xref: /openbsd-src/sys/netinet/ipsec_input.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2)
1 /*	$OpenBSD: ipsec_input.c,v 1.91 2008/10/22 23:04:45 mpf Exp $	*/
2 /*
3  * The authors of this code are John Ioannidis (ji@tla.org),
4  * Angelos D. Keromytis (kermit@csd.uch.gr) and
5  * Niels Provos (provos@physnet.uni-hamburg.de).
6  *
7  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
8  * in November 1995.
9  *
10  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
11  * by Angelos D. Keromytis.
12  *
13  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
14  * and Niels Provos.
15  *
16  * Additional features in 1999 by Angelos D. Keromytis.
17  *
18  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
19  * Angelos D. Keromytis and Niels Provos.
20  * Copyright (c) 2001, Angelos D. Keromytis.
21  *
22  * Permission to use, copy, and modify this software with or without fee
23  * is hereby granted, provided that this entire notice is included in
24  * all copies of any software which is or includes a copy or
25  * modification of this software.
26  * You may use this code under the GNU public license if you so wish. Please
27  * contribute changes back to the authors under this freer than GPL license
28  * so that we may further the use of strong encryption without limitations to
29  * all.
30  *
31  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
32  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
33  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
34  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
35  * PURPOSE.
36  */
37 
38 #include "pf.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/protosw.h>
43 #include <sys/mbuf.h>
44 #include <sys/socket.h>
45 #include <sys/sysctl.h>
46 #include <sys/kernel.h>
47 
48 #include <net/if.h>
49 #include <net/netisr.h>
50 #include <net/bpf.h>
51 
52 #if NPF > 0
53 #include <net/pfvar.h>
54 #endif
55 
56 #include <netinet/in.h>
57 #include <netinet/in_systm.h>
58 #include <netinet/ip.h>
59 #include <netinet/ip_var.h>
60 #include <netinet/in_var.h>
61 #include <netinet/ip_icmp.h>
62 #include <netinet/tcp.h>
63 #include <netinet/udp.h>
64 
65 #ifdef INET6
66 #ifndef INET
67 #include <netinet/in.h>
68 #endif
69 #include <netinet/ip6.h>
70 #include <netinet6/ip6_var.h>
71 #include <netinet6/ip6protosw.h>
72 #endif /* INET6 */
73 
74 #include <netinet/ip_ipsp.h>
75 #include <netinet/ip_esp.h>
76 #include <netinet/ip_ah.h>
77 #include <netinet/ip_ipcomp.h>
78 
79 #include <net/if_enc.h>
80 
81 #include "bpfilter.h"
82 
83 void *ipsec_common_ctlinput(int, struct sockaddr *, void *, int);
84 
85 #ifdef ENCDEBUG
86 #define DPRINTF(x)	if (encdebug) printf x
87 #else
88 #define DPRINTF(x)
89 #endif
90 
91 /* sysctl variables */
92 int esp_enable = 1;
93 int ah_enable = 1;
94 int ipcomp_enable = 0;
95 
96 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS;
97 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS;
98 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS;
99 
100 #ifdef INET6
101 extern struct ip6protosw inet6sw[];
102 extern u_char ip6_protox[];
103 #endif
104 
105 /*
106  * ipsec_common_input() gets called when we receive an IPsec-protected packet
107  * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate
108  * transform. The callback takes care of further processing (like ingress
109  * filtering).
110  */
111 int
112 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
113     int udpencap)
114 {
115 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \
116 			    sproto == IPPROTO_AH ? (y)++ : (z)++)
117 
118 	union sockaddr_union dst_address;
119 	struct timeval tv;
120 	struct tdb *tdbp;
121 	u_int32_t spi;
122 	u_int16_t cpi;
123 	int s, error;
124 
125 	IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input,
126 	    ipcompstat.ipcomps_input);
127 
128 	if (m == 0) {
129 		DPRINTF(("ipsec_common_input(): NULL packet received\n"));
130 		IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
131 		    ipcompstat.ipcomps_hdrops);
132 		return EINVAL;
133 	}
134 
135 	if ((sproto == IPPROTO_ESP && !esp_enable) ||
136 	    (sproto == IPPROTO_AH && !ah_enable) ||
137 	    (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
138 		rip_input(m, skip, sproto);
139 		return 0;
140 	}
141 
142 	if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) {
143 		m_freem(m);
144 		IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
145 		    ipcompstat.ipcomps_hdrops);
146 		DPRINTF(("ipsec_common_input(): packet too small\n"));
147 		return EINVAL;
148 	}
149 
150 	/* Retrieve the SPI from the relevant IPsec header */
151 	if (sproto == IPPROTO_ESP)
152 		m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
153 	else if (sproto == IPPROTO_AH)
154 		m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
155 		    (caddr_t) &spi);
156 	else if (sproto == IPPROTO_IPCOMP) {
157 		m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
158 		    (caddr_t) &cpi);
159 		spi = ntohl(htons(cpi));
160 	}
161 
162 	/*
163 	 * Find tunnel control block and (indirectly) call the appropriate
164 	 * kernel crypto routine. The resulting mbuf chain is a valid
165 	 * IP packet ready to go through input processing.
166 	 */
167 
168 	bzero(&dst_address, sizeof(dst_address));
169 	dst_address.sa.sa_family = af;
170 
171 	switch (af) {
172 #ifdef INET
173 	case AF_INET:
174 		dst_address.sin.sin_len = sizeof(struct sockaddr_in);
175 		m_copydata(m, offsetof(struct ip, ip_dst),
176 		    sizeof(struct in_addr),
177 		    (caddr_t) &(dst_address.sin.sin_addr));
178 		break;
179 #endif /* INET */
180 
181 #ifdef INET6
182 	case AF_INET6:
183 		dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
184 		m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
185 		    sizeof(struct in6_addr),
186 		    (caddr_t) &(dst_address.sin6.sin6_addr));
187 		in6_recoverscope(&dst_address.sin6, &dst_address.sin6.sin6_addr,
188 		    NULL);
189 		break;
190 #endif /* INET6 */
191 
192 	default:
193 		DPRINTF(("ipsec_common_input(): unsupported protocol "
194 		    "family %d\n", af));
195 		m_freem(m);
196 		IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf,
197 		    ipcompstat.ipcomps_nopf);
198 		return EPFNOSUPPORT;
199 	}
200 
201 	s = spltdb();
202 	tdbp = gettdb(spi, &dst_address, sproto);
203 	if (tdbp == NULL) {
204 		splx(s);
205 		DPRINTF(("ipsec_common_input(): could not find SA for "
206 		    "packet to %s, spi %08x\n",
207 		    ipsp_address(dst_address), ntohl(spi)));
208 		m_freem(m);
209 		IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb,
210 		    ipcompstat.ipcomps_notdb);
211 		return ENOENT;
212 	}
213 
214 	if (tdbp->tdb_flags & TDBF_INVALID) {
215 		splx(s);
216 		DPRINTF(("ipsec_common_input(): attempted to use invalid SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
217 		m_freem(m);
218 		IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid,
219 		    ipcompstat.ipcomps_invalid);
220 		return EINVAL;
221 	}
222 
223 	if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) {
224 		splx(s);
225 		DPRINTF(("ipsec_common_input(): attempted to use non-udpencap SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
226 		m_freem(m);
227 		espstat.esps_udpinval++;
228 		return EINVAL;
229 	}
230 
231 	if (tdbp->tdb_xform == NULL) {
232 		splx(s);
233 		DPRINTF(("ipsec_common_input(): attempted to use uninitialized SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
234 		m_freem(m);
235 		IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform,
236 		    ipcompstat.ipcomps_noxform);
237 		return ENXIO;
238 	}
239 
240 	if (sproto != IPPROTO_IPCOMP) {
241 		/* XXX This conflicts with the scoped nature of IPv6 */
242 		m->m_pkthdr.rcvif = &encif[0].sc_if;
243 	}
244 
245 	/* Register first use, setup expiration timer. */
246 	if (tdbp->tdb_first_use == 0) {
247 		tdbp->tdb_first_use = time_second;
248 
249 		tv.tv_usec = 0;
250 
251 		tv.tv_sec = tdbp->tdb_exp_first_use + tdbp->tdb_first_use;
252 		if (tdbp->tdb_flags & TDBF_FIRSTUSE)
253 			timeout_add(&tdbp->tdb_first_tmo, hzto(&tv));
254 
255 		tv.tv_sec = tdbp->tdb_first_use + tdbp->tdb_soft_first_use;
256 		if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE)
257 			timeout_add(&tdbp->tdb_sfirst_tmo, hzto(&tv));
258 	}
259 
260 	/*
261 	 * Call appropriate transform and return -- callback takes care of
262 	 * everything else.
263 	 */
264 	error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff);
265 	splx(s);
266 	return error;
267 }
268 
269 /*
270  * IPsec input callback, called by the transform callback. Takes care of
271  * filtering and other sanity checks on the processed packet.
272  */
273 int
274 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff,
275     struct m_tag *mt)
276 {
277 	int prot, af, sproto;
278 
279 #if NBPFILTER > 0
280 	struct ifnet *bpfif;
281 #endif
282 
283 #ifdef INET
284 	struct ip *ip, ipn;
285 #endif /* INET */
286 
287 #ifdef INET6
288 	struct ip6_hdr *ip6, ip6n;
289 #endif /* INET6 */
290 	struct m_tag *mtag;
291 	struct tdb_ident *tdbi;
292 
293 	af = tdbp->tdb_dst.sa.sa_family;
294 	sproto = tdbp->tdb_sproto;
295 
296 	tdbp->tdb_last_used = time_second;
297 
298 	/* Sanity check */
299 	if (m == NULL) {
300 		/* The called routine will print a message if necessary */
301 		IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr,
302 		    ipcompstat.ipcomps_badkcr);
303 		return EINVAL;
304 	}
305 
306 #ifdef INET
307 	/* Fix IPv4 header */
308 	if (af == AF_INET) {
309 		if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) {
310 			DPRINTF(("ipsec_common_input_cb(): processing failed "
311 			    "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst),
312 			    ntohl(tdbp->tdb_spi)));
313 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
314 			    ipcompstat.ipcomps_hdrops);
315 			return ENOBUFS;
316 		}
317 
318 		ip = mtod(m, struct ip *);
319 		ip->ip_len = htons(m->m_pkthdr.len);
320 		ip->ip_sum = 0;
321 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
322 		prot = ip->ip_p;
323 
324 		/* IP-in-IP encapsulation */
325 		if (prot == IPPROTO_IPIP) {
326 			if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
327 				m_freem(m);
328 				IPSEC_ISTAT(espstat.esps_hdrops,
329 				    ahstat.ahs_hdrops,
330 				    ipcompstat.ipcomps_hdrops);
331 				return EINVAL;
332 			}
333 			/* ipn will now contain the inner IPv4 header */
334 			m_copydata(m, skip, sizeof(struct ip),
335 			    (caddr_t) &ipn);
336 
337 			/*
338 			 * Check that the inner source address is the same as
339 			 * the proxy address, if available.
340 			 */
341 			if ((tdbp->tdb_proxy.sa.sa_family == AF_INET &&
342 			    tdbp->tdb_proxy.sin.sin_addr.s_addr !=
343 			    INADDR_ANY &&
344 			    ipn.ip_src.s_addr !=
345 			    tdbp->tdb_proxy.sin.sin_addr.s_addr) ||
346 			    (tdbp->tdb_proxy.sa.sa_family != AF_INET &&
347 				tdbp->tdb_proxy.sa.sa_family != 0)) {
348 
349 				DPRINTF(("ipsec_common_input_cb(): inner "
350 				    "source address %s doesn't correspond to "
351 				    "expected proxy source %s, SA %s/%08x\n",
352 				    inet_ntoa4(ipn.ip_src),
353 				    ipsp_address(tdbp->tdb_proxy),
354 				    ipsp_address(tdbp->tdb_dst),
355 				    ntohl(tdbp->tdb_spi)));
356 
357 				m_freem(m);
358 				IPSEC_ISTAT(espstat.esps_pdrops,
359 				    ahstat.ahs_pdrops,
360 				    ipcompstat.ipcomps_pdrops);
361 				return EACCES;
362 			}
363 		}
364 
365 #ifdef INET6
366 		/* IPv6-in-IP encapsulation. */
367 		if (prot == IPPROTO_IPV6) {
368 			if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
369 				m_freem(m);
370 				IPSEC_ISTAT(espstat.esps_hdrops,
371 				    ahstat.ahs_hdrops,
372 				    ipcompstat.ipcomps_hdrops);
373 				return EINVAL;
374 			}
375 			/* ip6n will now contain the inner IPv6 header. */
376 			m_copydata(m, skip, sizeof(struct ip6_hdr),
377 			    (caddr_t) &ip6n);
378 
379 			/*
380 			 * Check that the inner source address is the same as
381 			 * the proxy address, if available.
382 			 */
383 			if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 &&
384 			    !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) &&
385 			    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
386 				&tdbp->tdb_proxy.sin6.sin6_addr)) ||
387 			    (tdbp->tdb_proxy.sa.sa_family != AF_INET6 &&
388 				tdbp->tdb_proxy.sa.sa_family != 0)) {
389 
390 				DPRINTF(("ipsec_common_input_cb(): inner "
391 				    "source address %s doesn't correspond to "
392 				    "expected proxy source %s, SA %s/%08x\n",
393 				    ip6_sprintf(&ip6n.ip6_src),
394 				    ipsp_address(tdbp->tdb_proxy),
395 				    ipsp_address(tdbp->tdb_dst),
396 				    ntohl(tdbp->tdb_spi)));
397 
398 				m_freem(m);
399 				IPSEC_ISTAT(espstat.esps_pdrops,
400 				    ahstat.ahs_pdrops,
401 				    ipcompstat.ipcomps_pdrops);
402 				return EACCES;
403 			}
404 		}
405 #endif /* INET6 */
406 	}
407 #endif /* INET */
408 
409 #ifdef INET6
410 	/* Fix IPv6 header */
411 	if (af == AF_INET6)
412 	{
413 		if (m->m_len < sizeof(struct ip6_hdr) &&
414 		    (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
415 
416 			DPRINTF(("ipsec_common_input_cb(): processing failed "
417 			    "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst),
418 			    ntohl(tdbp->tdb_spi)));
419 
420 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
421 			    ipcompstat.ipcomps_hdrops);
422 			return EACCES;
423 		}
424 
425 		ip6 = mtod(m, struct ip6_hdr *);
426 		ip6->ip6_plen = htons(m->m_pkthdr.len - skip);
427 
428 		/* Save protocol */
429 		m_copydata(m, protoff, 1, (unsigned char *) &prot);
430 
431 #ifdef INET
432 		/* IP-in-IP encapsulation */
433 		if (prot == IPPROTO_IPIP) {
434 			if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
435 				m_freem(m);
436 				IPSEC_ISTAT(espstat.esps_hdrops,
437 				    ahstat.ahs_hdrops,
438 				    ipcompstat.ipcomps_hdrops);
439 				return EINVAL;
440 			}
441 			/* ipn will now contain the inner IPv4 header */
442 			m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
443 
444 			/*
445 			 * Check that the inner source address is the same as
446 			 * the proxy address, if available.
447 			 */
448 			if ((tdbp->tdb_proxy.sa.sa_family == AF_INET &&
449 			    tdbp->tdb_proxy.sin.sin_addr.s_addr !=
450 			    INADDR_ANY &&
451 			    ipn.ip_src.s_addr !=
452 				tdbp->tdb_proxy.sin.sin_addr.s_addr) ||
453 			    (tdbp->tdb_proxy.sa.sa_family != AF_INET &&
454 				tdbp->tdb_proxy.sa.sa_family != 0)) {
455 
456 				DPRINTF(("ipsec_common_input_cb(): inner "
457 				    "source address %s doesn't correspond to "
458 				    "expected proxy source %s, SA %s/%08x\n",
459 				    inet_ntoa4(ipn.ip_src),
460 				    ipsp_address(tdbp->tdb_proxy),
461 				    ipsp_address(tdbp->tdb_dst),
462 				    ntohl(tdbp->tdb_spi)));
463 
464 				m_freem(m);
465 				IPSEC_ISTAT(espstat.esps_pdrops,
466 				    ahstat.ahs_pdrops,
467 				    ipcompstat.ipcomps_pdrops);
468 				return EACCES;
469 			}
470 		}
471 #endif /* INET */
472 
473 		/* IPv6-in-IP encapsulation */
474 		if (prot == IPPROTO_IPV6) {
475 			if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
476 				m_freem(m);
477 				IPSEC_ISTAT(espstat.esps_hdrops,
478 				    ahstat.ahs_hdrops,
479 				    ipcompstat.ipcomps_hdrops);
480 				return EINVAL;
481 			}
482 			/* ip6n will now contain the inner IPv6 header. */
483 			m_copydata(m, skip, sizeof(struct ip6_hdr),
484 			    (caddr_t) &ip6n);
485 
486 			/*
487 			 * Check that the inner source address is the same as
488 			 * the proxy address, if available.
489 			 */
490 			if ((tdbp->tdb_proxy.sa.sa_family == AF_INET6 &&
491 			    !IN6_IS_ADDR_UNSPECIFIED(&tdbp->tdb_proxy.sin6.sin6_addr) &&
492 			    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
493 				&tdbp->tdb_proxy.sin6.sin6_addr)) ||
494 			    (tdbp->tdb_proxy.sa.sa_family != AF_INET6 &&
495 				tdbp->tdb_proxy.sa.sa_family != 0)) {
496 
497 				DPRINTF(("ipsec_common_input_cb(): inner "
498 				    "source address %s doesn't correspond to "
499 				    "expected proxy source %s, SA %s/%08x\n",
500 				    ip6_sprintf(&ip6n.ip6_src),
501 				    ipsp_address(tdbp->tdb_proxy),
502 				    ipsp_address(tdbp->tdb_dst),
503 				    ntohl(tdbp->tdb_spi)));
504 
505 				m_freem(m);
506 				IPSEC_ISTAT(espstat.esps_pdrops,
507 				    ahstat.ahs_pdrops,
508 				    ipcompstat.ipcomps_pdrops);
509 				return EACCES;
510 			}
511 		}
512 	}
513 #endif /* INET6 */
514 
515 	/*
516 	 * Record what we've done to the packet (under what SA it was
517 	 * processed). If we've been passed an mtag, it means the packet
518 	 * was already processed by an ethernet/crypto combo card and
519 	 * thus has a tag attached with all the right information, but
520 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
521 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
522 	 */
523 	if (mt == NULL && tdbp->tdb_sproto != IPPROTO_IPCOMP) {
524 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
525 		    sizeof(struct tdb_ident), M_NOWAIT);
526 		if (mtag == NULL) {
527 			m_freem(m);
528 			DPRINTF(("ipsec_common_input_cb(): failed to "
529 			    "get tag\n"));
530 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
531 			    ipcompstat.ipcomps_hdrops);
532 			return ENOMEM;
533 		}
534 
535 		tdbi = (struct tdb_ident *)(mtag + 1);
536 		bcopy(&tdbp->tdb_dst, &tdbi->dst,
537 		    sizeof(union sockaddr_union));
538 		tdbi->proto = tdbp->tdb_sproto;
539 		tdbi->spi = tdbp->tdb_spi;
540 
541 		m_tag_prepend(m, mtag);
542 	} else {
543 		if (mt != NULL)
544 			mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
545 	}
546 
547 	if (sproto == IPPROTO_ESP) {
548 		/* Packet is confidential ? */
549 		if (tdbp->tdb_encalgxform)
550 			m->m_flags |= M_CONF;
551 
552 		/* Check if we had authenticated ESP. */
553 		if (tdbp->tdb_authalgxform)
554 			m->m_flags |= M_AUTH;
555 	} else if (sproto == IPPROTO_AH)
556 		m->m_flags |= M_AUTH | M_AUTH_AH;
557 
558 #if NPF > 0
559 	/* Add pf tag if requested. */
560 	if (pf_tag_packet(m, tdbp->tdb_tag, -1))
561 		DPRINTF(("failed to tag ipsec packet\n"));
562 	pf_pkt_addr_changed(m);
563 #endif
564 
565 	if (tdbp->tdb_flags & TDBF_TUNNELING)
566 		m->m_flags |= M_TUNNEL;
567 
568 #if NBPFILTER > 0
569 	bpfif = &encif[0].sc_if;
570 	bpfif->if_ipackets++;
571 	bpfif->if_ibytes += m->m_pkthdr.len;
572 
573 	if (bpfif->if_bpf) {
574 		struct enchdr hdr;
575 
576 		hdr.af = af;
577 		hdr.spi = tdbp->tdb_spi;
578 		hdr.flags = m->m_flags & (M_AUTH|M_CONF|M_AUTH_AH);
579 
580 		bpf_mtap_hdr(bpfif->if_bpf, (char *)&hdr, ENC_HDRLEN, m,
581 		    BPF_DIRECTION_IN);
582 	}
583 #endif
584 
585 	/* Call the appropriate IPsec transform callback. */
586 	switch (af) {
587 #ifdef INET
588 	case AF_INET:
589 		switch (sproto)
590 		{
591 		case IPPROTO_ESP:
592 			return esp4_input_cb(m);
593 
594 		case IPPROTO_AH:
595 			return ah4_input_cb(m);
596 
597 		case IPPROTO_IPCOMP:
598 			return ipcomp4_input_cb(m);
599 
600 		default:
601 			DPRINTF(("ipsec_common_input_cb(): unknown/unsupported"
602 			    " security protocol %d\n", sproto));
603 			m_freem(m);
604 			return EPFNOSUPPORT;
605 		}
606 		break;
607 #endif /* INET */
608 
609 #ifdef INET6
610 	case AF_INET6:
611 		switch (sproto) {
612 		case IPPROTO_ESP:
613 			return esp6_input_cb(m, skip, protoff);
614 
615 		case IPPROTO_AH:
616 			return ah6_input_cb(m, skip, protoff);
617 
618 		case IPPROTO_IPCOMP:
619 			return ipcomp6_input_cb(m, skip, protoff);
620 
621 		default:
622 			DPRINTF(("ipsec_common_input_cb(): unknown/unsupported"
623 			    " security protocol %d\n", sproto));
624 			m_freem(m);
625 			return EPFNOSUPPORT;
626 		}
627 		break;
628 #endif /* INET6 */
629 
630 	default:
631 		DPRINTF(("ipsec_common_input_cb(): unknown/unsupported "
632 		    "protocol family %d\n", af));
633 		m_freem(m);
634 		return EPFNOSUPPORT;
635 	}
636 #undef IPSEC_ISTAT
637 }
638 
639 int
640 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
641     size_t newlen)
642 {
643 	/* All sysctl names at this level are terminal. */
644 	if (namelen != 1)
645 		return (ENOTDIR);
646 
647 	switch (name[0]) {
648 	case ESPCTL_STATS:
649 		if (newp != NULL)
650 			return (EPERM);
651 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
652 		    &espstat, sizeof(espstat)));
653 	default:
654 		if (name[0] < ESPCTL_MAXID)
655 			return (sysctl_int_arr(espctl_vars, name, namelen,
656 			    oldp, oldlenp, newp, newlen));
657 		return (ENOPROTOOPT);
658 	}
659 }
660 
661 int
662 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
663     size_t newlen)
664 {
665 	/* All sysctl names at this level are terminal. */
666 	if (namelen != 1)
667 		return (ENOTDIR);
668 
669 	switch (name[0]) {
670 	case AHCTL_STATS:
671 		if (newp != NULL)
672 			return (EPERM);
673 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
674 		    &ahstat, sizeof(ahstat)));
675 	default:
676 		if (name[0] < AHCTL_MAXID)
677 			return (sysctl_int_arr(ahctl_vars, name, namelen,
678 			    oldp, oldlenp, newp, newlen));
679 		return (ENOPROTOOPT);
680 	}
681 }
682 
683 int
684 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
685     size_t newlen)
686 {
687 	/* All sysctl names at this level are terminal. */
688 	if (namelen != 1)
689 		return (ENOTDIR);
690 
691 	switch (name[0]) {
692 	case IPCOMPCTL_STATS:
693 		if (newp != NULL)
694 			return (EPERM);
695 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
696 		    &ipcompstat, sizeof(ipcompstat)));
697 	default:
698 		if (name[0] < IPCOMPCTL_MAXID)
699 			return (sysctl_int_arr(ipcompctl_vars, name, namelen,
700 			    oldp, oldlenp, newp, newlen));
701 		return (ENOPROTOOPT);
702 	}
703 }
704 
705 #ifdef INET
706 /* IPv4 AH wrapper. */
707 void
708 ah4_input(struct mbuf *m, ...)
709 {
710 	int skip;
711 
712 	va_list ap;
713 	va_start(ap, m);
714 	skip = va_arg(ap, int);
715 	va_end(ap);
716 
717 	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
718 	    IPPROTO_AH, 0);
719 	return;
720 }
721 
722 /* IPv4 AH callback. */
723 int
724 ah4_input_cb(struct mbuf *m, ...)
725 {
726 	struct ifqueue *ifq = &ipintrq;
727 	int s = splnet();
728 
729 	/*
730 	 * Interface pointer is already in first mbuf; chop off the
731 	 * `outer' header and reschedule.
732 	 */
733 
734 	if (IF_QFULL(ifq)) {
735 		IF_DROP(ifq);
736 		ahstat.ahs_qfull++;
737 		splx(s);
738 
739 		m_freem(m);
740 		DPRINTF(("ah4_input_cb(): dropped packet because of full "
741 		    "IP queue\n"));
742 		return ENOBUFS;
743 	}
744 
745 	IF_ENQUEUE(ifq, m);
746 	schednetisr(NETISR_IP);
747 	splx(s);
748 	return 0;
749 }
750 
751 
752 void *
753 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
754 {
755 	if (sa->sa_family != AF_INET ||
756 	    sa->sa_len != sizeof(struct sockaddr_in))
757 		return (NULL);
758 
759 	return (ipsec_common_ctlinput(cmd, sa, v, IPPROTO_AH));
760 }
761 
762 /* IPv4 ESP wrapper. */
763 void
764 esp4_input(struct mbuf *m, ...)
765 {
766 	int skip;
767 
768 	va_list ap;
769 	va_start(ap, m);
770 	skip = va_arg(ap, int);
771 	va_end(ap);
772 
773 	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
774 	    IPPROTO_ESP, 0);
775 }
776 
777 /* IPv4 ESP callback. */
778 int
779 esp4_input_cb(struct mbuf *m, ...)
780 {
781 	struct ifqueue *ifq = &ipintrq;
782 	int s = splnet();
783 
784 	/*
785 	 * Interface pointer is already in first mbuf; chop off the
786 	 * `outer' header and reschedule.
787 	 */
788 	if (IF_QFULL(ifq)) {
789 		IF_DROP(ifq);
790 		espstat.esps_qfull++;
791 		splx(s);
792 
793 		m_freem(m);
794 		DPRINTF(("esp4_input_cb(): dropped packet because of full "
795 		    "IP queue\n"));
796 		return ENOBUFS;
797 	}
798 
799 	IF_ENQUEUE(ifq, m);
800 	schednetisr(NETISR_IP);
801 	splx(s);
802 	return 0;
803 }
804 
805 /* IPv4 IPCOMP wrapper */
806 void
807 ipcomp4_input(struct mbuf *m, ...)
808 {
809 	int skip;
810 	va_list ap;
811 	va_start(ap, m);
812 	skip = va_arg(ap, int);
813 	va_end(ap);
814 
815 	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
816 	    IPPROTO_IPCOMP, 0);
817 }
818 
819 /* IPv4 IPCOMP callback */
820 int
821 ipcomp4_input_cb(struct mbuf *m, ...)
822 {
823 	struct ifqueue *ifq = &ipintrq;
824 	int s = splnet();
825 
826 	/*
827 	 * Interface pointer is already in first mbuf; chop off the
828 	 * `outer' header and reschedule.
829 	 */
830 	if (IF_QFULL(ifq)) {
831 		IF_DROP(ifq);
832 		ipcompstat.ipcomps_qfull++;
833 		splx(s);
834 
835 		m_freem(m);
836 		DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n"));
837 		return ENOBUFS;
838 	}
839 
840 	IF_ENQUEUE(ifq, m);
841 	schednetisr(NETISR_IP);
842 	splx(s);
843 
844 	return 0;
845 }
846 
847 void *
848 ipsec_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
849 {
850 	extern u_int ip_mtudisc_timeout;
851 	struct ip *ip = v;
852 	int s;
853 
854 	if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) {
855 		struct tdb *tdbp;
856 		struct sockaddr_in dst;
857 		struct icmp *icp;
858 		int hlen = ip->ip_hl << 2;
859 		u_int32_t spi, mtu;
860 		ssize_t adjust;
861 
862 		/* Find the right MTU. */
863 		icp = (struct icmp *)((caddr_t) ip -
864 		    offsetof(struct icmp, icmp_ip));
865 		mtu = ntohs(icp->icmp_nextmtu);
866 
867 		/*
868 		 * Ignore the packet, if we do not receive a MTU
869 		 * or the MTU is too small to be acceptable.
870 		 */
871 		if (mtu < 296)
872 			return (NULL);
873 
874 		bzero(&dst, sizeof(struct sockaddr_in));
875 		dst.sin_family = AF_INET;
876 		dst.sin_len = sizeof(struct sockaddr_in);
877 		dst.sin_addr.s_addr = ip->ip_dst.s_addr;
878 
879 		bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t));
880 
881 		s = spltdb();
882 		tdbp = gettdb(spi, (union sockaddr_union *)&dst, proto);
883 		if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) {
884 			splx(s);
885 			return (NULL);
886 		}
887 
888 		/* Walk the chain backswards to the first tdb */
889 		for (; tdbp; tdbp = tdbp->tdb_inext) {
890 			if (tdbp->tdb_flags & TDBF_INVALID ||
891 			    (adjust = ipsec_hdrsz(tdbp)) == -1) {
892 				splx(s);
893 				return (NULL);
894 			}
895 
896 			mtu -= adjust;
897 
898 			/* Store adjusted MTU in tdb */
899 			tdbp->tdb_mtu = mtu;
900 			tdbp->tdb_mtutimeout = time_second +
901 			    ip_mtudisc_timeout;
902 			DPRINTF(("ipsec_common_ctlinput: "
903 			    "spi %08x mtu %d adjust %d\n",
904 			    ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
905 			    adjust));
906 		}
907 		splx(s);
908 		return (NULL);
909 	}
910 	return (NULL);
911 }
912 
913 void *
914 udpencap_ctlinput(int cmd, struct sockaddr *sa, void *v)
915 {
916 	struct ip *ip = v;
917 	struct tdb *tdbp;
918 	struct icmp *icp;
919 	u_int32_t mtu;
920 	ssize_t adjust;
921 	struct sockaddr_in dst, src;
922 	union sockaddr_union *su_dst, *su_src;
923 	int s;
924 
925 	icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip));
926 	mtu = ntohs(icp->icmp_nextmtu);
927 
928 	/*
929 	 * Ignore the packet, if we do not receive a MTU
930 	 * or the MTU is too small to be acceptable.
931 	 */
932 	if (mtu < 296)
933 		return (NULL);
934 
935 	bzero(&dst, sizeof(dst));
936 	dst.sin_family = AF_INET;
937 	dst.sin_len = sizeof(struct sockaddr_in);
938 	dst.sin_addr.s_addr = ip->ip_dst.s_addr;
939 	su_dst = (union sockaddr_union *)&dst;
940 	bzero(&src, sizeof(src));
941 	src.sin_family = AF_INET;
942 	src.sin_len = sizeof(struct sockaddr_in);
943 	src.sin_addr.s_addr = ip->ip_src.s_addr;
944 	su_src = (union sockaddr_union *)&src;
945 
946 	s = spltdb();
947 	tdbp = gettdbbysrcdst(0, su_src, su_dst, IPPROTO_ESP);
948 
949 	for (; tdbp != NULL; tdbp = tdbp->tdb_snext) {
950 		if (tdbp->tdb_sproto == IPPROTO_ESP &&
951 		    ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP))
952 		    == TDBF_UDPENCAP) &&
953 		    !bcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) &&
954 		    !bcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) {
955 			if ((adjust = ipsec_hdrsz(tdbp)) != -1) {
956 				/* Store adjusted MTU in tdb */
957 				tdbp->tdb_mtu = mtu - adjust;
958 				tdbp->tdb_mtutimeout = time_second +
959 				    ip_mtudisc_timeout;
960 				DPRINTF(("udpencap_ctlinput: "
961 				    "spi %08x mtu %d adjust %d\n",
962 				    ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
963 				    adjust));
964 			}
965 		}
966 	}
967 	splx(s);
968 	return (NULL);
969 }
970 
971 void *
972 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
973 {
974 	if (sa->sa_family != AF_INET ||
975 	    sa->sa_len != sizeof(struct sockaddr_in))
976 		return (NULL);
977 
978 	return (ipsec_common_ctlinput(cmd, sa, v, IPPROTO_ESP));
979 }
980 #endif /* INET */
981 
982 #ifdef INET6
983 /* IPv6 AH wrapper. */
984 int
985 ah6_input(struct mbuf **mp, int *offp, int proto)
986 {
987 	int l = 0;
988 	int protoff, nxt;
989 	struct ip6_ext ip6e;
990 
991 	if (*offp < sizeof(struct ip6_hdr)) {
992 		DPRINTF(("ah6_input(): bad offset\n"));
993 		return IPPROTO_DONE;
994 	} else if (*offp == sizeof(struct ip6_hdr)) {
995 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
996 	} else {
997 		/* Chase down the header chain... */
998 		protoff = sizeof(struct ip6_hdr);
999 		nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
1000 
1001 		do {
1002 			protoff += l;
1003 			m_copydata(*mp, protoff, sizeof(ip6e),
1004 			    (caddr_t) &ip6e);
1005 
1006 			if (nxt == IPPROTO_AH)
1007 				l = (ip6e.ip6e_len + 2) << 2;
1008 			else
1009 				l = (ip6e.ip6e_len + 1) << 3;
1010 #ifdef DIAGNOSTIC
1011 			if (l <= 0)
1012 				panic("ah6_input: l went zero or negative");
1013 #endif
1014 
1015 			nxt = ip6e.ip6e_nxt;
1016 		} while (protoff + l < *offp);
1017 
1018 		/* Malformed packet check */
1019 		if (protoff + l != *offp) {
1020 			DPRINTF(("ah6_input(): bad packet header chain\n"));
1021 			ahstat.ahs_hdrops++;
1022 			m_freem(*mp);
1023 			*mp = NULL;
1024 			return IPPROTO_DONE;
1025 		}
1026 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
1027 	}
1028 	ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
1029 	return IPPROTO_DONE;
1030 }
1031 
1032 /* IPv6 AH callback. */
1033 int
1034 ah6_input_cb(struct mbuf *m, int off, int protoff)
1035 {
1036 	int nxt;
1037 	u_int8_t nxt8;
1038 	int nest = 0;
1039 
1040 	/* Retrieve new protocol */
1041 	m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
1042 	nxt = nxt8;
1043 
1044 	/*
1045 	 * see the end of ip6_input for this logic.
1046 	 * IPPROTO_IPV[46] case will be processed just like other ones
1047 	 */
1048 	while (nxt != IPPROTO_DONE) {
1049 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
1050 			ip6stat.ip6s_toomanyhdr++;
1051 			goto bad;
1052 		}
1053 
1054 		/*
1055 		 * Protection against faulty packet - there should be
1056 		 * more sanity checks in header chain processing.
1057 		 */
1058 		if (m->m_pkthdr.len < off) {
1059 			ip6stat.ip6s_tooshort++;
1060 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
1061 			goto bad;
1062 		}
1063 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
1064 	}
1065 	return 0;
1066 
1067  bad:
1068 	m_freem(m);
1069 	return EINVAL;
1070 }
1071 
1072 /* IPv6 ESP wrapper. */
1073 int
1074 esp6_input(struct mbuf **mp, int *offp, int proto)
1075 {
1076 	int l = 0;
1077 	int protoff, nxt;
1078 	struct ip6_ext ip6e;
1079 
1080 	if (*offp < sizeof(struct ip6_hdr)) {
1081 		DPRINTF(("esp6_input(): bad offset\n"));
1082 		return IPPROTO_DONE;
1083 	} else if (*offp == sizeof(struct ip6_hdr)) {
1084 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
1085 	} else {
1086 		/* Chase down the header chain... */
1087 		protoff = sizeof(struct ip6_hdr);
1088 		nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
1089 
1090 		do {
1091 			protoff += l;
1092 			m_copydata(*mp, protoff, sizeof(ip6e),
1093 			    (caddr_t) &ip6e);
1094 
1095 			if (nxt == IPPROTO_AH)
1096 				l = (ip6e.ip6e_len + 2) << 2;
1097 			else
1098 				l = (ip6e.ip6e_len + 1) << 3;
1099 #ifdef DIAGNOSTIC
1100 			if (l <= 0)
1101 				panic("esp6_input: l went zero or negative");
1102 #endif
1103 
1104 			nxt = ip6e.ip6e_nxt;
1105 		} while (protoff + l < *offp);
1106 
1107 		/* Malformed packet check */
1108 		if (protoff + l != *offp) {
1109 			DPRINTF(("esp6_input(): bad packet header chain\n"));
1110 			espstat.esps_hdrops++;
1111 			m_freem(*mp);
1112 			*mp = NULL;
1113 			return IPPROTO_DONE;
1114 		}
1115 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
1116 	}
1117 	ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
1118 	return IPPROTO_DONE;
1119 
1120 }
1121 
1122 /* IPv6 ESP callback */
1123 int
1124 esp6_input_cb(struct mbuf *m, int skip, int protoff)
1125 {
1126 	return ah6_input_cb(m, skip, protoff);
1127 }
1128 
1129 /* IPv6 IPcomp wrapper */
1130 int
1131 ipcomp6_input(struct mbuf **mp, int *offp, int proto)
1132 {
1133 	int l = 0;
1134 	int protoff, nxt;
1135 	struct ip6_ext ip6e;
1136 
1137 	if (*offp < sizeof(struct ip6_hdr)) {
1138 		DPRINTF(("ipcomp6_input(): bad offset\n"));
1139 		return IPPROTO_DONE;
1140 	} else if (*offp == sizeof(struct ip6_hdr)) {
1141 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
1142 	} else {
1143 		/* Chase down the header chain... */
1144 		protoff = sizeof(struct ip6_hdr);
1145 		nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
1146 
1147 		do {
1148 			protoff += l;
1149 			m_copydata(*mp, protoff, sizeof(ip6e),
1150 			    (caddr_t) &ip6e);
1151 			if (nxt == IPPROTO_AH)
1152 				l = (ip6e.ip6e_len + 2) << 2;
1153 			else
1154 				l = (ip6e.ip6e_len + 1) << 3;
1155 #ifdef DIAGNOSTIC
1156 			if (l <= 0)
1157 				panic("ipcomp6_input: l went zero or negative");
1158 #endif
1159 
1160 			nxt = ip6e.ip6e_nxt;
1161 		} while (protoff + l < *offp);
1162 
1163 		/* Malformed packet check */
1164 		if (protoff + l != *offp) {
1165 			DPRINTF(("ipcomp6_input(): bad packet header chain\n"));
1166 			ipcompstat.ipcomps_hdrops++;
1167 			m_freem(*mp);
1168 			*mp = NULL;
1169 			return IPPROTO_DONE;
1170 		}
1171 
1172 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
1173 	}
1174 	ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
1175 	return IPPROTO_DONE;
1176 }
1177 
1178 /* IPv6 IPcomp callback */
1179 int
1180 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff)
1181 {
1182 	return ah6_input_cb(m, skip, protoff);
1183 }
1184 
1185 #endif /* INET6 */
1186