } 225 226 /* Bring the IP header in the first mbuf, if not there already */ 227 if (m->m_len < hlen) { 228 if ((m = m_pullup(m, hlen)) == NULL) { 229 DPRINTF(("ipip_input: m_pullup (1) failed\n")); 230 IPIP_STATINC(IPIP_STAT_HDROPS); 231 return; 232 } 233 } 234 235 ipo = mtod(m, struct ip *); 236 237 #ifdef MROUTING 238 if (ipo->ip_v == IPVERSION && ipo->ip_p == IPPROTO_IPV4) { 239 if (IN_MULTICAST(((struct ip *)((char *) ipo + iphlen))->ip_dst.s_addr)) { 240 ipip_mroute_input (m, iphlen); 241 return; 242 } 243 } 244 #endif /* MROUTING */ 245 246 /* Keep outer ecn field. */ 247 switch (v >> 4) { 248 #ifdef INET 249 case 4: 250 otos = ipo->ip_tos; 251 break; 252 #endif /* INET */ 253 #ifdef INET6 254 case 6: 255 otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff; 256 break; 257 #endif 258 default: 259 panic("ipip_input: unknown ip version %u (outer)", v>>4); 260 } 261 262 /* Remove outer IP header */ 263 m_adj(m, iphlen); 264 265 /* Sanity check */ 266 if (m->m_pkthdr.len < sizeof(struct ip)) { 267 IPIP_STATINC(IPIP_STAT_HDROPS); 268 m_freem(m); 269 return; 270 } 271 272 m_copydata(m, 0, 1, &v); 273 274 switch (v >> 4) { 275 #ifdef INET 276 case 4: 277 hlen = sizeof(struct ip); 278 break; 279 #endif /* INET */ 280 281 #ifdef INET6 282 case 6: 283 hlen = sizeof(struct ip6_hdr); 284 break; 285 #endif 286 default: 287 DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) " 288 "for inner header\n", v, v>>4)); 289 IPIP_STATINC(IPIP_STAT_FAMILY); 290 m_freem(m); 291 return; /* EAFNOSUPPORT */ 292 } 293 294 /* 295 * Bring the inner IP header in the first mbuf, if not there already. 296 */ 297 if (m->m_len < hlen) { 298 if ((m = m_pullup(m, hlen)) == NULL) { 299 DPRINTF(("ipip_input: m_pullup (2) failed\n")); 300 IPIP_STATINC(IPIP_STAT_HDROPS); 301 return; 302 } 303 } 304 305 /* 306 * RFC 1853 specifies that the inner TTL should not be touched on 307 * decapsulation. There's no reason this comment should be here, but 308 * this is as good as any a position. 309 */ 310 311 /* Some sanity checks in the inner IP header */ 312 switch (v >> 4) { 313 #ifdef INET 314 case 4: 315 ipo = mtod(m, struct ip *); 316 ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos); 317 break; 318 #endif /* INET */ 319 #ifdef INET6 320 case 6: 321 ip6 = (struct ip6_hdr *) ipo; 322 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 323 ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos); 324 ip6->ip6_flow &= ~htonl(0xff << 20); 325 ip6->ip6_flow |= htonl((u_int32_t) itos << 20); 326 break; 327 #endif 328 default: 329 panic("ipip_input: unknown ip version %u (inner)", v>>4); 330 } 331 332 /* Check for local address spoofing. */ 333 if ((m->m_pkthdr.rcvif == NULL || 334 !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) && 335 ipip_allow != 2) { 336 IFNET_FOREACH(ifp) { 337 IFADDR_FOREACH(ifa, ifp) { 338 #ifdef INET 339 if (ipo) { 340 if (ifa->ifa_addr->sa_family != 341 AF_INET) 342 continue; 343 344 sin = (struct sockaddr_in *) ifa->ifa_addr; 345 346 if (sin->sin_addr.s_addr == 347 ipo->ip_src.s_addr) { 348 IPIP_STATINC(IPIP_STAT_SPOOF); 349 m_freem(m); 350 return; 351 } 352 } 353 #endif /* INET */ 354 355 #ifdef INET6 356 if (ip6) { 357 if (ifa->ifa_addr->sa_family != 358 AF_INET6) 359 continue; 360 361 sin6 = (struct sockaddr_in6 *) ifa->ifa_addr; 362 363 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) { 364 IPIP_STATINC(IPIP_STAT_SPOOF); 365 m_freem(m); 366 return; 367 } 368 369 } 370 #endif /* INET6 */ 371 } 372 } 373 } 374 375 /* Statistics */ 376 IPIP_STATADD(IPIP_STAT_IBYTES, m->m_pkthdr.len - iphlen); 377 378 /* 379 * Interface pointer stays the same; if no IPsec processing has 380 * been done (or will be done), this will point to a normal 381 * interface. Otherwise, it'll point to an enc interface, which 382 * will allow a packet filter to distinguish between secure and 383 * untrusted packets. 384 */ 385 386 switch (v >> 4) { 387 #ifdef INET 388 case 4: 389 pktq = ip_pktq; 390 break; 391 #endif 392 #ifdef INET6 393 case 6: 394 pktq = ip6_pktq; 395 break; 396 #endif 397 default: 398 panic("ipip_input: should never reach here"); 399 } 400 401 int s = splnet(); 402 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 403 IPIP_STATINC(IPIP_STAT_QFULL); 404 m_freem(m); 405 } 406 splx(s); 407 } 408 409 int 410 ipip_output( 411 struct mbuf *m, 412 struct ipsecrequest *isr, 413 struct mbuf **mp, 414 int skip, 415 int protoff 416 ) 417 { 418 const struct secasvar *sav; 419 u_int8_t tp, otos; 420 struct secasindex *saidx; 421 int error; 422 #ifdef INET 423 u_int8_t itos; 424 struct ip *ipo; 425 #endif /* INET */ 426 #ifdef INET6 427 struct ip6_hdr *ip6, *ip6o; 428 #endif /* INET6 */ 429 430 IPSEC_SPLASSERT_SOFTNET("ipip_output"); 431 432 sav = isr->sav; 433 IPSEC_ASSERT(sav != NULL, ("ipip_output: null SA")); 434 IPSEC_ASSERT(sav->sah != NULL, ("ipip_output: null SAH")); 435 436 /* XXX Deal with empty TDB source/destination addresses. */ 437 438 m_copydata(m, 0, 1, &tp); 439 tp = (tp >> 4) & 0xff; /* Get the IP version number. */ 440 441 saidx = &sav->sah->saidx; 442 switch (saidx->dst.sa.sa_family) { 443 #ifdef INET 444 case AF_INET: 445 if (saidx->src.sa.sa_family != AF_INET || 446 saidx->src.sin.sin_addr.s_addr == INADDR_ANY || 447 saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) { 448 DPRINTF(("ipip_output: unspecified tunnel endpoint " 449 "address in SA %s/%08lx\n", 450 ipsec_address(&saidx->dst), 451 (u_long) ntohl(sav->spi))); 452 IPIP_STATINC(IPIP_STAT_UNSPEC); 453 error = EINVAL; 454 goto bad; 455 } 456 457 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 458 if (m == 0) { 459 DPRINTF(("ipip_output: M_PREPEND failed\n")); 460 IPIP_STATINC(IPIP_STAT_HDROPS); 461 error = ENOBUFS; 462 goto bad; 463 } 464 465 ipo = mtod(m, struct ip *); 466 467 ipo->ip_v = IPVERSION; 468 ipo->ip_hl = 5; 469 ipo->ip_len = htons(m->m_pkthdr.len); 470 ipo->ip_ttl = ip_defttl; 471 ipo->ip_sum = 0; 472 ipo->ip_src = saidx->src.sin.sin_addr; 473 ipo->ip_dst = saidx->dst.sin.sin_addr; 474 475 #if defined(__NetBSD__) 476 ipo->ip_id = ip_newid(NULL); 477 #elif defined(RANDOM_IP_ID) 478 ipo->ip_id = ip_randomid(); 479 #else 480 ipo->ip_id = htons(ip_id++); 481 #endif 482 483 /* If the inner protocol is IP... */ 484 if (tp == IPVERSION) { 485 /* Save ECN notification */ 486 m_copydata(m, sizeof(struct ip) + 487 offsetof(struct ip, ip_tos), 488 sizeof(u_int8_t), &itos); 489 490 ipo->ip_p = IPPROTO_IPIP; 491 492 /* 493 * We should be keeping tunnel soft-state and 494 * send back ICMPs if needed. 495 */ 496 m_copydata(m, sizeof(struct ip) + 497 offsetof(struct ip, ip_off), 498 sizeof(u_int16_t), &ipo->ip_off); 499 ipo->ip_off &= ~ IP_OFF_CONVERT(IP_DF | IP_MF | IP_OFFMASK); 500 } 501 #ifdef INET6 502 else if (tp == (IPV6_VERSION >> 4)) { 503 u_int32_t itos32; 504 505 /* Save ECN notification. */ 506 m_copydata(m, sizeof(struct ip) + 507 offsetof(struct ip6_hdr, ip6_flow), 508 sizeof(u_int32_t), &itos32); 509 itos = ntohl(itos32) >> 20; 510 ipo->ip_p = IPPROTO_IPV6; 511 ipo->ip_off = 0; 512 } 513 #endif /* INET6 */ 514 else { 515 goto nofamily; 516 } 517 518 otos = 0; 519 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 520 ipo->ip_tos = otos; 521 break; 522 #endif /* INET */ 523 524 #ifdef INET6 525 case AF_INET6: 526 if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) || 527 saidx->src.sa.sa_family != AF_INET6 || 528 IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) { 529 DPRINTF(("ipip_output: unspecified tunnel endpoint " 530 "address in SA %s/%08lx\n", 531 ipsec_address(&saidx->dst), 532 (u_long) ntohl(sav->spi))); 533 IPIP_STATINC(IPIP_STAT_UNSPEC); 534 error = ENOBUFS; 535 goto bad; 536 } 537 538 if (tp == (IPV6_VERSION >> 4)) { 539 /* scoped address handling */ 540 ip6 = mtod(m, struct ip6_hdr *); 541 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 542 ip6->ip6_src.s6_addr16[1] = 0; 543 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 544 ip6->ip6_dst.s6_addr16[1] = 0; 545 } 546 547 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 548 if (m == 0) { 549 DPRINTF(("ipip_output: M_PREPEND failed\n")); 550 IPIP_STATINC(IPIP_STAT_HDROPS); 551 error = ENOBUFS; 552 goto bad; 553 } 554 555 /* Initialize IPv6 header */ 556 ip6o = mtod(m, struct ip6_hdr *); 557 ip6o->ip6_flow = 0; 558 ip6o->ip6_vfc &= ~IPV6_VERSION_MASK; 559 ip6o->ip6_vfc |= IPV6_VERSION; 560 ip6o->ip6_plen = htons(m->m_pkthdr.len); 561 ip6o->ip6_hlim = ip_defttl; 562 ip6o->ip6_dst = saidx->dst.sin6.sin6_addr; 563 ip6o->ip6_src = saidx->src.sin6.sin6_addr; 564 if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_dst)) 565 ip6o->ip6_dst.s6_addr16[1] = htons(saidx->dst.sin6.sin6_scope_id); 566 if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_src)) 567 ip6o->ip6_src.s6_addr16[1] = htons(saidx->src.sin6.sin6_scope_id); 568 569 #ifdef INET 570 if (tp == IPVERSION) { 571 /* Save ECN notification */ 572 m_copydata(m, sizeof(struct ip6_hdr) + 573 offsetof(struct ip, ip_tos), sizeof(u_int8_t), 574 &itos); 575 576 /* This is really IPVERSION. */ 577 ip6o->ip6_nxt = IPPROTO_IPIP; 578 } else 579 #endif /* INET */ 580 if (tp == (IPV6_VERSION >> 4)) { 581 u_int32_t itos32; 582 583 /* Save ECN notification. */ 584 m_copydata(m, sizeof(struct ip6_hdr) + 585 offsetof(struct ip6_hdr, ip6_flow), 586 sizeof(u_int32_t), &itos32); 587 itos = ntohl(itos32) >> 20; 588 589 ip6o->ip6_nxt = IPPROTO_IPV6; 590 } else { 591 goto nofamily; 592 } 593 594 otos = 0; 595 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 596 ip6o->ip6_flow |= htonl((u_int32_t) otos << 20); 597 break; 598 #endif /* INET6 */ 599 600 default: 601 nofamily: 602 DPRINTF(("ipip_output: unsupported protocol family %u\n", 603 saidx->dst.sa.sa_family)); 604 IPIP_STATINC(IPIP_STAT_FAMILY); 605 error = EAFNOSUPPORT; /* XXX diffs from openbsd */ 606 goto bad; 607 } 608 609 IPIP_STATINC(IPIP_STAT_OPACKETS); 610 *mp = m; 611 612 #ifdef INET 613 if (saidx->dst.sa.sa_family == AF_INET) { 614 #if 0 615 if (sav->tdb_xform->xf_type == XF_IP4) 616 tdb->tdb_cur_bytes += 617 m->m_pkthdr.len - sizeof(struct ip); 618 #endif 619 IPIP_STATADD(IPIP_STAT_OBYTES, 620 m->m_pkthdr.len - sizeof(struct ip)); 621 } 622 #endif /* INET */ 623 624 #ifdef INET6 625 if (saidx->dst.sa.sa_family == AF_INET6) { 626 #if 0 627 if (sav->tdb_xform->xf_type == XF_IP4) 628 tdb->tdb_cur_bytes += 629 m->m_pkthdr.len - sizeof(struct ip6_hdr); 630 #endif 631 IPIP_STATADD(IPIP_STAT_OBYTES, 632 m->m_pkthdr.len - sizeof(struct ip6_hdr)); 633 } 634 #endif /* INET6 */ 635 636 return 0; 637 bad: 638 if (m) 639 m_freem(m); 640 *mp = NULL; 641 return (error); 642 } 643 644 static int 645 ipe4_init(struct secasvar *sav, const struct xformsw *xsp) 646 { 647 sav->tdb_xform = xsp; 648 return 0; 649 } 650 651 static int 652 ipe4_zeroize(struct secasvar *sav) 653 { 654 sav->tdb_xform = NULL; 655 return 0; 656 } 657 658 static int 659 ipe4_input( 660 struct mbuf *m, 661 const struct secasvar *sav, 662 int skip, 663 int protoff 664 ) 665 { 666 /* This is a rather serious mistake, so no conditional printing. */ 667 printf("ipe4_input: should never be called\n"); 668 if (m) 669 m_freem(m); 670 return EOPNOTSUPP; 671 } 672 673 static struct xformsw ipe4_xformsw = { 674 XF_IP4, 0, "IPv4 Simple Encapsulation", 675 ipe4_init, ipe4_zeroize, ipe4_input, ipip_output, 676 NULL, 677 }; 678 679 #ifdef INET 680 static struct encapsw ipe4_encapsw = { 681 .encapsw4 = { 682 .pr_input = ip4_input, 683 .pr_ctlinput = NULL, 684 } 685 }; 686 #endif 687 #ifdef INET6 688 static struct encapsw ipe4_encapsw6 = { 689 .encapsw6 = { 690 .pr_input = ip4_input6, 691 .pr_ctlinput = NULL, 692 } 693 }; 694 #endif 695 696 /* 697 * Check the encapsulated packet to see if we want it 698 */ 699 static int 700 ipe4_encapcheck(struct mbuf *m, 701 int off, 702 int proto, 703 void *arg 704 ) 705 { 706 /* 707 * Only take packets coming from IPSEC tunnels; the rest 708 * must be handled by the gif tunnel code. Note that we 709 * also return a minimum priority when we want the packet 710 * so any explicit gif tunnels take precedence. 711 */ 712 return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0); 713 } 714 715 INITFN void 716 ipe4_attach(void) 717 { 718 719 ipipstat_percpu = percpu_alloc(sizeof(uint64_t) * IPIP_NSTATS); 720 721 xform_register(&ipe4_xformsw); 722 /* attach to encapsulation framework */ 723 /* XXX save return cookie for detach on module remove */ 724 #ifdef INET 725 (void) encap_attach_func(AF_INET, -1, 726 ipe4_encapcheck, &ipe4_encapsw, NULL); 727 #endif 728 #ifdef INET6 729 (void) encap_attach_func(AF_INET6, -1, 730 ipe4_encapcheck, &ipe4_encapsw6, NULL); 731 #endif 732 } 733 734 #ifdef SYSINIT 735 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL); 736 #endif 737 738