+ len, m->m_pkthdr.len));
+ return EINVAL;
+ }
+
+ if (m->m_pkthdr.len < sizeof(struct ip)) {
+ KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
+ printf("ipsec_setspidx: "
+ "pkthdr.len(%d) < sizeof(struct ip), ignored.\n",
+ m->m_pkthdr.len));
+ return EINVAL;
+ }
+
+ if (m->m_len >= sizeof(*ip))
+ ip = mtod(m, struct ip *);
+ else {
+ m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
+ ip = &ipbuf;
+ }
+#ifdef _IP_VHL
+ v = _IP_VHL_V(ip->ip_vhl);
+#else
+ v = ip->ip_v;
+#endif
+ switch (v) {
+ case 4:
+ error = ipsec4_setspidx_ipaddr(m, spidx);
+ if (error)
+ return error;
+ ipsec4_get_ulp(m, spidx, needport);
+ return 0;
+#if INET6
+ case 6:
+ if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) {
+ KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
+ printf("ipsec_setspidx: "
+ "pkthdr.len(%d) < sizeof(struct ip6_hdr), "
+ "ignored.\n", m->m_pkthdr.len));
+ return EINVAL;
+ }
+ error = ipsec6_setspidx_ipaddr(m, spidx);
+ if (error)
+ return error;
+ ipsec6_get_ulp(m, spidx, needport);
+ return 0;
+#endif
+ default:
+ KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
+ printf("ipsec_setspidx: "
+ "unknown IP version %u, ignored.\n", v));
+ return EINVAL;
+ }
+}
+
+static void
+ipsec4_get_ulp(m, spidx, needport)
+ struct mbuf *m;
+ struct secpolicyindex *spidx;
+ int needport;
+{
+ struct ip ip;
+ struct ip6_ext ip6e;
+ u_int8_t nxt;
+ int off;
+ struct tcphdr th;
+ struct udphdr uh;
+
+ /* sanity check */
+ if (m == NULL)
+ panic("ipsec4_get_ulp: NULL pointer was passed.\n");
+ if (m->m_pkthdr.len < sizeof(ip))
+ panic("ipsec4_get_ulp: too short\n");
+
+ /* set default */
+ spidx->ul_proto = IPSEC_ULPROTO_ANY;
+ ((struct sockaddr_in *)&spidx->src)->sin_port = IPSEC_PORT_ANY;
+ ((struct sockaddr_in *)&spidx->dst)->sin_port = IPSEC_PORT_ANY;
+
+ m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
+ /* ip_input() flips it into host endian XXX need more checking */
+ if (ip.ip_off & (IP_MF | IP_OFFMASK))
+ return;
+
+ nxt = ip.ip_p;
+#ifdef _IP_VHL
+ off = _IP_VHL_HL(ip->ip_vhl) << 2;
+#else
+ off = ip.ip_hl << 2;
+#endif
+ while (off < m->m_pkthdr.len) {
+ switch (nxt) {
+ case IPPROTO_TCP:
+ spidx->ul_proto = nxt;
+ if (!needport)
+ return;
+ if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
+ return;
+ m_copydata(m, off, sizeof(th), (caddr_t)&th);
+ ((struct sockaddr_in *)&spidx->src)->sin_port =
+ th.th_sport;
+ ((struct sockaddr_in *)&spidx->dst)->sin_port =
+ th.th_dport;
+ return;
+ case IPPROTO_UDP:
+ spidx->ul_proto = nxt;
+ if (!needport)
+ return;
+ if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
+ return;
+ m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
+ ((struct sockaddr_in *)&spidx->src)->sin_port =
+ uh.uh_sport;
+ ((struct sockaddr_in *)&spidx->dst)->sin_port =
+ uh.uh_dport;
+ return;
+ case IPPROTO_AH:
+ if (off + sizeof(ip6e) > m->m_pkthdr.len)
+ return;
+ m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
+ off += (ip6e.ip6e_len + 2) << 2;
+ nxt = ip6e.ip6e_nxt;
+ break;
+ case IPPROTO_ICMP:
+ default:
+ /* XXX intermediate headers??? */
+ spidx->ul_proto = nxt;
+ return;
+ }
+ }
+}
+
+/* assumes that m is sane */
+static int
+ipsec4_setspidx_ipaddr(m, spidx)
+ struct mbuf *m;
+ struct secpolicyindex *spidx;
+{
+ struct ip *ip = NULL;
+ struct ip ipbuf;
+ struct sockaddr_in *sin;
+
+ if (m->m_len >= sizeof(*ip))
+ ip = mtod(m, struct ip *);
+ else {
+ m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
+ ip = &ipbuf;
+ }
+
+ sin = (struct sockaddr_in *)&spidx->src;
+ bzero(sin, sizeof(*sin));
+ sin->sin_family = AF_INET;
+ sin->sin_len = sizeof(struct sockaddr_in);
+ bcopy(&ip->ip_src, &sin->sin_addr, sizeof(ip->ip_src));
+ spidx->prefs = sizeof(struct in_addr) << 3;
+
+ sin = (struct sockaddr_in *)&spidx->dst;
+ bzero(sin, sizeof(*sin));
+ sin->sin_family = AF_INET;
+ sin->sin_len = sizeof(struct sockaddr_in);
+ bcopy(&ip->ip_dst, &sin->sin_addr, sizeof(ip->ip_dst));
+ spidx->prefd = sizeof(struct in_addr) << 3;
+ return 0;
+}
+
+#if INET6
+static void
+ipsec6_get_ulp(m, spidx, needport)
+ struct mbuf *m;
+ struct secpolicyindex *spidx;
+ int needport;
+{
+ int off, nxt;
+ struct tcphdr th;
+ struct udphdr uh;
+
+ /* sanity check */
+ if (m == NULL)
+ panic("ipsec6_get_ulp: NULL pointer was passed.\n");
+
+ KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
+ printf("ipsec6_get_ulp:\n"); kdebug_mbuf(m));
+
+ /* set default */
+ spidx->ul_proto = IPSEC_ULPROTO_ANY;
+ ((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY;
+ ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY;
+
+ nxt = -1;
+ off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
+ if (off < 0 || m->m_pkthdr.len < off)
+ return;
+
+ switch (nxt) {
+ case IPPROTO_TCP:
+ spidx->ul_proto = nxt;
+ if (!needport)
+ break;
+ if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
+ break;
+ m_copydata(m, off, sizeof(th), (caddr_t)&th);
+ ((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport;
+ ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport;
+ break;
+ case IPPROTO_UDP:
+ spidx->ul_proto = nxt;
+ if (!needport)
+ break;
+ if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
+ break;
+ m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
+ ((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport;
+ ((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport;
+ break;
+ case IPPROTO_ICMPV6:
+ default:
+ /* XXX intermediate headers??? */
+ spidx->ul_proto = nxt;
+ break;
projects / apple / xnu.git / blobdiff