xref: /openbsd-src/sys/netinet/ipsec_input.c (revision f2da64fbbbf1b03f09f390ab01267c93dfd77c4c)
1 /*	$OpenBSD: ipsec_input.c,v 1.136 2016/09/02 09:39:32 vgross Exp $	*/
2 /*
3  * The authors of this code are John Ioannidis (ji@tla.org),
4  * Angelos D. Keromytis (kermit@csd.uch.gr) and
5  * Niels Provos (provos@physnet.uni-hamburg.de).
6  *
7  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
8  * in November 1995.
9  *
10  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
11  * by Angelos D. Keromytis.
12  *
13  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
14  * and Niels Provos.
15  *
16  * Additional features in 1999 by Angelos D. Keromytis.
17  *
18  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
19  * Angelos D. Keromytis and Niels Provos.
20  * Copyright (c) 2001, Angelos D. Keromytis.
21  *
22  * Permission to use, copy, and modify this software with or without fee
23  * is hereby granted, provided that this entire notice is included in
24  * all copies of any software which is or includes a copy or
25  * modification of this software.
26  * You may use this code under the GNU public license if you so wish. Please
27  * contribute changes back to the authors under this freer than GPL license
28  * so that we may further the use of strong encryption without limitations to
29  * all.
30  *
31  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
32  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
33  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
34  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
35  * PURPOSE.
36  */
37 
38 #include "pf.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/protosw.h>
43 #include <sys/mbuf.h>
44 #include <sys/socket.h>
45 #include <sys/sysctl.h>
46 #include <sys/kernel.h>
47 #include <sys/timeout.h>
48 
49 #include <net/if.h>
50 #include <net/if_var.h>
51 #include <net/netisr.h>
52 #include <net/bpf.h>
53 #include <net/route.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/ip.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/ip_icmp.h>
59 #include <netinet/tcp.h>
60 #include <netinet/udp.h>
61 
62 #if NPF > 0
63 #include <net/pfvar.h>
64 #endif
65 
66 #ifdef INET6
67 #include <netinet6/in6_var.h>
68 #include <netinet/ip6.h>
69 #include <netinet6/ip6_var.h>
70 #include <netinet6/ip6protosw.h>
71 #endif /* INET6 */
72 
73 #include <netinet/ip_ipsp.h>
74 #include <netinet/ip_esp.h>
75 #include <netinet/ip_ah.h>
76 #include <netinet/ip_ipcomp.h>
77 
78 #include <net/if_enc.h>
79 
80 #include "bpfilter.h"
81 
82 void *ipsec_common_ctlinput(u_int, int, struct sockaddr *, void *, int);
83 int ah4_input_cb(struct mbuf *, ...);
84 int esp4_input_cb(struct mbuf *, ...);
85 int ipcomp4_input_cb(struct mbuf *, ...);
86 
87 #ifdef INET6
88 int ah6_input_cb(struct mbuf *, int, int);
89 int esp6_input_cb(struct mbuf *, int, int);
90 int ipcomp6_input_cb(struct mbuf *, int, int);
91 #endif
92 
93 #ifdef ENCDEBUG
94 #define DPRINTF(x)	if (encdebug) printf x
95 #else
96 #define DPRINTF(x)
97 #endif
98 
99 /* sysctl variables */
100 int esp_enable = 1;
101 int ah_enable = 1;
102 int ipcomp_enable = 0;
103 
104 int *espctl_vars[ESPCTL_MAXID] = ESPCTL_VARS;
105 int *ahctl_vars[AHCTL_MAXID] = AHCTL_VARS;
106 int *ipcompctl_vars[IPCOMPCTL_MAXID] = IPCOMPCTL_VARS;
107 
108 /*
109  * ipsec_common_input() gets called when we receive an IPsec-protected packet
110  * in IPv4 or IPv6. All it does is find the right TDB and call the appropriate
111  * transform. The callback takes care of further processing (like ingress
112  * filtering).
113  */
114 int
115 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
116     int udpencap)
117 {
118 #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \
119 			    sproto == IPPROTO_AH ? (y)++ : (z)++)
120 
121 	union sockaddr_union dst_address;
122 	struct tdb *tdbp;
123 	struct ifnet *encif;
124 	u_int32_t spi;
125 	u_int16_t cpi;
126 	int s, error;
127 #ifdef ENCDEBUG
128 	char buf[INET6_ADDRSTRLEN];
129 #endif
130 
131 	IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input,
132 	    ipcompstat.ipcomps_input);
133 
134 	if (m == NULL) {
135 		DPRINTF(("ipsec_common_input(): NULL packet received\n"));
136 		IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
137 		    ipcompstat.ipcomps_hdrops);
138 		return EINVAL;
139 	}
140 
141 	if ((sproto == IPPROTO_ESP && !esp_enable) ||
142 	    (sproto == IPPROTO_AH && !ah_enable) ||
143 #if NPF > 0
144 	    (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) ||
145 #endif
146 	    (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
147 		switch (af) {
148 		case AF_INET:
149 			rip_input(m, skip, sproto);
150 			break;
151 #ifdef INET6
152 		case AF_INET6:
153 			rip6_input(&m, &skip, sproto);
154 			break;
155 #endif /* INET6 */
156 		default:
157 			DPRINTF(("ipsec_common_input(): unsupported protocol "
158 			    "family %d\n", af));
159 			m_freem(m);
160 			IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf,
161 			    ipcompstat.ipcomps_nopf);
162 			return EPFNOSUPPORT;
163 		}
164 		return 0;
165 	}
166 	if ((sproto == IPPROTO_IPCOMP) && (m->m_flags & M_COMP)) {
167 		m_freem(m);
168 		ipcompstat.ipcomps_pdrops++;
169 		DPRINTF(("ipsec_common_input(): repeated decompression\n"));
170 		return EINVAL;
171 	}
172 
173 	if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) {
174 		m_freem(m);
175 		IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
176 		    ipcompstat.ipcomps_hdrops);
177 		DPRINTF(("ipsec_common_input(): packet too small\n"));
178 		return EINVAL;
179 	}
180 
181 	/* Retrieve the SPI from the relevant IPsec header */
182 	if (sproto == IPPROTO_ESP)
183 		m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
184 	else if (sproto == IPPROTO_AH)
185 		m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
186 		    (caddr_t) &spi);
187 	else if (sproto == IPPROTO_IPCOMP) {
188 		m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
189 		    (caddr_t) &cpi);
190 		spi = ntohl(htons(cpi));
191 	}
192 
193 	/*
194 	 * Find tunnel control block and (indirectly) call the appropriate
195 	 * kernel crypto routine. The resulting mbuf chain is a valid
196 	 * IP packet ready to go through input processing.
197 	 */
198 
199 	memset(&dst_address, 0, sizeof(dst_address));
200 	dst_address.sa.sa_family = af;
201 
202 	switch (af) {
203 	case AF_INET:
204 		dst_address.sin.sin_len = sizeof(struct sockaddr_in);
205 		m_copydata(m, offsetof(struct ip, ip_dst),
206 		    sizeof(struct in_addr),
207 		    (caddr_t) &(dst_address.sin.sin_addr));
208 		break;
209 
210 #ifdef INET6
211 	case AF_INET6:
212 		dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
213 		m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
214 		    sizeof(struct in6_addr),
215 		    (caddr_t) &(dst_address.sin6.sin6_addr));
216 		in6_recoverscope(&dst_address.sin6,
217 		    &dst_address.sin6.sin6_addr);
218 		break;
219 #endif /* INET6 */
220 
221 	default:
222 		DPRINTF(("ipsec_common_input(): unsupported protocol "
223 		    "family %d\n", af));
224 		m_freem(m);
225 		IPSEC_ISTAT(espstat.esps_nopf, ahstat.ahs_nopf,
226 		    ipcompstat.ipcomps_nopf);
227 		return EPFNOSUPPORT;
228 	}
229 
230 	s = splsoftnet();
231 	tdbp = gettdb(rtable_l2(m->m_pkthdr.ph_rtableid),
232 	    spi, &dst_address, sproto);
233 	if (tdbp == NULL) {
234 		splx(s);
235 		DPRINTF(("ipsec_common_input(): could not find SA for "
236 		    "packet to %s, spi %08x\n",
237 		    ipsp_address(&dst_address, buf, sizeof(buf)), ntohl(spi)));
238 		m_freem(m);
239 		IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb,
240 		    ipcompstat.ipcomps_notdb);
241 		return ENOENT;
242 	}
243 
244 	if (tdbp->tdb_flags & TDBF_INVALID) {
245 		splx(s);
246 		DPRINTF(("ipsec_common_input(): attempted to use invalid "
247 		    "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf,
248 		    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
249 		m_freem(m);
250 		IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid,
251 		    ipcompstat.ipcomps_invalid);
252 		return EINVAL;
253 	}
254 
255 	if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) {
256 		splx(s);
257 		DPRINTF(("ipsec_common_input(): attempted to use non-udpencap "
258 		    "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf,
259 		    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
260 		m_freem(m);
261 		espstat.esps_udpinval++;
262 		return EINVAL;
263 	}
264 
265 	if (!udpencap && (tdbp->tdb_flags & TDBF_UDPENCAP)) {
266 		splx(s);
267 		DPRINTF(("ipsec_common_input(): attempted to use udpencap "
268 		    "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf,
269 		    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
270 		m_freem(m);
271 		espstat.esps_udpneeded++;
272 		return EINVAL;
273 	}
274 
275 	if (tdbp->tdb_xform == NULL) {
276 		splx(s);
277 		DPRINTF(("ipsec_common_input(): attempted to use uninitialized "
278 		    "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf,
279 		    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
280 		m_freem(m);
281 		IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform,
282 		    ipcompstat.ipcomps_noxform);
283 		return ENXIO;
284 	}
285 
286 	if (sproto != IPPROTO_IPCOMP) {
287 		if ((encif = enc_getif(tdbp->tdb_rdomain,
288 		    tdbp->tdb_tap)) == NULL) {
289 			splx(s);
290 			DPRINTF(("ipsec_common_input(): "
291 			    "no enc%u interface for SA %s/%08x/%u\n",
292 			    tdbp->tdb_tap, ipsp_address(&dst_address, buf,
293 			    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
294 			m_freem(m);
295 
296 			IPSEC_ISTAT(espstat.esps_pdrops,
297 			    ahstat.ahs_pdrops,
298 			    ipcompstat.ipcomps_pdrops);
299 			return EACCES;
300 		}
301 
302 		/* XXX This conflicts with the scoped nature of IPv6 */
303 		m->m_pkthdr.ph_ifidx = encif->if_index;
304 	}
305 
306 	/* Register first use, setup expiration timer. */
307 	if (tdbp->tdb_first_use == 0) {
308 		tdbp->tdb_first_use = time_second;
309 		if (tdbp->tdb_flags & TDBF_FIRSTUSE)
310 			timeout_add_sec(&tdbp->tdb_first_tmo,
311 			    tdbp->tdb_exp_first_use);
312 		if (tdbp->tdb_flags & TDBF_SOFT_FIRSTUSE)
313 			timeout_add_sec(&tdbp->tdb_sfirst_tmo,
314 			    tdbp->tdb_soft_first_use);
315 	}
316 
317 	/*
318 	 * Call appropriate transform and return -- callback takes care of
319 	 * everything else.
320 	 */
321 	error = (*(tdbp->tdb_xform->xf_input))(m, tdbp, skip, protoff);
322 	splx(s);
323 	return error;
324 }
325 
326 /*
327  * IPsec input callback, called by the transform callback. Takes care of
328  * filtering and other sanity checks on the processed packet.
329  */
330 int
331 ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff)
332 {
333 	int af, sproto;
334 	u_char prot;
335 
336 #if NBPFILTER > 0
337 	struct ifnet *encif;
338 #endif
339 
340 	struct ip *ip, ipn;
341 
342 #ifdef INET6
343 	struct ip6_hdr *ip6, ip6n;
344 #endif /* INET6 */
345 	struct m_tag *mtag;
346 	struct tdb_ident *tdbi;
347 
348 #ifdef ENCDEBUG
349 	char buf[INET6_ADDRSTRLEN];
350 #endif
351 
352 	af = tdbp->tdb_dst.sa.sa_family;
353 	sproto = tdbp->tdb_sproto;
354 
355 	tdbp->tdb_last_used = time_second;
356 
357 	/* Sanity check */
358 	if (m == NULL) {
359 		/* The called routine will print a message if necessary */
360 		IPSEC_ISTAT(espstat.esps_badkcr, ahstat.ahs_badkcr,
361 		    ipcompstat.ipcomps_badkcr);
362 		return EINVAL;
363 	}
364 
365 	/* Fix IPv4 header */
366 	if (af == AF_INET) {
367 		if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) {
368 			DPRINTF(("ipsec_common_input_cb(): processing failed "
369 			    "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst,
370 			    buf, sizeof(buf)), ntohl(tdbp->tdb_spi)));
371 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
372 			    ipcompstat.ipcomps_hdrops);
373 			return ENOBUFS;
374 		}
375 
376 		ip = mtod(m, struct ip *);
377 		ip->ip_len = htons(m->m_pkthdr.len);
378 		ip->ip_sum = 0;
379 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
380 		prot = ip->ip_p;
381 
382 		/* IP-in-IP encapsulation */
383 		if (prot == IPPROTO_IPIP) {
384 			if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
385 				m_freem(m);
386 				IPSEC_ISTAT(espstat.esps_hdrops,
387 				    ahstat.ahs_hdrops,
388 				    ipcompstat.ipcomps_hdrops);
389 				return EINVAL;
390 			}
391 			/* ipn will now contain the inner IPv4 header */
392 			m_copydata(m, skip, sizeof(struct ip),
393 			    (caddr_t) &ipn);
394 		}
395 
396 #ifdef INET6
397 		/* IPv6-in-IP encapsulation. */
398 		if (prot == IPPROTO_IPV6) {
399 			if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
400 				m_freem(m);
401 				IPSEC_ISTAT(espstat.esps_hdrops,
402 				    ahstat.ahs_hdrops,
403 				    ipcompstat.ipcomps_hdrops);
404 				return EINVAL;
405 			}
406 			/* ip6n will now contain the inner IPv6 header. */
407 			m_copydata(m, skip, sizeof(struct ip6_hdr),
408 			    (caddr_t) &ip6n);
409 		}
410 #endif /* INET6 */
411 	}
412 
413 #ifdef INET6
414 	/* Fix IPv6 header */
415 	if (af == AF_INET6)
416 	{
417 		if (m->m_len < sizeof(struct ip6_hdr) &&
418 		    (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
419 
420 			DPRINTF(("ipsec_common_input_cb(): processing failed "
421 			    "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst,
422 			    buf, sizeof(buf)), ntohl(tdbp->tdb_spi)));
423 
424 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
425 			    ipcompstat.ipcomps_hdrops);
426 			return EACCES;
427 		}
428 
429 		ip6 = mtod(m, struct ip6_hdr *);
430 		ip6->ip6_plen = htons(m->m_pkthdr.len - skip);
431 
432 		/* Save protocol */
433 		m_copydata(m, protoff, 1, (caddr_t) &prot);
434 
435 		/* IP-in-IP encapsulation */
436 		if (prot == IPPROTO_IPIP) {
437 			if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
438 				m_freem(m);
439 				IPSEC_ISTAT(espstat.esps_hdrops,
440 				    ahstat.ahs_hdrops,
441 				    ipcompstat.ipcomps_hdrops);
442 				return EINVAL;
443 			}
444 			/* ipn will now contain the inner IPv4 header */
445 			m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
446 		}
447 
448 		/* IPv6-in-IP encapsulation */
449 		if (prot == IPPROTO_IPV6) {
450 			if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
451 				m_freem(m);
452 				IPSEC_ISTAT(espstat.esps_hdrops,
453 				    ahstat.ahs_hdrops,
454 				    ipcompstat.ipcomps_hdrops);
455 				return EINVAL;
456 			}
457 			/* ip6n will now contain the inner IPv6 header. */
458 			m_copydata(m, skip, sizeof(struct ip6_hdr),
459 			    (caddr_t) &ip6n);
460 		}
461 	}
462 #endif /* INET6 */
463 
464 	/*
465 	 * Fix TCP/UDP checksum of UDP encapsulated transport mode ESP packet.
466 	 * (RFC3948 3.1.2)
467 	 */
468 	if ((af == AF_INET || af == AF_INET6) &&
469 	    (tdbp->tdb_flags & TDBF_UDPENCAP) &&
470 	    (tdbp->tdb_flags & TDBF_TUNNELING) == 0) {
471 		u_int16_t cksum;
472 
473 		switch (prot) {
474 		case IPPROTO_UDP:
475 			if (m->m_pkthdr.len < skip + sizeof(struct udphdr)) {
476 				m_freem(m);
477 				IPSEC_ISTAT(espstat.esps_hdrops,
478 				    ahstat.ahs_hdrops,
479 				    ipcompstat.ipcomps_hdrops);
480 				return EINVAL;
481 			}
482 			cksum = 0;
483 			m_copyback(m, skip + offsetof(struct udphdr, uh_sum),
484 			    sizeof(cksum), &cksum, M_NOWAIT);
485 #ifdef INET6
486 			if (af == AF_INET6) {
487 				cksum = in6_cksum(m, IPPROTO_UDP, skip,
488 				    m->m_pkthdr.len - skip);
489 				m_copyback(m, skip + offsetof(struct udphdr,
490 				    uh_sum), sizeof(cksum), &cksum, M_NOWAIT);
491 			}
492 #endif
493 			break;
494 		case IPPROTO_TCP:
495 			if (m->m_pkthdr.len < skip + sizeof(struct tcphdr)) {
496 				m_freem(m);
497 				IPSEC_ISTAT(espstat.esps_hdrops,
498 				    ahstat.ahs_hdrops,
499 				    ipcompstat.ipcomps_hdrops);
500 				return EINVAL;
501 			}
502 			cksum = 0;
503 			m_copyback(m, skip + offsetof(struct tcphdr, th_sum),
504 			    sizeof(cksum), &cksum, M_NOWAIT);
505 			if (af == AF_INET)
506 				cksum = in4_cksum(m, IPPROTO_TCP, skip,
507 				    m->m_pkthdr.len - skip);
508 #ifdef INET6
509 			else if (af == AF_INET6)
510 				cksum = in6_cksum(m, IPPROTO_TCP, skip,
511 				    m->m_pkthdr.len - skip);
512 #endif
513 			m_copyback(m, skip + offsetof(struct tcphdr, th_sum),
514 			    sizeof(cksum), &cksum, M_NOWAIT);
515 			break;
516 		}
517 	}
518 
519 	/*
520 	 * Record what we've done to the packet (under what SA it was
521 	 * processed).
522 	 */
523 	if (tdbp->tdb_sproto != IPPROTO_IPCOMP) {
524 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
525 		    sizeof(struct tdb_ident), M_NOWAIT);
526 		if (mtag == NULL) {
527 			m_freem(m);
528 			DPRINTF(("ipsec_common_input_cb(): failed to "
529 			    "get tag\n"));
530 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
531 			    ipcompstat.ipcomps_hdrops);
532 			return ENOMEM;
533 		}
534 
535 		tdbi = (struct tdb_ident *)(mtag + 1);
536 		bcopy(&tdbp->tdb_dst, &tdbi->dst,
537 		    sizeof(union sockaddr_union));
538 		tdbi->proto = tdbp->tdb_sproto;
539 		tdbi->spi = tdbp->tdb_spi;
540 		tdbi->rdomain = tdbp->tdb_rdomain;
541 
542 		m_tag_prepend(m, mtag);
543 	}
544 
545 	if (sproto == IPPROTO_ESP) {
546 		/* Packet is confidential ? */
547 		if (tdbp->tdb_encalgxform)
548 			m->m_flags |= M_CONF;
549 
550 		/* Check if we had authenticated ESP. */
551 		if (tdbp->tdb_authalgxform)
552 			m->m_flags |= M_AUTH;
553 	} else if (sproto == IPPROTO_AH) {
554 		m->m_flags |= M_AUTH;
555 	} else if (sproto == IPPROTO_IPCOMP) {
556 		m->m_flags |= M_COMP;
557 	}
558 
559 #if NPF > 0
560 	/* Add pf tag if requested. */
561 	pf_tag_packet(m, tdbp->tdb_tag, -1);
562 	pf_pkt_addr_changed(m);
563 #endif
564 
565 	if (tdbp->tdb_flags & TDBF_TUNNELING)
566 		m->m_flags |= M_TUNNEL;
567 
568 #if NBPFILTER > 0
569 	if ((encif = enc_getif(tdbp->tdb_rdomain, tdbp->tdb_tap)) != NULL) {
570 		encif->if_ipackets++;
571 		encif->if_ibytes += m->m_pkthdr.len;
572 
573 		if (encif->if_bpf) {
574 			struct enchdr hdr;
575 
576 			hdr.af = af;
577 			hdr.spi = tdbp->tdb_spi;
578 			hdr.flags = m->m_flags & (M_AUTH|M_CONF);
579 
580 			bpf_mtap_hdr(encif->if_bpf, (char *)&hdr,
581 			    ENC_HDRLEN, m, BPF_DIRECTION_IN, NULL);
582 		}
583 	}
584 #endif
585 
586 	/* Call the appropriate IPsec transform callback. */
587 	switch (af) {
588 	case AF_INET:
589 		switch (sproto)
590 		{
591 		case IPPROTO_ESP:
592 			return esp4_input_cb(m);
593 
594 		case IPPROTO_AH:
595 			return ah4_input_cb(m);
596 
597 		case IPPROTO_IPCOMP:
598 			return ipcomp4_input_cb(m);
599 
600 		default:
601 			DPRINTF(("ipsec_common_input_cb(): unknown/unsupported"
602 			    " security protocol %d\n", sproto));
603 			m_freem(m);
604 			return EPFNOSUPPORT;
605 		}
606 		break;
607 
608 #ifdef INET6
609 	case AF_INET6:
610 		switch (sproto) {
611 		case IPPROTO_ESP:
612 			return esp6_input_cb(m, skip, protoff);
613 
614 		case IPPROTO_AH:
615 			return ah6_input_cb(m, skip, protoff);
616 
617 		case IPPROTO_IPCOMP:
618 			return ipcomp6_input_cb(m, skip, protoff);
619 
620 		default:
621 			DPRINTF(("ipsec_common_input_cb(): unknown/unsupported"
622 			    " security protocol %d\n", sproto));
623 			m_freem(m);
624 			return EPFNOSUPPORT;
625 		}
626 		break;
627 #endif /* INET6 */
628 
629 	default:
630 		DPRINTF(("ipsec_common_input_cb(): unknown/unsupported "
631 		    "protocol family %d\n", af));
632 		m_freem(m);
633 		return EPFNOSUPPORT;
634 	}
635 #undef IPSEC_ISTAT
636 }
637 
638 int
639 esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
640     size_t newlen)
641 {
642 	/* All sysctl names at this level are terminal. */
643 	if (namelen != 1)
644 		return (ENOTDIR);
645 
646 	switch (name[0]) {
647 	case ESPCTL_STATS:
648 		if (newp != NULL)
649 			return (EPERM);
650 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
651 		    &espstat, sizeof(espstat)));
652 	default:
653 		if (name[0] < ESPCTL_MAXID)
654 			return (sysctl_int_arr(espctl_vars, name, namelen,
655 			    oldp, oldlenp, newp, newlen));
656 		return (ENOPROTOOPT);
657 	}
658 }
659 
660 int
661 ah_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
662     size_t newlen)
663 {
664 	/* All sysctl names at this level are terminal. */
665 	if (namelen != 1)
666 		return (ENOTDIR);
667 
668 	switch (name[0]) {
669 	case AHCTL_STATS:
670 		if (newp != NULL)
671 			return (EPERM);
672 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
673 		    &ahstat, sizeof(ahstat)));
674 	default:
675 		if (name[0] < AHCTL_MAXID)
676 			return (sysctl_int_arr(ahctl_vars, name, namelen,
677 			    oldp, oldlenp, newp, newlen));
678 		return (ENOPROTOOPT);
679 	}
680 }
681 
682 int
683 ipcomp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
684     size_t newlen)
685 {
686 	/* All sysctl names at this level are terminal. */
687 	if (namelen != 1)
688 		return (ENOTDIR);
689 
690 	switch (name[0]) {
691 	case IPCOMPCTL_STATS:
692 		if (newp != NULL)
693 			return (EPERM);
694 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
695 		    &ipcompstat, sizeof(ipcompstat)));
696 	default:
697 		if (name[0] < IPCOMPCTL_MAXID)
698 			return (sysctl_int_arr(ipcompctl_vars, name, namelen,
699 			    oldp, oldlenp, newp, newlen));
700 		return (ENOPROTOOPT);
701 	}
702 }
703 
704 /* IPv4 AH wrapper. */
705 void
706 ah4_input(struct mbuf *m, ...)
707 {
708 	int skip;
709 
710 	va_list ap;
711 	va_start(ap, m);
712 	skip = va_arg(ap, int);
713 	va_end(ap);
714 
715 	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
716 	    IPPROTO_AH, 0);
717 	return;
718 }
719 
720 /* IPv4 AH callback. */
721 int
722 ah4_input_cb(struct mbuf *m, ...)
723 {
724 	/*
725 	 * Interface pointer is already in first mbuf; chop off the
726 	 * `outer' header and reschedule.
727 	 */
728 
729 	if (niq_enqueue(&ipintrq, m) != 0) {
730 		ahstat.ahs_qfull++;
731 		DPRINTF(("ah4_input_cb(): dropped packet because of full "
732 		    "IP queue\n"));
733 		return ENOBUFS;
734 	}
735 
736 	return 0;
737 }
738 
739 
740 /* XXX rdomain */
741 void *
742 ah4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v)
743 {
744 	if (sa->sa_family != AF_INET ||
745 	    sa->sa_len != sizeof(struct sockaddr_in))
746 		return (NULL);
747 
748 	return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_AH));
749 }
750 
751 /* IPv4 ESP wrapper. */
752 void
753 esp4_input(struct mbuf *m, ...)
754 {
755 	int skip;
756 
757 	va_list ap;
758 	va_start(ap, m);
759 	skip = va_arg(ap, int);
760 	va_end(ap);
761 
762 	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
763 	    IPPROTO_ESP, 0);
764 }
765 
766 /* IPv4 ESP callback. */
767 int
768 esp4_input_cb(struct mbuf *m, ...)
769 {
770 	/*
771 	 * Interface pointer is already in first mbuf; chop off the
772 	 * `outer' header and reschedule.
773 	 */
774 	if (niq_enqueue(&ipintrq, m) != 0) {
775 		espstat.esps_qfull++;
776 		DPRINTF(("esp4_input_cb(): dropped packet because of full "
777 		    "IP queue\n"));
778 		return ENOBUFS;
779 	}
780 
781 	return 0;
782 }
783 
784 /* IPv4 IPCOMP wrapper */
785 void
786 ipcomp4_input(struct mbuf *m, ...)
787 {
788 	int skip;
789 	va_list ap;
790 	va_start(ap, m);
791 	skip = va_arg(ap, int);
792 	va_end(ap);
793 
794 	ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET,
795 	    IPPROTO_IPCOMP, 0);
796 }
797 
798 /* IPv4 IPCOMP callback */
799 int
800 ipcomp4_input_cb(struct mbuf *m, ...)
801 {
802 	/*
803 	 * Interface pointer is already in first mbuf; chop off the
804 	 * `outer' header and reschedule.
805 	 */
806 	if (niq_enqueue(&ipintrq, m) != 0) {
807 		ipcompstat.ipcomps_qfull++;
808 		DPRINTF(("ipcomp4_input_cb(): dropped packet because of full IP queue\n"));
809 		return ENOBUFS;
810 	}
811 
812 	return 0;
813 }
814 
815 void *
816 ipsec_common_ctlinput(u_int rdomain, int cmd, struct sockaddr *sa,
817     void *v, int proto)
818 {
819 	struct ip *ip = v;
820 	int s;
821 
822 	if (cmd == PRC_MSGSIZE && ip && ip_mtudisc && ip->ip_v == 4) {
823 		struct tdb *tdbp;
824 		struct sockaddr_in dst;
825 		struct icmp *icp;
826 		int hlen = ip->ip_hl << 2;
827 		u_int32_t spi, mtu;
828 		ssize_t adjust;
829 
830 		/* Find the right MTU. */
831 		icp = (struct icmp *)((caddr_t) ip -
832 		    offsetof(struct icmp, icmp_ip));
833 		mtu = ntohs(icp->icmp_nextmtu);
834 
835 		/*
836 		 * Ignore the packet, if we do not receive a MTU
837 		 * or the MTU is too small to be acceptable.
838 		 */
839 		if (mtu < 296)
840 			return (NULL);
841 
842 		memset(&dst, 0, sizeof(struct sockaddr_in));
843 		dst.sin_family = AF_INET;
844 		dst.sin_len = sizeof(struct sockaddr_in);
845 		dst.sin_addr.s_addr = ip->ip_dst.s_addr;
846 
847 		bcopy((caddr_t)ip + hlen, &spi, sizeof(u_int32_t));
848 
849 		s = splsoftnet();
850 		tdbp = gettdb(rdomain, spi, (union sockaddr_union *)&dst,
851 		    proto);
852 		if (tdbp == NULL || tdbp->tdb_flags & TDBF_INVALID) {
853 			splx(s);
854 			return (NULL);
855 		}
856 
857 		/* Walk the chain backwards to the first tdb */
858 		for (; tdbp; tdbp = tdbp->tdb_inext) {
859 			if (tdbp->tdb_flags & TDBF_INVALID ||
860 			    (adjust = ipsec_hdrsz(tdbp)) == -1) {
861 				splx(s);
862 				return (NULL);
863 			}
864 
865 			mtu -= adjust;
866 
867 			/* Store adjusted MTU in tdb */
868 			tdbp->tdb_mtu = mtu;
869 			tdbp->tdb_mtutimeout = time_second +
870 			    ip_mtudisc_timeout;
871 			DPRINTF(("ipsec_common_ctlinput: "
872 			    "spi %08x mtu %d adjust %ld\n",
873 			    ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
874 			    adjust));
875 		}
876 		splx(s);
877 		return (NULL);
878 	}
879 	return (NULL);
880 }
881 
882 /* XXX rdomain */
883 void *
884 udpencap_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v)
885 {
886 	struct ip *ip = v;
887 	struct tdb *tdbp;
888 	struct icmp *icp;
889 	u_int32_t mtu;
890 	ssize_t adjust;
891 	struct sockaddr_in dst, src;
892 	union sockaddr_union *su_dst, *su_src;
893 	int s;
894 
895 	icp = (struct icmp *)((caddr_t) ip - offsetof(struct icmp, icmp_ip));
896 	mtu = ntohs(icp->icmp_nextmtu);
897 
898 	/*
899 	 * Ignore the packet, if we do not receive a MTU
900 	 * or the MTU is too small to be acceptable.
901 	 */
902 	if (mtu < 296)
903 		return (NULL);
904 
905 	memset(&dst, 0, sizeof(dst));
906 	dst.sin_family = AF_INET;
907 	dst.sin_len = sizeof(struct sockaddr_in);
908 	dst.sin_addr.s_addr = ip->ip_dst.s_addr;
909 	su_dst = (union sockaddr_union *)&dst;
910 	memset(&src, 0, sizeof(src));
911 	src.sin_family = AF_INET;
912 	src.sin_len = sizeof(struct sockaddr_in);
913 	src.sin_addr.s_addr = ip->ip_src.s_addr;
914 	su_src = (union sockaddr_union *)&src;
915 
916 	s = splsoftnet();
917 	tdbp = gettdbbysrcdst(rdomain, 0, su_src, su_dst, IPPROTO_ESP);
918 
919 	for (; tdbp != NULL; tdbp = tdbp->tdb_snext) {
920 		if (tdbp->tdb_sproto == IPPROTO_ESP &&
921 		    ((tdbp->tdb_flags & (TDBF_INVALID|TDBF_UDPENCAP)) ==
922 		    TDBF_UDPENCAP) &&
923 		    !memcmp(&tdbp->tdb_dst, &dst, SA_LEN(&su_dst->sa)) &&
924 		    !memcmp(&tdbp->tdb_src, &src, SA_LEN(&su_src->sa))) {
925 			if ((adjust = ipsec_hdrsz(tdbp)) != -1) {
926 				/* Store adjusted MTU in tdb */
927 				tdbp->tdb_mtu = mtu - adjust;
928 				tdbp->tdb_mtutimeout = time_second +
929 				    ip_mtudisc_timeout;
930 				DPRINTF(("udpencap_ctlinput: "
931 				    "spi %08x mtu %d adjust %ld\n",
932 				    ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
933 				    adjust));
934 			}
935 		}
936 	}
937 	splx(s);
938 	return (NULL);
939 }
940 
941 /* XXX rdomain */
942 void *
943 esp4_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v)
944 {
945 	if (sa->sa_family != AF_INET ||
946 	    sa->sa_len != sizeof(struct sockaddr_in))
947 		return (NULL);
948 
949 	return (ipsec_common_ctlinput(rdomain, cmd, sa, v, IPPROTO_ESP));
950 }
951 
952 #ifdef INET6
953 /* IPv6 AH wrapper. */
954 int
955 ah6_input(struct mbuf **mp, int *offp, int proto)
956 {
957 	int l = 0;
958 	int protoff, nxt;
959 	struct ip6_ext ip6e;
960 
961 	if (*offp < sizeof(struct ip6_hdr)) {
962 		DPRINTF(("ah6_input(): bad offset\n"));
963 		ahstat.ahs_hdrops++;
964 		m_freem(*mp);
965 		*mp = NULL;
966 		return IPPROTO_DONE;
967 	} else if (*offp == sizeof(struct ip6_hdr)) {
968 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
969 	} else {
970 		/* Chase down the header chain... */
971 		protoff = sizeof(struct ip6_hdr);
972 		nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
973 
974 		do {
975 			protoff += l;
976 			m_copydata(*mp, protoff, sizeof(ip6e),
977 			    (caddr_t) &ip6e);
978 
979 			if (nxt == IPPROTO_AH)
980 				l = (ip6e.ip6e_len + 2) << 2;
981 			else
982 				l = (ip6e.ip6e_len + 1) << 3;
983 #ifdef DIAGNOSTIC
984 			if (l <= 0)
985 				panic("ah6_input: l went zero or negative");
986 #endif
987 
988 			nxt = ip6e.ip6e_nxt;
989 		} while (protoff + l < *offp);
990 
991 		/* Malformed packet check */
992 		if (protoff + l != *offp) {
993 			DPRINTF(("ah6_input(): bad packet header chain\n"));
994 			ahstat.ahs_hdrops++;
995 			m_freem(*mp);
996 			*mp = NULL;
997 			return IPPROTO_DONE;
998 		}
999 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
1000 	}
1001 	ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
1002 	return IPPROTO_DONE;
1003 }
1004 
1005 /* IPv6 AH callback. */
1006 int
1007 ah6_input_cb(struct mbuf *m, int off, int protoff)
1008 {
1009 	int nxt;
1010 	u_int8_t nxt8;
1011 	int nest = 0;
1012 
1013 	/* Retrieve new protocol */
1014 	m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
1015 	nxt = nxt8;
1016 
1017 	/*
1018 	 * see the end of ip6_input for this logic.
1019 	 * IPPROTO_IPV[46] case will be processed just like other ones
1020 	 */
1021 	while (nxt != IPPROTO_DONE) {
1022 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
1023 			ip6stat.ip6s_toomanyhdr++;
1024 			goto bad;
1025 		}
1026 
1027 		/*
1028 		 * Protection against faulty packet - there should be
1029 		 * more sanity checks in header chain processing.
1030 		 */
1031 		if (m->m_pkthdr.len < off) {
1032 			ip6stat.ip6s_tooshort++;
1033 			goto bad;
1034 		}
1035 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
1036 	}
1037 	return 0;
1038 
1039  bad:
1040 	m_freem(m);
1041 	return EINVAL;
1042 }
1043 
1044 /* IPv6 ESP wrapper. */
1045 int
1046 esp6_input(struct mbuf **mp, int *offp, int proto)
1047 {
1048 	int l = 0;
1049 	int protoff, nxt;
1050 	struct ip6_ext ip6e;
1051 
1052 	if (*offp < sizeof(struct ip6_hdr)) {
1053 		DPRINTF(("esp6_input(): bad offset\n"));
1054 		espstat.esps_hdrops++;
1055 		m_freem(*mp);
1056 		*mp = NULL;
1057 		return IPPROTO_DONE;
1058 	} else if (*offp == sizeof(struct ip6_hdr)) {
1059 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
1060 	} else {
1061 		/* Chase down the header chain... */
1062 		protoff = sizeof(struct ip6_hdr);
1063 		nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
1064 
1065 		do {
1066 			protoff += l;
1067 			m_copydata(*mp, protoff, sizeof(ip6e),
1068 			    (caddr_t) &ip6e);
1069 
1070 			if (nxt == IPPROTO_AH)
1071 				l = (ip6e.ip6e_len + 2) << 2;
1072 			else
1073 				l = (ip6e.ip6e_len + 1) << 3;
1074 #ifdef DIAGNOSTIC
1075 			if (l <= 0)
1076 				panic("esp6_input: l went zero or negative");
1077 #endif
1078 
1079 			nxt = ip6e.ip6e_nxt;
1080 		} while (protoff + l < *offp);
1081 
1082 		/* Malformed packet check */
1083 		if (protoff + l != *offp) {
1084 			DPRINTF(("esp6_input(): bad packet header chain\n"));
1085 			espstat.esps_hdrops++;
1086 			m_freem(*mp);
1087 			*mp = NULL;
1088 			return IPPROTO_DONE;
1089 		}
1090 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
1091 	}
1092 	ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
1093 	return IPPROTO_DONE;
1094 
1095 }
1096 
1097 /* IPv6 ESP callback */
1098 int
1099 esp6_input_cb(struct mbuf *m, int skip, int protoff)
1100 {
1101 	return ah6_input_cb(m, skip, protoff);
1102 }
1103 
1104 /* IPv6 IPcomp wrapper */
1105 int
1106 ipcomp6_input(struct mbuf **mp, int *offp, int proto)
1107 {
1108 	int l = 0;
1109 	int protoff, nxt;
1110 	struct ip6_ext ip6e;
1111 
1112 	if (*offp < sizeof(struct ip6_hdr)) {
1113 		DPRINTF(("ipcomp6_input(): bad offset\n"));
1114 		ipcompstat.ipcomps_hdrops++;
1115 		m_freem(*mp);
1116 		*mp = NULL;
1117 		return IPPROTO_DONE;
1118 	} else if (*offp == sizeof(struct ip6_hdr)) {
1119 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
1120 	} else {
1121 		/* Chase down the header chain... */
1122 		protoff = sizeof(struct ip6_hdr);
1123 		nxt = (mtod(*mp, struct ip6_hdr *))->ip6_nxt;
1124 
1125 		do {
1126 			protoff += l;
1127 			m_copydata(*mp, protoff, sizeof(ip6e),
1128 			    (caddr_t) &ip6e);
1129 			if (nxt == IPPROTO_AH)
1130 				l = (ip6e.ip6e_len + 2) << 2;
1131 			else
1132 				l = (ip6e.ip6e_len + 1) << 3;
1133 #ifdef DIAGNOSTIC
1134 			if (l <= 0)
1135 				panic("ipcomp6_input: l went zero or negative");
1136 #endif
1137 
1138 			nxt = ip6e.ip6e_nxt;
1139 		} while (protoff + l < *offp);
1140 
1141 		/* Malformed packet check */
1142 		if (protoff + l != *offp) {
1143 			DPRINTF(("ipcomp6_input(): bad packet header chain\n"));
1144 			ipcompstat.ipcomps_hdrops++;
1145 			m_freem(*mp);
1146 			*mp = NULL;
1147 			return IPPROTO_DONE;
1148 		}
1149 
1150 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
1151 	}
1152 	ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0);
1153 	return IPPROTO_DONE;
1154 }
1155 
1156 /* IPv6 IPcomp callback */
1157 int
1158 ipcomp6_input_cb(struct mbuf *m, int skip, int protoff)
1159 {
1160 	return ah6_input_cb(m, skip, protoff);
1161 }
1162 
1163 #endif /* INET6 */
1164