xref: /netbsd-src/sys/netipsec/xform_ipip.c (revision c9496f6b604074a9451a67df576a5b423068e71e)
1 /*	$NetBSD: xform_ipip.c,v 1.58 2018/01/24 14:39:14 maxv Exp $	*/
2 /*	$FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $	*/
3 /*	$OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
4 
5 /*
6  * The authors of this code are John Ioannidis (ji@tla.org),
7  * Angelos D. Keromytis (kermit@csd.uch.gr) and
8  * Niels Provos (provos@physnet.uni-hamburg.de).
9  *
10  * The original version of this code was written by John Ioannidis
11  * for BSD/OS in Athens, Greece, in November 1995.
12  *
13  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
14  * by Angelos D. Keromytis.
15  *
16  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
17  * and Niels Provos.
18  *
19  * Additional features in 1999 by Angelos D. Keromytis.
20  *
21  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
22  * Angelos D. Keromytis and Niels Provos.
23  * Copyright (c) 2001, Angelos D. Keromytis.
24  *
25  * Permission to use, copy, and modify this software with or without fee
26  * is hereby granted, provided that this entire notice is included in
27  * all copies of any software which is or includes a copy or
28  * modification of this software.
29  * You may use this code under the GNU public license if you so wish. Please
30  * contribute changes back to the authors under this freer than GPL license
31  * so that we may further the use of strong encryption without limitations to
32  * all.
33  *
34  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
35  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
36  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
37  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
38  * PURPOSE.
39  */
40 
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.58 2018/01/24 14:39:14 maxv Exp $");
43 
44 /*
45  * IP-inside-IP processing
46  */
47 #if defined(_KERNEL_OPT)
48 #include "opt_inet.h"
49 #endif
50 
51 #include <sys/param.h>
52 #include <sys/systm.h>
53 #include <sys/mbuf.h>
54 #include <sys/socket.h>
55 #include <sys/kernel.h>
56 #include <sys/protosw.h>
57 #include <sys/sysctl.h>
58 
59 #include <net/if.h>
60 #include <net/route.h>
61 #include <net/netisr.h>
62 
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/in_var.h>
66 #include <netinet/ip.h>
67 #include <netinet/ip_ecn.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/ip_encap.h>
70 
71 #include <netipsec/ipsec.h>
72 #include <netipsec/ipsec_private.h>
73 #include <netipsec/xform.h>
74 
75 #include <netipsec/ipip_var.h>
76 
77 #ifdef MROUTING
78 #include <netinet/ip_mroute.h>
79 #endif
80 
81 #ifdef INET6
82 #include <netinet/ip6.h>
83 #include <netipsec/ipsec6.h>
84 #include <netinet6/in6_var.h>
85 #include <netinet6/ip6protosw.h>
86 #endif
87 
88 #include <netipsec/key.h>
89 #include <netipsec/key_debug.h>
90 
91 typedef void	pr_in_input_t (struct mbuf *m, ...);
92 
93 /*
94  * We can control the acceptance of IP4 packets by altering the sysctl
95  * net.inet.ipip.allow value.  Zero means drop them, all else is acceptance.
96  */
97 int	ipip_allow = 0;
98 
99 percpu_t *ipipstat_percpu;
100 
101 #ifdef SYSCTL_DECL
102 SYSCTL_DECL(_net_inet_ipip);
103 
104 SYSCTL_INT(_net_inet_ipip, OID_AUTO,
105 	ipip_allow,	CTLFLAG_RW,	&ipip_allow,	0, "");
106 SYSCTL_STRUCT(_net_inet_ipip, IPSECCTL_STATS,
107 	stats,		CTLFLAG_RD,	&ipipstat,	ipipstat, "");
108 
109 #endif
110 
111 void ipe4_attach(void);
112 
113 
114 /* XXX IPCOMP */
115 #define	M_IPSEC	(M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
116 
117 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp);
118 
119 #ifdef INET6
120 /*
121  * Really only a wrapper for ipip_input(), for use with IPv6.
122  */
123 int
124 ip4_input6(struct mbuf **m, int *offp, int proto, void *eparg __unused)
125 {
126 #if 0
127 	/* If we do not accept IP-in-IP explicitly, drop.  */
128 	if (!ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) {
129 		DPRINTF(("%s: dropped due to policy\n", __func__));
130 		IPIP_STATINC(IPIP_STAT_PDROPS);
131 		m_freem(*m);
132 		return IPPROTO_DONE;
133 	}
134 #endif
135 	_ipip_input(*m, *offp, NULL);
136 	return IPPROTO_DONE;
137 }
138 #endif /* INET6 */
139 
140 #ifdef INET
141 /*
142  * Really only a wrapper for ipip_input(), for use with IPv4.
143  */
144 void
145 ip4_input(struct mbuf *m, int off, int proto, void *eparg __unused)
146 {
147 
148 #if 0
149 	/* If we do not accept IP-in-IP explicitly, drop.  */
150 	if (!ipip_allow && (m->m_flags & M_IPSEC) == 0) {
151 		DPRINTF(("%s: dropped due to policy\n", __func__));
152 		IPIP_STATINC(IPIP_STAT_PDROPS);
153 		m_freem(m);
154 		return;
155 	}
156 #endif
157 
158 	_ipip_input(m, off, NULL);
159 }
160 #endif /* INET */
161 
162 /*
163  * ipip_input gets called when we receive an IP{46} encapsulated packet,
164  * either because we got it at a real interface, or because AH or ESP
165  * were being used in tunnel mode (in which case the rcvif element will
166  * contain the address of the encX interface associated with the tunnel.
167  */
168 
169 static void
170 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
171 {
172 	register struct sockaddr_in *sin;
173 	register struct ifnet *ifp;
174 	register struct ifaddr *ifa;
175 	pktqueue_t *pktq = NULL;
176 	struct ip *ipo;
177 #ifdef INET6
178 	register struct sockaddr_in6 *sin6;
179 	struct ip6_hdr *ip6 = NULL;
180 	uint8_t itos;
181 #endif
182 	uint8_t otos;
183 	uint8_t v;
184 	int hlen;
185 
186 	IPIP_STATINC(IPIP_STAT_IPACKETS);
187 
188 	m_copydata(m, 0, 1, &v);
189 
190 	switch (v >> 4) {
191 #ifdef INET
192 	case 4:
193 		hlen = sizeof(struct ip);
194 		break;
195 #endif /* INET */
196 #ifdef INET6
197 	case 6:
198 		hlen = sizeof(struct ip6_hdr);
199 		break;
200 #endif
201 	default:
202 		DPRINTF(("%s: bad protocol version 0x%x (%u) "
203 		    "for outer header\n", __func__, v, v>>4));
204 		IPIP_STATINC(IPIP_STAT_FAMILY);
205 		m_freem(m);
206 		return /* EAFNOSUPPORT */;
207 	}
208 
209 	/* Bring the IP header in the first mbuf, if not there already */
210 	if (m->m_len < hlen) {
211 		if ((m = m_pullup(m, hlen)) == NULL) {
212 			DPRINTF(("%s: m_pullup (1) failed\n", __func__));
213 			IPIP_STATINC(IPIP_STAT_HDROPS);
214 			return;
215 		}
216 	}
217 
218 	ipo = mtod(m, struct ip *);
219 
220 #ifdef MROUTING
221 	if (ipo->ip_v == IPVERSION && ipo->ip_p == IPPROTO_IPV4) {
222 		if (IN_MULTICAST(((struct ip *)((char *) ipo + iphlen))->ip_dst.s_addr)) {
223 			ipip_mroute_input (m, iphlen);
224 			return;
225 		}
226 	}
227 #endif /* MROUTING */
228 
229 	/* Keep outer ecn field. */
230 	switch (v >> 4) {
231 #ifdef INET
232 	case 4:
233 		otos = ipo->ip_tos;
234 		break;
235 #endif /* INET */
236 #ifdef INET6
237 	case 6:
238 		otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff;
239 		break;
240 #endif
241 	default:
242 		panic("%s: unknown ip version %u (outer)", __func__, v >> 4);
243 	}
244 
245 	/* Remove outer IP header */
246 	m_adj(m, iphlen);
247 
248 	/* Sanity check */
249 	if (m->m_pkthdr.len < sizeof(struct ip))  {
250 		IPIP_STATINC(IPIP_STAT_HDROPS);
251 		m_freem(m);
252 		return;
253 	}
254 
255 	m_copydata(m, 0, 1, &v);
256 
257 	switch (v >> 4) {
258 #ifdef INET
259 	case 4:
260 		hlen = sizeof(struct ip);
261 		break;
262 #endif /* INET */
263 
264 #ifdef INET6
265 	case 6:
266 		hlen = sizeof(struct ip6_hdr);
267 		break;
268 #endif
269 	default:
270 		DPRINTF(("%s: bad protocol version %#x (%u) "
271 		    "for inner header\n", __func__, v, v >> 4));
272 		IPIP_STATINC(IPIP_STAT_FAMILY);
273 		m_freem(m);
274 		return; /* EAFNOSUPPORT */
275 	}
276 
277 	/*
278 	 * Bring the inner IP header in the first mbuf, if not there already.
279 	 */
280 	if (m->m_len < hlen) {
281 		if ((m = m_pullup(m, hlen)) == NULL) {
282 			DPRINTF(("%s: m_pullup (2) failed\n", __func__));
283 			IPIP_STATINC(IPIP_STAT_HDROPS);
284 			return;
285 		}
286 	}
287 
288 	/*
289 	 * RFC 1853 specifies that the inner TTL should not be touched on
290 	 * decapsulation. There's no reason this comment should be here, but
291 	 * this is as good as any a position.
292 	 */
293 
294 	/* Some sanity checks in the inner IP header */
295 	switch (v >> 4) {
296 #ifdef INET
297 	case 4:
298 		ipo = mtod(m, struct ip *);
299 		ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos);
300 		break;
301 #endif /* INET */
302 #ifdef INET6
303 	case 6:
304 		ipo = NULL;
305 		ip6 = mtod(m, struct ip6_hdr *);
306 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
307 		ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
308 		ip6->ip6_flow &= ~htonl(0xff << 20);
309 		ip6->ip6_flow |= htonl((uint32_t) itos << 20);
310 		break;
311 #endif
312 	default:
313 		panic("%s: unknown ip version %u (inner)", __func__, v>>4);
314 	}
315 
316 	/* Check for local address spoofing. */
317 	if ((m_get_rcvif_NOMPSAFE(m) == NULL ||
318 	    !(m_get_rcvif_NOMPSAFE(m)->if_flags & IFF_LOOPBACK)) &&
319 	    ipip_allow != 2) {
320 		int s = pserialize_read_enter();
321 		IFNET_READER_FOREACH(ifp) {
322 			IFADDR_READER_FOREACH(ifa, ifp) {
323 #ifdef INET
324 				if (ipo) {
325 					if (ifa->ifa_addr->sa_family !=
326 					    AF_INET)
327 						continue;
328 
329 					sin = (struct sockaddr_in *) ifa->ifa_addr;
330 
331 					if (sin->sin_addr.s_addr ==
332 					    ipo->ip_src.s_addr)	{
333 						pserialize_read_exit(s);
334 						IPIP_STATINC(IPIP_STAT_SPOOF);
335 						m_freem(m);
336 						return;
337 					}
338 				}
339 #endif /* INET */
340 
341 #ifdef INET6
342 				if (ip6) {
343 					if (ifa->ifa_addr->sa_family !=
344 					    AF_INET6)
345 						continue;
346 
347 					sin6 = (struct sockaddr_in6 *) ifa->ifa_addr;
348 
349 					if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) {
350 						pserialize_read_exit(s);
351 						IPIP_STATINC(IPIP_STAT_SPOOF);
352 						m_freem(m);
353 						return;
354 					}
355 
356 				}
357 #endif /* INET6 */
358 			}
359 		}
360 		pserialize_read_exit(s);
361 	}
362 
363 	/* Statistics */
364 	IPIP_STATADD(IPIP_STAT_IBYTES, m->m_pkthdr.len - iphlen);
365 
366 	/*
367 	 * Interface pointer stays the same; if no IPsec processing has
368 	 * been done (or will be done), this will point to a normal
369 	 * interface. Otherwise, it'll point to an enc interface, which
370 	 * will allow a packet filter to distinguish between secure and
371 	 * untrusted packets.
372 	 */
373 
374 	switch (v >> 4) {
375 #ifdef INET
376 	case 4:
377 		pktq = ip_pktq;
378 		break;
379 #endif
380 #ifdef INET6
381 	case 6:
382 		pktq = ip6_pktq;
383 		break;
384 #endif
385 	default:
386 		panic("%s: should never reach here", __func__);
387 	}
388 
389 	int s = splnet();
390 	if (__predict_false(!pktq_enqueue(pktq, m, 0))) {
391 		IPIP_STATINC(IPIP_STAT_QFULL);
392 		m_freem(m);
393 	}
394 	splx(s);
395 }
396 
397 int
398 ipip_output(
399     struct mbuf *m,
400     const struct ipsecrequest *isr,
401     struct secasvar *sav,
402     struct mbuf **mp,
403     int skip,
404     int protoff
405 )
406 {
407 	char buf[IPSEC_ADDRSTRLEN];
408 	uint8_t tp, otos;
409 	struct secasindex *saidx;
410 	int error;
411 #ifdef INET
412 	uint8_t itos;
413 	struct ip *ipo;
414 #endif /* INET */
415 #ifdef INET6
416 	struct ip6_hdr *ip6, *ip6o;
417 #endif /* INET6 */
418 
419 	IPSEC_SPLASSERT_SOFTNET(__func__);
420 	KASSERT(sav != NULL);
421 
422 	/* XXX Deal with empty TDB source/destination addresses. */
423 
424 	m_copydata(m, 0, 1, &tp);
425 	tp = (tp >> 4) & 0xff;  /* Get the IP version number. */
426 
427 	saidx = &sav->sah->saidx;
428 	switch (saidx->dst.sa.sa_family) {
429 #ifdef INET
430 	case AF_INET:
431 		if (saidx->src.sa.sa_family != AF_INET ||
432 		    saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
433 		    saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) {
434 			DPRINTF(("%s: unspecified tunnel endpoint "
435 			    "address in SA %s/%08lx\n", __func__,
436 			    ipsec_address(&saidx->dst, buf, sizeof(buf)),
437 			    (u_long) ntohl(sav->spi)));
438 			IPIP_STATINC(IPIP_STAT_UNSPEC);
439 			error = EINVAL;
440 			goto bad;
441 		}
442 
443 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
444 		if (m == 0) {
445 			DPRINTF(("%s: M_PREPEND failed\n", __func__));
446 			IPIP_STATINC(IPIP_STAT_HDROPS);
447 			error = ENOBUFS;
448 			goto bad;
449 		}
450 
451 		ipo = mtod(m, struct ip *);
452 
453 		ipo->ip_v = IPVERSION;
454 		ipo->ip_hl = 5;
455 		ipo->ip_len = htons(m->m_pkthdr.len);
456 		ipo->ip_ttl = ip_defttl;
457 		ipo->ip_sum = 0;
458 		ipo->ip_src = saidx->src.sin.sin_addr;
459 		ipo->ip_dst = saidx->dst.sin.sin_addr;
460 		ipo->ip_id = ip_newid(NULL);
461 
462 		/* If the inner protocol is IP... */
463 		if (tp == IPVERSION) {
464 			/* Save ECN notification */
465 			m_copydata(m, sizeof(struct ip) +
466 			    offsetof(struct ip, ip_tos),
467 			    sizeof(uint8_t), &itos);
468 
469 			ipo->ip_p = IPPROTO_IPIP;
470 
471 			/*
472 			 * We should be keeping tunnel soft-state and
473 			 * send back ICMPs if needed.
474 			 */
475 			m_copydata(m, sizeof(struct ip) +
476 			    offsetof(struct ip, ip_off),
477 			    sizeof(uint16_t), &ipo->ip_off);
478 			ipo->ip_off &= ~ htons(IP_DF | IP_MF | IP_OFFMASK);
479 		}
480 #ifdef INET6
481 		else if (tp == (IPV6_VERSION >> 4)) {
482 			uint32_t itos32;
483 
484 			/* Save ECN notification. */
485 			m_copydata(m, sizeof(struct ip) +
486 			    offsetof(struct ip6_hdr, ip6_flow),
487 			    sizeof(uint32_t), &itos32);
488 			itos = ntohl(itos32) >> 20;
489 			ipo->ip_p = IPPROTO_IPV6;
490 			ipo->ip_off = 0;
491 		}
492 #endif /* INET6 */
493 		else {
494 			goto nofamily;
495 		}
496 
497 		otos = 0;
498 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
499 		ipo->ip_tos = otos;
500 		break;
501 #endif /* INET */
502 
503 #ifdef INET6
504 	case AF_INET6:
505 		if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) ||
506 		    saidx->src.sa.sa_family != AF_INET6 ||
507 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) {
508 			DPRINTF(("%s: unspecified tunnel endpoint "
509 			    "address in SA %s/%08lx\n", __func__,
510 			    ipsec_address(&saidx->dst, buf, sizeof(buf)),
511 			    (u_long) ntohl(sav->spi)));
512 			IPIP_STATINC(IPIP_STAT_UNSPEC);
513 			error = ENOBUFS;
514 			goto bad;
515 		}
516 
517 		if (tp == (IPV6_VERSION >> 4)) {
518 			/* scoped address handling */
519 			ip6 = mtod(m, struct ip6_hdr *);
520 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
521 				ip6->ip6_src.s6_addr16[1] = 0;
522 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
523 				ip6->ip6_dst.s6_addr16[1] = 0;
524 		}
525 
526 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
527 		if (m == 0) {
528 			DPRINTF(("%s: M_PREPEND failed\n", __func__));
529 			IPIP_STATINC(IPIP_STAT_HDROPS);
530 			error = ENOBUFS;
531 			goto bad;
532 		}
533 
534 		/* Initialize IPv6 header */
535 		ip6o = mtod(m, struct ip6_hdr *);
536 		ip6o->ip6_flow = 0;
537 		ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
538 		ip6o->ip6_vfc |= IPV6_VERSION;
539 		ip6o->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6o));
540 		ip6o->ip6_hlim = ip_defttl;
541 		ip6o->ip6_dst = saidx->dst.sin6.sin6_addr;
542 		ip6o->ip6_src = saidx->src.sin6.sin6_addr;
543 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_dst))
544 			ip6o->ip6_dst.s6_addr16[1] = htons(saidx->dst.sin6.sin6_scope_id);
545 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_src))
546 			ip6o->ip6_src.s6_addr16[1] = htons(saidx->src.sin6.sin6_scope_id);
547 
548 #ifdef INET
549 		if (tp == IPVERSION) {
550 			/* Save ECN notification */
551 			m_copydata(m, sizeof(struct ip6_hdr) +
552 			    offsetof(struct ip, ip_tos), sizeof(uint8_t),
553 			    &itos);
554 
555 			/* This is really IPVERSION. */
556 			ip6o->ip6_nxt = IPPROTO_IPIP;
557 		} else
558 #endif /* INET */
559 			if (tp == (IPV6_VERSION >> 4)) {
560 				uint32_t itos32;
561 
562 				/* Save ECN notification. */
563 				m_copydata(m, sizeof(struct ip6_hdr) +
564 				    offsetof(struct ip6_hdr, ip6_flow),
565 				    sizeof(uint32_t), &itos32);
566 				itos = ntohl(itos32) >> 20;
567 
568 				ip6o->ip6_nxt = IPPROTO_IPV6;
569 			} else {
570 				goto nofamily;
571 			}
572 
573 		otos = 0;
574 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
575 		ip6o->ip6_flow |= htonl((uint32_t) otos << 20);
576 		break;
577 #endif /* INET6 */
578 
579 	default:
580 nofamily:
581 		DPRINTF(("%s: unsupported protocol family %u\n", __func__,
582 		    saidx->dst.sa.sa_family));
583 		IPIP_STATINC(IPIP_STAT_FAMILY);
584 		error = EAFNOSUPPORT;		/* XXX diffs from openbsd */
585 		goto bad;
586 	}
587 
588 	IPIP_STATINC(IPIP_STAT_OPACKETS);
589 	*mp = m;
590 
591 #ifdef INET
592 	if (saidx->dst.sa.sa_family == AF_INET) {
593 #if 0
594 		if (sav->tdb_xform->xf_type == XF_IP4)
595 			tdb->tdb_cur_bytes +=
596 			    m->m_pkthdr.len - sizeof(struct ip);
597 #endif
598 		IPIP_STATADD(IPIP_STAT_OBYTES,
599 			     m->m_pkthdr.len - sizeof(struct ip));
600 	}
601 #endif /* INET */
602 
603 #ifdef INET6
604 	if (saidx->dst.sa.sa_family == AF_INET6) {
605 #if 0
606 		if (sav->tdb_xform->xf_type == XF_IP4)
607 			tdb->tdb_cur_bytes +=
608 			    m->m_pkthdr.len - sizeof(struct ip6_hdr);
609 #endif
610 		IPIP_STATADD(IPIP_STAT_OBYTES,
611 		    m->m_pkthdr.len - sizeof(struct ip6_hdr));
612 	}
613 #endif /* INET6 */
614 
615 	return 0;
616 bad:
617 	if (m)
618 		m_freem(m);
619 	*mp = NULL;
620 	return (error);
621 }
622 
623 static int
624 ipe4_init(struct secasvar *sav, const struct xformsw *xsp)
625 {
626 	sav->tdb_xform = xsp;
627 	return 0;
628 }
629 
630 static int
631 ipe4_zeroize(struct secasvar *sav)
632 {
633 	sav->tdb_xform = NULL;
634 	return 0;
635 }
636 
637 static int
638 ipe4_input(
639     struct mbuf *m,
640     struct secasvar *sav,
641     int skip,
642     int protoff
643 )
644 {
645 	/* This is a rather serious mistake, so no conditional printing. */
646 	printf("%s: should never be called\n", __func__);
647 	if (m)
648 		m_freem(m);
649 	return EOPNOTSUPP;
650 }
651 
652 static struct xformsw ipe4_xformsw = {
653 	.xf_type	= XF_IP4,
654 	.xf_flags	= 0,
655 	.xf_name	= "IPv4 Simple Encapsulation",
656 	.xf_init	= ipe4_init,
657 	.xf_zeroize	= ipe4_zeroize,
658 	.xf_input	= ipe4_input,
659 	.xf_output	= ipip_output,
660 	.xf_next	= NULL,
661 };
662 
663 #ifdef INET
664 static struct encapsw ipe4_encapsw = {
665 	.encapsw4 = {
666 		.pr_input = ip4_input,
667 		.pr_ctlinput = NULL,
668 	}
669 };
670 #endif
671 #ifdef INET6
672 static struct encapsw ipe4_encapsw6 = {
673 	.encapsw6 = {
674 		.pr_input = ip4_input6,
675 		.pr_ctlinput = NULL,
676 	}
677 };
678 #endif
679 
680 /*
681  * Check the encapsulated packet to see if we want it
682  */
683 static int
684 ipe4_encapcheck(struct mbuf *m,
685     int off,
686     int proto,
687     void *arg
688 )
689 {
690 	/*
691 	 * Only take packets coming from IPSEC tunnels; the rest
692 	 * must be handled by the gif tunnel code.  Note that we
693 	 * also return a minimum priority when we want the packet
694 	 * so any explicit gif tunnels take precedence.
695 	 */
696 	return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0);
697 }
698 
699 void
700 ipe4_attach(void)
701 {
702 
703 	ipipstat_percpu = percpu_alloc(sizeof(uint64_t) * IPIP_NSTATS);
704 
705 	xform_register(&ipe4_xformsw);
706 	/* attach to encapsulation framework */
707 	/* XXX save return cookie for detach on module remove */
708 
709 	encapinit();
710 	/* This function is called before ifinit(). Who else gets lock? */
711 	(void)encap_lock_enter();
712 	/* ipe4_encapsw and ipe4_encapsw must be added atomically */
713 #ifdef INET
714 	(void) encap_attach_func(AF_INET, -1,
715 		ipe4_encapcheck, &ipe4_encapsw, NULL);
716 #endif
717 #ifdef INET6
718 	(void) encap_attach_func(AF_INET6, -1,
719 		ipe4_encapcheck, &ipe4_encapsw6, NULL);
720 #endif
721 	encap_lock_exit();
722 }
723