]> git.saurik.com Git - apple/xnu.git/blame - bsd/netinet6/ipsec.c
projects / apple / xnu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
xnu-4570.1.46.tar.gz
[apple/xnu.git] / bsd / netinet6 / ipsec.c
CommitLineData
b0d623f7 1/*
39037602 2 * Copyright (c) 2008-2016 Apple Inc. All rights reserved.
b0d623f7
A		 3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
39037602 5 *
b0d623f7
A		 6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
39037602 14 *
b0d623f7
A		 15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
39037602 17 *
b0d623f7
A		 18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
39037602 25 *
b0d623f7
A		 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
9bccf70c
A		 29/* $FreeBSD: src/sys/netinet6/ipsec.c,v 1.3.2.7 2001/07/19 06:37:23 kris Exp $ */
30/* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
1c79356b
A		 31
32/*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61/*
62 * IPsec controller part.
63 */
1c79356b
A		 64
65#include <sys/param.h>
66#include <sys/systm.h>
67#include <sys/malloc.h>
68#include <sys/mbuf.h>
316670eb 69#include <sys/mcache.h>
1c79356b
A		 70#include <sys/domain.h>
71#include <sys/protosw.h>
72#include <sys/socket.h>
73#include <sys/socketvar.h>
74#include <sys/errno.h>
75#include <sys/time.h>
76#include <sys/kernel.h>
77#include <sys/syslog.h>
1c79356b 78#include <sys/sysctl.h>
91447636
A		 79#include <kern/locks.h>
80#include <sys/kauth.h>
2d21ac55 81#include <libkern/OSAtomic.h>
1c79356b
A		 82
83#include <net/if.h>
84#include <net/route.h>
fe8ab488 85#include <net/if_ipsec.h>
1c79356b
A		 86
87#include <netinet/in.h>
88#include <netinet/in_systm.h>
89#include <netinet/ip.h>
90#include <netinet/ip_var.h>
91#include <netinet/in_var.h>
92#include <netinet/udp.h>
93#include <netinet/udp_var.h>
94#include <netinet/ip_ecn.h>
1c79356b 95#if INET6
9bccf70c
A		 96#include <netinet6/ip6_ecn.h>
97#endif
98#include <netinet/tcp.h>
99#include <netinet/udp.h>
100
1c79356b 101#include <netinet/ip6.h>
9bccf70c 102#if INET6
1c79356b
A		 103#include <netinet6/ip6_var.h>
104#endif
105#include <netinet/in_pcb.h>
106#if INET6
1c79356b
A		 107#include <netinet/icmp6.h>
108#endif
109
110#include <netinet6/ipsec.h>
9bccf70c
A		 111#if INET6
112#include <netinet6/ipsec6.h>
113#endif
1c79356b 114#include <netinet6/ah.h>
9bccf70c
A		 115#if INET6
116#include <netinet6/ah6.h>
117#endif
1c79356b
A		 118#if IPSEC_ESP
119#include <netinet6/esp.h>
9bccf70c
A		 120#if INET6
121#include <netinet6/esp6.h>
122#endif
1c79356b
A		 123#endif
124#include <netinet6/ipcomp.h>
9bccf70c
A		 125#if INET6
126#include <netinet6/ipcomp6.h>
127#endif
1c79356b
A		 128#include <netkey/key.h>
129#include <netkey/keydb.h>
130#include <netkey/key_debug.h>
131
132#include <net/net_osdep.h>
133
9bccf70c 134#if IPSEC_DEBUG
1c79356b
A		 135int ipsec_debug = 1;
136#else
137int ipsec_debug = 0;
138#endif
139
55e303ae
A		 140#include <sys/kdebug.h>
141#define DBG_LAYER_BEG NETDBG_CODE(DBG_NETIPSEC, 1)
142#define DBG_LAYER_END NETDBG_CODE(DBG_NETIPSEC, 3)
143#define DBG_FNC_GETPOL_SOCK NETDBG_CODE(DBG_NETIPSEC, (1 << 8))
144#define DBG_FNC_GETPOL_ADDR NETDBG_CODE(DBG_NETIPSEC, (2 << 8))
145#define DBG_FNC_IPSEC_OUT NETDBG_CODE(DBG_NETIPSEC, (3 << 8))
146
91447636 147extern lck_mtx_t *sadb_mutex;
55e303ae 148
1c79356b 149struct ipsecstat ipsecstat;
1c79356b
A		 150int ip4_ah_cleartos = 1;
151int ip4_ah_offsetmask = 0; /* maybe IP_DF? */
152int ip4_ipsec_dfbit = 0; /* DF bit on encap. 0: clear 1: set 2: copy */
153int ip4_esp_trans_deflev = IPSEC_LEVEL_USE;
154int ip4_esp_net_deflev = IPSEC_LEVEL_USE;
155int ip4_ah_trans_deflev = IPSEC_LEVEL_USE;
156int ip4_ah_net_deflev = IPSEC_LEVEL_USE;
157struct secpolicy ip4_def_policy;
3e170ce0 158int ip4_ipsec_ecn = ECN_COMPATIBILITY; /* ECN ignore(-1)/compatibility(0)/normal(1) */
9bccf70c 159int ip4_esp_randpad = -1;
55e303ae 160int esp_udp_encap_port = 0;
9bccf70c 161static int sysctl_def_policy SYSCTL_HANDLER_ARGS;
b0d623f7 162extern int natt_keepalive_interval;
39037602 163extern u_int64_t natt_now;
1c79356b 164
2d21ac55
A		 165struct ipsec_tag;
166
1c79356b 167SYSCTL_DECL(_net_inet_ipsec);
9bccf70c
A		 168#if INET6
169SYSCTL_DECL(_net_inet6_ipsec6);
170#endif
1c79356b
A		 171/* net.inet.ipsec */
172SYSCTL_STRUCT(_net_inet_ipsec, IPSECCTL_STATS,
6d2010ae
A		 173 stats, CTLFLAG_RD | CTLFLAG_LOCKED, &ipsecstat, ipsecstat, "");
174SYSCTL_PROC(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,
9bccf70c 175 &ip4_def_policy.policy, 0, &sysctl_def_policy, "I", "");
1c79356b 176SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
6d2010ae 177 CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_esp_trans_deflev, 0, "");
1c79356b 178SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
6d2010ae 179 CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_esp_net_deflev, 0, "");
1c79356b 180SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
6d2010ae 181 CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_ah_trans_deflev, 0, "");
1c79356b 182SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
6d2010ae 183 CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_ah_net_deflev, 0, "");
1c79356b 184SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS,
6d2010ae 185 ah_cleartos, CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_ah_cleartos, 0, "");
1c79356b 186SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK,
6d2010ae 187 ah_offsetmask, CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_ah_offsetmask, 0, "");
1c79356b 188SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT,
6d2010ae 189 dfbit, CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_ipsec_dfbit, 0, "");
1c79356b 190SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN,
6d2010ae 191 ecn, CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_ipsec_ecn, 0, "");
1c79356b 192SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG,
6d2010ae 193 debug, CTLFLAG_RW | CTLFLAG_LOCKED, &ipsec_debug, 0, "");
9bccf70c 194SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD,
6d2010ae 195 esp_randpad, CTLFLAG_RW | CTLFLAG_LOCKED, &ip4_esp_randpad, 0, "");
9bccf70c
A		 196
197/* for performance, we bypass ipsec until a security policy is set */
198int ipsec_bypass = 1;
6d2010ae 199SYSCTL_INT(_net_inet_ipsec, OID_AUTO, bypass, CTLFLAG_RD | CTLFLAG_LOCKED, &ipsec_bypass,0, "");
1c79356b 200
55e303ae
A		 201/*
202 * NAT Traversal requires a UDP port for encapsulation,
203 * esp_udp_encap_port controls which port is used. Racoon
204 * must set this port to the port racoon is using locally
205 * for nat traversal.
206 */
207SYSCTL_INT(_net_inet_ipsec, OID_AUTO, esp_port,
6d2010ae 208 CTLFLAG_RW | CTLFLAG_LOCKED, &esp_udp_encap_port, 0, "");
55e303ae 209
1c79356b
A		 210#if INET6
211struct ipsecstat ipsec6stat;
1c79356b
A		 212int ip6_esp_trans_deflev = IPSEC_LEVEL_USE;
213int ip6_esp_net_deflev = IPSEC_LEVEL_USE;
214int ip6_ah_trans_deflev = IPSEC_LEVEL_USE;
215int ip6_ah_net_deflev = IPSEC_LEVEL_USE;
216struct secpolicy ip6_def_policy;
3e170ce0 217int ip6_ipsec_ecn = ECN_COMPATIBILITY; /* ECN ignore(-1)/compatibility(0)/normal(1) */
9bccf70c 218int ip6_esp_randpad = -1;
1c79356b 219
1c79356b
A		 220/* net.inet6.ipsec6 */
221SYSCTL_STRUCT(_net_inet6_ipsec6, IPSECCTL_STATS,
6d2010ae 222 stats, CTLFLAG_RD | CTLFLAG_LOCKED, &ipsec6stat, ipsecstat, "");
1c79356b 223SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY,
6d2010ae 224 def_policy, CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_def_policy.policy, 0, "");
1c79356b 225SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
6d2010ae 226 CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_esp_trans_deflev, 0, "");
1c79356b 227SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
6d2010ae 228 CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_esp_net_deflev, 0, "");
1c79356b 229SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
6d2010ae 230 CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_ah_trans_deflev, 0, "");
1c79356b 231SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
6d2010ae 232 CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_ah_net_deflev, 0, "");
1c79356b 233SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN,
6d2010ae 234 ecn, CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_ipsec_ecn, 0, "");
1c79356b 235SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG,
6d2010ae 236 debug, CTLFLAG_RW | CTLFLAG_LOCKED, &ipsec_debug, 0, "");
9bccf70c 237SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD,
6d2010ae 238 esp_randpad, CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_esp_randpad, 0, "");
1c79356b
A		 239#endif /* INET6 */
240
39236c6e
A		 241static int ipsec_setspidx_interface(struct secpolicyindex *, u_int, struct mbuf *,
242 int, int, int);
91447636
A		 243static int ipsec_setspidx_mbuf(struct secpolicyindex *, u_int, u_int,
244 struct mbuf *, int);
245static int ipsec4_setspidx_inpcb(struct mbuf *, struct inpcb *pcb);
9bccf70c 246#if INET6
91447636 247static int ipsec6_setspidx_in6pcb(struct mbuf *, struct in6pcb *pcb);
9bccf70c 248#endif
39236c6e 249static int ipsec_setspidx(struct mbuf *, struct secpolicyindex *, int, int);
91447636
A		 250static void ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *, int);
251static int ipsec4_setspidx_ipaddr(struct mbuf *, struct secpolicyindex *);
1c79356b 252#if INET6
91447636
A		 253static void ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *, int);
254static int ipsec6_setspidx_ipaddr(struct mbuf *, struct secpolicyindex *);
1c79356b 255#endif
91447636
A		 256static struct inpcbpolicy *ipsec_newpcbpolicy(void);
257static void ipsec_delpcbpolicy(struct inpcbpolicy *);
258static struct secpolicy *ipsec_deepcopy_policy(struct secpolicy *src);
259static int ipsec_set_policy(struct secpolicy **pcb_sp,
fe8ab488 260 int optname, caddr_t request, size_t len, int priv);
91447636
A		 261static void vshiftl(unsigned char *, int, int);
262static int ipsec_in_reject(struct secpolicy *, struct mbuf *);
1c79356b 263#if INET6
2d21ac55 264static int ipsec64_encapsulate(struct mbuf *, struct secasvar *);
3e170ce0
A		 265static int ipsec6_update_routecache_and_output(struct ipsec_output_state *state, struct secasvar *sav);
266static int ipsec46_encapsulate(struct ipsec_output_state *state, struct secasvar *sav);
1c79356b 267#endif
2d21ac55
A		 268static struct ipsec_tag *ipsec_addaux(struct mbuf *);
269static struct ipsec_tag *ipsec_findaux(struct mbuf *);
270static void ipsec_optaux(struct mbuf *, struct ipsec_tag *);
b0d623f7 271int ipsec_send_natt_keepalive(struct secasvar *sav);
3e170ce0 272bool ipsec_fill_offload_frame(ifnet_t ifp, struct secasvar *sav, struct ifnet_keepalive_offload_frame *frame, size_t frame_data_offset);
9bccf70c
A		 273
274static int
275sysctl_def_policy SYSCTL_HANDLER_ARGS
276{
277 int old_policy = ip4_def_policy.policy;
278 int error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
279
b0d623f7
A		 280#pragma unused(arg1, arg2)
281
9bccf70c
A		 282 if (ip4_def_policy.policy != IPSEC_POLICY_NONE &&
283 ip4_def_policy.policy != IPSEC_POLICY_DISCARD) {
284 ip4_def_policy.policy = old_policy;
285 return EINVAL;
286 }
287
288 /* Turn off the bypass if the default security policy changes */
289 if (ipsec_bypass != 0 && ip4_def_policy.policy != IPSEC_POLICY_NONE)
290 ipsec_bypass = 0;
291
292 return error;
293}
1c79356b
A		 294
295/*
296 * For OUTBOUND packet having a socket. Searching SPD for packet,
297 * and return a pointer to SP.
298 * OUT: NULL: no apropreate SP found, the following value is set to error.
299 * 0 : bypass
300 * EACCES : discard packet.
301 * ENOENT : ipsec_acquire() in progress, maybe.
91447636 302 * others : error occurred.
1c79356b
A		 303 * others: a pointer to SP
304 *
305 * NOTE: IPv6 mapped adddress concern is implemented here.
306 */
307struct secpolicy *
fe8ab488
A		 308ipsec4_getpolicybysock(struct mbuf *m,
309 u_int dir,
310 struct socket *so,
311 int *error)
1c79356b
A		 312{
313 struct inpcbpolicy *pcbsp = NULL;
314 struct secpolicy *currsp = NULL; /* policy on socket */
315 struct secpolicy *kernsp = NULL; /* policy on kernel */
fe8ab488 316
5ba3f43e 317 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b
A		 318 /* sanity check */
319 if (m == NULL || so == NULL || error == NULL)
320 panic("ipsec4_getpolicybysock: NULL pointer was passed.\n");
fe8ab488
A		 321
322 if (so->so_pcb == NULL) {
323 printf("ipsec4_getpolicybysock: so->so_pcb == NULL\n");
324 return ipsec4_getpolicybyaddr(m, dir, 0, error);
325 }
9bccf70c 326
39236c6e 327 switch (SOCK_DOM(so)) {
fe8ab488
A		 328 case PF_INET:
329 pcbsp = sotoinpcb(so)->inp_sp;
330 break;
9bccf70c 331#if INET6
fe8ab488
A		 332 case PF_INET6:
333 pcbsp = sotoin6pcb(so)->in6p_sp;
334 break;
9bccf70c
A		 335#endif
336 }
337
338 if (!pcbsp){
339 /* Socket has not specified an IPSEC policy */
340 return ipsec4_getpolicybyaddr(m, dir, 0, error);
341 }
fe8ab488 342
55e303ae 343 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_START, 0,0,0,0,0);
fe8ab488 344
39236c6e 345 switch (SOCK_DOM(so)) {
fe8ab488
A		 346 case PF_INET:
347 /* set spidx in pcb */
348 *error = ipsec4_setspidx_inpcb(m, sotoinpcb(so));
349 break;
1c79356b 350#if INET6
fe8ab488
A		 351 case PF_INET6:
352 /* set spidx in pcb */
353 *error = ipsec6_setspidx_in6pcb(m, sotoin6pcb(so));
354 break;
1c79356b 355#endif
fe8ab488
A		 356 default:
357 panic("ipsec4_getpolicybysock: unsupported address family\n");
1c79356b 358 }
55e303ae
A		 359 if (*error) {
360 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 1,*error,0,0,0);
9bccf70c 361 return NULL;
55e303ae 362 }
fe8ab488 363
1c79356b
A		 364 /* sanity check */
365 if (pcbsp == NULL)
366 panic("ipsec4_getpolicybysock: pcbsp is NULL.\n");
fe8ab488
A		 367
368 switch (dir) {
369 case IPSEC_DIR_INBOUND:
370 currsp = pcbsp->sp_in;
371 break;
372 case IPSEC_DIR_OUTBOUND:
373 currsp = pcbsp->sp_out;
374 break;
375 default:
376 panic("ipsec4_getpolicybysock: illegal direction.\n");
377 }
378
1c79356b
A		 379 /* sanity check */
380 if (currsp == NULL)
381 panic("ipsec4_getpolicybysock: currsp is NULL.\n");
fe8ab488 382
1c79356b 383 /* when privilieged socket */
fe8ab488
A		 384 if (pcbsp->priv) {
385 switch (currsp->policy) {
386 case IPSEC_POLICY_BYPASS:
387 lck_mtx_lock(sadb_mutex);
388 currsp->refcnt++;
389 lck_mtx_unlock(sadb_mutex);
390 *error = 0;
391 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 2,*error,0,0,0);
392 return currsp;
393
394 case IPSEC_POLICY_ENTRUST:
395 /* look for a policy in SPD */
396 kernsp = key_allocsp(&currsp->spidx, dir);
397
398 /* SP found */
399 if (kernsp != NULL) {
400 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
401 printf("DP ipsec4_getpolicybysock called "
402 "to allocate SP:0x%llx\n",
403 (uint64_t)VM_KERNEL_ADDRPERM(kernsp)));
404 *error = 0;
405 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 3,*error,0,0,0);
406 return kernsp;
407 }
408
409 /* no SP found */
410 lck_mtx_lock(sadb_mutex);
411 if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
412 && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
413 ipseclog((LOG_INFO,
414 "fixed system default policy: %d->%d\n",
415 ip4_def_policy.policy, IPSEC_POLICY_NONE));
416 ip4_def_policy.policy = IPSEC_POLICY_NONE;
417 }
418 ip4_def_policy.refcnt++;
419 lck_mtx_unlock(sadb_mutex);
420 *error = 0;
421 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 4,*error,0,0,0);
422 return &ip4_def_policy;
423
424 case IPSEC_POLICY_IPSEC:
425 lck_mtx_lock(sadb_mutex);
426 currsp->refcnt++;
427 lck_mtx_unlock(sadb_mutex);
428 *error = 0;
429 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 5,*error,0,0,0);
430 return currsp;
431
432 default:
433 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
434 "Invalid policy for PCB %d\n", currsp->policy));
435 *error = EINVAL;
436 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 6,*error,0,0,0);
437 return NULL;
438 }
439 /* NOTREACHED */
440 }
441
442 /* when non-privilieged socket */
443 /* look for a policy in SPD */
444 kernsp = key_allocsp(&currsp->spidx, dir);
445
446 /* SP found */
447 if (kernsp != NULL) {
448 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
449 printf("DP ipsec4_getpolicybysock called "
450 "to allocate SP:0x%llx\n",
451 (uint64_t)VM_KERNEL_ADDRPERM(kernsp)));
452 *error = 0;
453 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 7,*error,0,0,0);
454 return kernsp;
455 }
456
457 /* no SP found */
458 switch (currsp->policy) {
1c79356b 459 case IPSEC_POLICY_BYPASS:
fe8ab488
A		 460 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
461 "Illegal policy for non-priviliged defined %d\n",
462 currsp->policy));
463 *error = EINVAL;
464 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 8,*error,0,0,0);
465 return NULL;
466
1c79356b 467 case IPSEC_POLICY_ENTRUST:
2d21ac55 468 lck_mtx_lock(sadb_mutex);
1c79356b 469 if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
fe8ab488 470 && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
1c79356b 471 ipseclog((LOG_INFO,
fe8ab488
A		 472 "fixed system default policy: %d->%d\n",
473 ip4_def_policy.policy, IPSEC_POLICY_NONE));
1c79356b
A		 474 ip4_def_policy.policy = IPSEC_POLICY_NONE;
475 }
476 ip4_def_policy.refcnt++;
2d21ac55 477 lck_mtx_unlock(sadb_mutex);
1c79356b 478 *error = 0;
fe8ab488 479 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 9,*error,0,0,0);
1c79356b
A		 480 return &ip4_def_policy;
481
482 case IPSEC_POLICY_IPSEC:
2d21ac55 483 lck_mtx_lock(sadb_mutex);
1c79356b 484 currsp->refcnt++;
2d21ac55 485 lck_mtx_unlock(sadb_mutex);
1c79356b 486 *error = 0;
fe8ab488 487 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 10,*error,0,0,0);
1c79356b 488 return currsp;
fe8ab488 489
1c79356b
A		 490 default:
491 ipseclog((LOG_ERR, "ipsec4_getpolicybysock: "
fe8ab488 492 "Invalid policy for PCB %d\n", currsp->policy));
1c79356b 493 *error = EINVAL;
fe8ab488 494 KERNEL_DEBUG(DBG_FNC_GETPOL_SOCK | DBG_FUNC_END, 11,*error,0,0,0);
1c79356b 495 return NULL;
1c79356b
A		 496 }
497 /* NOTREACHED */
498}
499
500/*
501 * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
502 * and return a pointer to SP.
503 * OUT: positive: a pointer to the entry for security policy leaf matched.
504 * NULL: no apropreate SP found, the following value is set to error.
505 * 0 : bypass
506 * EACCES : discard packet.
507 * ENOENT : ipsec_acquire() in progress, maybe.
91447636 508 * others : error occurred.
1c79356b
A		 509 */
510struct secpolicy *
39236c6e
A		 511ipsec4_getpolicybyaddr(struct mbuf *m,
512 u_int dir,
513 int flag,
514 int *error)
1c79356b
A		 515{
516 struct secpolicy *sp = NULL;
39236c6e 517
9bccf70c
A		 518 if (ipsec_bypass != 0)
519 return 0;
520
5ba3f43e 521 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
2d21ac55 522
1c79356b
A		 523 /* sanity check */
524 if (m == NULL || error == NULL)
525 panic("ipsec4_getpolicybyaddr: NULL pointer was passed.\n");
39236c6e
A		 526 {
527 struct secpolicyindex spidx;
1c79356b 528
39236c6e
A		 529 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_START, 0,0,0,0,0);
530 bzero(&spidx, sizeof(spidx));
1c79356b 531
39236c6e
A		 532 /* make a index to look for a policy */
533 *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET, m,
534 (flag & IP_FORWARDING) ? 0 : 1);
1c79356b 535
39236c6e
A		 536 if (*error != 0) {
537 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_END, 1,*error,0,0,0);
538 return NULL;
539 }
1c79356b 540
39236c6e 541 sp = key_allocsp(&spidx, dir);
55e303ae 542 }
1c79356b 543
1c79356b
A		 544 /* SP found */
545 if (sp != NULL) {
546 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
39236c6e
A		 547 printf("DP ipsec4_getpolicybyaddr called "
548 "to allocate SP:0x%llx\n",
549 (uint64_t)VM_KERNEL_ADDRPERM(sp)));
1c79356b 550 *error = 0;
55e303ae 551 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_END, 2,*error,0,0,0);
1c79356b
A		 552 return sp;
553 }
554
555 /* no SP found */
2d21ac55 556 lck_mtx_lock(sadb_mutex);
1c79356b
A		 557 if (ip4_def_policy.policy != IPSEC_POLICY_DISCARD
558 && ip4_def_policy.policy != IPSEC_POLICY_NONE) {
559 ipseclog((LOG_INFO, "fixed system default policy:%d->%d\n",
560 ip4_def_policy.policy,
561 IPSEC_POLICY_NONE));
562 ip4_def_policy.policy = IPSEC_POLICY_NONE;
563 }
564 ip4_def_policy.refcnt++;
2d21ac55 565 lck_mtx_unlock(sadb_mutex);
1c79356b 566 *error = 0;
55e303ae 567 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_END, 3,*error,0,0,0);
1c79356b
A		 568 return &ip4_def_policy;
569}
570
39236c6e
A		 571/* Match with bound interface rather than src addr.
572 * Unlike getpolicybyaddr, do not set the default policy.
573 * Return 0 if should continue processing, or -1 if packet
574 * should be dropped.
575 */
576int
577ipsec4_getpolicybyinterface(struct mbuf *m,
578 u_int dir,
579 int *flags,
580 struct ip_out_args *ipoa,
581 struct secpolicy **sp)
582{
583 struct secpolicyindex spidx;
584 int error = 0;
585
586 if (ipsec_bypass != 0)
587 return 0;
588
589 /* Sanity check */
590 if (m == NULL || ipoa == NULL || sp == NULL)
591 panic("ipsec4_getpolicybyinterface: NULL pointer was passed.\n");
592
593 if (ipoa->ipoa_boundif == IFSCOPE_NONE)
594 return 0;
595
596 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_START, 0,0,0,0,0);
597 bzero(&spidx, sizeof(spidx));
598
599 /* make a index to look for a policy */
600 error = ipsec_setspidx_interface(&spidx, dir, m, (*flags & IP_FORWARDING) ? 0 : 1,
601 ipoa->ipoa_boundif, 4);
602
603 if (error != 0) {
604 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_END, 1,error,0,0,0);
605 return 0;
606 }
607
608 *sp = key_allocsp(&spidx, dir);
609
610 /* Return SP, whether NULL or not */
611 if (*sp != NULL && (*sp)->policy == IPSEC_POLICY_IPSEC) {
612 if ((*sp)->ipsec_if == NULL) {
613 /* Invalid to capture on an interface without redirect */
614 key_freesp(*sp, KEY_SADB_UNLOCKED);
615 *sp = NULL;
616 return -1;
617 } else if ((*sp)->disabled) {
618 /* Disabled policies go in the clear */
619 key_freesp(*sp, KEY_SADB_UNLOCKED);
620 *sp = NULL;
621 *flags |= IP_NOIPSEC; /* Avoid later IPSec check */
622 } else {
623 /* If policy is enabled, redirect to ipsec interface */
624 ipoa->ipoa_boundif = (*sp)->ipsec_if->if_index;
625 }
626 }
627
628 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_END, 2,error,0,0,0);
629
630 return 0;
631}
632
633
1c79356b
A		 634#if INET6
635/*
636 * For OUTBOUND packet having a socket. Searching SPD for packet,
637 * and return a pointer to SP.
638 * OUT: NULL: no apropreate SP found, the following value is set to error.
639 * 0 : bypass
640 * EACCES : discard packet.
641 * ENOENT : ipsec_acquire() in progress, maybe.
91447636 642 * others : error occurred.
1c79356b
A		 643 * others: a pointer to SP
644 */
645struct secpolicy *
fe8ab488
A		 646ipsec6_getpolicybysock(struct mbuf *m,
647 u_int dir,
648 struct socket *so,
649 int *error)
1c79356b
A		 650{
651 struct inpcbpolicy *pcbsp = NULL;
652 struct secpolicy *currsp = NULL; /* policy on socket */
653 struct secpolicy *kernsp = NULL; /* policy on kernel */
fe8ab488 654
5ba3f43e 655 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
2d21ac55 656
1c79356b
A		 657 /* sanity check */
658 if (m == NULL || so == NULL || error == NULL)
659 panic("ipsec6_getpolicybysock: NULL pointer was passed.\n");
fe8ab488 660
9bccf70c 661#if DIAGNOSTIC
fe8ab488
A		 662 if (SOCK_DOM(so) != PF_INET6)
663 panic("ipsec6_getpolicybysock: socket domain != inet6\n");
9bccf70c 664#endif
fe8ab488
A		 665
666 pcbsp = sotoin6pcb(so)->in6p_sp;
667
668 if (!pcbsp){
669 return ipsec6_getpolicybyaddr(m, dir, 0, error);
670 }
9bccf70c 671
9bccf70c
A		 672 /* set spidx in pcb */
673 ipsec6_setspidx_in6pcb(m, sotoin6pcb(so));
fe8ab488 674
1c79356b
A		 675 /* sanity check */
676 if (pcbsp == NULL)
677 panic("ipsec6_getpolicybysock: pcbsp is NULL.\n");
fe8ab488
A		 678
679 switch (dir) {
680 case IPSEC_DIR_INBOUND:
681 currsp = pcbsp->sp_in;
682 break;
683 case IPSEC_DIR_OUTBOUND:
684 currsp = pcbsp->sp_out;
685 break;
686 default:
687 panic("ipsec6_getpolicybysock: illegal direction.\n");
688 }
689
1c79356b
A		 690 /* sanity check */
691 if (currsp == NULL)
692 panic("ipsec6_getpolicybysock: currsp is NULL.\n");
fe8ab488 693
1c79356b 694 /* when privilieged socket */
fe8ab488
A		 695 if (pcbsp->priv) {
696 switch (currsp->policy) {
697 case IPSEC_POLICY_BYPASS:
698 lck_mtx_lock(sadb_mutex);
699 currsp->refcnt++;
700 lck_mtx_unlock(sadb_mutex);
701 *error = 0;
702 return currsp;
703
704 case IPSEC_POLICY_ENTRUST:
705 /* look for a policy in SPD */
706 kernsp = key_allocsp(&currsp->spidx, dir);
707
708 /* SP found */
709 if (kernsp != NULL) {
710 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
711 printf("DP ipsec6_getpolicybysock called "
712 "to allocate SP:0x%llx\n",
713 (uint64_t)VM_KERNEL_ADDRPERM(kernsp)));
714 *error = 0;
715 return kernsp;
716 }
717
718 /* no SP found */
719 lck_mtx_lock(sadb_mutex);
720 if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
721 && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
722 ipseclog((LOG_INFO,
723 "fixed system default policy: %d->%d\n",
724 ip6_def_policy.policy, IPSEC_POLICY_NONE));
725 ip6_def_policy.policy = IPSEC_POLICY_NONE;
726 }
727 ip6_def_policy.refcnt++;
728 lck_mtx_unlock(sadb_mutex);
729 *error = 0;
730 return &ip6_def_policy;
731
732 case IPSEC_POLICY_IPSEC:
733 lck_mtx_lock(sadb_mutex);
734 currsp->refcnt++;
735 lck_mtx_unlock(sadb_mutex);
736 *error = 0;
737 return currsp;
738
739 default:
740 ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
741 "Invalid policy for PCB %d\n", currsp->policy));
742 *error = EINVAL;
743 return NULL;
744 }
745 /* NOTREACHED */
746 }
747
748 /* when non-privilieged socket */
749 /* look for a policy in SPD */
750 kernsp = key_allocsp(&currsp->spidx, dir);
751
752 /* SP found */
753 if (kernsp != NULL) {
754 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
755 printf("DP ipsec6_getpolicybysock called "
756 "to allocate SP:0x%llx\n",
757 (uint64_t)VM_KERNEL_ADDRPERM(kernsp)));
758 *error = 0;
759 return kernsp;
760 }
761
762 /* no SP found */
763 switch (currsp->policy) {
1c79356b 764 case IPSEC_POLICY_BYPASS:
fe8ab488
A		 765 ipseclog((LOG_ERR, "ipsec6_getpolicybysock: "
766 "Illegal policy for non-priviliged defined %d\n",
767 currsp->policy));
768 *error = EINVAL;
769 return NULL;
770
1c79356b 771 case IPSEC_POLICY_ENTRUST:
2d21ac55 772 lck_mtx_lock(sadb_mutex);
1c79356b 773 if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
fe8ab488 774 && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
1c79356b 775 ipseclog((LOG_INFO,
fe8ab488
A		 776 "fixed system default policy: %d->%d\n",
777 ip6_def_policy.policy, IPSEC_POLICY_NONE));
1c79356b
A		 778 ip6_def_policy.policy = IPSEC_POLICY_NONE;
779 }
780 ip6_def_policy.refcnt++;
2d21ac55 781 lck_mtx_unlock(sadb_mutex);
1c79356b
A		 782 *error = 0;
783 return &ip6_def_policy;
784
785 case IPSEC_POLICY_IPSEC:
2d21ac55 786 lck_mtx_lock(sadb_mutex);
1c79356b 787 currsp->refcnt++;
2d21ac55 788 lck_mtx_unlock(sadb_mutex);
1c79356b
A		 789 *error = 0;
790 return currsp;
fe8ab488 791
1c79356b 792 default:
fe8ab488
A		 793 ipseclog((LOG_ERR,
794 "ipsec6_policybysock: Invalid policy for PCB %d\n",
795 currsp->policy));
1c79356b
A		 796 *error = EINVAL;
797 return NULL;
1c79356b
A		 798 }
799 /* NOTREACHED */
800}
801
802/*
803 * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
804 * and return a pointer to SP.
805 * `flag' means that packet is to be forwarded whether or not.
806 * flag = 1: forwad
807 * OUT: positive: a pointer to the entry for security policy leaf matched.
808 * NULL: no apropreate SP found, the following value is set to error.
809 * 0 : bypass
810 * EACCES : discard packet.
811 * ENOENT : ipsec_acquire() in progress, maybe.
91447636 812 * others : error occurred.
1c79356b
A		 813 */
814#ifndef IP_FORWARDING
815#define IP_FORWARDING 1
816#endif
817
818struct secpolicy *
39236c6e
A		 819ipsec6_getpolicybyaddr(struct mbuf *m,
820 u_int dir,
821 int flag,
822 int *error)
1c79356b
A		 823{
824 struct secpolicy *sp = NULL;
825
5ba3f43e 826 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
2d21ac55 827
1c79356b
A		 828 /* sanity check */
829 if (m == NULL || error == NULL)
830 panic("ipsec6_getpolicybyaddr: NULL pointer was passed.\n");
831
832 {
833 struct secpolicyindex spidx;
834
835 bzero(&spidx, sizeof(spidx));
836
837 /* make a index to look for a policy */
9bccf70c
A		 838 *error = ipsec_setspidx_mbuf(&spidx, dir, AF_INET6, m,
839 (flag & IP_FORWARDING) ? 0 : 1);
1c79356b
A		 840
841 if (*error != 0)
842 return NULL;
843
844 sp = key_allocsp(&spidx, dir);
845 }
846
847 /* SP found */
848 if (sp != NULL) {
849 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
39236c6e
A		 850 printf("DP ipsec6_getpolicybyaddr called "
851 "to allocate SP:0x%llx\n",
852 (uint64_t)VM_KERNEL_ADDRPERM(sp)));
1c79356b
A		 853 *error = 0;
854 return sp;
855 }
856
857 /* no SP found */
2d21ac55 858 lck_mtx_lock(sadb_mutex);
1c79356b
A		 859 if (ip6_def_policy.policy != IPSEC_POLICY_DISCARD
860 && ip6_def_policy.policy != IPSEC_POLICY_NONE) {
861 ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n",
862 ip6_def_policy.policy, IPSEC_POLICY_NONE));
863 ip6_def_policy.policy = IPSEC_POLICY_NONE;
864 }
865 ip6_def_policy.refcnt++;
2d21ac55 866 lck_mtx_unlock(sadb_mutex);
1c79356b
A		 867 *error = 0;
868 return &ip6_def_policy;
869}
39236c6e
A		 870
871/* Match with bound interface rather than src addr.
872 * Unlike getpolicybyaddr, do not set the default policy.
873 * Return 0 if should continue processing, or -1 if packet
874 * should be dropped.
875 */
876int
877ipsec6_getpolicybyinterface(struct mbuf *m,
878 u_int dir,
879 int flag,
880 struct ip6_out_args *ip6oap,
881 int *noipsec,
882 struct secpolicy **sp)
883{
884 struct secpolicyindex spidx;
885 int error = 0;
886
887 if (ipsec_bypass != 0)
888 return 0;
889
890 /* Sanity check */
891 if (m == NULL || sp == NULL || noipsec == NULL || ip6oap == NULL)
892 panic("ipsec6_getpolicybyinterface: NULL pointer was passed.\n");
893
894 *noipsec = 0;
895
896 if (ip6oap->ip6oa_boundif == IFSCOPE_NONE)
897 return 0;
898
899 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_START, 0,0,0,0,0);
900 bzero(&spidx, sizeof(spidx));
901
902 /* make a index to look for a policy */
903 error = ipsec_setspidx_interface(&spidx, dir, m, (flag & IP_FORWARDING) ? 0 : 1,
904 ip6oap->ip6oa_boundif, 6);
905
906 if (error != 0) {
907 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_END, 1,error,0,0,0);
908 return 0;
909 }
910
911 *sp = key_allocsp(&spidx, dir);
912
913 /* Return SP, whether NULL or not */
914 if (*sp != NULL && (*sp)->policy == IPSEC_POLICY_IPSEC) {
915 if ((*sp)->ipsec_if == NULL) {
916 /* Invalid to capture on an interface without redirect */
917 key_freesp(*sp, KEY_SADB_UNLOCKED);
918 *sp = NULL;
919 return -1;
920 } else if ((*sp)->disabled) {
921 /* Disabled policies go in the clear */
922 key_freesp(*sp, KEY_SADB_UNLOCKED);
923 *sp = NULL;
924 *noipsec = 1; /* Avoid later IPSec check */
925 } else {
926 /* If policy is enabled, redirect to ipsec interface */
927 ip6oap->ip6oa_boundif = (*sp)->ipsec_if->if_index;
928 }
929 }
930
931 KERNEL_DEBUG(DBG_FNC_GETPOL_ADDR | DBG_FUNC_END, 2,*error,0,0,0);
932
933 return 0;
934}
1c79356b
A		 935#endif /* INET6 */
936
937/*
938 * set IP address into spidx from mbuf.
939 * When Forwarding packet and ICMP echo reply, this function is used.
940 *
941 * IN: get the followings from mbuf.
942 * protocol family, src, dst, next protocol
943 * OUT:
944 * 0: success.
945 * other: failure, and set errno.
946 */
39236c6e 947static int
2d21ac55
A		 948ipsec_setspidx_mbuf(
949 struct secpolicyindex *spidx,
950 u_int dir,
951 __unused u_int family,
952 struct mbuf *m,
953 int needport)
1c79356b 954{
9bccf70c 955 int error;
1c79356b
A		 956
957 /* sanity check */
958 if (spidx == NULL || m == NULL)
959 panic("ipsec_setspidx_mbuf: NULL pointer was passed.\n");
960
1c79356b
A		 961 bzero(spidx, sizeof(*spidx));
962
39236c6e 963 error = ipsec_setspidx(m, spidx, needport, 0);
9bccf70c
A		 964 if (error)
965 goto bad;
1c79356b 966 spidx->dir = dir;
1c79356b 967
9bccf70c 968 return 0;
1c79356b 969
9bccf70c
A		 970 bad:
971 /* XXX initialize */
972 bzero(spidx, sizeof(*spidx));
973 return EINVAL;
974}
1c79356b 975
39236c6e
A		 976static int
977ipsec_setspidx_interface(
978 struct secpolicyindex *spidx,
979 u_int dir,
980 struct mbuf *m,
981 int needport,
982 int ifindex,
983 int ip_version)
984{
985 int error;
986
987 /* sanity check */
988 if (spidx == NULL || m == NULL)
989 panic("ipsec_setspidx_interface: NULL pointer was passed.\n");
990
991 bzero(spidx, sizeof(*spidx));
992
993 error = ipsec_setspidx(m, spidx, needport, ip_version);
994 if (error)
995 goto bad;
996 spidx->dir = dir;
997
998 if (ifindex != 0) {
999 ifnet_head_lock_shared();
1000 spidx->internal_if = ifindex2ifnet[ifindex];
1001 ifnet_head_done();
1002 } else {
1003 spidx->internal_if = NULL;
1004 }
1005
1006 return 0;
1007
1008bad:
1009 return EINVAL;
1010}
1011
9bccf70c 1012static int
39037602 1013ipsec4_setspidx_inpcb(struct mbuf *m, struct inpcb *pcb)
9bccf70c
A		 1014{
1015 struct secpolicyindex *spidx;
1016 int error;
fe8ab488 1017
9bccf70c
A		 1018 if (ipsec_bypass != 0)
1019 return 0;
fe8ab488 1020
9bccf70c
A		 1021 /* sanity check */
1022 if (pcb == NULL)
1023 panic("ipsec4_setspidx_inpcb: no PCB found.\n");
fe8ab488
A		 1024 if (pcb->inp_sp == NULL)
1025 panic("ipsec4_setspidx_inpcb: no inp_sp found.\n");
1026 if (pcb->inp_sp->sp_out == NULL || pcb->inp_sp->sp_in == NULL)
1027 panic("ipsec4_setspidx_inpcb: no sp_in/out found.\n");
1028
1029 bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
1030 bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
1031
1032 spidx = &pcb->inp_sp->sp_in->spidx;
1033 error = ipsec_setspidx(m, spidx, 1, 0);
1034 if (error)
1035 goto bad;
9bccf70c 1036 spidx->dir = IPSEC_DIR_INBOUND;
fe8ab488 1037
9bccf70c 1038 spidx = &pcb->inp_sp->sp_out->spidx;
39236c6e 1039 error = ipsec_setspidx(m, spidx, 1, 0);
9bccf70c
A		 1040 if (error)
1041 goto bad;
1042 spidx->dir = IPSEC_DIR_OUTBOUND;
fe8ab488 1043
9bccf70c 1044 return 0;
fe8ab488 1045
9bccf70c
A		 1046bad:
1047 bzero(&pcb->inp_sp->sp_in->spidx, sizeof(*spidx));
1048 bzero(&pcb->inp_sp->sp_out->spidx, sizeof(*spidx));
1049 return error;
1050}
1c79356b 1051
9bccf70c
A		 1052#if INET6
1053static int
39037602 1054ipsec6_setspidx_in6pcb(struct mbuf *m, struct in6pcb *pcb)
9bccf70c
A		 1055{
1056 struct secpolicyindex *spidx;
1057 int error;
fe8ab488 1058
9bccf70c
A		 1059 /* sanity check */
1060 if (pcb == NULL)
1061 panic("ipsec6_setspidx_in6pcb: no PCB found.\n");
fe8ab488
A		 1062 if (pcb->in6p_sp == NULL)
1063 panic("ipsec6_setspidx_in6pcb: no in6p_sp found.\n");
1064 if (pcb->in6p_sp->sp_out == NULL || pcb->in6p_sp->sp_in == NULL)
1065 panic("ipsec6_setspidx_in6pcb: no sp_in/out found.\n");
1066
1067 bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
1068 bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
1069
1070 spidx = &pcb->in6p_sp->sp_in->spidx;
1071 error = ipsec_setspidx(m, spidx, 1, 0);
1072 if (error)
1073 goto bad;
1074 spidx->dir = IPSEC_DIR_INBOUND;
1075
1076 spidx = &pcb->in6p_sp->sp_out->spidx;
39236c6e 1077 error = ipsec_setspidx(m, spidx, 1, 0);
55e303ae
A		 1078 if (error)
1079 goto bad;
1080 spidx->dir = IPSEC_DIR_OUTBOUND;
fe8ab488 1081
1c79356b 1082 return 0;
fe8ab488 1083
9bccf70c
A		 1084bad:
1085 bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
1086 bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
1087 return error;
1c79356b 1088}
9bccf70c 1089#endif
1c79356b 1090
1c79356b 1091/*
9bccf70c
A		 1092 * configure security policy index (src/dst/proto/sport/dport)
1093 * by looking at the content of mbuf.
1094 * the caller is responsible for error recovery (like clearing up spidx).
1c79356b 1095 */
9bccf70c 1096static int
39236c6e
A		 1097ipsec_setspidx(struct mbuf *m,
1098 struct secpolicyindex *spidx,
1099 int needport,
1100 int force_ip_version)
1c79356b 1101{
9bccf70c
A		 1102 struct ip *ip = NULL;
1103 struct ip ipbuf;
1104 u_int v;
1105 struct mbuf *n;
1106 int len;
1107 int error;
39236c6e 1108
1c79356b 1109 if (m == NULL)
9bccf70c 1110 panic("ipsec_setspidx: m == 0 passed.\n");
39236c6e 1111
9bccf70c
A		 1112 /*
1113 * validate m->m_pkthdr.len. we see incorrect length if we
1114 * mistakenly call this function with inconsistent mbuf chain
1115 * (like 4.4BSD tcp/udp processing). XXX should we panic here?
1116 */
1117 len = 0;
1118 for (n = m; n; n = n->m_next)
1119 len += n->m_len;
1120 if (m->m_pkthdr.len != len) {
1121 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1122 printf("ipsec_setspidx: "
1123 "total of m_len(%d) != pkthdr.len(%d), "
1124 "ignored.\n",
1125 len, m->m_pkthdr.len));
1126 return EINVAL;
1127 }
1c79356b 1128
9bccf70c
A		 1129 if (m->m_pkthdr.len < sizeof(struct ip)) {
1130 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1131 printf("ipsec_setspidx: "
1132 "pkthdr.len(%d) < sizeof(struct ip), ignored.\n",
1133 m->m_pkthdr.len));
1134 return EINVAL;
1135 }
1c79356b 1136
9bccf70c
A		 1137 if (m->m_len >= sizeof(*ip))
1138 ip = mtod(m, struct ip *);
1139 else {
1140 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
1141 ip = &ipbuf;
1142 }
39236c6e
A		 1143
1144 if (force_ip_version) {
1145 v = force_ip_version;
1146 } else {
9bccf70c 1147#ifdef _IP_VHL
39236c6e 1148 v = _IP_VHL_V(ip->ip_vhl);
9bccf70c 1149#else
39236c6e 1150 v = ip->ip_v;
9bccf70c 1151#endif
39236c6e 1152 }
9bccf70c
A		 1153 switch (v) {
1154 case 4:
1155 error = ipsec4_setspidx_ipaddr(m, spidx);
1156 if (error)
1157 return error;
1158 ipsec4_get_ulp(m, spidx, needport);
1159 return 0;
2d21ac55 1160#if INET6
9bccf70c
A		 1161 case 6:
1162 if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) {
1163 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1164 printf("ipsec_setspidx: "
1165 "pkthdr.len(%d) < sizeof(struct ip6_hdr), "
1166 "ignored.\n", m->m_pkthdr.len));
1167 return EINVAL;
1c79356b 1168 }
9bccf70c
A		 1169 error = ipsec6_setspidx_ipaddr(m, spidx);
1170 if (error)
1171 return error;
1172 ipsec6_get_ulp(m, spidx, needport);
1173 return 0;
1174#endif
1c79356b 1175 default:
9bccf70c
A		 1176 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1177 printf("ipsec_setspidx: "
1178 "unknown IP version %u, ignored.\n", v));
1179 return EINVAL;
1c79356b
A		 1180 }
1181}
1c79356b
A		 1182
1183static void
39037602 1184ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
9bccf70c
A		 1185{
1186 struct ip ip;
1187 struct ip6_ext ip6e;
1188 u_int8_t nxt;
1189 int off;
1190 struct tcphdr th;
1191 struct udphdr uh;
1c79356b
A		 1192
1193 /* sanity check */
9bccf70c
A		 1194 if (m == NULL)
1195 panic("ipsec4_get_ulp: NULL pointer was passed.\n");
1196 if (m->m_pkthdr.len < sizeof(ip))
1197 panic("ipsec4_get_ulp: too short\n");
1c79356b 1198
9bccf70c
A		 1199 /* set default */
1200 spidx->ul_proto = IPSEC_ULPROTO_ANY;
1201 ((struct sockaddr_in *)&spidx->src)->sin_port = IPSEC_PORT_ANY;
1202 ((struct sockaddr_in *)&spidx->dst)->sin_port = IPSEC_PORT_ANY;
1c79356b 1203
9bccf70c
A		 1204 m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
1205 /* ip_input() flips it into host endian XXX need more checking */
1206 if (ip.ip_off & (IP_MF | IP_OFFMASK))
1207 return;
1c79356b 1208
9bccf70c
A		 1209 nxt = ip.ip_p;
1210#ifdef _IP_VHL
1211 off = _IP_VHL_HL(ip->ip_vhl) << 2;
1212#else
1213 off = ip.ip_hl << 2;
1214#endif
1215 while (off < m->m_pkthdr.len) {
1216 switch (nxt) {
1217 case IPPROTO_TCP:
1218 spidx->ul_proto = nxt;
1219 if (!needport)
1220 return;
1221 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
1222 return;
1223 m_copydata(m, off, sizeof(th), (caddr_t)&th);
1224 ((struct sockaddr_in *)&spidx->src)->sin_port =
1225 th.th_sport;
1226 ((struct sockaddr_in *)&spidx->dst)->sin_port =
1227 th.th_dport;
1228 return;
1229 case IPPROTO_UDP:
1230 spidx->ul_proto = nxt;
1231 if (!needport)
1232 return;
1233 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
1234 return;
1235 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
1236 ((struct sockaddr_in *)&spidx->src)->sin_port =
1237 uh.uh_sport;
1238 ((struct sockaddr_in *)&spidx->dst)->sin_port =
1239 uh.uh_dport;
1240 return;
1241 case IPPROTO_AH:
91447636 1242 if (off + sizeof(ip6e) > m->m_pkthdr.len)
9bccf70c
A		 1243 return;
1244 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
1245 off += (ip6e.ip6e_len + 2) << 2;
1246 nxt = ip6e.ip6e_nxt;
1247 break;
1248 case IPPROTO_ICMP:
1249 default:
1250 /* XXX intermediate headers??? */
1251 spidx->ul_proto = nxt;
1252 return;
1253 }
1254 }
1c79356b
A		 1255}
1256
9bccf70c
A		 1257/* assumes that m is sane */
1258static int
39037602 1259ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
1c79356b
A		 1260{
1261 struct ip *ip = NULL;
1262 struct ip ipbuf;
9bccf70c 1263 struct sockaddr_in *sin;
1c79356b 1264
9bccf70c 1265 if (m->m_len >= sizeof(*ip))
1c79356b
A		 1266 ip = mtod(m, struct ip *);
1267 else {
1268 m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
1269 ip = &ipbuf;
1270 }
1271
9bccf70c
A		 1272 sin = (struct sockaddr_in *)&spidx->src;
1273 bzero(sin, sizeof(*sin));
1274 sin->sin_family = AF_INET;
1275 sin->sin_len = sizeof(struct sockaddr_in);
1276 bcopy(&ip->ip_src, &sin->sin_addr, sizeof(ip->ip_src));
1277 spidx->prefs = sizeof(struct in_addr) << 3;
1c79356b 1278
9bccf70c
A		 1279 sin = (struct sockaddr_in *)&spidx->dst;
1280 bzero(sin, sizeof(*sin));
1281 sin->sin_family = AF_INET;
1282 sin->sin_len = sizeof(struct sockaddr_in);
1283 bcopy(&ip->ip_dst, &sin->sin_addr, sizeof(ip->ip_dst));
1284 spidx->prefd = sizeof(struct in_addr) << 3;
39236c6e 1285
9bccf70c 1286 return 0;
1c79356b
A		 1287}
1288
1289#if INET6
1290static void
fe8ab488
A		 1291ipsec6_get_ulp(struct mbuf *m,
1292 struct secpolicyindex *spidx,
1293 int needport)
9bccf70c
A		 1294{
1295 int off, nxt;
1296 struct tcphdr th;
1297 struct udphdr uh;
1c79356b
A		 1298
1299 /* sanity check */
9bccf70c
A		 1300 if (m == NULL)
1301 panic("ipsec6_get_ulp: NULL pointer was passed.\n");
1c79356b 1302
9bccf70c
A		 1303 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1304 printf("ipsec6_get_ulp:\n"); kdebug_mbuf(m));
1c79356b 1305
9bccf70c
A		 1306 /* set default */
1307 spidx->ul_proto = IPSEC_ULPROTO_ANY;
1308 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY;
1309 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY;
1c79356b 1310
9bccf70c
A		 1311 nxt = -1;
1312 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
1313 if (off < 0 || m->m_pkthdr.len < off)
1314 return;
1315
1316 switch (nxt) {
1317 case IPPROTO_TCP:
1318 spidx->ul_proto = nxt;
1319 if (!needport)
1320 break;
1321 if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
1322 break;
1323 m_copydata(m, off, sizeof(th), (caddr_t)&th);
1324 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport;
1325 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport;
1326 break;
1327 case IPPROTO_UDP:
1328 spidx->ul_proto = nxt;
1329 if (!needport)
1330 break;
1331 if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
1332 break;
1333 m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
1334 ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport;
1335 ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport;
1336 break;
1337 case IPPROTO_ICMPV6:
1338 default:
1339 /* XXX intermediate headers??? */
1340 spidx->ul_proto = nxt;
1341 break;
1342 }
1c79356b
A		 1343}
1344
9bccf70c
A		 1345/* assumes that m is sane */
1346static int
fe8ab488
A		 1347ipsec6_setspidx_ipaddr(struct mbuf *m,
1348 struct secpolicyindex *spidx)
1c79356b
A		 1349{
1350 struct ip6_hdr *ip6 = NULL;
1351 struct ip6_hdr ip6buf;
9bccf70c 1352 struct sockaddr_in6 *sin6;
1c79356b
A		 1353
1354 if (m->m_len >= sizeof(*ip6))
1355 ip6 = mtod(m, struct ip6_hdr *);
1356 else {
1357 m_copydata(m, 0, sizeof(ip6buf), (caddr_t)&ip6buf);
1358 ip6 = &ip6buf;
1359 }
1360
9bccf70c
A		 1361 sin6 = (struct sockaddr_in6 *)&spidx->src;
1362 bzero(sin6, sizeof(*sin6));
1363 sin6->sin6_family = AF_INET6;
1364 sin6->sin6_len = sizeof(struct sockaddr_in6);
1365 bcopy(&ip6->ip6_src, &sin6->sin6_addr, sizeof(ip6->ip6_src));
1366 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
1367 sin6->sin6_addr.s6_addr16[1] = 0;
1368 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
1c79356b 1369 }
9bccf70c 1370 spidx->prefs = sizeof(struct in6_addr) << 3;
1c79356b 1371
9bccf70c
A		 1372 sin6 = (struct sockaddr_in6 *)&spidx->dst;
1373 bzero(sin6, sizeof(*sin6));
1374 sin6->sin6_family = AF_INET6;
1375 sin6->sin6_len = sizeof(struct sockaddr_in6);
1376 bcopy(&ip6->ip6_dst, &sin6->sin6_addr, sizeof(ip6->ip6_dst));
1377 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
1378 sin6->sin6_addr.s6_addr16[1] = 0;
1379 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
1380 }
1381 spidx->prefd = sizeof(struct in6_addr) << 3;
1c79356b 1382
9bccf70c 1383 return 0;
1c79356b
A		 1384}
1385#endif
1386
1387static struct inpcbpolicy *
39037602 1388ipsec_newpcbpolicy(void)
1c79356b
A		 1389{
1390 struct inpcbpolicy *p;
fe8ab488 1391
0b4e3aa0 1392 p = (struct inpcbpolicy *)_MALLOC(sizeof(*p), M_SECA, M_WAITOK);
1c79356b
A		 1393 return p;
1394}
1395
1396static void
fe8ab488 1397ipsec_delpcbpolicy(struct inpcbpolicy *p)
1c79356b 1398{
9bccf70c 1399 FREE(p, M_SECA);
1c79356b
A		 1400}
1401
1402/* initialize policy in PCB */
1403int
fe8ab488
A		 1404ipsec_init_policy(struct socket *so,
1405 struct inpcbpolicy **pcb_sp)
1c79356b
A		 1406{
1407 struct inpcbpolicy *new;
fe8ab488 1408
1c79356b
A		 1409 /* sanity check. */
1410 if (so == NULL || pcb_sp == NULL)
1411 panic("ipsec_init_policy: NULL pointer was passed.\n");
fe8ab488
A		 1412
1413 new = ipsec_newpcbpolicy();
1414 if (new == NULL) {
1415 ipseclog((LOG_DEBUG, "ipsec_init_policy: No more memory.\n"));
1416 return ENOBUFS;
1417 }
9bccf70c 1418 bzero(new, sizeof(*new));
fe8ab488 1419
9bccf70c 1420#ifdef __APPLE__
316670eb 1421 if (kauth_cred_issuser(so->so_cred))
9bccf70c 1422#else
fe8ab488 1423 if (so->so_cred != 0 && !suser(so->so_cred->pc_ucred, NULL))
9bccf70c 1424#endif
fe8ab488
A		 1425 new->priv = 1;
1426 else
1427 new->priv = 0;
1428
1429 if ((new->sp_in = key_newsp()) == NULL) {
1430 ipsec_delpcbpolicy(new);
1431 return ENOBUFS;
1432 }
1c79356b
A		 1433 new->sp_in->state = IPSEC_SPSTATE_ALIVE;
1434 new->sp_in->policy = IPSEC_POLICY_ENTRUST;
fe8ab488 1435
1c79356b 1436 if ((new->sp_out = key_newsp()) == NULL) {
2d21ac55 1437 key_freesp(new->sp_in, KEY_SADB_UNLOCKED);
1c79356b
A		 1438 ipsec_delpcbpolicy(new);
1439 return ENOBUFS;
1440 }
1441 new->sp_out->state = IPSEC_SPSTATE_ALIVE;
1442 new->sp_out->policy = IPSEC_POLICY_ENTRUST;
fe8ab488 1443
1c79356b 1444 *pcb_sp = new;
fe8ab488 1445
1c79356b
A		 1446 return 0;
1447}
1448
1449/* copy old ipsec policy into new */
1450int
fe8ab488
A		 1451ipsec_copy_policy(struct inpcbpolicy *old,
1452 struct inpcbpolicy *new)
1c79356b
A		 1453{
1454 struct secpolicy *sp;
fe8ab488 1455
9bccf70c
A		 1456 if (ipsec_bypass != 0)
1457 return 0;
fe8ab488 1458
1c79356b
A		 1459 sp = ipsec_deepcopy_policy(old->sp_in);
1460 if (sp) {
2d21ac55 1461 key_freesp(new->sp_in, KEY_SADB_UNLOCKED);
1c79356b
A		 1462 new->sp_in = sp;
1463 } else
1464 return ENOBUFS;
fe8ab488 1465
1c79356b
A		 1466 sp = ipsec_deepcopy_policy(old->sp_out);
1467 if (sp) {
2d21ac55 1468 key_freesp(new->sp_out, KEY_SADB_UNLOCKED);
1c79356b
A		 1469 new->sp_out = sp;
1470 } else
1471 return ENOBUFS;
fe8ab488 1472
1c79356b 1473 new->priv = old->priv;
fe8ab488 1474
1c79356b
A		 1475 return 0;
1476}
1477
1478/* deep-copy a policy in PCB */
1479static struct secpolicy *
fe8ab488 1480ipsec_deepcopy_policy(struct secpolicy *src)
1c79356b
A		 1481{
1482 struct ipsecrequest *newchain = NULL;
1483 struct ipsecrequest *p;
1484 struct ipsecrequest **q;
1485 struct ipsecrequest *r;
1486 struct secpolicy *dst;
fe8ab488 1487
2d21ac55
A		 1488 if (src == NULL)
1489 return NULL;
1c79356b 1490 dst = key_newsp();
2d21ac55 1491 if (dst == NULL)
1c79356b 1492 return NULL;
fe8ab488 1493
1c79356b
A		 1494 /*
1495 * deep-copy IPsec request chain. This is required since struct
1496 * ipsecrequest is not reference counted.
1497 */
1498 q = &newchain;
1499 for (p = src->req; p; p = p->next) {
1500 *q = (struct ipsecrequest *)_MALLOC(sizeof(struct ipsecrequest),
3e170ce0 1501 M_SECA, M_WAITOK | M_ZERO);
1c79356b
A		 1502 if (*q == NULL)
1503 goto fail;
1c79356b 1504 (*q)->next = NULL;
fe8ab488 1505
1c79356b
A		 1506 (*q)->saidx.proto = p->saidx.proto;
1507 (*q)->saidx.mode = p->saidx.mode;
1508 (*q)->level = p->level;
1509 (*q)->saidx.reqid = p->saidx.reqid;
fe8ab488 1510
1c79356b
A		 1511 bcopy(&p->saidx.src, &(*q)->saidx.src, sizeof((*q)->saidx.src));
1512 bcopy(&p->saidx.dst, &(*q)->saidx.dst, sizeof((*q)->saidx.dst));
fe8ab488 1513
1c79356b 1514 (*q)->sp = dst;
fe8ab488 1515
1c79356b
A		 1516 q = &((*q)->next);
1517 }
fe8ab488 1518
1c79356b
A		 1519 dst->req = newchain;
1520 dst->state = src->state;
1521 dst->policy = src->policy;
1522 /* do not touch the refcnt fields */
fe8ab488 1523
1c79356b 1524 return dst;
fe8ab488 1525
1c79356b
A		 1526fail:
1527 for (p = newchain; p; p = r) {
1528 r = p->next;
9bccf70c 1529 FREE(p, M_SECA);
1c79356b
A		 1530 p = NULL;
1531 }
2d21ac55 1532 key_freesp(dst, KEY_SADB_UNLOCKED);
1c79356b
A		 1533 return NULL;
1534}
1535
1536/* set policy and ipsec request if present. */
1537static int
fe8ab488
A		 1538ipsec_set_policy(struct secpolicy **pcb_sp,
1539 __unused int optname,
1540 caddr_t request,
1541 size_t len,
1542 int priv)
1c79356b
A		 1543{
1544 struct sadb_x_policy *xpl;
1545 struct secpolicy *newsp = NULL;
1546 int error;
fe8ab488 1547
1c79356b
A		 1548 /* sanity check. */
1549 if (pcb_sp == NULL || *pcb_sp == NULL || request == NULL)
1550 return EINVAL;
1551 if (len < sizeof(*xpl))
1552 return EINVAL;
316670eb 1553 xpl = (struct sadb_x_policy *)(void *)request;
fe8ab488 1554
1c79356b 1555 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
fe8ab488
A		 1556 printf("ipsec_set_policy: passed policy\n");
1557 kdebug_sadb_x_policy((struct sadb_ext *)xpl));
1558
1c79356b
A		 1559 /* check policy type */
1560 /* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */
1561 if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD
1562 || xpl->sadb_x_policy_type == IPSEC_POLICY_NONE)
1563 return EINVAL;
fe8ab488 1564
1c79356b
A		 1565 /* check privileged socket */
1566 if (priv == 0 && xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS)
1567 return EACCES;
fe8ab488 1568
1c79356b
A		 1569 /* allocation new SP entry */
1570 if ((newsp = key_msg2sp(xpl, len, &error)) == NULL)
1571 return error;
fe8ab488 1572
1c79356b 1573 newsp->state = IPSEC_SPSTATE_ALIVE;
fe8ab488 1574
1c79356b 1575 /* clear old SP and set new SP */
2d21ac55 1576 key_freesp(*pcb_sp, KEY_SADB_UNLOCKED);
1c79356b
A		 1577 *pcb_sp = newsp;
1578 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
fe8ab488
A		 1579 printf("ipsec_set_policy: new policy\n");
1580 kdebug_secpolicy(newsp));
1581
1c79356b
A		 1582 return 0;
1583}
1584
1585int
fe8ab488
A		 1586ipsec4_set_policy(struct inpcb *inp,
1587 int optname,
1588 caddr_t request,
1589 size_t len,
1590 int priv)
1c79356b
A		 1591{
1592 struct sadb_x_policy *xpl;
1593 struct secpolicy **pcb_sp;
9bccf70c 1594 int error = 0;
316670eb
A		 1595 struct sadb_x_policy xpl_aligned_buf;
1596 u_int8_t *xpl_unaligned;
fe8ab488 1597
1c79356b
A		 1598 /* sanity check. */
1599 if (inp == NULL || request == NULL)
1600 return EINVAL;
1601 if (len < sizeof(*xpl))
1602 return EINVAL;
316670eb 1603 xpl = (struct sadb_x_policy *)(void *)request;
fe8ab488 1604
316670eb
A		 1605 /* This is a new mbuf allocated by soopt_getm() */
1606 if (IPSEC_IS_P2ALIGNED(xpl)) {
1607 xpl_unaligned = NULL;
1608 } else {
1609 xpl_unaligned = (__typeof__(xpl_unaligned))xpl;
1610 memcpy(&xpl_aligned_buf, xpl, sizeof(xpl_aligned_buf));
1611 xpl = (__typeof__(xpl))&xpl_aligned_buf;
1612 }
fe8ab488 1613
9bccf70c
A		 1614 if (inp->inp_sp == NULL) {
1615 error = ipsec_init_policy(inp->inp_socket, &inp->inp_sp);
1616 if (error)
1617 return error;
1618 }
fe8ab488 1619
1c79356b
A		 1620 /* select direction */
1621 switch (xpl->sadb_x_policy_dir) {
fe8ab488
A		 1622 case IPSEC_DIR_INBOUND:
1623 pcb_sp = &inp->inp_sp->sp_in;
1624 break;
1625 case IPSEC_DIR_OUTBOUND:
1626 pcb_sp = &inp->inp_sp->sp_out;
1627 break;
1628 default:
1629 ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1630 xpl->sadb_x_policy_dir));
1631 return EINVAL;
1c79356b 1632 }
fe8ab488 1633
9bccf70c
A		 1634 /* turn bypass off */
1635 if (ipsec_bypass != 0)
1636 ipsec_bypass = 0;
fe8ab488 1637
1c79356b
A		 1638 return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1639}
1640
1c79356b
A		 1641/* delete policy in PCB */
1642int
fe8ab488 1643ipsec4_delete_pcbpolicy(struct inpcb *inp)
1c79356b 1644{
fe8ab488 1645
1c79356b
A		 1646 /* sanity check. */
1647 if (inp == NULL)
1648 panic("ipsec4_delete_pcbpolicy: NULL pointer was passed.\n");
fe8ab488
A		 1649
1650 if (inp->inp_sp == NULL)
1651 return 0;
1652
1c79356b 1653 if (inp->inp_sp->sp_in != NULL) {
2d21ac55 1654 key_freesp(inp->inp_sp->sp_in, KEY_SADB_UNLOCKED);
1c79356b
A		 1655 inp->inp_sp->sp_in = NULL;
1656 }
fe8ab488 1657
1c79356b 1658 if (inp->inp_sp->sp_out != NULL) {
2d21ac55 1659 key_freesp(inp->inp_sp->sp_out, KEY_SADB_UNLOCKED);
1c79356b
A		 1660 inp->inp_sp->sp_out = NULL;
1661 }
fe8ab488 1662
1c79356b
A		 1663 ipsec_delpcbpolicy(inp->inp_sp);
1664 inp->inp_sp = NULL;
fe8ab488 1665
1c79356b
A		 1666 return 0;
1667}
1668
1669#if INET6
1670int
fe8ab488
A		 1671ipsec6_set_policy(struct in6pcb *in6p,
1672 int optname,
1673 caddr_t request,
1674 size_t len,
1675 int priv)
1c79356b
A		 1676{
1677 struct sadb_x_policy *xpl;
1678 struct secpolicy **pcb_sp;
9bccf70c 1679 int error = 0;
316670eb
A		 1680 struct sadb_x_policy xpl_aligned_buf;
1681 u_int8_t *xpl_unaligned;
fe8ab488 1682
1c79356b
A		 1683 /* sanity check. */
1684 if (in6p == NULL || request == NULL)
1685 return EINVAL;
1686 if (len < sizeof(*xpl))
1687 return EINVAL;
316670eb 1688 xpl = (struct sadb_x_policy *)(void *)request;
fe8ab488 1689
316670eb
A		 1690 /* This is a new mbuf allocated by soopt_getm() */
1691 if (IPSEC_IS_P2ALIGNED(xpl)) {
1692 xpl_unaligned = NULL;
1693 } else {
1694 xpl_unaligned = (__typeof__(xpl_unaligned))xpl;
1695 memcpy(&xpl_aligned_buf, xpl, sizeof(xpl_aligned_buf));
1696 xpl = (__typeof__(xpl))&xpl_aligned_buf;
1697 }
fe8ab488 1698
9bccf70c
A		 1699 if (in6p->in6p_sp == NULL) {
1700 error = ipsec_init_policy(in6p->inp_socket, &in6p->in6p_sp);
1701 if (error)
1702 return error;
1703 }
fe8ab488 1704
1c79356b
A		 1705 /* select direction */
1706 switch (xpl->sadb_x_policy_dir) {
fe8ab488
A		 1707 case IPSEC_DIR_INBOUND:
1708 pcb_sp = &in6p->in6p_sp->sp_in;
1709 break;
1710 case IPSEC_DIR_OUTBOUND:
1711 pcb_sp = &in6p->in6p_sp->sp_out;
1712 break;
1713 default:
1714 ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1715 xpl->sadb_x_policy_dir));
1716 return EINVAL;
1c79356b
A		 1717 }
1718
1719 return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1720}
1721
1722int
fe8ab488 1723ipsec6_delete_pcbpolicy(struct in6pcb *in6p)
1c79356b 1724{
fe8ab488 1725
1c79356b
A		 1726 /* sanity check. */
1727 if (in6p == NULL)
1728 panic("ipsec6_delete_pcbpolicy: NULL pointer was passed.\n");
fe8ab488
A		 1729
1730 if (in6p->in6p_sp == NULL)
1731 return 0;
1732
1c79356b 1733 if (in6p->in6p_sp->sp_in != NULL) {
2d21ac55 1734 key_freesp(in6p->in6p_sp->sp_in, KEY_SADB_UNLOCKED);
1c79356b
A		 1735 in6p->in6p_sp->sp_in = NULL;
1736 }
fe8ab488 1737
1c79356b 1738 if (in6p->in6p_sp->sp_out != NULL) {
2d21ac55 1739 key_freesp(in6p->in6p_sp->sp_out, KEY_SADB_UNLOCKED);
1c79356b
A		 1740 in6p->in6p_sp->sp_out = NULL;
1741 }
fe8ab488 1742
1c79356b
A		 1743 ipsec_delpcbpolicy(in6p->in6p_sp);
1744 in6p->in6p_sp = NULL;
fe8ab488 1745
1c79356b
A		 1746 return 0;
1747}
1748#endif
1749
1750/*
1751 * return current level.
1752 * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
1753 */
1754u_int
39037602 1755ipsec_get_reqlevel(struct ipsecrequest *isr)
1c79356b
A		 1756{
1757 u_int level = 0;
2d21ac55 1758 u_int esp_trans_deflev = 0, esp_net_deflev = 0, ah_trans_deflev = 0, ah_net_deflev = 0;
91447636 1759
1c79356b
A		 1760 /* sanity check */
1761 if (isr == NULL || isr->sp == NULL)
1762 panic("ipsec_get_reqlevel: NULL pointer is passed.\n");
1763 if (((struct sockaddr *)&isr->sp->spidx.src)->sa_family
1764 != ((struct sockaddr *)&isr->sp->spidx.dst)->sa_family)
1765 panic("ipsec_get_reqlevel: family mismatched.\n");
1766
1767/* XXX note that we have ipseclog() expanded here - code sync issue */
1768#define IPSEC_CHECK_DEFAULT(lev) \
1769 (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE \
1770 && (lev) != IPSEC_LEVEL_UNIQUE) \
1771 ? (ipsec_debug \
1772 ? log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
1773 (lev), IPSEC_LEVEL_REQUIRE) \
6d2010ae 1774 : (void)0), \
1c79356b
A		 1775 (lev) = IPSEC_LEVEL_REQUIRE, \
1776 (lev) \
1777 : (lev))
1778
1779 /* set default level */
1780 switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) {
1781#if INET
1782 case AF_INET:
1783 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev);
1784 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev);
1785 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev);
1786 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev);
1787 break;
1788#endif
1789#if INET6
1790 case AF_INET6:
1791 esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev);
1792 esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev);
1793 ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev);
1794 ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev);
1795 break;
1796#endif /* INET6 */
1797 default:
1798 panic("key_get_reqlevel: Unknown family. %d\n",
1799 ((struct sockaddr *)&isr->sp->spidx.src)->sa_family);
1800 }
1801
9bccf70c 1802#undef IPSEC_CHECK_DEFAULT
1c79356b
A		 1803
1804 /* set level */
1805 switch (isr->level) {
1806 case IPSEC_LEVEL_DEFAULT:
1807 switch (isr->saidx.proto) {
1808 case IPPROTO_ESP:
1809 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1810 level = esp_net_deflev;
1811 else
1812 level = esp_trans_deflev;
1813 break;
1814 case IPPROTO_AH:
1815 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1816 level = ah_net_deflev;
1817 else
1818 level = ah_trans_deflev;
91447636 1819 break;
1c79356b
A		 1820 case IPPROTO_IPCOMP:
1821 /*
1822 * we don't really care, as IPcomp document says that
1823 * we shouldn't compress small packets
1824 */
1825 level = IPSEC_LEVEL_USE;
1826 break;
1827 default:
1828 panic("ipsec_get_reqlevel: "
1829 "Illegal protocol defined %u\n",
1830 isr->saidx.proto);
1831 }
1832 break;
1833
1834 case IPSEC_LEVEL_USE:
1835 case IPSEC_LEVEL_REQUIRE:
1836 level = isr->level;
1837 break;
1838 case IPSEC_LEVEL_UNIQUE:
1839 level = IPSEC_LEVEL_REQUIRE;
1840 break;
1841
1842 default:
1843 panic("ipsec_get_reqlevel: Illegal IPsec level %u\n",
1844 isr->level);
1845 }
1846
1847 return level;
1848}
1849
1850/*
1851 * Check AH/ESP integrity.
1852 * OUT:
1853 * 0: valid
1854 * 1: invalid
1855 */
1856static int
39037602 1857ipsec_in_reject(struct secpolicy *sp, struct mbuf *m)
1c79356b
A		 1858{
1859 struct ipsecrequest *isr;
1860 u_int level;
1861 int need_auth, need_conf, need_icv;
1862
1863 KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1864 printf("ipsec_in_reject: using SP\n");
1865 kdebug_secpolicy(sp));
1866
1867 /* check policy */
1868 switch (sp->policy) {
1869 case IPSEC_POLICY_DISCARD:
2d21ac55 1870 case IPSEC_POLICY_GENERATE:
1c79356b
A		 1871 return 1;
1872 case IPSEC_POLICY_BYPASS:
1873 case IPSEC_POLICY_NONE:
1874 return 0;
1875
1876 case IPSEC_POLICY_IPSEC:
1877 break;
1878
1879 case IPSEC_POLICY_ENTRUST:
1880 default:
1881 panic("ipsec_hdrsiz: Invalid policy found. %d\n", sp->policy);
1882 }
1883
1884 need_auth = 0;
1885 need_conf = 0;
1886 need_icv = 0;
1887
9bccf70c
A		 1888 /* XXX should compare policy against ipsec header history */
1889
1c79356b
A		 1890 for (isr = sp->req; isr != NULL; isr = isr->next) {
1891
1892 /* get current level */
1893 level = ipsec_get_reqlevel(isr);
1894
1895 switch (isr->saidx.proto) {
1896 case IPPROTO_ESP:
1897 if (level == IPSEC_LEVEL_REQUIRE) {
1898 need_conf++;
1899
2d21ac55
A		 1900#if 0
1901 /* this won't work with multiple input threads - isr->sav would change
1902 * with every packet and is not necessarily related to the current packet
1903 * being processed. If ESP processing is required - the esp code should
1904 * make sure that the integrity check is present and correct. I don't see
1905 * why it would be necessary to check for the presence of the integrity
1906 * check value here. I think this is just wrong.
1907 * isr->sav has been removed.
1908 * %%%%%% this needs to be re-worked at some point but I think the code below can
1909 * be ignored for now.
1910 */
1c79356b
A		 1911 if (isr->sav != NULL
1912 && isr->sav->flags == SADB_X_EXT_NONE
1913 && isr->sav->alg_auth != SADB_AALG_NONE)
1914 need_icv++;
2d21ac55 1915#endif
1c79356b
A		 1916 }
1917 break;
1918 case IPPROTO_AH:
1919 if (level == IPSEC_LEVEL_REQUIRE) {
1920 need_auth++;
1921 need_icv++;
1922 }
1923 break;
1924 case IPPROTO_IPCOMP:
1925 /*
1926 * we don't really care, as IPcomp document says that
9bccf70c
A		 1927 * we shouldn't compress small packets, IPComp policy
1928 * should always be treated as being in "use" level.
1c79356b
A		 1929 */
1930 break;
1931 }
1932 }
1933
1934 KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1935 printf("ipsec_in_reject: auth:%d conf:%d icv:%d m_flags:%x\n",
1936 need_auth, need_conf, need_icv, m->m_flags));
1937
1938 if ((need_conf && !(m->m_flags & M_DECRYPTED))
1939 || (!need_auth && need_icv && !(m->m_flags & M_AUTHIPDGM))
1940 || (need_auth && !(m->m_flags & M_AUTHIPHDR)))
1941 return 1;
1942
1943 return 0;
1944}
1945
1946/*
1947 * Check AH/ESP integrity.
1948 * This function is called from tcp_input(), udp_input(),
1949 * and {ah,esp}4_input for tunnel mode
1950 */
1951int
39037602 1952ipsec4_in_reject_so(struct mbuf *m, struct socket *so)
1c79356b
A		 1953{
1954 struct secpolicy *sp = NULL;
1955 int error;
1956 int result;
1957
5ba3f43e 1958 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b
A		 1959 /* sanity check */
1960 if (m == NULL)
1961 return 0; /* XXX should be panic ? */
1962
1963 /* get SP for this packet.
1964 * When we are called from ip_forward(), we call
1965 * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
1966 */
1967 if (so == NULL)
1968 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
1969 else
fe8ab488 1970 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_INBOUND, 0, &error);
1c79356b
A		 1971
1972 if (sp == NULL)
1973 return 0; /* XXX should be panic ?
1974 * -> No, there may be error. */
1975
1976 result = ipsec_in_reject(sp, m);
1977 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
39236c6e
A		 1978 printf("DP ipsec4_in_reject_so call free SP:0x%llx\n",
1979 (uint64_t)VM_KERNEL_ADDRPERM(sp)));
2d21ac55 1980 key_freesp(sp, KEY_SADB_UNLOCKED);
1c79356b
A		 1981
1982 return result;
1983}
1984
1985int
39037602 1986ipsec4_in_reject(struct mbuf *m, struct inpcb *inp)
1c79356b 1987{
5ba3f43e 1988 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b
A		 1989 if (inp == NULL)
1990 return ipsec4_in_reject_so(m, NULL);
9bccf70c
A		 1991 if (inp->inp_socket)
1992 return ipsec4_in_reject_so(m, inp->inp_socket);
1993 else
1994 panic("ipsec4_in_reject: invalid inpcb/socket");
91447636
A		 1995
1996 /* NOTREACHED */
1997 return 0;
1c79356b
A		 1998}
1999
2000#if INET6
2001/*
2002 * Check AH/ESP integrity.
2003 * This function is called from tcp6_input(), udp6_input(),
2004 * and {ah,esp}6_input for tunnel mode
2005 */
2006int
39037602 2007ipsec6_in_reject_so(struct mbuf *m, struct socket *so)
1c79356b
A		 2008{
2009 struct secpolicy *sp = NULL;
2010 int error;
2011 int result;
2012
5ba3f43e 2013 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b
A		 2014 /* sanity check */
2015 if (m == NULL)
2016 return 0; /* XXX should be panic ? */
2017
2018 /* get SP for this packet.
2019 * When we are called from ip_forward(), we call
2020 * ipsec6_getpolicybyaddr() with IP_FORWARDING flag.
2021 */
2022 if (so == NULL)
2023 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
2024 else
fe8ab488 2025 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_INBOUND, 0, &error);
1c79356b
A		 2026
2027 if (sp == NULL)
2028 return 0; /* XXX should be panic ? */
2029
2030 result = ipsec_in_reject(sp, m);
2031 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
39236c6e
A		 2032 printf("DP ipsec6_in_reject_so call free SP:0x%llx\n",
2033 (uint64_t)VM_KERNEL_ADDRPERM(sp)));
2d21ac55 2034 key_freesp(sp, KEY_SADB_UNLOCKED);
1c79356b
A		 2035
2036 return result;
2037}
2038
2039int
39037602 2040ipsec6_in_reject(struct mbuf *m, struct in6pcb *in6p)
1c79356b 2041{
91447636 2042
5ba3f43e 2043 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b
A		 2044 if (in6p == NULL)
2045 return ipsec6_in_reject_so(m, NULL);
9bccf70c
A		 2046 if (in6p->in6p_socket)
2047 return ipsec6_in_reject_so(m, in6p->in6p_socket);
2048 else
2049 panic("ipsec6_in_reject: invalid in6p/socket");
91447636
A		 2050
2051 /* NOTREACHED */
2052 return 0;
1c79356b
A		 2053}
2054#endif
2055
2056/*
2057 * compute the byte size to be occupied by IPsec header.
2058 * in case it is tunneled, it includes the size of outer IP header.
2059 * NOTE: SP passed is free in this function.
2060 */
2d21ac55 2061size_t
39037602 2062ipsec_hdrsiz(struct secpolicy *sp)
1c79356b
A		 2063{
2064 struct ipsecrequest *isr;
2065 size_t siz, clen;
2066
5ba3f43e 2067 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b 2068 KEYDEBUG(KEYDEBUG_IPSEC_DATA,
55e303ae 2069 printf("ipsec_hdrsiz: using SP\n");
1c79356b
A		 2070 kdebug_secpolicy(sp));
2071
2072 /* check policy */
2073 switch (sp->policy) {
2074 case IPSEC_POLICY_DISCARD:
2d21ac55 2075 case IPSEC_POLICY_GENERATE:
1c79356b
A		 2076 case IPSEC_POLICY_BYPASS:
2077 case IPSEC_POLICY_NONE:
2078 return 0;
2079
2080 case IPSEC_POLICY_IPSEC:
2081 break;
2082
2083 case IPSEC_POLICY_ENTRUST:
2084 default:
2085 panic("ipsec_hdrsiz: Invalid policy found. %d\n", sp->policy);
2086 }
2087
2088 siz = 0;
2089
2090 for (isr = sp->req; isr != NULL; isr = isr->next) {
2091
2092 clen = 0;
2093
2094 switch (isr->saidx.proto) {
2095 case IPPROTO_ESP:
2096#if IPSEC_ESP
2097 clen = esp_hdrsiz(isr);
2098#else
2099 clen = 0; /*XXX*/
2100#endif
2101 break;
2102 case IPPROTO_AH:
2103 clen = ah_hdrsiz(isr);
2104 break;
2105 case IPPROTO_IPCOMP:
2106 clen = sizeof(struct ipcomp);
2107 break;
2108 }
2109
2110 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
2111 switch (((struct sockaddr *)&isr->saidx.dst)->sa_family) {
2112 case AF_INET:
2113 clen += sizeof(struct ip);
2114 break;
2115#if INET6
2116 case AF_INET6:
2117 clen += sizeof(struct ip6_hdr);
2118 break;
2119#endif
2120 default:
2121 ipseclog((LOG_ERR, "ipsec_hdrsiz: "
2122 "unknown AF %d in IPsec tunnel SA\n",
2123 ((struct sockaddr *)&isr->saidx.dst)->sa_family));
2124 break;
2125 }
2126 }
2127 siz += clen;
2128 }
2129
2130 return siz;
2131}
2132
2133/* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */
2134size_t
39037602 2135ipsec4_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
1c79356b
A		 2136{
2137 struct secpolicy *sp = NULL;
2138 int error;
2139 size_t size;
2140
5ba3f43e 2141 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b
A		 2142 /* sanity check */
2143 if (m == NULL)
2144 return 0; /* XXX should be panic ? */
2145 if (inp != NULL && inp->inp_socket == NULL)
2146 panic("ipsec4_hdrsize: why is socket NULL but there is PCB.");
2147
2148 /* get SP for this packet.
2149 * When we are called from ip_forward(), we call
2150 * ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
2151 */
2152 if (inp == NULL)
2153 sp = ipsec4_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
2154 else
fe8ab488 2155 sp = ipsec4_getpolicybyaddr(m, dir, 0, &error);
1c79356b
A		 2156
2157 if (sp == NULL)
2158 return 0; /* XXX should be panic ? */
2159
2160 size = ipsec_hdrsiz(sp);
2161 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
39236c6e
A		 2162 printf("DP ipsec4_hdrsiz call free SP:0x%llx\n",
2163 (uint64_t)VM_KERNEL_ADDRPERM(sp)));
1c79356b 2164 KEYDEBUG(KEYDEBUG_IPSEC_DATA,
b0d623f7 2165 printf("ipsec4_hdrsiz: size:%lu.\n", (u_int32_t)size));
2d21ac55 2166 key_freesp(sp, KEY_SADB_UNLOCKED);
1c79356b
A		 2167
2168 return size;
2169}
2170
2171#if INET6
2172/* This function is called from ipsec6_hdrsize_tcp(),
2173 * and maybe from ip6_forward.()
2174 */
2175size_t
39037602 2176ipsec6_hdrsiz(struct mbuf *m, u_int dir, struct in6pcb *in6p)
1c79356b
A		 2177{
2178 struct secpolicy *sp = NULL;
2179 int error;
2180 size_t size;
2181
5ba3f43e 2182 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
1c79356b
A		 2183 /* sanity check */
2184 if (m == NULL)
2185 return 0; /* XXX shoud be panic ? */
2186 if (in6p != NULL && in6p->in6p_socket == NULL)
2187 panic("ipsec6_hdrsize: why is socket NULL but there is PCB.");
2188
2189 /* get SP for this packet */
2190 /* XXX Is it right to call with IP_FORWARDING. */
2191 if (in6p == NULL)
2192 sp = ipsec6_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
2193 else
fe8ab488 2194 sp = ipsec6_getpolicybyaddr(m, dir, 0, &error);
1c79356b
A		 2195
2196 if (sp == NULL)
2197 return 0;
2198 size = ipsec_hdrsiz(sp);
2199 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
39236c6e
A		 2200 printf("DP ipsec6_hdrsiz call free SP:0x%llx\n",
2201 (uint64_t)VM_KERNEL_ADDRPERM(sp)));
1c79356b 2202 KEYDEBUG(KEYDEBUG_IPSEC_DATA,
b0d623f7 2203 printf("ipsec6_hdrsiz: size:%lu.\n", (u_int32_t)size));
2d21ac55 2204 key_freesp(sp, KEY_SADB_UNLOCKED);
1c79356b
A		 2205
2206 return size;
2207}
2208#endif /*INET6*/
2209
2210#if INET
2211/*
2212 * encapsulate for ipsec tunnel.
2213 * ip->ip_src must be fixed later on.
2214 */
316670eb 2215int
39037602 2216ipsec4_encapsulate(struct mbuf *m, struct secasvar *sav)
1c79356b
A		 2217{
2218 struct ip *oip;
2219 struct ip *ip;
2220 size_t hlen;
2221 size_t plen;
2222
2223 /* can't tunnel between different AFs */
2224 if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2225 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
2226 || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET) {
2227 m_freem(m);
2228 return EINVAL;
2229 }
2230#if 0
2231 /* XXX if the dst is myself, perform nothing. */
9bccf70c 2232 if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
1c79356b
A		 2233 m_freem(m);
2234 return EINVAL;
2235 }
2236#endif
2237
2238 if (m->m_len < sizeof(*ip))
2239 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
2240
2241 ip = mtod(m, struct ip *);
2242#ifdef _IP_VHL
9bccf70c 2243 hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
1c79356b
A		 2244#else
2245 hlen = ip->ip_hl << 2;
2246#endif
2247
2248 if (m->m_len != hlen)
2249 panic("ipsec4_encapsulate: assumption failed (first mbuf length)");
2250
2251 /* generate header checksum */
2252 ip->ip_sum = 0;
2253#ifdef _IP_VHL
2254 ip->ip_sum = in_cksum(m, hlen);
2255#else
2256 ip->ip_sum = in_cksum(m, hlen);
2257#endif
2258
2259 plen = m->m_pkthdr.len;
2260
2261 /*
2262 * grow the mbuf to accomodate the new IPv4 header.
2263 * NOTE: IPv4 options will never be copied.
2264 */
2265 if (M_LEADINGSPACE(m->m_next) < hlen) {
2266 struct mbuf *n;
2267 MGET(n, M_DONTWAIT, MT_DATA);
2268 if (!n) {
2269 m_freem(m);
2270 return ENOBUFS;
2271 }
2272 n->m_len = hlen;
2273 n->m_next = m->m_next;
2274 m->m_next = n;
2275 m->m_pkthdr.len += hlen;
2276 oip = mtod(n, struct ip *);
2277 } else {
2278 m->m_next->m_len += hlen;
2279 m->m_next->m_data -= hlen;
2280 m->m_pkthdr.len += hlen;
2281 oip = mtod(m->m_next, struct ip *);
2282 }
2283 ip = mtod(m, struct ip *);
2284 ovbcopy((caddr_t)ip, (caddr_t)oip, hlen);
2285 m->m_len = sizeof(struct ip);
2286 m->m_pkthdr.len -= (hlen - sizeof(struct ip));
2287
2288 /* construct new IPv4 header. see RFC 2401 5.1.2.1 */
2289 /* ECN consideration. */
2290 ip_ecn_ingress(ip4_ipsec_ecn, &ip->ip_tos, &oip->ip_tos);
2291#ifdef _IP_VHL
2292 ip->ip_vhl = IP_MAKE_VHL(IPVERSION, sizeof(struct ip) >> 2);
2293#else
2294 ip->ip_hl = sizeof(struct ip) >> 2;
2295#endif
2296 ip->ip_off &= htons(~IP_OFFMASK);
2297 ip->ip_off &= htons(~IP_MF);
2298 switch (ip4_ipsec_dfbit) {
55e303ae 2299 case 0: /* clear DF bit */
1c79356b
A		 2300 ip->ip_off &= htons(~IP_DF);
2301 break;
55e303ae 2302 case 1: /* set DF bit */
1c79356b
A		 2303 ip->ip_off |= htons(IP_DF);
2304 break;
55e303ae 2305 default: /* copy DF bit */
1c79356b
A		 2306 break;
2307 }
2308 ip->ip_p = IPPROTO_IPIP;
2309 if (plen + sizeof(struct ip) < IP_MAXPACKET)
2310 ip->ip_len = htons(plen + sizeof(struct ip));
2311 else {
2312 ipseclog((LOG_ERR, "IPv4 ipsec: size exceeds limit: "
2313 "leave ip_len as is (invalid packet)\n"));
2314 }
5ba3f43e
A		 2315 if (rfc6864 && IP_OFF_IS_ATOMIC(ntohs(ip->ip_off))) {
2316 ip->ip_id = 0;
2317 } else {
2318 ip->ip_id = ip_randomid();
2319 }
1c79356b
A		 2320 bcopy(&((struct sockaddr_in *)&sav->sah->saidx.src)->sin_addr,
2321 &ip->ip_src, sizeof(ip->ip_src));
2322 bcopy(&((struct sockaddr_in *)&sav->sah->saidx.dst)->sin_addr,
2323 &ip->ip_dst, sizeof(ip->ip_dst));
9bccf70c 2324 ip->ip_ttl = IPDEFTTL;
1c79356b
A		 2325
2326 /* XXX Should ip_src be updated later ? */
2327
2328 return 0;
2329}
316670eb 2330
1c79356b
A		 2331#endif /*INET*/
2332
2333#if INET6
316670eb 2334int
39037602 2335ipsec6_encapsulate(struct mbuf *m, struct secasvar *sav)
1c79356b
A		 2336{
2337 struct ip6_hdr *oip6;
2338 struct ip6_hdr *ip6;
2339 size_t plen;
2340
2341 /* can't tunnel between different AFs */
2342 if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2343 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
2344 || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET6) {
2345 m_freem(m);
2346 return EINVAL;
2347 }
2348#if 0
2349 /* XXX if the dst is myself, perform nothing. */
9bccf70c 2350 if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
1c79356b
A		 2351 m_freem(m);
2352 return EINVAL;
2353 }
2354#endif
2355
2356 plen = m->m_pkthdr.len;
2357
2358 /*
2359 * grow the mbuf to accomodate the new IPv6 header.
2360 */
2361 if (m->m_len != sizeof(struct ip6_hdr))
2362 panic("ipsec6_encapsulate: assumption failed (first mbuf length)");
2363 if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
2364 struct mbuf *n;
2365 MGET(n, M_DONTWAIT, MT_DATA);
2366 if (!n) {
2367 m_freem(m);
2368 return ENOBUFS;
2369 }
2370 n->m_len = sizeof(struct ip6_hdr);
2371 n->m_next = m->m_next;
2372 m->m_next = n;
2373 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2374 oip6 = mtod(n, struct ip6_hdr *);
2375 } else {
2376 m->m_next->m_len += sizeof(struct ip6_hdr);
2377 m->m_next->m_data -= sizeof(struct ip6_hdr);
2378 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2379 oip6 = mtod(m->m_next, struct ip6_hdr *);
2380 }
2381 ip6 = mtod(m, struct ip6_hdr *);
2382 ovbcopy((caddr_t)ip6, (caddr_t)oip6, sizeof(struct ip6_hdr));
2383
2384 /* Fake link-local scope-class addresses */
2385 if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
2386 oip6->ip6_src.s6_addr16[1] = 0;
2387 if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
2388 oip6->ip6_dst.s6_addr16[1] = 0;
2389
2390 /* construct new IPv6 header. see RFC 2401 5.1.2.2 */
2391 /* ECN consideration. */
2392 ip6_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &oip6->ip6_flow);
2393 if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
2394 ip6->ip6_plen = htons(plen);
2395 else {
2396 /* ip6->ip6_plen will be updated in ip6_output() */
2397 }
2398 ip6->ip6_nxt = IPPROTO_IPV6;
2399 bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.src)->sin6_addr,
2400 &ip6->ip6_src, sizeof(ip6->ip6_src));
2401 bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.dst)->sin6_addr,
2402 &ip6->ip6_dst, sizeof(ip6->ip6_dst));
9bccf70c 2403 ip6->ip6_hlim = IPV6_DEFHLIM;
1c79356b
A		 2404
2405 /* XXX Should ip6_src be updated later ? */
2406
2407 return 0;
2408}
2d21ac55
A		 2409
2410static int
39037602 2411ipsec64_encapsulate(struct mbuf *m, struct secasvar *sav)
2d21ac55
A		 2412{
2413 struct ip6_hdr *ip6, *ip6i;
2414 struct ip *ip;
2415 size_t plen;
2416 u_int8_t hlim;
2417
2418 /* tunneling over IPv4 */
2419 if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2420 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
2421 || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET) {
2422 m_freem(m);
2423 return EINVAL;
2424 }
2425#if 0
2426 /* XXX if the dst is myself, perform nothing. */
2427 if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
2428 m_freem(m);
2429 return EINVAL;
2430 }
2431#endif
2432
2433 plen = m->m_pkthdr.len;
2434 ip6 = mtod(m, struct ip6_hdr *);
2435 hlim = ip6->ip6_hlim;
2436 /*
2437 * grow the mbuf to accomodate the new IPv4 header.
2438 */
2439 if (m->m_len != sizeof(struct ip6_hdr))
2440 panic("ipsec6_encapsulate: assumption failed (first mbuf length)");
2441 if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
2442 struct mbuf *n;
2443 MGET(n, M_DONTWAIT, MT_DATA);
2444 if (!n) {
2445 m_freem(m);
2446 return ENOBUFS;
2447 }
2448 n->m_len = sizeof(struct ip6_hdr);
2449 n->m_next = m->m_next;
2450 m->m_next = n;
2451 m->m_pkthdr.len += sizeof(struct ip);
2452 ip6i = mtod(n, struct ip6_hdr *);
2453 } else {
2454 m->m_next->m_len += sizeof(struct ip6_hdr);
2455 m->m_next->m_data -= sizeof(struct ip6_hdr);
2456 m->m_pkthdr.len += sizeof(struct ip);
2457 ip6i = mtod(m->m_next, struct ip6_hdr *);
2458 }
2d21ac55
A		 2459
2460 bcopy(ip6, ip6i, sizeof(struct ip6_hdr));
2461 ip = mtod(m, struct ip *);
2462 m->m_len = sizeof(struct ip);
2463 /*
2464 * Fill in some of the IPv4 fields - we don't need all of them
2465 * because the rest will be filled in by ip_output
2466 */
2467 ip->ip_v = IPVERSION;
2468 ip->ip_hl = sizeof(struct ip) >> 2;
2469 ip->ip_id = 0;
2470 ip->ip_sum = 0;
2471 ip->ip_tos = 0;
2472 ip->ip_off = 0;
2473 ip->ip_ttl = hlim;
2474 ip->ip_p = IPPROTO_IPV6;
3e170ce0
A		 2475
2476 /* construct new IPv4 header. see RFC 2401 5.1.2.1 */
2477 /* ECN consideration. */
2478 ip64_ecn_ingress(ip4_ipsec_ecn, &ip->ip_tos, &ip6->ip6_flow);
2479
2d21ac55
A		 2480 if (plen + sizeof(struct ip) < IP_MAXPACKET)
2481 ip->ip_len = htons(plen + sizeof(struct ip));
2482 else {
2483 ip->ip_len = htons(plen);
2484 ipseclog((LOG_ERR, "IPv4 ipsec: size exceeds limit: "
2485 "leave ip_len as is (invalid packet)\n"));
2486 }
2487 bcopy(&((struct sockaddr_in *)&sav->sah->saidx.src)->sin_addr,
2488 &ip->ip_src, sizeof(ip->ip_src));
2489 bcopy(&((struct sockaddr_in *)&sav->sah->saidx.dst)->sin_addr,
2490 &ip->ip_dst, sizeof(ip->ip_dst));
2491
2492 return 0;
2493}
316670eb
A		 2494
2495int
39037602
A		 2496ipsec6_update_routecache_and_output(
2497 struct ipsec_output_state *state,
2498 struct secasvar *sav)
3e170ce0
A		 2499{
2500 struct sockaddr_in6* dst6;
2501 struct route *ro6;
2502 struct ip6_hdr *ip6;
2503 errno_t error = 0;
2504
2505 int plen;
2506 struct ip6_out_args ip6oa;
2507 struct route_in6 ro6_new;
2508 struct flowadv *adv = NULL;
2509
2510 if (!state->m) {
2511 return EINVAL;
2512 }
2513 ip6 = mtod(state->m, struct ip6_hdr *);
2514
2515 // grab sadb_mutex, before updating sah's route cache
2516 lck_mtx_lock(sadb_mutex);
2517 ro6 = &sav->sah->sa_route;
2518 dst6 = (struct sockaddr_in6 *)(void *)&ro6->ro_dst;
2519 if (ro6->ro_rt) {
2520 RT_LOCK(ro6->ro_rt);
2521 }
2522 if (ROUTE_UNUSABLE(ro6) ||
2523 !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst)) {
2524 if (ro6->ro_rt != NULL)
2525 RT_UNLOCK(ro6->ro_rt);
2526 ROUTE_RELEASE(ro6);
2527 }
2528 if (ro6->ro_rt == 0) {
2529 bzero(dst6, sizeof(*dst6));
2530 dst6->sin6_family = AF_INET6;
2531 dst6->sin6_len = sizeof(*dst6);
2532 dst6->sin6_addr = ip6->ip6_dst;
39037602 2533 rtalloc_scoped(ro6, sav->sah->outgoing_if);
3e170ce0
A		 2534 if (ro6->ro_rt) {
2535 RT_LOCK(ro6->ro_rt);
2536 }
2537 }
2538 if (ro6->ro_rt == 0) {
2539 ip6stat.ip6s_noroute++;
2540 IPSEC_STAT_INCREMENT(ipsec6stat.out_noroute);
2541 error = EHOSTUNREACH;
2542 // release sadb_mutex, after updating sah's route cache
2543 lck_mtx_unlock(sadb_mutex);
2544 return error;
2545 }
2546
2547 /*
2548 * adjust state->dst if tunnel endpoint is offlink
2549 *
2550 * XXX: caching rt_gateway value in the state is
2551 * not really good, since it may point elsewhere
2552 * when the gateway gets modified to a larger
2553 * sockaddr via rt_setgate(). This is currently
2554 * addressed by SA_SIZE roundup in that routine.
2555 */
2556 if (ro6->ro_rt->rt_flags & RTF_GATEWAY)
2557 dst6 = (struct sockaddr_in6 *)(void *)ro6->ro_rt->rt_gateway;
2558 RT_UNLOCK(ro6->ro_rt);
2559 ROUTE_RELEASE(&state->ro);
2560 route_copyout(&state->ro, ro6, sizeof(state->ro));
2561 state->dst = (struct sockaddr *)dst6;
2562 state->tunneled = 6;
2563 // release sadb_mutex, after updating sah's route cache
2564 lck_mtx_unlock(sadb_mutex);
2565
2566 state->m = ipsec6_splithdr(state->m);
2567 if (!state->m) {
2568 IPSEC_STAT_INCREMENT(ipsec6stat.out_nomem);
2569 error = ENOMEM;
2570 return error;
2571 }
2572
2573 ip6 = mtod(state->m, struct ip6_hdr *);
2574 switch (sav->sah->saidx.proto) {
2575 case IPPROTO_ESP:
2576#if IPSEC_ESP
2577 error = esp6_output(state->m, &ip6->ip6_nxt, state->m->m_next, sav);
2578#else
2579 m_freem(state->m);
2580 error = EINVAL;
2581#endif
2582 break;
2583 case IPPROTO_AH:
2584 error = ah6_output(state->m, &ip6->ip6_nxt, state->m->m_next, sav);
2585 break;
2586 case IPPROTO_IPCOMP:
2587 /* XXX code should be here */
2588 /*FALLTHROUGH*/
2589 default:
2590 ipseclog((LOG_ERR, "%s: unknown ipsec protocol %d\n", __FUNCTION__, sav->sah->saidx.proto));
2591 m_freem(state->m);
2592 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
2593 error = EINVAL;
2594 break;
2595 }
2596 if (error) {
2597 // If error, packet already freed by above output routines
2598 state->m = NULL;
2599 return error;
2600 }
2601
2602 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
2603 if (plen > IPV6_MAXPACKET) {
2604 ipseclog((LOG_ERR, "%s: IPsec with IPv6 jumbogram is not supported\n", __FUNCTION__));
2605 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
2606 error = EINVAL;/*XXX*/
2607 return error;
2608 }
2609 ip6 = mtod(state->m, struct ip6_hdr *);
2610 ip6->ip6_plen = htons(plen);
2611
2612 ipsec_set_pkthdr_for_interface(sav->sah->ipsec_if, state->m, AF_INET6);
39037602 2613 ipsec_set_ip6oa_for_interface(sav->sah->ipsec_if, &ip6oa);
3e170ce0
A		 2614
2615 /* Increment statistics */
2616 ifnet_stat_increment_out(sav->sah->ipsec_if, 1, mbuf_pkthdr_len(state->m), 0);
2617
2618 /* Send to ip6_output */
2619 bzero(&ro6_new, sizeof(ro6_new));
2620 bzero(&ip6oa, sizeof(ip6oa));
2621 ip6oa.ip6oa_flowadv.code = 0;
39037602 2622 ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR;
3e170ce0
A		 2623 if (state->outgoing_if) {
2624 ip6oa.ip6oa_boundif = state->outgoing_if;
39037602 2625 ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
3e170ce0
A		 2626 }
2627
2628 adv = &ip6oa.ip6oa_flowadv;
2629 (void) ip6_output(state->m, NULL, &ro6_new, IPV6_OUTARGS, NULL, NULL, &ip6oa);
813fb2f6
A		 2630 state->m = NULL;
2631
3e170ce0
A		 2632 if (adv->code == FADV_FLOW_CONTROLLED || adv->code == FADV_SUSPENDED) {
2633 error = ENOBUFS;
2634 ifnet_disable_output(sav->sah->ipsec_if);
2635 return error;
2636 }
2637
2638 return 0;
2639}
2640
2641int
39037602 2642ipsec46_encapsulate(struct ipsec_output_state *state, struct secasvar *sav)
3e170ce0
A		 2643{
2644 struct mbuf *m;
2645 struct ip6_hdr *ip6;
2646 struct ip *oip;
2647 struct ip *ip;
2648 size_t hlen;
2649 size_t plen;
2650
2651 m = state->m;
2652 if (!m) {
2653 return EINVAL;
2654 }
2655
2656 /* can't tunnel between different AFs */
2657 if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
2658 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family
2659 || ((struct sockaddr *)&sav->sah->saidx.src)->sa_family != AF_INET6) {
2660 m_freem(m);
2661 return EINVAL;
2662 }
2663#if 0
2664 /* XXX if the dst is myself, perform nothing. */
2665 if (key_ismyaddr((struct sockaddr *)&sav->sah->saidx.dst)) {
2666 m_freem(m);
2667 return EINVAL;
2668 }
2669#endif
2670
2671 if (m->m_len < sizeof(*ip)) {
2672 panic("ipsec46_encapsulate: assumption failed (first mbuf length)");
2673 return EINVAL;
2674 }
2675
2676 ip = mtod(m, struct ip *);
2677#ifdef _IP_VHL
2678 hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
2679#else
2680 hlen = ip->ip_hl << 2;
2681#endif
2682
2683 if (m->m_len != hlen) {
2684 panic("ipsec46_encapsulate: assumption failed (first mbuf length)");
2685 return EINVAL;
2686 }
2687
2688 /* generate header checksum */
2689 ip->ip_sum = 0;
2690#ifdef _IP_VHL
2691 ip->ip_sum = in_cksum(m, hlen);
2692#else
2693 ip->ip_sum = in_cksum(m, hlen);
2694#endif
2695
2696 plen = m->m_pkthdr.len; // save original IPv4 packet len, this will be ipv6 payload len
2697
2698 /*
2699 * First move the IPv4 header to the second mbuf in the chain
2700 */
2701 if (M_LEADINGSPACE(m->m_next) < hlen) {
2702 struct mbuf *n;
2703 MGET(n, M_DONTWAIT, MT_DATA);
2704 if (!n) {
2705 m_freem(m);
2706 return ENOBUFS;
2707 }
2708 n->m_len = hlen;
2709 n->m_next = m->m_next;
2710 m->m_next = n;
2711 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2712 oip = mtod(n, struct ip *);
2713 } else {
2714 m->m_next->m_len += hlen;
2715 m->m_next->m_data -= hlen;
2716 m->m_pkthdr.len += sizeof(struct ip6_hdr);
2717 oip = mtod(m->m_next, struct ip *);
2718 }
2719 ip = mtod(m, struct ip *);
2720 ovbcopy((caddr_t)ip, (caddr_t)oip, hlen);
2721
2722 /*
2723 * Grow the first mbuf to accomodate the new IPv6 header.
2724 */
2725 if (M_LEADINGSPACE(m) < sizeof(struct ip6_hdr) - hlen) {
2726 struct mbuf *n;
2727 MGETHDR(n, M_DONTWAIT, MT_HEADER);
2728 if (!n) {
2729 m_freem(m);
2730 return ENOBUFS;
2731 }
2732 M_COPY_PKTHDR(n, m);
2733 MH_ALIGN(n, sizeof(struct ip6_hdr));
2734 n->m_len = sizeof(struct ip6_hdr);
2735 n->m_next = m->m_next;
2736 m->m_next = NULL;
2737 m_freem(m);
2738 state->m = n;
2739 m = state->m;
2740 } else {
2741 m->m_len += (sizeof(struct ip6_hdr) - hlen);
2742 m->m_data -= (sizeof(struct ip6_hdr) - hlen);
2743 }
2744 ip6 = mtod(m, struct ip6_hdr *);
2745 ip6->ip6_flow = 0;
2746 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
2747 ip6->ip6_vfc |= IPV6_VERSION;
2748
2749 /* construct new IPv6 header. see RFC 2401 5.1.2.2 */
2750 /* ECN consideration. */
2751 ip46_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &ip->ip_tos);
2752 if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
2753 ip6->ip6_plen = htons(plen);
2754 else {
2755 /* ip6->ip6_plen will be updated in ip6_output() */
2756 }
2757
2758 ip6->ip6_nxt = IPPROTO_IPV4;
2759 ip6->ip6_hlim = IPV6_DEFHLIM;
2760
2761 bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.src)->sin6_addr,
2762 &ip6->ip6_src, sizeof(ip6->ip6_src));
2763 bcopy(&((struct sockaddr_in6 *)&sav->sah->saidx.dst)->sin6_addr,
2764 &ip6->ip6_dst, sizeof(ip6->ip6_dst));
2765
2766 return 0;
2767}
2768
1c79356b
A		 2769#endif /*INET6*/
2770
2771/*
2772 * Check the variable replay window.
2773 * ipsec_chkreplay() performs replay check before ICV verification.
2774 * ipsec_updatereplay() updates replay bitmap. This must be called after
2775 * ICV verification (it also performs replay check, which is usually done
2776 * beforehand).
2777 * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
2778 *
2779 * based on RFC 2401.
2780 */
2781int
39037602 2782ipsec_chkreplay(u_int32_t seq, struct secasvar *sav)
1c79356b
A		 2783{
2784 const struct secreplay *replay;
2785 u_int32_t diff;
2786 int fr;
2787 u_int32_t wsizeb; /* constant: bits of window size */
2788 int frlast; /* constant: last frame */
2789
2d21ac55 2790
1c79356b
A		 2791 /* sanity check */
2792 if (sav == NULL)
2793 panic("ipsec_chkreplay: NULL pointer was passed.\n");
2794
2d21ac55 2795 lck_mtx_lock(sadb_mutex);
1c79356b
A		 2796 replay = sav->replay;
2797
2d21ac55
A		 2798 if (replay->wsize == 0) {
2799 lck_mtx_unlock(sadb_mutex);
1c79356b 2800 return 1; /* no need to check replay. */
2d21ac55 2801 }
1c79356b
A		 2802
2803 /* constant */
2804 frlast = replay->wsize - 1;
2805 wsizeb = replay->wsize << 3;
2806
2807 /* sequence number of 0 is invalid */
2d21ac55
A		 2808 if (seq == 0) {
2809 lck_mtx_unlock(sadb_mutex);
1c79356b 2810 return 0;
2d21ac55 2811 }
1c79356b
A		 2812
2813 /* first time is always okay */
2d21ac55
A		 2814 if (replay->count == 0) {
2815 lck_mtx_unlock(sadb_mutex);
1c79356b 2816 return 1;
2d21ac55 2817 }
1c79356b
A		 2818
2819 if (seq > replay->lastseq) {
2820 /* larger sequences are okay */
2d21ac55 2821 lck_mtx_unlock(sadb_mutex);
1c79356b
A		 2822 return 1;
2823 } else {
2824 /* seq is equal or less than lastseq. */
2825 diff = replay->lastseq - seq;
2826
2827 /* over range to check, i.e. too old or wrapped */
2d21ac55
A		 2828 if (diff >= wsizeb) {
2829 lck_mtx_unlock(sadb_mutex);
1c79356b 2830 return 0;
2d21ac55 2831 }
1c79356b
A		 2832
2833 fr = frlast - diff / 8;
2834
2835 /* this packet already seen ? */
2d21ac55
A		 2836 if ((replay->bitmap)[fr] & (1 << (diff % 8))) {
2837 lck_mtx_unlock(sadb_mutex);
1c79356b 2838 return 0;
2d21ac55 2839 }
1c79356b
A		 2840
2841 /* out of order but good */
2d21ac55 2842 lck_mtx_unlock(sadb_mutex);
1c79356b
A		 2843 return 1;
2844 }
2845}
2846
2847/*
2848 * check replay counter whether to update or not.
2849 * OUT: 0: OK
2850 * 1: NG
2851 */
2852int
39037602 2853ipsec_updatereplay(u_int32_t seq, struct secasvar *sav)
1c79356b
A		 2854{
2855 struct secreplay *replay;
2856 u_int32_t diff;
2857 int fr;
2858 u_int32_t wsizeb; /* constant: bits of window size */
2859 int frlast; /* constant: last frame */
2d21ac55 2860
1c79356b
A		 2861 /* sanity check */
2862 if (sav == NULL)
2863 panic("ipsec_chkreplay: NULL pointer was passed.\n");
2864
2d21ac55 2865 lck_mtx_lock(sadb_mutex);
1c79356b
A		 2866 replay = sav->replay;
2867
2868 if (replay->wsize == 0)
2869 goto ok; /* no need to check replay. */
2870
2871 /* constant */
2872 frlast = replay->wsize - 1;
2873 wsizeb = replay->wsize << 3;
2874
2875 /* sequence number of 0 is invalid */
2876 if (seq == 0)
2877 return 1;
2878
2879 /* first time */
2880 if (replay->count == 0) {
2881 replay->lastseq = seq;
2882 bzero(replay->bitmap, replay->wsize);
2883 (replay->bitmap)[frlast] = 1;
2884 goto ok;
2885 }
2886
2887 if (seq > replay->lastseq) {
2888 /* seq is larger than lastseq. */
2889 diff = seq - replay->lastseq;
2890
2891 /* new larger sequence number */
2892 if (diff < wsizeb) {
2893 /* In window */
2894 /* set bit for this packet */
2d21ac55 2895 vshiftl((unsigned char *) replay->bitmap, diff, replay->wsize);
1c79356b
A		 2896 (replay->bitmap)[frlast] |= 1;
2897 } else {
2898 /* this packet has a "way larger" */
2899 bzero(replay->bitmap, replay->wsize);
2900 (replay->bitmap)[frlast] = 1;
2901 }
2902 replay->lastseq = seq;
2903
2904 /* larger is good */
2905 } else {
2906 /* seq is equal or less than lastseq. */
2907 diff = replay->lastseq - seq;
2908
2909 /* over range to check, i.e. too old or wrapped */
2d21ac55
A		 2910 if (diff >= wsizeb) {
2911 lck_mtx_unlock(sadb_mutex);
1c79356b 2912 return 1;
2d21ac55 2913 }
1c79356b
A		 2914
2915 fr = frlast - diff / 8;
2916
2917 /* this packet already seen ? */
2d21ac55
A		 2918 if ((replay->bitmap)[fr] & (1 << (diff % 8))) {
2919 lck_mtx_unlock(sadb_mutex);
1c79356b 2920 return 1;
2d21ac55 2921 }
1c79356b
A		 2922
2923 /* mark as seen */
2924 (replay->bitmap)[fr] |= (1 << (diff % 8));
2925
2926 /* out of order but good */
2927 }
2928
2929ok:
2930 if (replay->count == ~0) {
2931
2932 /* set overflow flag */
2933 replay->overflow++;
2934
2935 /* don't increment, no more packets accepted */
2d21ac55
A		 2936 if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
2937 lck_mtx_unlock(sadb_mutex);
1c79356b 2938 return 1;
2d21ac55 2939 }
1c79356b
A		 2940
2941 ipseclog((LOG_WARNING, "replay counter made %d cycle. %s\n",
2942 replay->overflow, ipsec_logsastr(sav)));
2943 }
2944
2945 replay->count++;
2d21ac55
A		 2946
2947 lck_mtx_unlock(sadb_mutex);
1c79356b
A		 2948 return 0;
2949}
2950
2951/*
55e303ae 2952 * shift variable length buffer to left.
1c79356b
A		 2953 * IN: bitmap: pointer to the buffer
2954 * nbit: the number of to shift.
2955 * wsize: buffer size (bytes).
2956 */
2957static void
39037602 2958vshiftl(unsigned char *bitmap, int nbit, int wsize)
1c79356b
A		 2959{
2960 int s, j, i;
2961 unsigned char over;
2962
2963 for (j = 0; j < nbit; j += 8) {
2964 s = (nbit - j < 8) ? (nbit - j): 8;
2965 bitmap[0] <<= s;
2966 for (i = 1; i < wsize; i++) {
2967 over = (bitmap[i] >> (8 - s));
2968 bitmap[i] <<= s;
2969 bitmap[i-1] |= over;
2970 }
2971 }
2972
2973 return;
2974}
2975
2976const char *
39037602 2977ipsec4_logpacketstr(struct ip *ip, u_int32_t spi)
1c79356b 2978{
316670eb 2979 static char buf[256] __attribute__((aligned(4)));
1c79356b
A		 2980 char *p;
2981 u_int8_t *s, *d;
2982
2983 s = (u_int8_t *)(&ip->ip_src);
2984 d = (u_int8_t *)(&ip->ip_dst);
2985
2986 p = buf;
2987 snprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
2988 while (p && *p)
2989 p++;
9bccf70c 2990 snprintf(p, sizeof(buf) - (p - buf), "src=%u.%u.%u.%u",
1c79356b
A		 2991 s[0], s[1], s[2], s[3]);
2992 while (p && *p)
2993 p++;
9bccf70c 2994 snprintf(p, sizeof(buf) - (p - buf), " dst=%u.%u.%u.%u",
1c79356b
A		 2995 d[0], d[1], d[2], d[3]);
2996 while (p && *p)
2997 p++;
2998 snprintf(p, sizeof(buf) - (p - buf), ")");
2999
3000 return buf;
3001}
3002
3003#if INET6
3004const char *
39037602 3005ipsec6_logpacketstr(struct ip6_hdr *ip6, u_int32_t spi)
1c79356b 3006{
316670eb 3007 static char buf[256] __attribute__((aligned(4)));
1c79356b
A		 3008 char *p;
3009
3010 p = buf;
3011 snprintf(buf, sizeof(buf), "packet(SPI=%u ", (u_int32_t)ntohl(spi));
3012 while (p && *p)
3013 p++;
3014 snprintf(p, sizeof(buf) - (p - buf), "src=%s",
3015 ip6_sprintf(&ip6->ip6_src));
3016 while (p && *p)
3017 p++;
3018 snprintf(p, sizeof(buf) - (p - buf), " dst=%s",
3019 ip6_sprintf(&ip6->ip6_dst));
3020 while (p && *p)
3021 p++;
3022 snprintf(p, sizeof(buf) - (p - buf), ")");
3023
3024 return buf;
3025}
3026#endif /*INET6*/
3027
3028const char *
39037602 3029ipsec_logsastr(struct secasvar *sav)
1c79356b 3030{
316670eb 3031 static char buf[256] __attribute__((aligned(4)));
1c79356b
A		 3032 char *p;
3033 struct secasindex *saidx = &sav->sah->saidx;
3034
3035 /* validity check */
3036 if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family
3037 != ((struct sockaddr *)&sav->sah->saidx.dst)->sa_family)
3038 panic("ipsec_logsastr: family mismatched.\n");
3039
3040 p = buf;
3041 snprintf(buf, sizeof(buf), "SA(SPI=%u ", (u_int32_t)ntohl(sav->spi));
3042 while (p && *p)
3043 p++;
3044 if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET) {
3045 u_int8_t *s, *d;
3046 s = (u_int8_t *)&((struct sockaddr_in *)&saidx->src)->sin_addr;
3047 d = (u_int8_t *)&((struct sockaddr_in *)&saidx->dst)->sin_addr;
3048 snprintf(p, sizeof(buf) - (p - buf),
3049 "src=%d.%d.%d.%d dst=%d.%d.%d.%d",
3050 s[0], s[1], s[2], s[3], d[0], d[1], d[2], d[3]);
3051 }
3052#if INET6
3053 else if (((struct sockaddr *)&saidx->src)->sa_family == AF_INET6) {
3054 snprintf(p, sizeof(buf) - (p - buf),
3055 "src=%s",
3056 ip6_sprintf(&((struct sockaddr_in6 *)&saidx->src)->sin6_addr));
3057 while (p && *p)
3058 p++;
3059 snprintf(p, sizeof(buf) - (p - buf),
3060 " dst=%s",
3061 ip6_sprintf(&((struct sockaddr_in6 *)&saidx->dst)->sin6_addr));
3062 }
3063#endif
3064 while (p && *p)
3065 p++;
3066 snprintf(p, sizeof(buf) - (p - buf), ")");
3067
3068 return buf;
3069}
3070
3071void
39037602 3072ipsec_dumpmbuf(struct mbuf *m)
1c79356b
A		 3073{
3074 int totlen;
3075 int i;
3076 u_char *p;
3077
3078 totlen = 0;
3079 printf("---\n");
3080 while (m) {
3081 p = mtod(m, u_char *);
3082 for (i = 0; i < m->m_len; i++) {
3083 printf("%02x ", p[i]);
3084 totlen++;
3085 if (totlen % 16 == 0)
3086 printf("\n");
3087 }
3088 m = m->m_next;
3089 }
3090 if (totlen % 16 != 0)
3091 printf("\n");
3092 printf("---\n");
3093}
3094
9bccf70c 3095#if INET
1c79356b
A		 3096/*
3097 * IPsec output logic for IPv4.
3098 */
fe8ab488
A		 3099static int
3100ipsec4_output_internal(struct ipsec_output_state *state, struct secasvar *sav)
1c79356b
A		 3101{
3102 struct ip *ip = NULL;
2d21ac55 3103 int error = 0;
1c79356b 3104 struct sockaddr_in *dst4;
ebb1b9f4 3105 struct route *ro4;
1c79356b 3106
fe8ab488
A		 3107 /* validity check */
3108 if (sav == NULL || sav->sah == NULL) {
3109 error = EINVAL;
3110 goto bad;
3111 }
3112
3113 /*
3114 * If there is no valid SA, we give up to process any
3115 * more. In such a case, the SA's status is changed
3116 * from DYING to DEAD after allocating. If a packet
3117 * send to the receiver by dead SA, the receiver can
3118 * not decode a packet because SA has been dead.
3119 */
3120 if (sav->state != SADB_SASTATE_MATURE
3121 && sav->state != SADB_SASTATE_DYING) {
3122 IPSEC_STAT_INCREMENT(ipsecstat.out_nosa);
3123 error = EINVAL;
3124 goto bad;
3125 }
3126
3127 state->outgoing_if = sav->sah->outgoing_if;
3128
3129 /*
3130 * There may be the case that SA status will be changed when
3131 * we are refering to one. So calling splsoftnet().
3132 */
3133
3134 if (sav->sah->saidx.mode == IPSEC_MODE_TUNNEL) {
3135 /*
3136 * build IPsec tunnel.
3137 */
fe8ab488
A		 3138 state->m = ipsec4_splithdr(state->m);
3139 if (!state->m) {
3140 error = ENOMEM;
3141 goto bad;
3142 }
fe8ab488 3143
3e170ce0
A		 3144 if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family == AF_INET6) {
3145 error = ipsec46_encapsulate(state, sav);
3146 if (error) {
3147 // packet already freed by encapsulation error handling
3148 state->m = NULL;
3149 return error;
3150 }
3151
3152 error = ipsec6_update_routecache_and_output(state, sav);
3153 return error;
3154
3155 } else if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family == AF_INET) {
3156 error = ipsec4_encapsulate(state->m, sav);
3157 if (error) {
3158 state->m = NULL;
fe8ab488
A		 3159 goto bad;
3160 }
3e170ce0 3161 ip = mtod(state->m, struct ip *);
fe8ab488 3162
3e170ce0
A		 3163 // grab sadb_mutex, before updating sah's route cache
3164 lck_mtx_lock(sadb_mutex);
3165 ro4= &sav->sah->sa_route;
3166 dst4 = (struct sockaddr_in *)(void *)&ro4->ro_dst;
3167 if (ro4->ro_rt != NULL) {
3168 RT_LOCK(ro4->ro_rt);
3169 }
3170 if (ROUTE_UNUSABLE(ro4) ||
3171 dst4->sin_addr.s_addr != ip->ip_dst.s_addr) {
3172 if (ro4->ro_rt != NULL)
3173 RT_UNLOCK(ro4->ro_rt);
3174 ROUTE_RELEASE(ro4);
3175 }
3176 if (ro4->ro_rt == 0) {
3177 dst4->sin_family = AF_INET;
3178 dst4->sin_len = sizeof(*dst4);
3179 dst4->sin_addr = ip->ip_dst;
39037602 3180 rtalloc_scoped(ro4, sav->sah->outgoing_if);
3e170ce0
A		 3181 if (ro4->ro_rt == 0) {
3182 OSAddAtomic(1, &ipstat.ips_noroute);
3183 error = EHOSTUNREACH;
3184 // release sadb_mutex, after updating sah's route cache
3185 lck_mtx_unlock(sadb_mutex);
3186 goto bad;
3187 }
3188 RT_LOCK(ro4->ro_rt);
3189 }
3190
3191 /*
3192 * adjust state->dst if tunnel endpoint is offlink
3193 *
3194 * XXX: caching rt_gateway value in the state is
3195 * not really good, since it may point elsewhere
3196 * when the gateway gets modified to a larger
3197 * sockaddr via rt_setgate(). This is currently
3198 * addressed by SA_SIZE roundup in that routine.
3199 */
3200 if (ro4->ro_rt->rt_flags & RTF_GATEWAY)
3201 dst4 = (struct sockaddr_in *)(void *)ro4->ro_rt->rt_gateway;
3202 RT_UNLOCK(ro4->ro_rt);
3203 ROUTE_RELEASE(&state->ro);
3204 route_copyout(&state->ro, ro4, sizeof(state->ro));
3205 state->dst = (struct sockaddr *)dst4;
3206 state->tunneled = 4;
3207 // release sadb_mutex, after updating sah's route cache
3208 lck_mtx_unlock(sadb_mutex);
3209 } else {
3210 ipseclog((LOG_ERR, "%s: family mismatched between inner and outer spi=%u\n",
3211 __FUNCTION__, (u_int32_t)ntohl(sav->spi)));
3212 error = EAFNOSUPPORT;
3213 goto bad;
3214 }
fe8ab488
A		 3215 }
3216
3217 state->m = ipsec4_splithdr(state->m);
3218 if (!state->m) {
3219 error = ENOMEM;
3220 goto bad;
3221 }
3222 switch (sav->sah->saidx.proto) {
3223 case IPPROTO_ESP:
3224#if IPSEC_ESP
3225 if ((error = esp4_output(state->m, sav)) != 0) {
3226 state->m = NULL;
3227 goto bad;
3228 }
3229 break;
3230#else
3231 m_freem(state->m);
3232 state->m = NULL;
3233 error = EINVAL;
3234 goto bad;
3235#endif
3236 case IPPROTO_AH:
3237 if ((error = ah4_output(state->m, sav)) != 0) {
3238 state->m = NULL;
3239 goto bad;
3240 }
3241 break;
3242 case IPPROTO_IPCOMP:
3243 if ((error = ipcomp4_output(state->m, sav)) != 0) {
3244 state->m = NULL;
3245 goto bad;
3246 }
3247 break;
3248 default:
3249 ipseclog((LOG_ERR,
3250 "ipsec4_output: unknown ipsec protocol %d\n",
3251 sav->sah->saidx.proto));
3252 m_freem(state->m);
3253 state->m = NULL;
3254 error = EINVAL;
3255 goto bad;
3256 }
3257
3258 if (state->m == 0) {
3259 error = ENOMEM;
3260 goto bad;
3261 }
3262
3263 return 0;
3264
3265bad:
3266 return error;
3267}
3268
3269int
3270ipsec4_interface_output(struct ipsec_output_state *state, ifnet_t interface)
3271{
3272 int error = 0;
3273 struct secasvar *sav = NULL;
3274
5ba3f43e 3275 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
2d21ac55 3276
1c79356b
A		 3277 if (!state)
3278 panic("state == NULL in ipsec4_output");
3279 if (!state->m)
3280 panic("state->m == NULL in ipsec4_output");
1c79356b
A		 3281 if (!state->dst)
3282 panic("state->dst == NULL in ipsec4_output");
fe8ab488
A		 3283
3284 sav = key_alloc_outbound_sav_for_interface(interface, AF_INET);
3285 if (sav == NULL) {
3286 goto bad;
3287 }
3288
3289 if ((error = ipsec4_output_internal(state, sav)) != 0) {
3290 goto bad;
3291 }
3292
3293 KERNEL_DEBUG(DBG_FNC_IPSEC_OUT | DBG_FUNC_END, 0,0,0,0,0);
3294 if (sav)
3295 key_freesav(sav, KEY_SADB_UNLOCKED);
3296 return 0;
3297
3298bad:
3299 if (sav)
3300 key_freesav(sav, KEY_SADB_UNLOCKED);
3301 m_freem(state->m);
3302 state->m = NULL;
3303 KERNEL_DEBUG(DBG_FNC_IPSEC_OUT | DBG_FUNC_END, error,0,0,0,0);
3304 return error;
3305}
1c79356b 3306
fe8ab488
A		 3307int
3308ipsec4_output(struct ipsec_output_state *state, struct secpolicy *sp, __unused int flags)
3309{
3310 struct ip *ip = NULL;
3311 struct ipsecrequest *isr = NULL;
3312 struct secasindex saidx;
3313 struct secasvar *sav = NULL;
3314 int error = 0;
3315 struct sockaddr_in *sin;
3316
5ba3f43e 3317 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
fe8ab488
A		 3318
3319 if (!state)
3320 panic("state == NULL in ipsec4_output");
3321 if (!state->m)
3322 panic("state->m == NULL in ipsec4_output");
3323 if (!state->dst)
3324 panic("state->dst == NULL in ipsec4_output");
3325
55e303ae 3326 KERNEL_DEBUG(DBG_FNC_IPSEC_OUT | DBG_FUNC_START, 0,0,0,0,0);
fe8ab488 3327
1c79356b 3328 KEYDEBUG(KEYDEBUG_IPSEC_DATA,
fe8ab488
A		 3329 printf("ipsec4_output: applied SP\n");
3330 kdebug_secpolicy(sp));
3331
1c79356b 3332 for (isr = sp->req; isr != NULL; isr = isr->next) {
1c79356b
A		 3333 /* make SA index for search proper SA */
3334 ip = mtod(state->m, struct ip *);
3335 bcopy(&isr->saidx, &saidx, sizeof(saidx));
9bccf70c
A		 3336 saidx.mode = isr->saidx.mode;
3337 saidx.reqid = isr->saidx.reqid;
3338 sin = (struct sockaddr_in *)&saidx.src;
3339 if (sin->sin_len == 0) {
3340 sin->sin_len = sizeof(*sin);
3341 sin->sin_family = AF_INET;
3342 sin->sin_port = IPSEC_PORT_ANY;
3343 bcopy(&ip->ip_src, &sin->sin_addr,
fe8ab488 3344 sizeof(sin->sin_addr));
1c79356b 3345 }
9bccf70c
A		 3346 sin = (struct sockaddr_in *)&saidx.dst;
3347 if (sin->sin_len == 0) {
3348 sin->sin_len = sizeof(*sin);
3349 sin->sin_family = AF_INET;
3350 sin->sin_port = IPSEC_PORT_ANY;
fe8ab488
A		 3351 /*
3352 * Get port from packet if upper layer is UDP and nat traversal
3353 * is enabled and transport mode.
3354 */
3355
2d21ac55 3356 if ((esp_udp_encap_port & 0xFFFF) != 0 &&
fe8ab488 3357 isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
2d21ac55
A		 3358
3359 if (ip->ip_p == IPPROTO_UDP) {
3360 struct udphdr *udp;
3361 size_t hlen;
3362#ifdef _IP_VHL
3363 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
3364#else
3365 hlen = ip->ip_hl << 2;
3366#endif
3367 if (state->m->m_len < hlen + sizeof(struct udphdr)) {
3368 state->m = m_pullup(state->m, hlen + sizeof(struct udphdr));
3369 if (!state->m) {
fe8ab488 3370 ipseclog((LOG_DEBUG, "IPv4 output: can't pullup UDP header\n"));
2d21ac55
A		 3371 IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
3372 goto bad;
3373 }
3374 ip = mtod(state->m, struct ip *);
3375 }
316670eb 3376 udp = (struct udphdr *)(void *)(((u_int8_t *)ip) + hlen);
2d21ac55
A		 3377 sin->sin_port = udp->uh_dport;
3378 }
3379 }
fe8ab488 3380
9bccf70c 3381 bcopy(&ip->ip_dst, &sin->sin_addr,
fe8ab488 3382 sizeof(sin->sin_addr));
1c79356b 3383 }
fe8ab488 3384
2d21ac55 3385 if ((error = key_checkrequest(isr, &saidx, &sav)) != 0) {
1c79356b
A		 3386 /*
3387 * IPsec processing is required, but no SA found.
3388 * I assume that key_acquire() had been called
3389 * to get/establish the SA. Here I discard
3390 * this packet because it is responsibility for
3391 * upper layer to retransmit the packet.
3392 */
2d21ac55 3393 IPSEC_STAT_INCREMENT(ipsecstat.out_nosa);
1c79356b
A		 3394 goto bad;
3395 }
fe8ab488 3396
1c79356b 3397 /* validity check */
2d21ac55 3398 if (sav == NULL) {
1c79356b 3399 switch (ipsec_get_reqlevel(isr)) {
fe8ab488
A		 3400 case IPSEC_LEVEL_USE:
3401 continue;
3402 case IPSEC_LEVEL_REQUIRE:
3403 /* must be not reached here. */
3404 panic("ipsec4_output: no SA found, but required.");
1c79356b 3405 }
1c79356b 3406 }
fe8ab488
A		 3407
3408 if ((error = ipsec4_output_internal(state, sav)) != 0) {
1c79356b
A		 3409 goto bad;
3410 }
1c79356b 3411 }
fe8ab488 3412
55e303ae 3413 KERNEL_DEBUG(DBG_FNC_IPSEC_OUT | DBG_FUNC_END, 0,0,0,0,0);
2d21ac55
A		 3414 if (sav)
3415 key_freesav(sav, KEY_SADB_UNLOCKED);
1c79356b 3416 return 0;
fe8ab488 3417
1c79356b 3418bad:
2d21ac55
A		 3419 if (sav)
3420 key_freesav(sav, KEY_SADB_UNLOCKED);
1c79356b
A		 3421 m_freem(state->m);
3422 state->m = NULL;
55e303ae 3423 KERNEL_DEBUG(DBG_FNC_IPSEC_OUT | DBG_FUNC_END, error,0,0,0,0);
1c79356b
A		 3424 return error;
3425}
fe8ab488 3426
9bccf70c 3427#endif
1c79356b
A		 3428
3429#if INET6
3430/*
3431 * IPsec output logic for IPv6, transport mode.
3432 */
fe8ab488
A		 3433static int
3434ipsec6_output_trans_internal(
2d21ac55 3435 struct ipsec_output_state *state,
fe8ab488 3436 struct secasvar *sav,
2d21ac55 3437 u_char *nexthdrp,
fe8ab488
A		 3438 struct mbuf *mprev)
3439{
3440 struct ip6_hdr *ip6;
3441 int error = 0;
3442 int plen;
3443
3444 /* validity check */
3445 if (sav == NULL || sav->sah == NULL) {
3446 error = EINVAL;
3447 goto bad;
3448 }
3449
3450 /*
3451 * If there is no valid SA, we give up to process.
3452 * see same place at ipsec4_output().
3453 */
3454 if (sav->state != SADB_SASTATE_MATURE
3455 && sav->state != SADB_SASTATE_DYING) {
3456 IPSEC_STAT_INCREMENT(ipsec6stat.out_nosa);
3457 error = EINVAL;
3458 goto bad;
3459 }
3460
3461 state->outgoing_if = sav->sah->outgoing_if;
3462
3463 switch (sav->sah->saidx.proto) {
3464 case IPPROTO_ESP:
3465#if IPSEC_ESP
3466 error = esp6_output(state->m, nexthdrp, mprev->m_next, sav);
3467#else
3468 m_freem(state->m);
3469 error = EINVAL;
3470#endif
3471 break;
3472 case IPPROTO_AH:
3473 error = ah6_output(state->m, nexthdrp, mprev->m_next, sav);
3474 break;
3475 case IPPROTO_IPCOMP:
3476 error = ipcomp6_output(state->m, nexthdrp, mprev->m_next, sav);
3477 break;
3478 default:
3479 ipseclog((LOG_ERR, "ipsec6_output_trans: "
3480 "unknown ipsec protocol %d\n", sav->sah->saidx.proto));
3481 m_freem(state->m);
3482 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
3483 error = EINVAL;
3484 break;
3485 }
3486 if (error) {
3487 state->m = NULL;
3488 goto bad;
3489 }
3490 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
3491 if (plen > IPV6_MAXPACKET) {
3492 ipseclog((LOG_ERR, "ipsec6_output_trans: "
3493 "IPsec with IPv6 jumbogram is not supported\n"));
3494 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
3495 error = EINVAL; /*XXX*/
3496 goto bad;
3497 }
3498 ip6 = mtod(state->m, struct ip6_hdr *);
3499 ip6->ip6_plen = htons(plen);
3500
3501 return 0;
3502bad:
3503 return error;
3504}
3505
3506int
3507ipsec6_output_trans(
3508 struct ipsec_output_state *state,
3509 u_char *nexthdrp,
3510 struct mbuf *mprev,
3511 struct secpolicy *sp,
3512 __unused int flags,
3513 int *tun)
1c79356b
A		 3514{
3515 struct ip6_hdr *ip6;
3516 struct ipsecrequest *isr = NULL;
3517 struct secasindex saidx;
3518 int error = 0;
9bccf70c 3519 struct sockaddr_in6 *sin6;
2d21ac55 3520 struct secasvar *sav = NULL;
fe8ab488 3521
5ba3f43e 3522 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
2d21ac55 3523
1c79356b 3524 if (!state)
55e303ae 3525 panic("state == NULL in ipsec6_output_trans");
1c79356b 3526 if (!state->m)
55e303ae 3527 panic("state->m == NULL in ipsec6_output_trans");
1c79356b 3528 if (!nexthdrp)
55e303ae 3529 panic("nexthdrp == NULL in ipsec6_output_trans");
1c79356b 3530 if (!mprev)
55e303ae 3531 panic("mprev == NULL in ipsec6_output_trans");
1c79356b 3532 if (!sp)
55e303ae 3533 panic("sp == NULL in ipsec6_output_trans");
1c79356b 3534 if (!tun)
55e303ae 3535 panic("tun == NULL in ipsec6_output_trans");
fe8ab488 3536
1c79356b 3537 KEYDEBUG(KEYDEBUG_IPSEC_DATA,
fe8ab488
A		 3538 printf("ipsec6_output_trans: applyed SP\n");
3539 kdebug_secpolicy(sp));
91447636 3540
1c79356b
A		 3541 *tun = 0;
3542 for (isr = sp->req; isr; isr = isr->next) {
3543 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
3544 /* the rest will be handled by ipsec6_output_tunnel() */
3545 break;
3546 }
fe8ab488 3547
1c79356b
A		 3548 /* make SA index for search proper SA */
3549 ip6 = mtod(state->m, struct ip6_hdr *);
3550 bcopy(&isr->saidx, &saidx, sizeof(saidx));
9bccf70c
A		 3551 saidx.mode = isr->saidx.mode;
3552 saidx.reqid = isr->saidx.reqid;
3553 sin6 = (struct sockaddr_in6 *)&saidx.src;
3554 if (sin6->sin6_len == 0) {
3555 sin6->sin6_len = sizeof(*sin6);
3556 sin6->sin6_family = AF_INET6;
3557 sin6->sin6_port = IPSEC_PORT_ANY;
3558 bcopy(&ip6->ip6_src, &sin6->sin6_addr,
fe8ab488 3559 sizeof(ip6->ip6_src));
9bccf70c
A		 3560 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
3561 /* fix scope id for comparing SPD */
3562 sin6->sin6_addr.s6_addr16[1] = 0;
3563 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
3564 }
1c79356b 3565 }
9bccf70c
A		 3566 sin6 = (struct sockaddr_in6 *)&saidx.dst;
3567 if (sin6->sin6_len == 0) {
3568 sin6->sin6_len = sizeof(*sin6);
3569 sin6->sin6_family = AF_INET6;
3570 sin6->sin6_port = IPSEC_PORT_ANY;
3571 bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
fe8ab488 3572 sizeof(ip6->ip6_dst));
9bccf70c
A		 3573 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
3574 /* fix scope id for comparing SPD */
3575 sin6->sin6_addr.s6_addr16[1] = 0;
3576 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
3577 }
1c79356b 3578 }
fe8ab488 3579
2d21ac55 3580 if (key_checkrequest(isr, &saidx, &sav) == ENOENT) {
1c79356b
A		 3581 /*
3582 * IPsec processing is required, but no SA found.
3583 * I assume that key_acquire() had been called
3584 * to get/establish the SA. Here I discard
3585 * this packet because it is responsibility for
3586 * upper layer to retransmit the packet.
3587 */
2d21ac55 3588 IPSEC_STAT_INCREMENT(ipsec6stat.out_nosa);
1c79356b 3589 error = ENOENT;
fe8ab488 3590
9bccf70c
A		 3591 /*
3592 * Notify the fact that the packet is discarded
3593 * to ourselves. I believe this is better than
3594 * just silently discarding. (jinmei@kame.net)
3595 * XXX: should we restrict the error to TCP packets?
3596 * XXX: should we directly notify sockets via
3597 * pfctlinputs?
3598 */
3599 icmp6_error(state->m, ICMP6_DST_UNREACH,
fe8ab488 3600 ICMP6_DST_UNREACH_ADMIN, 0);
9bccf70c 3601 state->m = NULL; /* icmp6_error freed the mbuf */
1c79356b
A		 3602 goto bad;
3603 }
fe8ab488 3604
1c79356b 3605 /* validity check */
2d21ac55 3606 if (sav == NULL) {
1c79356b 3607 switch (ipsec_get_reqlevel(isr)) {
fe8ab488
A		 3608 case IPSEC_LEVEL_USE:
3609 continue;
3610 case IPSEC_LEVEL_REQUIRE:
3611 /* must be not reached here. */
3612 panic("ipsec6_output_trans: no SA found, but required.");
1c79356b
A		 3613 }
3614 }
fe8ab488
A		 3615
3616 if ((error = ipsec6_output_trans_internal(state, sav, nexthdrp, mprev)) != 0) {
3617 goto bad;
3618 }
3619 }
3620
3621 /* if we have more to go, we need a tunnel mode processing */
3622 if (isr != NULL)
3623 *tun = 1;
3624
3625 if (sav)
3626 key_freesav(sav, KEY_SADB_UNLOCKED);
3627 return 0;
3628
3629bad:
3630 if (sav)
3631 key_freesav(sav, KEY_SADB_UNLOCKED);
3632 m_freem(state->m);
3633 state->m = NULL;
3634 return error;
3635}
1c79356b 3636
fe8ab488
A		 3637/*
3638 * IPsec output logic for IPv6, tunnel mode.
3639 */
3640static int
3641ipsec6_output_tunnel_internal(struct ipsec_output_state *state, struct secasvar *sav, int *must_be_last)
3642{
3643 struct ip6_hdr *ip6;
3644 int error = 0;
3645 int plen;
3646 struct sockaddr_in6* dst6;
3647 struct route *ro6;
3648
3649 /* validity check */
3650 if (sav == NULL || sav->sah == NULL || sav->sah->saidx.mode != IPSEC_MODE_TUNNEL) {
3651 error = EINVAL;
3652 goto bad;
3653 }
3654
3655 /*
3656 * If there is no valid SA, we give up to process.
3657 * see same place at ipsec4_output().
3658 */
3659 if (sav->state != SADB_SASTATE_MATURE
3660 && sav->state != SADB_SASTATE_DYING) {
3661 IPSEC_STAT_INCREMENT(ipsec6stat.out_nosa);
3662 error = EINVAL;
3663 goto bad;
3664 }
3665
3666 state->outgoing_if = sav->sah->outgoing_if;
3667
3668 if (sav->sah->saidx.mode == IPSEC_MODE_TUNNEL) {
1c79356b 3669 /*
fe8ab488 3670 * build IPsec tunnel.
1c79356b 3671 */
fe8ab488
A		 3672 state->m = ipsec6_splithdr(state->m);
3673 if (!state->m) {
3674 IPSEC_STAT_INCREMENT(ipsec6stat.out_nomem);
3675 error = ENOMEM;
3676 goto bad;
3677 }
3678
3679 if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family == AF_INET6) {
3680 error = ipsec6_encapsulate(state->m, sav);
3681 if (error) {
3682 state->m = 0;
3683 goto bad;
3684 }
3685 ip6 = mtod(state->m, struct ip6_hdr *);
3686 } else if (((struct sockaddr *)&sav->sah->saidx.src)->sa_family == AF_INET) {
3687
3688 struct ip *ip;
3689 struct sockaddr_in* dst4;
3690 struct route *ro4 = NULL;
3691 struct route ro4_copy;
39037602
A		 3692 struct ip_out_args ipoa = { IFSCOPE_NONE, { 0 }, IPOAF_SELECT_SRCIF, 0,
3693 SO_TC_UNSPEC, _NET_SERVICE_TYPE_UNSPEC };
fe8ab488
A		 3694
3695 if (must_be_last)
3696 *must_be_last = 1;
3697
3698 state->tunneled = 4; /* must not process any further in ip6_output */
3699 error = ipsec64_encapsulate(state->m, sav);
3700 if (error) {
3701 state->m = 0;
3702 goto bad;
3703 }
3704 /* Now we have an IPv4 packet */
3705 ip = mtod(state->m, struct ip *);
3706
3707 // grab sadb_mutex, to update sah's route cache and get a local copy of it
3708 lck_mtx_lock(sadb_mutex);
3709 ro4 = &sav->sah->sa_route;
3710 dst4 = (struct sockaddr_in *)(void *)&ro4->ro_dst;
3711 if (ro4->ro_rt) {
3712 RT_LOCK(ro4->ro_rt);
3713 }
3714 if (ROUTE_UNUSABLE(ro4) ||
3715 dst4->sin_addr.s_addr != ip->ip_dst.s_addr) {
3716 if (ro4->ro_rt != NULL)
3717 RT_UNLOCK(ro4->ro_rt);
3718 ROUTE_RELEASE(ro4);
3719 }
3720 if (ro4->ro_rt == NULL) {
3721 dst4->sin_family = AF_INET;
3722 dst4->sin_len = sizeof(*dst4);
3723 dst4->sin_addr = ip->ip_dst;
3724 } else {
3725 RT_UNLOCK(ro4->ro_rt);
3726 }
3727 route_copyout(&ro4_copy, ro4, sizeof(ro4_copy));
3728 // release sadb_mutex, after updating sah's route cache and getting a local copy
3729 lck_mtx_unlock(sadb_mutex);
3730 state->m = ipsec4_splithdr(state->m);
3731 if (!state->m) {
3732 error = ENOMEM;
3733 ROUTE_RELEASE(&ro4_copy);
3734 goto bad;
3735 }
3736 switch (sav->sah->saidx.proto) {
3737 case IPPROTO_ESP:
3738#if IPSEC_ESP
3739 if ((error = esp4_output(state->m, sav)) != 0) {
3740 state->m = NULL;
3741 ROUTE_RELEASE(&ro4_copy);
3742 goto bad;
3743 }
3744 break;
3745
3746#else
3747 m_freem(state->m);
3748 state->m = NULL;
3749 error = EINVAL;
3750 ROUTE_RELEASE(&ro4_copy);
3751 goto bad;
3752#endif
3753 case IPPROTO_AH:
3754 if ((error = ah4_output(state->m, sav)) != 0) {
3755 state->m = NULL;
3756 ROUTE_RELEASE(&ro4_copy);
3757 goto bad;
3758 }
3759 break;
3760 case IPPROTO_IPCOMP:
3761 if ((error = ipcomp4_output(state->m, sav)) != 0) {
3762 state->m = NULL;
3763 ROUTE_RELEASE(&ro4_copy);
3764 goto bad;
3765 }
3766 break;
3767 default:
3768 ipseclog((LOG_ERR,
3769 "ipsec4_output: unknown ipsec protocol %d\n",
3770 sav->sah->saidx.proto));
3771 m_freem(state->m);
3772 state->m = NULL;
3773 error = EINVAL;
3774 ROUTE_RELEASE(&ro4_copy);
3775 goto bad;
3776 }
3777
3778 if (state->m == 0) {
3779 error = ENOMEM;
3780 ROUTE_RELEASE(&ro4_copy);
3781 goto bad;
3782 }
3783 ipsec_set_pkthdr_for_interface(sav->sah->ipsec_if, state->m, AF_INET);
39037602
A		 3784 ipsec_set_ipoa_for_interface(sav->sah->ipsec_if, &ipoa);
3785
fe8ab488
A		 3786 ip = mtod(state->m, struct ip *);
3787 ip->ip_len = ntohs(ip->ip_len); /* flip len field before calling ip_output */
3788 error = ip_output(state->m, NULL, &ro4_copy, IP_OUTARGS, NULL, &ipoa);
3789 state->m = NULL;
3790 // grab sadb_mutex, to synchronize the sah's route cache with the local copy
3791 lck_mtx_lock(sadb_mutex);
3792 route_copyin(&ro4_copy, ro4, sizeof(ro4_copy));
3793 lck_mtx_unlock(sadb_mutex);
3794 if (error != 0)
3795 goto bad;
3796 goto done;
3797 } else {
3798 ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
3799 "unsupported inner family, spi=%u\n",
3800 (u_int32_t)ntohl(sav->spi)));
3801 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
3802 error = EAFNOSUPPORT;
3803 goto bad;
3804 }
3805
3806 // grab sadb_mutex, before updating sah's route cache
3807 lck_mtx_lock(sadb_mutex);
3808 ro6 = &sav->sah->sa_route;
3809 dst6 = (struct sockaddr_in6 *)(void *)&ro6->ro_dst;
3810 if (ro6->ro_rt) {
3811 RT_LOCK(ro6->ro_rt);
3812 }
3813 if (ROUTE_UNUSABLE(ro6) ||
3814 !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst)) {
3815 if (ro6->ro_rt != NULL)
3816 RT_UNLOCK(ro6->ro_rt);
3817 ROUTE_RELEASE(ro6);
3818 }
3819 if (ro6->ro_rt == 0) {
3820 bzero(dst6, sizeof(*dst6));
3821 dst6->sin6_family = AF_INET6;
3822 dst6->sin6_len = sizeof(*dst6);
3823 dst6->sin6_addr = ip6->ip6_dst;
39037602 3824 rtalloc_scoped(ro6, sav->sah->outgoing_if);
fe8ab488
A		 3825 if (ro6->ro_rt) {
3826 RT_LOCK(ro6->ro_rt);
3827 }
3828 }
3829 if (ro6->ro_rt == 0) {
3830 ip6stat.ip6s_noroute++;
3831 IPSEC_STAT_INCREMENT(ipsec6stat.out_noroute);
3832 error = EHOSTUNREACH;
3833 // release sadb_mutex, after updating sah's route cache
3834 lck_mtx_unlock(sadb_mutex);
1c79356b
A		 3835 goto bad;
3836 }
fe8ab488
A		 3837
3838 /*
3839 * adjust state->dst if tunnel endpoint is offlink
3840 *
3841 * XXX: caching rt_gateway value in the state is
3842 * not really good, since it may point elsewhere
3843 * when the gateway gets modified to a larger
3844 * sockaddr via rt_setgate(). This is currently
3845 * addressed by SA_SIZE roundup in that routine.
3846 */
3847 if (ro6->ro_rt->rt_flags & RTF_GATEWAY)
3848 dst6 = (struct sockaddr_in6 *)(void *)ro6->ro_rt->rt_gateway;
3849 RT_UNLOCK(ro6->ro_rt);
3850 ROUTE_RELEASE(&state->ro);
3851 route_copyout(&state->ro, ro6, sizeof(state->ro));
3852 state->dst = (struct sockaddr *)dst6;
3853 state->tunneled = 6;
3854 // release sadb_mutex, after updating sah's route cache
3855 lck_mtx_unlock(sadb_mutex);
3856 }
3857
3858 state->m = ipsec6_splithdr(state->m);
3859 if (!state->m) {
3860 IPSEC_STAT_INCREMENT(ipsec6stat.out_nomem);
3861 error = ENOMEM;
3862 goto bad;
3863 }
3864 ip6 = mtod(state->m, struct ip6_hdr *);
3865 switch (sav->sah->saidx.proto) {
1c79356b
A		 3866 case IPPROTO_ESP:
3867#if IPSEC_ESP
fe8ab488 3868 error = esp6_output(state->m, &ip6->ip6_nxt, state->m->m_next, sav);
1c79356b
A		 3869#else
3870 m_freem(state->m);
3871 error = EINVAL;
3872#endif
3873 break;
3874 case IPPROTO_AH:
fe8ab488 3875 error = ah6_output(state->m, &ip6->ip6_nxt, state->m->m_next, sav);
1c79356b
A		 3876 break;
3877 case IPPROTO_IPCOMP:
fe8ab488
A		 3878 /* XXX code should be here */
3879 /*FALLTHROUGH*/
1c79356b 3880 default:
fe8ab488
A		 3881 ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
3882 "unknown ipsec protocol %d\n", sav->sah->saidx.proto));
1c79356b 3883 m_freem(state->m);
2d21ac55 3884 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
1c79356b
A		 3885 error = EINVAL;
3886 break;
1c79356b 3887 }
fe8ab488
A		 3888 if (error) {
3889 state->m = NULL;
3890 goto bad;
3891 }
3892 plen = state->m->m_pkthdr.len - sizeof(struct ip6_hdr);
3893 if (plen > IPV6_MAXPACKET) {
3894 ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
3895 "IPsec with IPv6 jumbogram is not supported\n"));
3896 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
3897 error = EINVAL; /*XXX*/
3898 goto bad;
3899 }
3900 ip6 = mtod(state->m, struct ip6_hdr *);
3901 ip6->ip6_plen = htons(plen);
3902done:
1c79356b 3903 return 0;
fe8ab488 3904
1c79356b 3905bad:
1c79356b
A		 3906 return error;
3907}
3908
1c79356b 3909int
2d21ac55
A		 3910ipsec6_output_tunnel(
3911 struct ipsec_output_state *state,
3912 struct secpolicy *sp,
ebb1b9f4 3913 __unused int flags)
1c79356b
A		 3914{
3915 struct ip6_hdr *ip6;
3916 struct ipsecrequest *isr = NULL;
3917 struct secasindex saidx;
2d21ac55 3918 struct secasvar *sav = NULL;
1c79356b 3919 int error = 0;
1c79356b 3920
5ba3f43e 3921 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
2d21ac55 3922
1c79356b 3923 if (!state)
55e303ae 3924 panic("state == NULL in ipsec6_output_tunnel");
1c79356b 3925 if (!state->m)
55e303ae 3926 panic("state->m == NULL in ipsec6_output_tunnel");
1c79356b 3927 if (!sp)
55e303ae 3928 panic("sp == NULL in ipsec6_output_tunnel");
1c79356b
A		 3929
3930 KEYDEBUG(KEYDEBUG_IPSEC_DATA,
3931 printf("ipsec6_output_tunnel: applyed SP\n");
3932 kdebug_secpolicy(sp));
3933
3934 /*
3935 * transport mode ipsec (before the 1st tunnel mode) is already
3936 * processed by ipsec6_output_trans().
3937 */
3938 for (isr = sp->req; isr; isr = isr->next) {
3939 if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
3940 break;
3941 }
3942
55e303ae
A		 3943 for (/* already initialized */; isr; isr = isr->next) {
3944 if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
3945 /* When tunnel mode, SA peers must be specified. */
3946 bcopy(&isr->saidx, &saidx, sizeof(saidx));
3947 } else {
3948 /* make SA index to look for a proper SA */
3949 struct sockaddr_in6 *sin6;
3950
3951 bzero(&saidx, sizeof(saidx));
3952 saidx.proto = isr->saidx.proto;
3953 saidx.mode = isr->saidx.mode;
3954 saidx.reqid = isr->saidx.reqid;
3955
3956 ip6 = mtod(state->m, struct ip6_hdr *);
3957 sin6 = (struct sockaddr_in6 *)&saidx.src;
3958 if (sin6->sin6_len == 0) {
3959 sin6->sin6_len = sizeof(*sin6);
3960 sin6->sin6_family = AF_INET6;
3961 sin6->sin6_port = IPSEC_PORT_ANY;
3962 bcopy(&ip6->ip6_src, &sin6->sin6_addr,
3963 sizeof(ip6->ip6_src));
3964 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
3965 /* fix scope id for comparing SPD */
3966 sin6->sin6_addr.s6_addr16[1] = 0;
3967 sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
3968 }
3969 }
3970 sin6 = (struct sockaddr_in6 *)&saidx.dst;
3971 if (sin6->sin6_len == 0) {
3972 sin6->sin6_len = sizeof(*sin6);
3973 sin6->sin6_family = AF_INET6;
3974 sin6->sin6_port = IPSEC_PORT_ANY;
3975 bcopy(&ip6->ip6_dst, &sin6->sin6_addr,
3976 sizeof(ip6->ip6_dst));
3977 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
3978 /* fix scope id for comparing SPD */
3979 sin6->sin6_addr.s6_addr16[1] = 0;
3980 sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
3981 }
3982 }
3983 }
3984
2d21ac55 3985 if (key_checkrequest(isr, &saidx, &sav) == ENOENT) {
1c79356b
A		 3986 /*
3987 * IPsec processing is required, but no SA found.
3988 * I assume that key_acquire() had been called
3989 * to get/establish the SA. Here I discard
3990 * this packet because it is responsibility for
3991 * upper layer to retransmit the packet.
3992 */
2d21ac55 3993 IPSEC_STAT_INCREMENT(ipsec6stat.out_nosa);
1c79356b
A		 3994 error = ENOENT;
3995 goto bad;
3996 }
3997
3998 /* validity check */
2d21ac55 3999 if (sav == NULL) {
1c79356b
A		 4000 switch (ipsec_get_reqlevel(isr)) {
4001 case IPSEC_LEVEL_USE:
4002 continue;
4003 case IPSEC_LEVEL_REQUIRE:
4004 /* must be not reached here. */
4005 panic("ipsec6_output_tunnel: no SA found, but required.");
4006 }
4007 }
4008
4009 /*
4010 * If there is no valid SA, we give up to process.
4011 * see same place at ipsec4_output().
4012 */
2d21ac55
A		 4013 if (sav->state != SADB_SASTATE_MATURE
4014 && sav->state != SADB_SASTATE_DYING) {
4015 IPSEC_STAT_INCREMENT(ipsec6stat.out_nosa);
1c79356b
A		 4016 error = EINVAL;
4017 goto bad;
4018 }
2d21ac55 4019
fe8ab488
A		 4020 int must_be_last = 0;
4021
4022 if ((error = ipsec6_output_tunnel_internal(state, sav, &must_be_last)) != 0) {
1c79356b
A		 4023 goto bad;
4024 }
fe8ab488
A		 4025
4026 if (must_be_last && isr->next) {
1c79356b 4027 ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
fe8ab488
A		 4028 "IPv4 must be outer layer, spi=%u\n",
4029 (u_int32_t)ntohl(sav->spi)));
1c79356b 4030 error = EINVAL;
1c79356b
A		 4031 goto bad;
4032 }
1c79356b 4033 }
fe8ab488 4034
2d21ac55
A		 4035 if (sav)
4036 key_freesav(sav, KEY_SADB_UNLOCKED);
1c79356b
A		 4037 return 0;
4038
4039bad:
2d21ac55
A		 4040 if (sav)
4041 key_freesav(sav, KEY_SADB_UNLOCKED);
4042 if (state->m)
4043 m_freem(state->m);
1c79356b
A		 4044 state->m = NULL;
4045 return error;
4046}
fe8ab488
A		 4047
4048int
4049ipsec6_interface_output(struct ipsec_output_state *state, ifnet_t interface, u_char *nexthdrp, struct mbuf *mprev)
4050{
4051 int error = 0;
4052 struct secasvar *sav = NULL;
4053
5ba3f43e 4054 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
fe8ab488
A		 4055
4056 if (!state)
4057 panic("state == NULL in ipsec6_output");
4058 if (!state->m)
4059 panic("state->m == NULL in ipsec6_output");
4060 if (!nexthdrp)
4061 panic("nexthdrp == NULL in ipsec6_output");
4062 if (!mprev)
4063 panic("mprev == NULL in ipsec6_output");
4064
4065 sav = key_alloc_outbound_sav_for_interface(interface, AF_INET6);
4066 if (sav == NULL) {
4067 goto bad;
4068 }
4069
4070 if (sav->sah && sav->sah->saidx.mode == IPSEC_MODE_TUNNEL) {
4071 if ((error = ipsec6_output_tunnel_internal(state, sav, NULL)) != 0) {
4072 goto bad;
4073 }
4074 }
4075 else {
4076 if ((error = ipsec6_output_trans_internal(state, sav, nexthdrp, mprev)) != 0) {
4077 goto bad;
4078 }
4079 }
4080
4081 if (sav)
4082 key_freesav(sav, KEY_SADB_UNLOCKED);
4083 return 0;
4084
4085bad:
4086 if (sav)
4087 key_freesav(sav, KEY_SADB_UNLOCKED);
4088 m_freem(state->m);
4089 state->m = NULL;
4090 return error;
4091}
1c79356b
A		 4092#endif /*INET6*/
4093
9bccf70c 4094#if INET
1c79356b
A		 4095/*
4096 * Chop IP header and option off from the payload.
4097 */
316670eb 4098struct mbuf *
39037602 4099ipsec4_splithdr(struct mbuf *m)
1c79356b
A		 4100{
4101 struct mbuf *mh;
4102 struct ip *ip;
4103 int hlen;
4104
4105 if (m->m_len < sizeof(struct ip))
316670eb 4106 panic("ipsec4_splithdr: first mbuf too short, m_len %d, pkt_len %d, m_flag %x", m->m_len, m->m_pkthdr.len, m->m_flags);
1c79356b
A		 4107 ip = mtod(m, struct ip *);
4108#ifdef _IP_VHL
9bccf70c 4109 hlen = _IP_VHL_HL(ip->ip_vhl) << 2;
1c79356b
A		 4110#else
4111 hlen = ip->ip_hl << 2;
4112#endif
4113 if (m->m_len > hlen) {
2d21ac55 4114 MGETHDR(mh, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1c79356b
A		 4115 if (!mh) {
4116 m_freem(m);
4117 return NULL;
4118 }
4119 M_COPY_PKTHDR(mh, m);
4120 MH_ALIGN(mh, hlen);
4121 m->m_flags &= ~M_PKTHDR;
2d21ac55 4122 m_mchtype(m, MT_DATA);
1c79356b
A		 4123 m->m_len -= hlen;
4124 m->m_data += hlen;
4125 mh->m_next = m;
4126 m = mh;
4127 m->m_len = hlen;
4128 bcopy((caddr_t)ip, mtod(m, caddr_t), hlen);
4129 } else if (m->m_len < hlen) {
4130 m = m_pullup(m, hlen);
4131 if (!m)
4132 return NULL;
4133 }
4134 return m;
4135}
9bccf70c 4136#endif
1c79356b
A		 4137
4138#if INET6
316670eb 4139struct mbuf *
39037602 4140ipsec6_splithdr(struct mbuf *m)
1c79356b
A		 4141{
4142 struct mbuf *mh;
4143 struct ip6_hdr *ip6;
4144 int hlen;
4145
4146 if (m->m_len < sizeof(struct ip6_hdr))
4147 panic("ipsec6_splithdr: first mbuf too short");
4148 ip6 = mtod(m, struct ip6_hdr *);
4149 hlen = sizeof(struct ip6_hdr);
4150 if (m->m_len > hlen) {
2d21ac55 4151 MGETHDR(mh, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1c79356b
A		 4152 if (!mh) {
4153 m_freem(m);
4154 return NULL;
4155 }
4156 M_COPY_PKTHDR(mh, m);
4157 MH_ALIGN(mh, hlen);
4158 m->m_flags &= ~M_PKTHDR;
2d21ac55 4159 m_mchtype(m, MT_DATA);
1c79356b
A		 4160 m->m_len -= hlen;
4161 m->m_data += hlen;
4162 mh->m_next = m;
4163 m = mh;
4164 m->m_len = hlen;
4165 bcopy((caddr_t)ip6, mtod(m, caddr_t), hlen);
4166 } else if (m->m_len < hlen) {
4167 m = m_pullup(m, hlen);
4168 if (!m)
4169 return NULL;
4170 }
4171 return m;
4172}
4173#endif
4174
4175/* validate inbound IPsec tunnel packet. */
4176int
39037602
A		 4177ipsec4_tunnel_validate(
4178 struct mbuf *m, /* no pullup permitted, m->m_len >= ip */
4179 int off,
4180 u_int nxt0,
4181 struct secasvar *sav,
4182 sa_family_t *ifamily)
1c79356b
A		 4183{
4184 u_int8_t nxt = nxt0 & 0xff;
4185 struct sockaddr_in *sin;
2d21ac55
A		 4186 struct sockaddr_in osrc, odst, i4src, i4dst;
4187 struct sockaddr_in6 i6src, i6dst;
1c79356b 4188 int hlen;
9bccf70c
A		 4189 struct secpolicy *sp;
4190 struct ip *oip;
1c79356b 4191
5ba3f43e 4192 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
91447636 4193
9bccf70c
A		 4194#if DIAGNOSTIC
4195 if (m->m_len < sizeof(struct ip))
4196 panic("too short mbuf on ipsec4_tunnel_validate");
4197#endif
2d21ac55 4198 if (nxt != IPPROTO_IPV4 && nxt != IPPROTO_IPV6)
1c79356b 4199 return 0;
9bccf70c
A		 4200 if (m->m_pkthdr.len < off + sizeof(struct ip))
4201 return 0;
4202 /* do not decapsulate if the SA is for transport mode only */
4203 if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
4204 return 0;
4205
4206 oip = mtod(m, struct ip *);
1c79356b 4207#ifdef _IP_VHL
9bccf70c 4208 hlen = _IP_VHL_HL(oip->ip_vhl) << 2;
1c79356b 4209#else
9bccf70c 4210 hlen = oip->ip_hl << 2;
1c79356b
A		 4211#endif
4212 if (hlen != sizeof(struct ip))
4213 return 0;
9bccf70c 4214
9bccf70c
A		 4215 sin = (struct sockaddr_in *)&sav->sah->saidx.dst;
4216 if (sin->sin_family != AF_INET)
1c79356b 4217 return 0;
9bccf70c
A		 4218 if (bcmp(&oip->ip_dst, &sin->sin_addr, sizeof(oip->ip_dst)) != 0)
4219 return 0;
4220
39037602
A		 4221 if (sav->sah->ipsec_if != NULL) {
4222 // the ipsec interface SAs don't have a policies.
316670eb
A		 4223 if (nxt == IPPROTO_IPV4) {
4224 *ifamily = AF_INET;
4225 } else if (nxt == IPPROTO_IPV6) {
4226 *ifamily = AF_INET6;
4227 } else {
4228 return 0;
4229 }
4230 return 1;
4231 }
4232
9bccf70c
A		 4233 /* XXX slow */
4234 bzero(&osrc, sizeof(osrc));
4235 bzero(&odst, sizeof(odst));
2d21ac55
A		 4236 osrc.sin_family = odst.sin_family = AF_INET;
4237 osrc.sin_len = odst.sin_len = sizeof(struct sockaddr_in);
9bccf70c
A		 4238 osrc.sin_addr = oip->ip_src;
4239 odst.sin_addr = oip->ip_dst;
9bccf70c
A		 4240 /*
4241 * RFC2401 5.2.1 (b): (assume that we are using tunnel mode)
4242 * - if the inner destination is multicast address, there can be
4243 * multiple permissible inner source address. implementation
4244 * may want to skip verification of inner source address against
4245 * SPD selector.
4246 * - if the inner protocol is ICMP, the packet may be an error report
4247 * from routers on the other side of the VPN cloud (R in the
4248 * following diagram). in this case, we cannot verify inner source
4249 * address against SPD selector.
4250 * me -- gw === gw -- R -- you
4251 *
4252 * we consider the first bullet to be users responsibility on SPD entry
4253 * configuration (if you need to encrypt multicast traffic, set
4254 * the source range of SPD selector to 0.0.0.0/0, or have explicit
4255 * address ranges for possible senders).
4256 * the second bullet is not taken care of (yet).
4257 *
4258 * therefore, we do not do anything special about inner source.
4259 */
2d21ac55
A		 4260 if (nxt == IPPROTO_IPV4) {
4261 bzero(&i4src, sizeof(struct sockaddr_in));
4262 bzero(&i4dst, sizeof(struct sockaddr_in));
4263 i4src.sin_family = i4dst.sin_family = *ifamily = AF_INET;
4264 i4src.sin_len = i4dst.sin_len = sizeof(struct sockaddr_in);
4265 m_copydata(m, off + offsetof(struct ip, ip_src), sizeof(i4src.sin_addr),
4266 (caddr_t)&i4src.sin_addr);
4267 m_copydata(m, off + offsetof(struct ip, ip_dst), sizeof(i4dst.sin_addr),
4268 (caddr_t)&i4dst.sin_addr);
4269 sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
4270 (struct sockaddr *)&i4src, (struct sockaddr *)&i4dst);
4271 } else if (nxt == IPPROTO_IPV6) {
4272 bzero(&i6src, sizeof(struct sockaddr_in6));
4273 bzero(&i6dst, sizeof(struct sockaddr_in6));
4274 i6src.sin6_family = i6dst.sin6_family = *ifamily = AF_INET6;
4275 i6src.sin6_len = i6dst.sin6_len = sizeof(struct sockaddr_in6);
4276 m_copydata(m, off + offsetof(struct ip6_hdr, ip6_src), sizeof(i6src.sin6_addr),
4277 (caddr_t)&i6src.sin6_addr);
4278 m_copydata(m, off + offsetof(struct ip6_hdr, ip6_dst), sizeof(i6dst.sin6_addr),
4279 (caddr_t)&i6dst.sin6_addr);
4280 sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
4281 (struct sockaddr *)&i6src, (struct sockaddr *)&i6dst);
4282 } else
4283 return 0; /* unsupported family */
4284
4285 if (!sp)
9bccf70c 4286 return 0;
2d21ac55
A		 4287
4288 key_freesp(sp, KEY_SADB_UNLOCKED);
1c79356b
A		 4289
4290 return 1;
4291}
4292
4293#if INET6
4294/* validate inbound IPsec tunnel packet. */
4295int
39037602
A		 4296ipsec6_tunnel_validate(
4297 struct mbuf *m, /* no pullup permitted, m->m_len >= ip */
4298 int off,
4299 u_int nxt0,
4300 struct secasvar *sav,
4301 sa_family_t *ifamily)
1c79356b
A		 4302{
4303 u_int8_t nxt = nxt0 & 0xff;
4304 struct sockaddr_in6 *sin6;
490019cf
A		 4305 struct sockaddr_in i4src, i4dst;
4306 struct sockaddr_in6 osrc, odst, i6src, i6dst;
9bccf70c
A		 4307 struct secpolicy *sp;
4308 struct ip6_hdr *oip6;
1c79356b 4309
5ba3f43e 4310 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
2d21ac55 4311
9bccf70c
A		 4312#if DIAGNOSTIC
4313 if (m->m_len < sizeof(struct ip6_hdr))
4314 panic("too short mbuf on ipsec6_tunnel_validate");
4315#endif
3e170ce0 4316 if (nxt != IPPROTO_IPV4 && nxt != IPPROTO_IPV6)
1c79356b 4317 return 0;
3e170ce0 4318
9bccf70c
A		 4319 if (m->m_pkthdr.len < off + sizeof(struct ip6_hdr))
4320 return 0;
4321 /* do not decapsulate if the SA is for transport mode only */
4322 if (sav->sah->saidx.mode == IPSEC_MODE_TRANSPORT)
4323 return 0;
4324
4325 oip6 = mtod(m, struct ip6_hdr *);
4326 /* AF_INET should be supported, but at this moment we don't. */
4327 sin6 = (struct sockaddr_in6 *)&sav->sah->saidx.dst;
4328 if (sin6->sin6_family != AF_INET6)
4329 return 0;
4330 if (!IN6_ARE_ADDR_EQUAL(&oip6->ip6_dst, &sin6->sin6_addr))
1c79356b 4331 return 0;
9bccf70c 4332
39037602
A		 4333 if (sav->sah->ipsec_if != NULL) {
4334 // the ipsec interface SAs don't have a policies.
3e170ce0
A		 4335 if (nxt == IPPROTO_IPV4) {
4336 *ifamily = AF_INET;
4337 } else if (nxt == IPPROTO_IPV6) {
4338 *ifamily = AF_INET6;
4339 } else {
4340 return 0;
4341 }
316670eb
A		 4342 return 1;
4343 }
39037602 4344
9bccf70c
A		 4345 /* XXX slow */
4346 bzero(&osrc, sizeof(osrc));
4347 bzero(&odst, sizeof(odst));
490019cf
A		 4348 osrc.sin6_family = odst.sin6_family = AF_INET6;
4349 osrc.sin6_len = odst.sin6_len = sizeof(struct sockaddr_in6);
9bccf70c
A		 4350 osrc.sin6_addr = oip6->ip6_src;
4351 odst.sin6_addr = oip6->ip6_dst;
9bccf70c
A		 4352
4353 /*
4354 * regarding to inner source address validation, see a long comment
4355 * in ipsec4_tunnel_validate.
4356 */
4357
490019cf
A		 4358 if (nxt == IPPROTO_IPV4) {
4359 bzero(&i4src, sizeof(struct sockaddr_in));
4360 bzero(&i4dst, sizeof(struct sockaddr_in));
4361 i4src.sin_family = i4dst.sin_family = *ifamily = AF_INET;
4362 i4src.sin_len = i4dst.sin_len = sizeof(struct sockaddr_in);
4363 m_copydata(m, off + offsetof(struct ip, ip_src), sizeof(i4src.sin_addr),
4364 (caddr_t)&i4src.sin_addr);
4365 m_copydata(m, off + offsetof(struct ip, ip_dst), sizeof(i4dst.sin_addr),
4366 (caddr_t)&i4dst.sin_addr);
4367 sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
4368 (struct sockaddr *)&i4src, (struct sockaddr *)&i4dst);
4369 } else if (nxt == IPPROTO_IPV6) {
4370 bzero(&i6src, sizeof(struct sockaddr_in6));
4371 bzero(&i6dst, sizeof(struct sockaddr_in6));
4372 i6src.sin6_family = i6dst.sin6_family = *ifamily = AF_INET6;
4373 i6src.sin6_len = i6dst.sin6_len = sizeof(struct sockaddr_in6);
4374 m_copydata(m, off + offsetof(struct ip6_hdr, ip6_src), sizeof(i6src.sin6_addr),
4375 (caddr_t)&i6src.sin6_addr);
4376 m_copydata(m, off + offsetof(struct ip6_hdr, ip6_dst), sizeof(i6dst.sin6_addr),
4377 (caddr_t)&i6dst.sin6_addr);
4378 sp = key_gettunnel((struct sockaddr *)&osrc, (struct sockaddr *)&odst,
4379 (struct sockaddr *)&i6src, (struct sockaddr *)&i6dst);
4380 } else
4381 return 0; /* unsupported family */
55e303ae
A		 4382 /*
4383 * when there is no suitable inbound policy for the packet of the ipsec
4384 * tunnel mode, the kernel never decapsulate the tunneled packet
4385 * as the ipsec tunnel mode even when the system wide policy is "none".
4386 * then the kernel leaves the generic tunnel module to process this
4387 * packet. if there is no rule of the generic tunnel, the packet
4388 * is rejected and the statistics will be counted up.
4389 */
9bccf70c
A		 4390 if (!sp)
4391 return 0;
2d21ac55 4392 key_freesp(sp, KEY_SADB_UNLOCKED);
1c79356b
A		 4393
4394 return 1;
4395}
4396#endif
4397
4398/*
4399 * Make a mbuf chain for encryption.
4400 * If the original mbuf chain contains a mbuf with a cluster,
4401 * allocate a new cluster and copy the data to the new cluster.
4402 * XXX: this hack is inefficient, but is necessary to handle cases
4403 * of TCP retransmission...
4404 */
4405struct mbuf *
39037602 4406ipsec_copypkt(struct mbuf *m)
1c79356b
A		 4407{
4408 struct mbuf *n, **mpp, *mnew;
4409
4410 for (n = m, mpp = &m; n; n = n->m_next) {
4411 if (n->m_flags & M_EXT) {
4412 /*
4413 * Make a copy only if there are more than one references
4414 * to the cluster.
4415 * XXX: is this approach effective?
4416 */
4417 if (
813fb2f6 4418 m_get_ext_free(n) != NULL ||
d12e1678 4419 m_mclhasreference(n)
1c79356b
A		 4420 )
4421 {
4422 int remain, copied;
4423 struct mbuf *mm;
4424
4425 if (n->m_flags & M_PKTHDR) {
2d21ac55 4426 MGETHDR(mnew, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1c79356b
A		 4427 if (mnew == NULL)
4428 goto fail;
1c79356b 4429 M_COPY_PKTHDR(mnew, n);
1c79356b
A		 4430 }
4431 else {
4432 MGET(mnew, M_DONTWAIT, MT_DATA);
4433 if (mnew == NULL)
4434 goto fail;
4435 }
4436 mnew->m_len = 0;
4437 mm = mnew;
4438
4439 /*
4440 * Copy data. If we don't have enough space to
4441 * store the whole data, allocate a cluster
4442 * or additional mbufs.
4443 * XXX: we don't use m_copyback(), since the
4444 * function does not use clusters and thus is
4445 * inefficient.
4446 */
4447 remain = n->m_len;
4448 copied = 0;
9bccf70c 4449 while (1) {
1c79356b
A		 4450 int len;
4451 struct mbuf *mn;
4452
4453 if (remain <= (mm->m_flags & M_PKTHDR ? MHLEN : MLEN))
4454 len = remain;
4455 else { /* allocate a cluster */
4456 MCLGET(mm, M_DONTWAIT);
4457 if (!(mm->m_flags & M_EXT)) {
4458 m_free(mm);
4459 goto fail;
4460 }
4461 len = remain < MCLBYTES ?
4462 remain : MCLBYTES;
4463 }
4464
4465 bcopy(n->m_data + copied, mm->m_data,
4466 len);
4467
4468 copied += len;
4469 remain -= len;
4470 mm->m_len = len;
4471
4472 if (remain <= 0) /* completed? */
4473 break;
4474
4475 /* need another mbuf */
2d21ac55 4476 MGETHDR(mn, M_DONTWAIT, MT_HEADER); /* XXXMAC: tags copied next time in loop? */
1c79356b
A		 4477 if (mn == NULL)
4478 goto fail;
9bccf70c 4479 mn->m_pkthdr.rcvif = NULL;
1c79356b
A		 4480 mm->m_next = mn;
4481 mm = mn;
4482 }
4483
4484 /* adjust chain */
4485 mm->m_next = m_free(n);
4486 n = mm;
4487 *mpp = mnew;
4488 mpp = &n->m_next;
4489
4490 continue;
4491 }
4492 }
4493 *mpp = n;
4494 mpp = &n->m_next;
4495 }
4496
4497 return(m);
4498 fail:
4499 m_freem(m);
4500 return(NULL);
4501}
4502
2d21ac55
A		 4503/*
4504 * Tags are allocated as mbufs for now, since our minimum size is MLEN, we
4505 * should make use of up to that much space.
4506 */
4507#define IPSEC_TAG_HEADER \
4508
4509struct ipsec_tag {
4510 struct socket *socket;
4511 u_int32_t history_count;
4512 struct ipsec_history history[];
5ba3f43e
A		 4513#if __arm__ && (__BIGGEST_ALIGNMENT__ > 4)
4514/* For the newer ARMv7k ABI where 64-bit types are 64-bit aligned, but pointers
4515 * are 32-bit:
4516 * Aligning to 64-bit since we case to m_tag which is 64-bit aligned.
4517 */
4518} __attribute__ ((aligned(8)));
4519#else
2d21ac55 4520};
5ba3f43e 4521#endif
2d21ac55
A		 4522
4523#define IPSEC_TAG_SIZE (MLEN - sizeof(struct m_tag))
4524#define IPSEC_TAG_HDR_SIZE (offsetof(struct ipsec_tag, history[0]))
4525#define IPSEC_HISTORY_MAX ((IPSEC_TAG_SIZE - IPSEC_TAG_HDR_SIZE) / \
4526 sizeof(struct ipsec_history))
4527
4528static struct ipsec_tag *
4529ipsec_addaux(
4530 struct mbuf *m)
1c79356b 4531{
2d21ac55
A		 4532 struct m_tag *tag;
4533
4534 /* Check if the tag already exists */
4535 tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPSEC, NULL);
4536
4537 if (tag == NULL) {
4538 struct ipsec_tag *itag;
4539
4540 /* Allocate a tag */
6d2010ae
A		 4541 tag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPSEC,
4542 IPSEC_TAG_SIZE, M_DONTWAIT, m);
2d21ac55
A		 4543
4544 if (tag) {
4545 itag = (struct ipsec_tag*)(tag + 1);
4546 itag->socket = 0;
4547 itag->history_count = 0;
4548
4549 m_tag_prepend(m, tag);
4550 }
4551 }
4552
4553 return tag ? (struct ipsec_tag*)(tag + 1) : NULL;
1c79356b
A		 4554}
4555
2d21ac55
A		 4556static struct ipsec_tag *
4557ipsec_findaux(
4558 struct mbuf *m)
1c79356b 4559{
2d21ac55
A		 4560 struct m_tag *tag;
4561
4562 tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPSEC, NULL);
4563
4564 return tag ? (struct ipsec_tag*)(tag + 1) : NULL;
1c79356b
A		 4565}
4566
9bccf70c 4567void
2d21ac55
A		 4568ipsec_delaux(
4569 struct mbuf *m)
1c79356b 4570{
2d21ac55
A		 4571 struct m_tag *tag;
4572
4573 tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPSEC, NULL);
4574
4575 if (tag) {
4576 m_tag_delete(m, tag);
4577 }
1c79356b
A		 4578}
4579
9bccf70c
A		 4580/* if the aux buffer is unnecessary, nuke it. */
4581static void
2d21ac55
A		 4582ipsec_optaux(
4583 struct mbuf *m,
4584 struct ipsec_tag *itag)
9bccf70c 4585{
2d21ac55
A		 4586 if (itag && itag->socket == NULL && itag->history_count == 0) {
4587 m_tag_delete(m, ((struct m_tag*)itag) - 1);
4588 }
9bccf70c 4589}
1c79356b
A		 4590
4591int
fe8ab488 4592ipsec_setsocket(struct mbuf *m, struct socket *so)
1c79356b 4593{
2d21ac55 4594 struct ipsec_tag *tag;
fe8ab488 4595
9bccf70c
A		 4596 /* if so == NULL, don't insist on getting the aux mbuf */
4597 if (so) {
2d21ac55
A		 4598 tag = ipsec_addaux(m);
4599 if (!tag)
9bccf70c
A		 4600 return ENOBUFS;
4601 } else
2d21ac55
A		 4602 tag = ipsec_findaux(m);
4603 if (tag) {
4604 tag->socket = so;
4605 ipsec_optaux(m, tag);
4606 }
9bccf70c
A		 4607 return 0;
4608}
1c79356b 4609
9bccf70c 4610struct socket *
fe8ab488 4611ipsec_getsocket(struct mbuf *m)
9bccf70c 4612{
2d21ac55
A		 4613 struct ipsec_tag *itag;
4614
4615 itag = ipsec_findaux(m);
4616 if (itag)
4617 return itag->socket;
9bccf70c
A		 4618 else
4619 return NULL;
4620}
1c79356b
A		 4621
4622int
2d21ac55
A		 4623ipsec_addhist(
4624 struct mbuf *m,
4625 int proto,
4626 u_int32_t spi)
1c79356b 4627{
2d21ac55
A		 4628 struct ipsec_tag *itag;
4629 struct ipsec_history *p;
4630 itag = ipsec_addaux(m);
4631 if (!itag)
9bccf70c 4632 return ENOBUFS;
2d21ac55 4633 if (itag->history_count == IPSEC_HISTORY_MAX)
55e303ae 4634 return ENOSPC; /* XXX */
2d21ac55
A		 4635
4636 p = &itag->history[itag->history_count];
4637 itag->history_count++;
4638
9bccf70c
A		 4639 bzero(p, sizeof(*p));
4640 p->ih_proto = proto;
4641 p->ih_spi = spi;
2d21ac55 4642
9bccf70c 4643 return 0;
1c79356b
A		 4644}
4645
9bccf70c 4646struct ipsec_history *
2d21ac55
A		 4647ipsec_gethist(
4648 struct mbuf *m,
4649 int *lenp)
9bccf70c 4650{
2d21ac55
A		 4651 struct ipsec_tag *itag;
4652
4653 itag = ipsec_findaux(m);
4654 if (!itag)
9bccf70c 4655 return NULL;
2d21ac55 4656 if (itag->history_count == 0)
9bccf70c 4657 return NULL;
9bccf70c 4658 if (lenp)
2d21ac55
A		 4659 *lenp = (int)(itag->history_count * sizeof(struct ipsec_history));
4660 return itag->history;
9bccf70c 4661}
1c79356b 4662
9bccf70c 4663void
2d21ac55
A		 4664ipsec_clearhist(
4665 struct mbuf *m)
1c79356b 4666{
2d21ac55
A		 4667 struct ipsec_tag *itag;
4668
4669 itag = ipsec_findaux(m);
4670 if (itag) {
4671 itag->history_count = 0;
4672 }
4673 ipsec_optaux(m, itag);
1c79356b 4674}
55e303ae 4675
b0d623f7 4676__private_extern__ int
55e303ae
A		 4677ipsec_send_natt_keepalive(
4678 struct secasvar *sav)
4679{
316670eb
A		 4680 struct mbuf *m;
4681 struct ip *ip;
4682 int error;
39236c6e 4683 struct ip_out_args ipoa =
39037602
A		 4684 { IFSCOPE_NONE, { 0 }, IPOAF_SELECT_SRCIF, 0,
4685 SO_TC_UNSPEC, _NET_SERVICE_TYPE_UNSPEC };
316670eb 4686 struct route ro;
fe8ab488 4687 int keepalive_interval = natt_keepalive_interval;
91447636 4688
5ba3f43e 4689 LCK_MTX_ASSERT(sadb_mutex, LCK_MTX_ASSERT_NOTOWNED);
316670eb 4690
b0d623f7
A		 4691 if ((esp_udp_encap_port & 0xFFFF) == 0 || sav->remote_ike_port == 0) return FALSE;
4692
fe8ab488
A		 4693 if (sav->natt_interval != 0) {
4694 keepalive_interval = (int)sav->natt_interval;
4695 }
4696
b0d623f7 4697 // natt timestamp may have changed... reverify
fe8ab488 4698 if ((natt_now - sav->natt_last_activity) < keepalive_interval) return FALSE;
b0d623f7 4699
316670eb
A		 4700 if (sav->flags & SADB_X_EXT_ESP_KEEPALIVE) return FALSE; // don't send these from the kernel
4701
55e303ae 4702 m = m_gethdr(M_NOWAIT, MT_DATA);
b0d623f7 4703 if (m == NULL) return FALSE;
316670eb
A		 4704
4705 ip = (__typeof__(ip))m_mtod(m);
4706
4707 // this sends one type of NATT keepalives (Type 1, ESP keepalives, aren't sent by kernel)
4708 if ((sav->flags & SADB_X_EXT_ESP_KEEPALIVE) == 0) {
4709 struct udphdr *uh;
4710
4711 /*
4712 * Type 2: a UDP packet complete with IP header.
4713 * We must do this because UDP output requires
4714 * an inpcb which we don't have. UDP packet
4715 * contains one byte payload. The byte is set
4716 * to 0xFF.
4717 */
4718 uh = (__typeof__(uh))(void *)((char *)m_mtod(m) + sizeof(*ip));
4719 m->m_len = sizeof(struct udpiphdr) + 1;
4720 bzero(m_mtod(m), m->m_len);
4721 m->m_pkthdr.len = m->m_len;
4722
4723 ip->ip_len = m->m_len;
4724 ip->ip_ttl = ip_defttl;
4725 ip->ip_p = IPPROTO_UDP;
4726 if (sav->sah->dir != IPSEC_DIR_INBOUND) {
4727 ip->ip_src = ((struct sockaddr_in*)&sav->sah->saidx.src)->sin_addr;
4728 ip->ip_dst = ((struct sockaddr_in*)&sav->sah->saidx.dst)->sin_addr;
4729 } else {
4730 ip->ip_src = ((struct sockaddr_in*)&sav->sah->saidx.dst)->sin_addr;
4731 ip->ip_dst = ((struct sockaddr_in*)&sav->sah->saidx.src)->sin_addr;
4732 }
4733 uh->uh_sport = htons((u_short)esp_udp_encap_port);
4734 uh->uh_dport = htons(sav->remote_ike_port);
4735 uh->uh_ulen = htons(1 + sizeof(*uh));
4736 uh->uh_sum = 0;
4737 *(u_int8_t*)((char*)m_mtod(m) + sizeof(*ip) + sizeof(*uh)) = 0xFF;
b0d623f7 4738 }
6d2010ae
A		 4739
4740 // grab sadb_mutex, to get a local copy of sah's route cache
4741 lck_mtx_lock(sadb_mutex);
39236c6e
A		 4742 if (ROUTE_UNUSABLE(&sav->sah->sa_route) ||
4743 rt_key(sav->sah->sa_route.ro_rt)->sa_family != AF_INET)
4744 ROUTE_RELEASE(&sav->sah->sa_route);
4745
6d2010ae
A		 4746 route_copyout(&ro, &sav->sah->sa_route, sizeof(ro));
4747 lck_mtx_unlock(sadb_mutex);
fe8ab488
A		 4748
4749 necp_mark_packet_as_keepalive(m, TRUE);
6d2010ae
A		 4750
4751 error = ip_output(m, NULL, &ro, IP_OUTARGS | IP_NOIPSEC, NULL, &ipoa);
4752
4753 // grab sadb_mutex, to synchronize the sah's route cache with the local copy
4754 lck_mtx_lock(sadb_mutex);
4755 route_copyin(&ro, &sav->sah->sa_route, sizeof(ro));
4756 lck_mtx_unlock(sadb_mutex);
b0d623f7 4757 if (error == 0) {
55e303ae 4758 sav->natt_last_activity = natt_now;
b0d623f7
A		 4759 return TRUE;
4760 }
4761 return FALSE;
55e303ae 4762}
fe8ab488
A		 4763
4764__private_extern__ bool
4765ipsec_fill_offload_frame(ifnet_t ifp,
4766 struct secasvar *sav,
3e170ce0 4767 struct ifnet_keepalive_offload_frame *frame,
fe8ab488
A		 4768 size_t frame_data_offset)
4769{
4770 u_int8_t *data = NULL;
4771 struct ip *ip = NULL;
4772 struct udphdr *uh = NULL;
4773
4774 if (sav == NULL || sav->sah == NULL || frame == NULL ||
4775 (ifp != NULL && ifp->if_index != sav->sah->outgoing_if) ||
4776 sav->sah->saidx.dst.ss_family != AF_INET ||
4777 !(sav->flags & SADB_X_EXT_NATT) ||
4778 !(sav->flags & SADB_X_EXT_NATT_KEEPALIVE) ||
4779 !(sav->flags & SADB_X_EXT_NATT_KEEPALIVE_OFFLOAD) ||
4780 sav->flags & SADB_X_EXT_ESP_KEEPALIVE ||
4781 (esp_udp_encap_port & 0xFFFF) == 0 ||
4782 sav->remote_ike_port == 0 ||
3e170ce0 4783 (natt_keepalive_interval == 0 && sav->natt_interval == 0 && sav->natt_offload_interval == 0)) {
fe8ab488
A		 4784 /* SA is not eligible for keepalive offload on this interface */
4785 return (FALSE);
4786 }
4787
3e170ce0
A		 4788 if (frame_data_offset + sizeof(struct udpiphdr) + 1 >
4789 IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
fe8ab488
A		 4790 /* Not enough room in this data frame */
4791 return (FALSE);
4792 }
4793
4794 data = frame->data;
4795 ip = (__typeof__(ip))(void *)(data + frame_data_offset);
4796 uh = (__typeof__(uh))(void *)(data + frame_data_offset + sizeof(*ip));
4797
4798 frame->length = frame_data_offset + sizeof(struct udpiphdr) + 1;
3e170ce0
A		 4799 frame->type = IFNET_KEEPALIVE_OFFLOAD_FRAME_IPSEC;
4800 frame->ether_type = IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV4;
4801
4802 bzero(data, IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE);
fe8ab488
A		 4803
4804 ip->ip_v = IPVERSION;
4805 ip->ip_hl = sizeof(struct ip) >> 2;
4806 ip->ip_off &= htons(~IP_OFFMASK);
4807 ip->ip_off &= htons(~IP_MF);
4808 switch (ip4_ipsec_dfbit) {
4809 case 0: /* clear DF bit */
4810 ip->ip_off &= htons(~IP_DF);
4811 break;
4812 case 1: /* set DF bit */
4813 ip->ip_off |= htons(IP_DF);
4814 break;
4815 default: /* copy DF bit */
4816 break;
4817 }
4818 ip->ip_len = htons(sizeof(struct udpiphdr) + 1);
5ba3f43e
A		 4819 if (rfc6864 && IP_OFF_IS_ATOMIC(htons(ip->ip_off))) {
4820 ip->ip_id = 0;
4821 } else {
4822 ip->ip_id = ip_randomid();
4823 }
fe8ab488
A		 4824 ip->ip_ttl = ip_defttl;
4825 ip->ip_p = IPPROTO_UDP;
4826 ip->ip_sum = 0;
4827 if (sav->sah->dir != IPSEC_DIR_INBOUND) {
4828 ip->ip_src = ((struct sockaddr_in*)&sav->sah->saidx.src)->sin_addr;
4829 ip->ip_dst = ((struct sockaddr_in*)&sav->sah->saidx.dst)->sin_addr;
4830 } else {
4831 ip->ip_src = ((struct sockaddr_in*)&sav->sah->saidx.dst)->sin_addr;
4832 ip->ip_dst = ((struct sockaddr_in*)&sav->sah->saidx.src)->sin_addr;
4833 }
4834 ip->ip_sum = in_cksum_hdr_opt(ip);
4835 uh->uh_sport = htons((u_short)esp_udp_encap_port);
4836 uh->uh_dport = htons(sav->remote_ike_port);
4837 uh->uh_ulen = htons(1 + sizeof(*uh));
4838 uh->uh_sum = 0;
4839 *(u_int8_t*)(data + frame_data_offset + sizeof(*ip) + sizeof(*uh)) = 0xFF;
4840
3e170ce0
A		 4841 if (sav->natt_offload_interval != 0) {
4842 frame->interval = sav->natt_offload_interval;
4843 } else if (sav->natt_interval != 0) {
fe8ab488
A		 4844 frame->interval = sav->natt_interval;
4845 } else {
4846 frame->interval = natt_keepalive_interval;
4847 }
4848 return (TRUE);
4849}
mirror of XNU