1 /* $NetBSD: xform_ipip.c,v 1.42 2016/07/07 09:32:03 ozaki-r Exp $ */ 2 /* $FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $ */ 3 /* $OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */ 4 5 /* 6 * The authors of this code are John Ioannidis (ji@tla.org), 7 * Angelos D. Keromytis (kermit@csd.uch.gr) and 8 * Niels Provos (provos@physnet.uni-hamburg.de). 9 * 10 * The original version of this code was written by John Ioannidis 11 * for BSD/OS in Athens, Greece, in November 1995. 12 * 13 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 14 * by Angelos D. Keromytis. 15 * 16 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 17 * and Niels Provos. 18 * 19 * Additional features in 1999 by Angelos D. Keromytis. 20 * 21 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 22 * Angelos D. Keromytis and Niels Provos. 23 * Copyright (c) 2001, Angelos D. Keromytis. 24 * 25 * Permission to use, copy, and modify this software with or without fee 26 * is hereby granted, provided that this entire notice is included in 27 * all copies of any software which is or includes a copy or 28 * modification of this software. 29 * You may use this code under the GNU public license if you so wish. Please 30 * contribute changes back to the authors under this freer than GPL license 31 * so that we may further the use of strong encryption without limitations to 32 * all. 33 * 34 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 35 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 36 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 37 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 38 * PURPOSE. 39 */ 40 41 #include <sys/cdefs.h> 42 __KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.42 2016/07/07 09:32:03 ozaki-r Exp $"); 43 44 /* 45 * IP-inside-IP processing 46 */ 47 #include "opt_inet.h" 48 #ifdef __FreeBSD__ 49 #include "opt_inet6.h" 50 #include "opt_random_ip_id.h" 51 #endif /* __FreeBSD__ */ 52 53 54 #include <sys/param.h> 55 #include <sys/systm.h> 56 #include <sys/mbuf.h> 57 #include <sys/socket.h> 58 #include <sys/kernel.h> 59 #include <sys/protosw.h> 60 #include <sys/sysctl.h> 61 62 #include <net/if.h> 63 #include <net/route.h> 64 #include <net/netisr.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/in_var.h> 69 #include <netinet/ip.h> 70 #include <netinet/ip_ecn.h> 71 #include <netinet/ip_var.h> 72 #include <netinet/ip_encap.h> 73 #ifdef __FreeBSD__ 74 #include <netinet/ipprotosw.h> 75 #endif 76 77 #include <netipsec/ipsec.h> 78 #include <netipsec/ipsec_private.h> 79 #include <netipsec/xform.h> 80 81 #include <netipsec/ipip_var.h> 82 83 #ifdef MROUTING 84 #include <netinet/ip_mroute.h> 85 #endif 86 87 #ifdef INET6 88 #include <netinet/ip6.h> 89 #include <netipsec/ipsec6.h> 90 # ifdef __FreeBSD__ 91 # include <netinet6/ip6_ecn.h> 92 # endif 93 #include <netinet6/in6_var.h> 94 #include <netinet6/ip6protosw.h> 95 #endif 96 97 #include <netipsec/key.h> 98 #include <netipsec/key_debug.h> 99 #include <netipsec/ipsec_osdep.h> 100 101 #ifdef __FreeBSD__ 102 typedef void pr_in_input_t (struct mbuf *, int, int); /* XXX FIX THIS */ 103 #else 104 typedef void pr_in_input_t (struct mbuf *m, ...); 105 #endif 106 107 /* 108 * We can control the acceptance of IP4 packets by altering the sysctl 109 * net.inet.ipip.allow value. Zero means drop them, all else is acceptance. 110 */ 111 int ipip_allow = 0; 112 113 percpu_t *ipipstat_percpu; 114 115 #ifdef SYSCTL_DECL 116 SYSCTL_DECL(_net_inet_ipip); 117 118 SYSCTL_INT(_net_inet_ipip, OID_AUTO, 119 ipip_allow, CTLFLAG_RW, &ipip_allow, 0, ""); 120 SYSCTL_STRUCT(_net_inet_ipip, IPSECCTL_STATS, 121 stats, CTLFLAG_RD, &ipipstat, ipipstat, ""); 122 123 #endif 124 125 #ifdef __FreeBSD__ 126 static 127 #endif 128 void ipe4_attach(void); 129 130 131 /* XXX IPCOMP */ 132 #define M_IPSEC (M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED) 133 134 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp); 135 136 #ifdef INET6 137 /* 138 * Really only a wrapper for ipip_input(), for use with IPv6. 139 */ 140 int 141 ip4_input6(struct mbuf **m, int *offp, int proto) 142 { 143 #if 0 144 /* If we do not accept IP-in-IP explicitly, drop. */ 145 if (!ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) { 146 DPRINTF(("ip4_input6: dropped due to policy\n")); 147 IPIP_STATINC(IPIP_STAT_PDROPS); 148 m_freem(*m); 149 return IPPROTO_DONE; 150 } 151 #endif 152 _ipip_input(*m, *offp, NULL); 153 return IPPROTO_DONE; 154 } 155 #endif /* INET6 */ 156 157 #ifdef INET 158 /* 159 * Really only a wrapper for ipip_input(), for use with IPv4. 160 */ 161 void 162 ip4_input(struct mbuf *m, int off, int proto) 163 { 164 165 #if 0 166 /* If we do not accept IP-in-IP explicitly, drop. */ 167 if (!ipip_allow && (m->m_flags & M_IPSEC) == 0) { 168 DPRINTF(("ip4_input: dropped due to policy\n")); 169 IPIP_STATINC(IPIP_STAT_PDROPS); 170 m_freem(m); 171 return; 172 } 173 #endif 174 175 _ipip_input(m, off, NULL); 176 } 177 #endif /* INET */ 178 179 /* 180 * ipip_input gets called when we receive an IP{46} encapsulated packet, 181 * either because we got it at a real interface, or because AH or ESP 182 * were being used in tunnel mode (in which case the rcvif element will 183 * contain the address of the encX interface associated with the tunnel. 184 */ 185 186 static void 187 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp) 188 { 189 register struct sockaddr_in *sin; 190 register struct ifnet *ifp; 191 register struct ifaddr *ifa; 192 pktqueue_t *pktq = NULL; 193 struct ip *ipo; 194 #ifdef INET6 195 register struct sockaddr_in6 *sin6; 196 struct ip6_hdr *ip6 = NULL; 197 u_int8_t itos; 198 #endif 199 u_int8_t otos; 200 u_int8_t v; 201 int hlen; 202 203 IPIP_STATINC(IPIP_STAT_IPACKETS); 204 205 m_copydata(m, 0, 1, &v); 206 207 switch (v >> 4) { 208 #ifdef INET 209 case 4: 210 hlen = sizeof(struct ip); 211 break; 212 #endif /* INET */ 213 #ifdef INET6 214 case 6: 215 hlen = sizeof(struct ip6_hdr); 216 break; 217 #endif 218 default: 219 DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) " 220 "for outer header\n", v, v>>4)); 221 IPIP_STATINC(IPIP_STAT_FAMILY); 222 m_freem(m); 223 return /* EAFNOSUPPORT */; 224 } 225 226 /* Bring the IP header in the first mbuf, if not there already */ 227 if (m->m_len < hlen) { 228 if ((m = m_pullup(m, hlen)) == NULL) { 229 DPRINTF(("ipip_input: m_pullup (1) failed\n")); 230 IPIP_STATINC(IPIP_STAT_HDROPS); 231 return; 232 } 233 } 234 235 ipo = mtod(m, struct ip *); 236 237 #ifdef MROUTING 238 if (ipo->ip_v == IPVERSION && ipo->ip_p == IPPROTO_IPV4) { 239 if (IN_MULTICAST(((struct ip *)((char *) ipo + iphlen))->ip_dst.s_addr)) { 240 ipip_mroute_input (m, iphlen); 241 return; 242 } 243 } 244 #endif /* MROUTING */ 245 246 /* Keep outer ecn field. */ 247 switch (v >> 4) { 248 #ifdef INET 249 case 4: 250 otos = ipo->ip_tos; 251 break; 252 #endif /* INET */ 253 #ifdef INET6 254 case 6: 255 otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff; 256 break; 257 #endif 258 default: 259 panic("ipip_input: unknown ip version %u (outer)", v>>4); 260 } 261 262 /* Remove outer IP header */ 263 m_adj(m, iphlen); 264 265 /* Sanity check */ 266 if (m->m_pkthdr.len < sizeof(struct ip)) { 267 IPIP_STATINC(IPIP_STAT_HDROPS); 268 m_freem(m); 269 return; 270 } 271 272 m_copydata(m, 0, 1, &v); 273 274 switch (v >> 4) { 275 #ifdef INET 276 case 4: 277 hlen = sizeof(struct ip); 278 break; 279 #endif /* INET */ 280 281 #ifdef INET6 282 case 6: 283 hlen = sizeof(struct ip6_hdr); 284 break; 285 #endif 286 default: 287 DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) " 288 "for inner header\n", v, v>>4)); 289 IPIP_STATINC(IPIP_STAT_FAMILY); 290 m_freem(m); 291 return; /* EAFNOSUPPORT */ 292 } 293 294 /* 295 * Bring the inner IP header in the first mbuf, if not there already. 296 */ 297 if (m->m_len < hlen) { 298 if ((m = m_pullup(m, hlen)) == NULL) { 299 DPRINTF(("ipip_input: m_pullup (2) failed\n")); 300 IPIP_STATINC(IPIP_STAT_HDROPS); 301 return; 302 } 303 } 304 305 /* 306 * RFC 1853 specifies that the inner TTL should not be touched on 307 * decapsulation. There's no reason this comment should be here, but 308 * this is as good as any a position. 309 */ 310 311 /* Some sanity checks in the inner IP header */ 312 switch (v >> 4) { 313 #ifdef INET 314 case 4: 315 ipo = mtod(m, struct ip *); 316 ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos); 317 break; 318 #endif /* INET */ 319 #ifdef INET6 320 case 6: 321 ip6 = (struct ip6_hdr *) ipo; 322 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 323 ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos); 324 ip6->ip6_flow &= ~htonl(0xff << 20); 325 ip6->ip6_flow |= htonl((u_int32_t) itos << 20); 326 break; 327 #endif 328 default: 329 panic("ipip_input: unknown ip version %u (inner)", v>>4); 330 } 331 332 /* Check for local address spoofing. */ 333 if ((m_get_rcvif_NOMPSAFE(m) == NULL || 334 !(m_get_rcvif_NOMPSAFE(m)->if_flags & IFF_LOOPBACK)) && 335 ipip_allow != 2) { 336 int s = pserialize_read_enter(); 337 IFNET_READER_FOREACH(ifp) { 338 IFADDR_READER_FOREACH(ifa, ifp) { 339 #ifdef INET 340 if (ipo) { 341 if (ifa->ifa_addr->sa_family != 342 AF_INET) 343 continue; 344 345 sin = (struct sockaddr_in *) ifa->ifa_addr; 346 347 if (sin->sin_addr.s_addr == 348 ipo->ip_src.s_addr) { 349 pserialize_read_exit(s); 350 IPIP_STATINC(IPIP_STAT_SPOOF); 351 m_freem(m); 352 return; 353 } 354 } 355 #endif /* INET */ 356 357 #ifdef INET6 358 if (ip6) { 359 if (ifa->ifa_addr->sa_family != 360 AF_INET6) 361 continue; 362 363 sin6 = (struct sockaddr_in6 *) ifa->ifa_addr; 364 365 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) { 366 pserialize_read_exit(s); 367 IPIP_STATINC(IPIP_STAT_SPOOF); 368 m_freem(m); 369 return; 370 } 371 372 } 373 #endif /* INET6 */ 374 } 375 } 376 pserialize_read_exit(s); 377 } 378 379 /* Statistics */ 380 IPIP_STATADD(IPIP_STAT_IBYTES, m->m_pkthdr.len - iphlen); 381 382 /* 383 * Interface pointer stays the same; if no IPsec processing has 384 * been done (or will be done), this will point to a normal 385 * interface. Otherwise, it'll point to an enc interface, which 386 * will allow a packet filter to distinguish between secure and 387 * untrusted packets. 388 */ 389 390 switch (v >> 4) { 391 #ifdef INET 392 case 4: 393 pktq = ip_pktq; 394 break; 395 #endif 396 #ifdef INET6 397 case 6: 398 pktq = ip6_pktq; 399 break; 400 #endif 401 default: 402 panic("ipip_input: should never reach here"); 403 } 404 405 int s = splnet(); 406 if (__predict_false(!pktq_enqueue(pktq, m, 0))) { 407 IPIP_STATINC(IPIP_STAT_QFULL); 408 m_freem(m); 409 } 410 splx(s); 411 } 412 413 int 414 ipip_output( 415 struct mbuf *m, 416 struct ipsecrequest *isr, 417 struct mbuf **mp, 418 int skip, 419 int protoff 420 ) 421 { 422 const struct secasvar *sav; 423 u_int8_t tp, otos; 424 struct secasindex *saidx; 425 int error; 426 #ifdef INET 427 u_int8_t itos; 428 struct ip *ipo; 429 #endif /* INET */ 430 #ifdef INET6 431 struct ip6_hdr *ip6, *ip6o; 432 #endif /* INET6 */ 433 434 IPSEC_SPLASSERT_SOFTNET("ipip_output"); 435 436 sav = isr->sav; 437 IPSEC_ASSERT(sav != NULL, ("ipip_output: null SA")); 438 IPSEC_ASSERT(sav->sah != NULL, ("ipip_output: null SAH")); 439 440 /* XXX Deal with empty TDB source/destination addresses. */ 441 442 m_copydata(m, 0, 1, &tp); 443 tp = (tp >> 4) & 0xff; /* Get the IP version number. */ 444 445 saidx = &sav->sah->saidx; 446 switch (saidx->dst.sa.sa_family) { 447 #ifdef INET 448 case AF_INET: 449 if (saidx->src.sa.sa_family != AF_INET || 450 saidx->src.sin.sin_addr.s_addr == INADDR_ANY || 451 saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) { 452 DPRINTF(("ipip_output: unspecified tunnel endpoint " 453 "address in SA %s/%08lx\n", 454 ipsec_address(&saidx->dst), 455 (u_long) ntohl(sav->spi))); 456 IPIP_STATINC(IPIP_STAT_UNSPEC); 457 error = EINVAL; 458 goto bad; 459 } 460 461 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 462 if (m == 0) { 463 DPRINTF(("ipip_output: M_PREPEND failed\n")); 464 IPIP_STATINC(IPIP_STAT_HDROPS); 465 error = ENOBUFS; 466 goto bad; 467 } 468 469 ipo = mtod(m, struct ip *); 470 471 ipo->ip_v = IPVERSION; 472 ipo->ip_hl = 5; 473 ipo->ip_len = htons(m->m_pkthdr.len); 474 ipo->ip_ttl = ip_defttl; 475 ipo->ip_sum = 0; 476 ipo->ip_src = saidx->src.sin.sin_addr; 477 ipo->ip_dst = saidx->dst.sin.sin_addr; 478 479 #if defined(__NetBSD__) 480 ipo->ip_id = ip_newid(NULL); 481 #elif defined(RANDOM_IP_ID) 482 ipo->ip_id = ip_randomid(); 483 #else 484 ipo->ip_id = htons(ip_id++); 485 #endif 486 487 /* If the inner protocol is IP... */ 488 if (tp == IPVERSION) { 489 /* Save ECN notification */ 490 m_copydata(m, sizeof(struct ip) + 491 offsetof(struct ip, ip_tos), 492 sizeof(u_int8_t), &itos); 493 494 ipo->ip_p = IPPROTO_IPIP; 495 496 /* 497 * We should be keeping tunnel soft-state and 498 * send back ICMPs if needed. 499 */ 500 m_copydata(m, sizeof(struct ip) + 501 offsetof(struct ip, ip_off), 502 sizeof(u_int16_t), &ipo->ip_off); 503 ipo->ip_off &= ~ IP_OFF_CONVERT(IP_DF | IP_MF | IP_OFFMASK); 504 } 505 #ifdef INET6 506 else if (tp == (IPV6_VERSION >> 4)) { 507 u_int32_t itos32; 508 509 /* Save ECN notification. */ 510 m_copydata(m, sizeof(struct ip) + 511 offsetof(struct ip6_hdr, ip6_flow), 512 sizeof(u_int32_t), &itos32); 513 itos = ntohl(itos32) >> 20; 514 ipo->ip_p = IPPROTO_IPV6; 515 ipo->ip_off = 0; 516 } 517 #endif /* INET6 */ 518 else { 519 goto nofamily; 520 } 521 522 otos = 0; 523 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 524 ipo->ip_tos = otos; 525 break; 526 #endif /* INET */ 527 528 #ifdef INET6 529 case AF_INET6: 530 if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) || 531 saidx->src.sa.sa_family != AF_INET6 || 532 IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) { 533 DPRINTF(("ipip_output: unspecified tunnel endpoint " 534 "address in SA %s/%08lx\n", 535 ipsec_address(&saidx->dst), 536 (u_long) ntohl(sav->spi))); 537 IPIP_STATINC(IPIP_STAT_UNSPEC); 538 error = ENOBUFS; 539 goto bad; 540 } 541 542 if (tp == (IPV6_VERSION >> 4)) { 543 /* scoped address handling */ 544 ip6 = mtod(m, struct ip6_hdr *); 545 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 546 ip6->ip6_src.s6_addr16[1] = 0; 547 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 548 ip6->ip6_dst.s6_addr16[1] = 0; 549 } 550 551 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 552 if (m == 0) { 553 DPRINTF(("ipip_output: M_PREPEND failed\n")); 554 IPIP_STATINC(IPIP_STAT_HDROPS); 555 error = ENOBUFS; 556 goto bad; 557 } 558 559 /* Initialize IPv6 header */ 560 ip6o = mtod(m, struct ip6_hdr *); 561 ip6o->ip6_flow = 0; 562 ip6o->ip6_vfc &= ~IPV6_VERSION_MASK; 563 ip6o->ip6_vfc |= IPV6_VERSION; 564 ip6o->ip6_plen = htons(m->m_pkthdr.len); 565 ip6o->ip6_hlim = ip_defttl; 566 ip6o->ip6_dst = saidx->dst.sin6.sin6_addr; 567 ip6o->ip6_src = saidx->src.sin6.sin6_addr; 568 if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_dst)) 569 ip6o->ip6_dst.s6_addr16[1] = htons(saidx->dst.sin6.sin6_scope_id); 570 if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_src)) 571 ip6o->ip6_src.s6_addr16[1] = htons(saidx->src.sin6.sin6_scope_id); 572 573 #ifdef INET 574 if (tp == IPVERSION) { 575 /* Save ECN notification */ 576 m_copydata(m, sizeof(struct ip6_hdr) + 577 offsetof(struct ip, ip_tos), sizeof(u_int8_t), 578 &itos); 579 580 /* This is really IPVERSION. */ 581 ip6o->ip6_nxt = IPPROTO_IPIP; 582 } else 583 #endif /* INET */ 584 if (tp == (IPV6_VERSION >> 4)) { 585 u_int32_t itos32; 586 587 /* Save ECN notification. */ 588 m_copydata(m, sizeof(struct ip6_hdr) + 589 offsetof(struct ip6_hdr, ip6_flow), 590 sizeof(u_int32_t), &itos32); 591 itos = ntohl(itos32) >> 20; 592 593 ip6o->ip6_nxt = IPPROTO_IPV6; 594 } else { 595 goto nofamily; 596 } 597 598 otos = 0; 599 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 600 ip6o->ip6_flow |= htonl((u_int32_t) otos << 20); 601 break; 602 #endif /* INET6 */ 603 604 default: 605 nofamily: 606 DPRINTF(("ipip_output: unsupported protocol family %u\n", 607 saidx->dst.sa.sa_family)); 608 IPIP_STATINC(IPIP_STAT_FAMILY); 609 error = EAFNOSUPPORT; /* XXX diffs from openbsd */ 610 goto bad; 611 } 612 613 IPIP_STATINC(IPIP_STAT_OPACKETS); 614 *mp = m; 615 616 #ifdef INET 617 if (saidx->dst.sa.sa_family == AF_INET) { 618 #if 0 619 if (sav->tdb_xform->xf_type == XF_IP4) 620 tdb->tdb_cur_bytes += 621 m->m_pkthdr.len - sizeof(struct ip); 622 #endif 623 IPIP_STATADD(IPIP_STAT_OBYTES, 624 m->m_pkthdr.len - sizeof(struct ip)); 625 } 626 #endif /* INET */ 627 628 #ifdef INET6 629 if (saidx->dst.sa.sa_family == AF_INET6) { 630 #if 0 631 if (sav->tdb_xform->xf_type == XF_IP4) 632 tdb->tdb_cur_bytes += 633 m->m_pkthdr.len - sizeof(struct ip6_hdr); 634 #endif 635 IPIP_STATADD(IPIP_STAT_OBYTES, 636 m->m_pkthdr.len - sizeof(struct ip6_hdr)); 637 } 638 #endif /* INET6 */ 639 640 return 0; 641 bad: 642 if (m) 643 m_freem(m); 644 *mp = NULL; 645 return (error); 646 } 647 648 static int 649 ipe4_init(struct secasvar *sav, const struct xformsw *xsp) 650 { 651 sav->tdb_xform = xsp; 652 return 0; 653 } 654 655 static int 656 ipe4_zeroize(struct secasvar *sav) 657 { 658 sav->tdb_xform = NULL; 659 return 0; 660 } 661 662 static int 663 ipe4_input( 664 struct mbuf *m, 665 const struct secasvar *sav, 666 int skip, 667 int protoff 668 ) 669 { 670 /* This is a rather serious mistake, so no conditional printing. */ 671 printf("ipe4_input: should never be called\n"); 672 if (m) 673 m_freem(m); 674 return EOPNOTSUPP; 675 } 676 677 static struct xformsw ipe4_xformsw = { 678 XF_IP4, 0, "IPv4 Simple Encapsulation", 679 ipe4_init, ipe4_zeroize, ipe4_input, ipip_output, 680 NULL, 681 }; 682 683 #ifdef INET 684 static struct encapsw ipe4_encapsw = { 685 .encapsw4 = { 686 .pr_input = ip4_input, 687 .pr_ctlinput = NULL, 688 } 689 }; 690 #endif 691 #ifdef INET6 692 static struct encapsw ipe4_encapsw6 = { 693 .encapsw6 = { 694 .pr_input = ip4_input6, 695 .pr_ctlinput = NULL, 696 } 697 }; 698 #endif 699 700 /* 701 * Check the encapsulated packet to see if we want it 702 */ 703 static int 704 ipe4_encapcheck(struct mbuf *m, 705 int off, 706 int proto, 707 void *arg 708 ) 709 { 710 /* 711 * Only take packets coming from IPSEC tunnels; the rest 712 * must be handled by the gif tunnel code. Note that we 713 * also return a minimum priority when we want the packet 714 * so any explicit gif tunnels take precedence. 715 */ 716 return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0); 717 } 718 719 INITFN void 720 ipe4_attach(void) 721 { 722 723 ipipstat_percpu = percpu_alloc(sizeof(uint64_t) * IPIP_NSTATS); 724 725 xform_register(&ipe4_xformsw); 726 /* attach to encapsulation framework */ 727 /* XXX save return cookie for detach on module remove */ 728 729 encapinit(); 730 /* This function is called before ifinit(). Who else gets lock? */ 731 (void)encap_lock_enter(); 732 /* ipe4_encapsw and ipe4_encapsw must be added atomically */ 733 #ifdef INET 734 (void) encap_attach_func(AF_INET, -1, 735 ipe4_encapcheck, &ipe4_encapsw, NULL); 736 #endif 737 #ifdef INET6 738 (void) encap_attach_func(AF_INET6, -1, 739 ipe4_encapcheck, &ipe4_encapsw6, NULL); 740 #endif 741 encap_lock_exit(); 742 } 743 744 #ifdef SYSINIT 745 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL); 746 #endif 747 748