xnu-7195.101.1.tar.gz

[apple/xnu.git] / bsd / netinet6 / esp_input.c

diff --git a/bsd/netinet6/esp_input.c b/bsd/netinet6/esp_input.c
index e51ea9b0f972fc870b021907bbd32488a8a5d031..1723ed2a5f16e51f8db0b2e8edf35b2bbd7242c1 100644 (file)
--- a/bsd/netinet6/esp_input.c
+++ b/bsd/netinet6/esp_input.c
@@ -1,8 +1,8 @@
 /*
 /*

- * Copyright (c) 2008-2013 Apple Inc. All rights reserved.
+ * Copyright (c) 2008-2016 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

- * 
+ *

  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in


@@ -11,10 +11,10 @@
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.

- * 
+ *

  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.

- * 
+ *

  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,


@@ -22,7 +22,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.

- * 
+ *

  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 


@@ -58,6 +58,8 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 

+#define _IP_VHL
+

 /*
  * RFC1827/2406 Encapsulated Security Payload.
  */
 /*
  * RFC1827/2406 Encapsulated Security Payload.
  */


@@ -89,30 +91,22 @@
 #include <netinet/ip_ecn.h>
 #include <netinet/in_pcb.h>
 #include <netinet/udp.h>
 #include <netinet/ip_ecn.h>
 #include <netinet/in_pcb.h>
 #include <netinet/udp.h>

-#if INET6
+#include <netinet/tcp.h>
+#include <netinet/in_tclass.h>

 #include <netinet6/ip6_ecn.h>
 #include <netinet6/ip6_ecn.h>

-#endif

 
 

-#if INET6

 #include <netinet/ip6.h>
 #include <netinet6/in6_pcb.h>
 #include <netinet6/ip6_var.h>
 #include <netinet/icmp6.h>
 #include <netinet6/ip6protosw.h>
 #include <netinet/ip6.h>
 #include <netinet6/in6_pcb.h>
 #include <netinet6/ip6_var.h>
 #include <netinet/icmp6.h>
 #include <netinet6/ip6protosw.h>

-#endif

 
 #include <netinet6/ipsec.h>
 
 #include <netinet6/ipsec.h>

-#if INET6

 #include <netinet6/ipsec6.h>
 #include <netinet6/ipsec6.h>

-#endif

 #include <netinet6/ah.h>
 #include <netinet6/ah.h>

-#if INET6

 #include <netinet6/ah6.h>
 #include <netinet6/ah6.h>

-#endif

 #include <netinet6/esp.h>
 #include <netinet6/esp.h>

-#if INET6

 #include <netinet6/esp6.h>
 #include <netinet6/esp6.h>

-#endif

 #include <netkey/key.h>
 #include <netkey/keydb.h>
 #include <netkey/key_debug.h>
 #include <netkey/key.h>
 #include <netkey/keydb.h>
 #include <netkey/key_debug.h>


@@ -122,27 +116,27 @@
 
 #include <net/net_osdep.h>
 #include <mach/sdt.h>
 
 #include <net/net_osdep.h>
 #include <mach/sdt.h>

+#include <corecrypto/cc.h>

 
 #include <sys/kdebug.h>
 
 #include <sys/kdebug.h>

-#define DBG_LAYER_BEG          NETDBG_CODE(DBG_NETIPSEC, 1)
-#define DBG_LAYER_END          NETDBG_CODE(DBG_NETIPSEC, 3)
-#define DBG_FNC_ESPIN          NETDBG_CODE(DBG_NETIPSEC, (6 << 8))
-#define DBG_FNC_DECRYPT                NETDBG_CODE(DBG_NETIPSEC, (7 << 8))
+#define DBG_LAYER_BEG           NETDBG_CODE(DBG_NETIPSEC, 1)
+#define DBG_LAYER_END           NETDBG_CODE(DBG_NETIPSEC, 3)
+#define DBG_FNC_ESPIN           NETDBG_CODE(DBG_NETIPSEC, (6 << 8))
+#define DBG_FNC_DECRYPT         NETDBG_CODE(DBG_NETIPSEC, (7 << 8))

 #define IPLEN_FLIPPED
 
 extern lck_mtx_t  *sadb_mutex;
 
 #define IPLEN_FLIPPED
 
 extern lck_mtx_t  *sadb_mutex;
 

-#if INET

 #define ESPMAXLEN \
        (sizeof(struct esp) < sizeof(struct newesp) \
 #define ESPMAXLEN \
        (sizeof(struct esp) < sizeof(struct newesp) \

-               ? sizeof(struct newesp) : sizeof(struct esp))
+               ? sizeof(struct newesp) : sizeof(struct esp))

 
 static struct ip *
 
 static struct ip *

-esp4_input_strip_udp_encap (struct mbuf *m, int iphlen)
+esp4_input_strip_udp_encap(struct mbuf *m, int iphlen)

 {
        // strip the udp header that's encapsulating ESP
        struct ip *ip;
 {
        // strip the udp header that's encapsulating ESP
        struct ip *ip;

-       size_t     stripsiz = sizeof(struct udphdr);
+       u_int8_t stripsiz = (u_int8_t)sizeof(struct udphdr);

 
        ip = mtod(m, __typeof__(ip));
        ovbcopy((caddr_t)ip, (caddr_t)(((u_char *)ip) + stripsiz), iphlen);
 
        ip = mtod(m, __typeof__(ip));
        ovbcopy((caddr_t)ip, (caddr_t)(((u_char *)ip) + stripsiz), iphlen);


@@ -156,11 +150,11 @@ esp4_input_strip_udp_encap (struct mbuf *m, int iphlen)
 }
 
 static struct ip6_hdr *
 }
 
 static struct ip6_hdr *

-esp6_input_strip_udp_encap (struct mbuf *m, int ip6hlen)
+esp6_input_strip_udp_encap(struct mbuf *m, int ip6hlen)

 {
        // strip the udp header that's encapsulating ESP
        struct ip6_hdr *ip6;
 {
        // strip the udp header that's encapsulating ESP
        struct ip6_hdr *ip6;

-       size_t     stripsiz = sizeof(struct udphdr);
+       u_int8_t stripsiz = (u_int8_t)sizeof(struct udphdr);

 
        ip6 = mtod(m, __typeof__(ip6));
        ovbcopy((caddr_t)ip6, (caddr_t)(((u_char *)ip6) + stripsiz), ip6hlen);
 
        ip6 = mtod(m, __typeof__(ip6));
        ovbcopy((caddr_t)ip6, (caddr_t)(((u_char *)ip6) + stripsiz), ip6hlen);


@@ -173,15 +167,51 @@ esp6_input_strip_udp_encap (struct mbuf *m, int ip6hlen)
        return ip6;
 }
 
        return ip6;
 }
 

+static void
+esp_input_log(struct mbuf *m, struct secasvar *sav, u_int32_t spi, u_int32_t seq)
+{
+       if (net_mpklog_enabled &&
+           (sav->sah->ipsec_if->if_xflags & IFXF_MPK_LOG) == IFXF_MPK_LOG) {
+               struct tcphdr th = {};
+               u_int32_t proto_len = 0;
+               u_int8_t iphlen = 0;
+               u_int8_t proto = 0;
+
+               struct ip *inner_ip = mtod(m, struct ip *);
+               if (IP_VHL_V(inner_ip->ip_vhl) == 4) {
+                       iphlen = (u_int8_t)(IP_VHL_HL(inner_ip->ip_vhl) << 2);
+                       proto = inner_ip->ip_p;
+               } else if (IP_VHL_V(inner_ip->ip_vhl) == 6) {
+                       struct ip6_hdr *inner_ip6 = mtod(m, struct ip6_hdr *);
+                       iphlen = sizeof(struct ip6_hdr);
+                       proto = inner_ip6->ip6_nxt;
+               }
+
+               if (proto == IPPROTO_TCP) {
+                       if ((int)(iphlen + sizeof(th)) <= m->m_pkthdr.len) {
+                               m_copydata(m, iphlen, sizeof(th), (u_int8_t *)&th);
+                       }
+
+                       proto_len = m->m_pkthdr.len - iphlen - (th.th_off << 2);
+                       MPKL_ESP_INPUT_TCP(esp_mpkl_log_object,
+                           ntohl(spi), seq,
+                           ntohs(th.th_sport), ntohs(th.th_dport),
+                           ntohl(th.th_seq), proto_len);
+               }
+       }
+}
+

 void
 void

-esp4_input(m, off)
-       struct mbuf *m;
-       int off;
+esp4_input(struct mbuf *m, int off)
+{
+       (void)esp4_input_extended(m, off, NULL);
+}
+
+struct mbuf *
+esp4_input_extended(struct mbuf *m, int off, ifnet_t interface)

 {
        struct ip *ip;
 {
        struct ip *ip;

-#if INET6

        struct ip6_hdr *ip6;
        struct ip6_hdr *ip6;

-#endif /* INET6 */

        struct esp *esp;
        struct esptail esptail;
        u_int32_t spi;
        struct esp *esp;
        struct esptail esptail;
        u_int32_t spi;


@@ -191,15 +221,17 @@ esp4_input(m, off)
        u_int16_t nxt;
        const struct esp_algorithm *algo;
        int ivlen;
        u_int16_t nxt;
        const struct esp_algorithm *algo;
        int ivlen;

-       size_t hlen;

        size_t esplen;
        size_t esplen;

-       sa_family_t     ifamily;
+       u_int8_t hlen;
+       sa_family_t     ifamily;
+       struct mbuf *out_m = NULL;
+       mbuf_traffic_class_t traffic_class = 0;

 
 

-       KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_START, 0,0,0,0,0);
+       KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_START, 0, 0, 0, 0, 0);

        /* sanity check for alignment. */
        if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) {
                ipseclog((LOG_ERR, "IPv4 ESP input: packet alignment problem "
        /* sanity check for alignment. */
        if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) {
                ipseclog((LOG_ERR, "IPv4 ESP input: packet alignment problem "

-                       "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len));
+                   "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len));

                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                goto bad;
        }
                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                goto bad;
        }


@@ -214,6 +246,8 @@ esp4_input(m, off)
                }
        }
 
                }
        }
 

+       m->m_pkthdr.csum_flags &= ~CSUM_RX_FLAGS;
+

        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 
        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 


@@ -222,13 +256,13 @@ esp4_input(m, off)
        if (ip->ip_p != IPPROTO_ESP &&
            !(ip->ip_p == IPPROTO_UDP && off >= sizeof(struct udphdr))) {
                ipseclog((LOG_DEBUG,
        if (ip->ip_p != IPPROTO_ESP &&
            !(ip->ip_p == IPPROTO_UDP && off >= sizeof(struct udphdr))) {
                ipseclog((LOG_DEBUG,

-                         "IPv4 ESP input: invalid protocol type\n"));
+                   "IPv4 ESP input: invalid protocol type\n"));

                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                goto bad;
        }
        esp = (struct esp *)(void *)(((u_int8_t *)ip) + off);
 #ifdef _IP_VHL
                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                goto bad;
        }
        esp = (struct esp *)(void *)(((u_int8_t *)ip) + off);
 #ifdef _IP_VHL

-       hlen = IP_VHL_HL(ip->ip_vhl) << 2;
+       hlen = (u_int8_t)(IP_VHL_HL(ip->ip_vhl) << 2);

 #else
        hlen = ip->ip_hl << 2;
 #endif
 #else
        hlen = ip->ip_hl << 2;
 #endif


@@ -236,12 +270,12 @@ esp4_input(m, off)
        /* find the sassoc. */
        spi = esp->esp_spi;
 
        /* find the sassoc. */
        spi = esp->esp_spi;
 

-       if ((sav = key_allocsa(AF_INET,
-                             (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst,
-                             IPPROTO_ESP, spi)) == 0) {
+       if ((sav = key_allocsa_extended(AF_INET,
+           (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst,
+           IPPROTO_ESP, spi, interface)) == 0) {

                ipseclog((LOG_WARNING,
                ipseclog((LOG_WARNING,

-                   "IPv4 ESP input: no key association found for spi %u\n",
-                   (u_int32_t)ntohl(spi)));
+                   "IPv4 ESP input: no key association found for spi %u (0x%08x)\n",
+                   (u_int32_t)ntohl(spi), (u_int32_t)ntohl(spi)));

                IPSEC_STAT_INCREMENT(ipsecstat.in_nosa);
                goto bad;
        }
                IPSEC_STAT_INCREMENT(ipsecstat.in_nosa);
                goto bad;
        }


@@ -249,18 +283,18 @@ esp4_input(m, off)
            printf("DP esp4_input called to allocate SA:0x%llx\n",
            (uint64_t)VM_KERNEL_ADDRPERM(sav)));
        if (sav->state != SADB_SASTATE_MATURE
            printf("DP esp4_input called to allocate SA:0x%llx\n",
            (uint64_t)VM_KERNEL_ADDRPERM(sav)));
        if (sav->state != SADB_SASTATE_MATURE

-        && sav->state != SADB_SASTATE_DYING) {
+           && sav->state != SADB_SASTATE_DYING) {

                ipseclog((LOG_DEBUG,
                ipseclog((LOG_DEBUG,

-                   "IPv4 ESP input: non-mature/dying SA found for spi %u\n",
-                   (u_int32_t)ntohl(spi)));
+                   "IPv4 ESP input: non-mature/dying SA found for spi %u (0x%08x)\n",
+                   (u_int32_t)ntohl(spi), (u_int32_t)ntohl(spi)));

                IPSEC_STAT_INCREMENT(ipsecstat.in_badspi);
                goto bad;
        }
        algo = esp_algorithm_lookup(sav->alg_enc);
        if (!algo) {
                ipseclog((LOG_DEBUG, "IPv4 ESP input: "
                IPSEC_STAT_INCREMENT(ipsecstat.in_badspi);
                goto bad;
        }
        algo = esp_algorithm_lookup(sav->alg_enc);
        if (!algo) {
                ipseclog((LOG_DEBUG, "IPv4 ESP input: "

-                   "unsupported encryption algorithm for spi %u\n",
-                   (u_int32_t)ntohl(spi)));
+                   "unsupported encryption algorithm for spi %u (0x%08x)\n",
+                   (u_int32_t)ntohl(spi), (u_int32_t)ntohl(spi)));

                IPSEC_STAT_INCREMENT(ipsecstat.in_badspi);
                goto bad;
        }
                IPSEC_STAT_INCREMENT(ipsecstat.in_badspi);
                goto bad;
        }


@@ -276,29 +310,39 @@ esp4_input(m, off)
 
        seq = ntohl(((struct newesp *)esp)->esp_seq);
 
 
        seq = ntohl(((struct newesp *)esp)->esp_seq);
 

+       if ((sav->flags2 & SADB_X_EXT_SA2_SEQ_PER_TRAFFIC_CLASS) ==
+           SADB_X_EXT_SA2_SEQ_PER_TRAFFIC_CLASS) {
+               u_int8_t dscp = ip->ip_tos >> IPTOS_DSCP_SHIFT;
+               traffic_class = rfc4594_dscp_to_tc(dscp);
+       }
+

        /* Save ICV from packet for verification later */
        size_t siz = 0;
        unsigned char saved_icv[AH_MAXSUMSIZE];
        if (algo->finalizedecrypt) {
                siz = algo->icvlen;
        /* Save ICV from packet for verification later */
        size_t siz = 0;
        unsigned char saved_icv[AH_MAXSUMSIZE];
        if (algo->finalizedecrypt) {
                siz = algo->icvlen;

-               m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) saved_icv);
+               VERIFY(siz <= USHRT_MAX);
+               m_copydata(m, m->m_pkthdr.len - (u_short)siz, (u_short)siz, (caddr_t) saved_icv);

                goto delay_icv;
        }
 
                goto delay_icv;
        }
 

-       if (!((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay
-        && (sav->alg_auth && sav->key_auth)))
+       if (!((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay[traffic_class] != NULL &&
+           (sav->alg_auth && sav->key_auth))) {

                goto noreplaycheck;
                goto noreplaycheck;

+       }

 
        if (sav->alg_auth == SADB_X_AALG_NULL ||
 
        if (sav->alg_auth == SADB_X_AALG_NULL ||

-           sav->alg_auth == SADB_AALG_NONE)
+           sav->alg_auth == SADB_AALG_NONE) {

                goto noreplaycheck;
                goto noreplaycheck;

+       }

 
        /*
         * check for sequence number.
         */
 
        /*
         * check for sequence number.
         */

-       if (ipsec_chkreplay(seq, sav))
+       _CASSERT(MBUF_TC_MAX <= UINT8_MAX);
+       if (ipsec_chkreplay(seq, sav, (u_int8_t)traffic_class)) {

                ; /*okey*/
                ; /*okey*/

-       else {
+       } else {

                IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay);
                ipseclog((LOG_WARNING,
                    "replay packet in IPv4 ESP input: %s %s\n",
                IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay);
                ipseclog((LOG_WARNING,
                    "replay packet in IPv4 ESP input: %s %s\n",


@@ -307,62 +351,63 @@ esp4_input(m, off)
        }
 
        /* check ICV */
        }
 
        /* check ICV */

-    {
-       u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4)));
-       u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4)));
-       const struct ah_algorithm *sumalgo;
-
-       sumalgo = ah_algorithm_lookup(sav->alg_auth);
-       if (!sumalgo)
-               goto noreplaycheck;
-       siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
-       if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
-               IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
-               goto bad;
-       }
-       if (AH_MAXSUMSIZE < siz) {
-               ipseclog((LOG_DEBUG,
-                   "internal error: AH_MAXSUMSIZE must be larger than %lu\n",
-                   (u_int32_t)siz));
-               IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
-               goto bad;
-       }
+       {
+               u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4)));
+               u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4)));
+               const struct ah_algorithm *sumalgo;
+
+               sumalgo = ah_algorithm_lookup(sav->alg_auth);
+               if (!sumalgo) {
+                       goto noreplaycheck;
+               }
+               siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
+               if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
+                       IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
+                       goto bad;
+               }
+               if (AH_MAXSUMSIZE < siz) {
+                       ipseclog((LOG_DEBUG,
+                           "internal error: AH_MAXSUMSIZE must be larger than %u\n",
+                           (u_int32_t)siz));
+                       IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
+                       goto bad;
+               }

 
 

-       m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) &sum0[0]);
+               m_copydata(m, m->m_pkthdr.len - (int)siz, (int)siz, (caddr_t) &sum0[0]);

 
 

-       if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) {
-               ipseclog((LOG_WARNING, "auth fail in IPv4 ESP input: %s %s\n",
-                   ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
-               IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail);
-               goto bad;
-       }
+               if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) {
+                       ipseclog((LOG_WARNING, "auth fail in IPv4 ESP input: %s %s\n",
+                           ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
+                       IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail);
+                       goto bad;
+               }

 
 

-       if (bcmp(sum0, sum, siz) != 0) {
-               ipseclog((LOG_WARNING, "auth fail in IPv4 ESP input: %s %s\n",
-                   ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
-               IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail);
-               goto bad;
-       }
+               if (cc_cmp_safe(siz, sum0, sum)) {
+                       ipseclog((LOG_WARNING, "cc_cmp fail in IPv4 ESP input: %s %s\n",
+                           ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
+                       IPSEC_STAT_INCREMENT(ipsecstat.in_espauthfail);
+                       goto bad;
+               }

 
 delay_icv:
 
 
 delay_icv:
 

-       /* strip off the authentication data */
-       m_adj(m, -siz);
-       ip = mtod(m, struct ip *);
+               /* strip off the authentication data */
+               m_adj(m, (int)-siz);
+               ip = mtod(m, struct ip *);

 #ifdef IPLEN_FLIPPED
 #ifdef IPLEN_FLIPPED

-       ip->ip_len = ip->ip_len - siz;
+               ip->ip_len = ip->ip_len - (u_short)siz;

 #else
 #else

-       ip->ip_len = htons(ntohs(ip->ip_len) - siz);
+               ip->ip_len = htons(ntohs(ip->ip_len) - siz);

 #endif
 #endif

-       m->m_flags |= M_AUTHIPDGM;
-       IPSEC_STAT_INCREMENT(ipsecstat.in_espauthsucc);
-    }
+               m->m_flags |= M_AUTHIPDGM;
+               IPSEC_STAT_INCREMENT(ipsecstat.in_espauthsucc);
+       }

 
        /*
         * update sequence number.
         */
 
        /*
         * update sequence number.
         */

-       if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay) {
-               if (ipsec_updatereplay(seq, sav)) {
+       if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay[traffic_class] != NULL) {
+               if (ipsec_updatereplay(seq, sav, (u_int8_t)traffic_class)) {

                        IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay);
                        goto bad;
                }
                        IPSEC_STAT_INCREMENT(ipsecstat.in_espreplay);
                        goto bad;
                }


@@ -376,10 +421,11 @@ noreplaycheck:
                esplen = sizeof(struct esp);
        } else {
                /* RFC 2406 */
                esplen = sizeof(struct esp);
        } else {
                /* RFC 2406 */

-               if (sav->flags & SADB_X_EXT_DERIV)
+               if (sav->flags & SADB_X_EXT_DERIV) {

                        esplen = sizeof(struct esp);
                        esplen = sizeof(struct esp);

-               else
+               } else {

                        esplen = sizeof(struct newesp);
                        esplen = sizeof(struct newesp);

+               }

        }
 
        if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) {
        }
 
        if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) {


@@ -390,7 +436,7 @@ noreplaycheck:
        }
 
        if (m->m_len < off + esplen + ivlen) {
        }
 
        if (m->m_len < off + esplen + ivlen) {

-               m = m_pullup(m, off + esplen + ivlen);
+               m = m_pullup(m, (int)(off + esplen + ivlen));

                if (!m) {
                        ipseclog((LOG_DEBUG,
                            "IPv4 ESP input: can't pullup in esp4_input\n"));
                if (!m) {
                        ipseclog((LOG_DEBUG,
                            "IPv4 ESP input: can't pullup in esp4_input\n"));


@@ -410,50 +456,43 @@ noreplaycheck:
        /*
         * decrypt the packet.
         */
        /*
         * decrypt the packet.
         */

-       if (!algo->decrypt)
+       if (!algo->decrypt) {

                panic("internal error: no decrypt function");
                panic("internal error: no decrypt function");

-       KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_START, 0,0,0,0,0);
+       }
+       KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_START, 0, 0, 0, 0, 0);

        if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
                /* m is already freed */
                m = NULL;
                ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s\n",
                    ipsec_logsastr(sav)));
                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
        if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
                /* m is already freed */
                m = NULL;
                ipseclog((LOG_ERR, "decrypt fail in IPv4 ESP input: %s\n",
                    ipsec_logsastr(sav)));
                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);

-               KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
+               KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1, 0, 0, 0, 0);

                goto bad;
        }
                goto bad;
        }

-       KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 2,0,0,0,0);
+       KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 2, 0, 0, 0, 0);

        IPSEC_STAT_INCREMENT(ipsecstat.in_esphist[sav->alg_enc]);
 
        m->m_flags |= M_DECRYPTED;
 
        IPSEC_STAT_INCREMENT(ipsecstat.in_esphist[sav->alg_enc]);
 
        m->m_flags |= M_DECRYPTED;
 

-       if (algo->finalizedecrypt)
-        {
-           unsigned char tag[algo->icvlen];
-           if ((*algo->finalizedecrypt)(sav, tag, algo->icvlen)) {
-               ipseclog((LOG_ERR, "packet decryption ICV failure\n"));
-               IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
-               KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
-               goto bad;
-           }     
-           if (memcmp(saved_icv, tag, algo->icvlen)) {
-               ipseclog((LOG_ERR, "packet decryption ICV mismatch\n"));
-               IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
-               KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
-               goto bad;
-           }
+       if (algo->finalizedecrypt) {
+               if ((*algo->finalizedecrypt)(sav, saved_icv, algo->icvlen)) {
+                       ipseclog((LOG_ERR, "esp4 packet decryption ICV failure\n"));
+                       IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
+                       KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1, 0, 0, 0, 0);
+                       goto bad;
+               }

        }
 
        /*
         * find the trailer of the ESP.
         */
        m_copydata(m, m->m_pkthdr.len - sizeof(esptail), sizeof(esptail),
        }
 
        /*
         * find the trailer of the ESP.
         */
        m_copydata(m, m->m_pkthdr.len - sizeof(esptail), sizeof(esptail),

-            (caddr_t)&esptail);
+           (caddr_t)&esptail);

        nxt = esptail.esp_nxt;
        taillen = esptail.esp_padlen + sizeof(esptail);
 
        if (m->m_pkthdr.len < taillen
        nxt = esptail.esp_nxt;
        taillen = esptail.esp_padlen + sizeof(esptail);
 
        if (m->m_pkthdr.len < taillen

-        || m->m_pkthdr.len - taillen < hlen) { /*?*/
+           || m->m_pkthdr.len - taillen < hlen) { /*?*/

                ipseclog((LOG_WARNING,
                    "bad pad length in IPv4 ESP input: %s %s\n",
                    ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
                ipseclog((LOG_WARNING,
                    "bad pad length in IPv4 ESP input: %s %s\n",
                    ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));


@@ -462,10 +501,10 @@ noreplaycheck:
        }
 
        /* strip off the trailing pad area. */
        }
 
        /* strip off the trailing pad area. */

-       m_adj(m, -taillen);
+       m_adj(m, (int)-taillen);

        ip = mtod(m, struct ip *);
 #ifdef IPLEN_FLIPPED
        ip = mtod(m, struct ip *);
 #ifdef IPLEN_FLIPPED

-       ip->ip_len = ip->ip_len - taillen;
+       ip->ip_len = ip->ip_len - (u_short)taillen;

 #else
        ip->ip_len = htons(ntohs(ip->ip_len) - taillen);
 #endif
 #else
        ip->ip_len = htons(ntohs(ip->ip_len) - taillen);
 #endif


@@ -475,10 +514,11 @@ noreplaycheck:
                        m = m_pullup(m, off);
                        if (!m) {
                                ipseclog((LOG_DEBUG,
                        m = m_pullup(m, off);
                        if (!m) {
                                ipseclog((LOG_DEBUG,

-                                         "IPv4 ESP input: invalid udp encapsulated ESP packet length \n"));
+                                   "IPv4 ESP input: invalid udp encapsulated ESP packet length \n"));

                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }
                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }

+                       ip = mtod(m, struct ip *);

                }
 
                // check the UDP encap header to detect changes in the source port, and then strip the header
                }
 
                // check the UDP encap header to detect changes in the source port, and then strip the header


@@ -486,8 +526,8 @@ noreplaycheck:
                // if peer is behind nat and this is the latest esp packet
                if ((sav->flags & SADB_X_EXT_NATT_DETECTED_PEER) != 0 &&
                    (sav->flags & SADB_X_EXT_OLD) == 0 &&
                // if peer is behind nat and this is the latest esp packet
                if ((sav->flags & SADB_X_EXT_NATT_DETECTED_PEER) != 0 &&
                    (sav->flags & SADB_X_EXT_OLD) == 0 &&

-                   seq && sav->replay &&
-                   seq >= sav->replay->lastseq)  {
+                   seq && sav->replay[traffic_class] &&
+                   seq >= sav->replay[traffic_class]->lastseq) {

                        struct udphdr *encap_uh = (__typeof__(encap_uh))(void *)((caddr_t)ip + off);
                        if (encap_uh->uh_sport &&
                            ntohs(encap_uh->uh_sport) != sav->remote_ike_port) {
                        struct udphdr *encap_uh = (__typeof__(encap_uh))(void *)((caddr_t)ip + off);
                        if (encap_uh->uh_sport &&
                            ntohs(encap_uh->uh_sport) != sav->remote_ike_port) {


@@ -498,19 +538,8 @@ noreplaycheck:
                esp = (struct esp *)(void *)(((u_int8_t *)ip) + off);
        }
 
                esp = (struct esp *)(void *)(((u_int8_t *)ip) + off);
        }
 

-       if (sav->utun_is_keepalive_fn) {
-               if (sav->utun_is_keepalive_fn(sav->utun_pcb, &m, nxt, sav->flags, (off + esplen + ivlen))) {
-                       if (m) {
-                               // not really bad, we just wanna exit
-                               IPSEC_STAT_INCREMENT(ipsecstat.in_success);
-                               m = NULL;
-                       }
-                       goto bad;
-               }
-       }
-

        /* was it transmitted over the IPsec tunnel SA? */
        /* was it transmitted over the IPsec tunnel SA? */

-       if (ipsec4_tunnel_validate(m, off + esplen + ivlen, nxt, sav, &ifamily)) {
+       if (ipsec4_tunnel_validate(m, (int)(off + esplen + ivlen), nxt, sav, &ifamily)) {

                ifaddr_t ifa;
                struct sockaddr_storage addr;
 
                ifaddr_t ifa;
                struct sockaddr_storage addr;
 


@@ -525,7 +554,7 @@ noreplaycheck:
                int sum;
 
                tos = ip->ip_tos;
                int sum;
 
                tos = ip->ip_tos;

-               m_adj(m, off + esplen + ivlen);
+               m_adj(m, (int)(off + esplen + ivlen));

                if (ifamily == AF_INET) {
                        struct sockaddr_in *ipaddr;
 
                if (ifamily == AF_INET) {
                        struct sockaddr_in *ipaddr;
 


@@ -546,30 +575,27 @@ noreplaycheck:
                        }
 
                        if (otos != ip->ip_tos) {
                        }
 
                        if (otos != ip->ip_tos) {

-                           sum = ~ntohs(ip->ip_sum) & 0xffff;
-                           sum += (~otos & 0xffff) + ip->ip_tos;
-                           sum = (sum >> 16) + (sum & 0xffff);
-                           sum += (sum >> 16);  /* add carry */
-                           ip->ip_sum = htons(~sum & 0xffff);
+                               sum = ~ntohs(ip->ip_sum) & 0xffff;
+                               sum += (~otos & 0xffff) + ip->ip_tos;
+                               sum = (sum >> 16) + (sum & 0xffff);
+                               sum += (sum >> 16); /* add carry */
+                               ip->ip_sum = htons(~sum & 0xffff);

                        }
 
                        if (!key_checktunnelsanity(sav, AF_INET,
                            (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst)) {
                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
                        }
 
                        if (!key_checktunnelsanity(sav, AF_INET,
                            (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst)) {
                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "

-                           "in ESP input: %s %s\n",
-                           ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
+                                   "in ESP input: %s %s\n",
+                                   ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));

                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }
 
                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }
 

-                       if (ip_doscopedroute) {
-                               bzero(&addr, sizeof(addr));
-                               ipaddr = (__typeof__(ipaddr))&addr;
-                               ipaddr->sin_family = AF_INET;
-                               ipaddr->sin_len = sizeof(*ipaddr);
-                               ipaddr->sin_addr = ip->ip_dst;
-                       }
-#if INET6
+                       bzero(&addr, sizeof(addr));
+                       ipaddr = (__typeof__(ipaddr)) & addr;
+                       ipaddr->sin_family = AF_INET;
+                       ipaddr->sin_len = sizeof(*ipaddr);
+                       ipaddr->sin_addr = ip->ip_dst;

                } else if (ifamily == AF_INET6) {
                        struct sockaddr_in6 *ip6addr;
 
                } else if (ifamily == AF_INET6) {
                        struct sockaddr_in6 *ip6addr;
 


@@ -602,23 +628,20 @@ noreplaycheck:
                        if (!key_checktunnelsanity(sav, AF_INET6,
                            (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst)) {
                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
                        if (!key_checktunnelsanity(sav, AF_INET6,
                            (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst)) {
                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "

-                           "in ESP input: %s %s\n",
-                           ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
+                                   "in ESP input: %s %s\n",
+                                   ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));

                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }
 
                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }
 

-                       if (ip6_doscopedroute) {
-                               bzero(&addr, sizeof(addr));
-                               ip6addr = (__typeof__(ip6addr))&addr;
-                               ip6addr->sin6_family = AF_INET6;
-                               ip6addr->sin6_len = sizeof(*ip6addr);
-                               ip6addr->sin6_addr = ip6->ip6_dst;
-                       }
-#endif /* INET6 */
+                       bzero(&addr, sizeof(addr));
+                       ip6addr = (__typeof__(ip6addr)) & addr;
+                       ip6addr->sin6_family = AF_INET6;
+                       ip6addr->sin6_len = sizeof(*ip6addr);
+                       ip6addr->sin6_addr = ip6->ip6_dst;

                } else {
                        ipseclog((LOG_ERR, "ipsec tunnel unsupported address family "
                } else {
                        ipseclog((LOG_ERR, "ipsec tunnel unsupported address family "

-                                 "in ESP input\n"));
+                           "in ESP input\n"));

                        goto bad;
                }
 
                        goto bad;
                }
 


@@ -629,41 +652,53 @@ noreplaycheck:
                        goto bad;
                }
 
                        goto bad;
                }
 

-               if (ip_doscopedroute || ip6_doscopedroute) {
-                       // update the receiving interface address based on the inner address
-                       ifa = ifa_ifwithaddr((struct sockaddr *)&addr);
-                       if (ifa) {
-                               m->m_pkthdr.rcvif = ifa->ifa_ifp;
-                               IFA_REMREF(ifa);
-                       }
+               // update the receiving interface address based on the inner address
+               ifa = ifa_ifwithaddr((struct sockaddr *)&addr);
+               if (ifa) {
+                       m->m_pkthdr.rcvif = ifa->ifa_ifp;
+                       IFA_REMREF(ifa);

                }
 
                /* Clear the csum flags, they can't be valid for the inner headers */
                m->m_pkthdr.csum_flags = 0;
 
                }
 
                /* Clear the csum flags, they can't be valid for the inner headers */
                m->m_pkthdr.csum_flags = 0;
 

-               // Input via IPSec interface
-               if (sav->sah->ipsec_if != NULL) {
-                       if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
-                               m = NULL;
+               // Input via IPsec interface
+               lck_mtx_lock(sadb_mutex);
+               ifnet_t ipsec_if = sav->sah->ipsec_if;
+               if (ipsec_if != NULL) {
+                       // If an interface is found, add a reference count before dropping the lock
+                       ifnet_reference(ipsec_if);
+               }
+               lck_mtx_unlock(sadb_mutex);
+               if (ipsec_if != NULL) {
+                       esp_input_log(m, sav, spi, seq);
+                       ipsec_save_wake_packet(m, ntohl(spi), seq);
+
+                       // Return mbuf
+                       if (interface != NULL &&
+                           interface == ipsec_if) {
+                               out_m = m;
+                               ifnet_release(ipsec_if);

                                goto done;
                                goto done;

-                       } else {
-                               goto bad;

                        }
                        }

-               }
-               
-               if (sav->utun_in_fn) {
-                       if (!(sav->utun_in_fn(sav->utun_pcb, &m, ifamily == AF_INET ? PF_INET : PF_INET6))) {
+
+                       errno_t inject_error = ipsec_inject_inbound_packet(ipsec_if, m);
+                       ifnet_release(ipsec_if);
+
+                       if (inject_error == 0) {

                                m = NULL;
                                m = NULL;

-                               // we just wanna exit since packet has been completely processed
+                               goto done;
+                       } else {

                                goto bad;
                        }
                }
 
                                goto bad;
                        }
                }
 

-               if (proto_input(ifamily == AF_INET ? PF_INET : PF_INET6, m) != 0)
+               if (proto_input(ifamily == AF_INET ? PF_INET : PF_INET6, m) != 0) {

                        goto bad;
                        goto bad;

+               }

 
                nxt = IPPROTO_DONE;
 
                nxt = IPPROTO_DONE;

-               KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 2,0,0,0,0);
+               KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 2, 0, 0, 0, 0);

        } else {
                /*
                 * strip off ESP header and IV.
        } else {
                /*
                 * strip off ESP header and IV.


@@ -682,18 +717,18 @@ noreplaycheck:
 
                ip = mtod(m, struct ip *);
 #ifdef IPLEN_FLIPPED
 
                ip = mtod(m, struct ip *);
 #ifdef IPLEN_FLIPPED

-               ip->ip_len = ip->ip_len - stripsiz;
+               ip->ip_len = ip->ip_len - (u_short)stripsiz;

 #else
                ip->ip_len = htons(ntohs(ip->ip_len) - stripsiz);
 #endif
 #else
                ip->ip_len = htons(ntohs(ip->ip_len) - stripsiz);
 #endif

-               ip->ip_p = nxt;
+               ip->ip_p = (u_int8_t)nxt;

 
                key_sa_recordxfer(sav, m);
                if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0) {
                        IPSEC_STAT_INCREMENT(ipsecstat.in_nomem);
                        goto bad;
                }
 
                key_sa_recordxfer(sav, m);
                if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0) {
                        IPSEC_STAT_INCREMENT(ipsecstat.in_nomem);
                        goto bad;
                }

-               
+

                /*
                 * Set the csum valid flag, if we authenticated the
                 * packet, the payload shouldn't be corrupt unless
                /*
                 * Set the csum valid flag, if we authenticated the
                 * packet, the payload shouldn't be corrupt unless


@@ -703,6 +738,7 @@ noreplaycheck:
                if (nxt == IPPROTO_TCP || nxt == IPPROTO_UDP) {
                        m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
                        m->m_pkthdr.csum_data = 0xFFFF;
                if (nxt == IPPROTO_TCP || nxt == IPPROTO_UDP) {
                        m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
                        m->m_pkthdr.csum_data = 0xFFFF;

+                       _CASSERT(offsetof(struct pkthdr, csum_data) == offsetof(struct pkthdr, csum_rx_val));

                }
 
                if (nxt != IPPROTO_DONE) {
                }
 
                if (nxt != IPPROTO_DONE) {


@@ -711,33 +747,33 @@ noreplaycheck:
                                IPSEC_STAT_INCREMENT(ipsecstat.in_polvio);
                                goto bad;
                        }
                                IPSEC_STAT_INCREMENT(ipsecstat.in_polvio);
                                goto bad;
                        }

-                       KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 3,0,0,0,0);
-                       
+                       KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 3, 0, 0, 0, 0);
+

                        /* translate encapsulated UDP port ? */
                        /* translate encapsulated UDP port ? */

-                       if ((sav->flags & SADB_X_EXT_NATT_MULTIPLEUSERS) != 0)  {
-                               struct udphdr   *udp;
-                               
-                               if (nxt != IPPROTO_UDP) {       /* not UPD packet - drop it */
+                       if ((sav->flags & SADB_X_EXT_NATT_MULTIPLEUSERS) != 0) {
+                               struct udphdr   *udp;
+
+                               if (nxt != IPPROTO_UDP) {       /* not UPD packet - drop it */

                                        IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                        goto bad;
                                }
                                        IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                        goto bad;
                                }

-                                       
+

                                if (m->m_len < off + sizeof(struct udphdr)) {
                                        m = m_pullup(m, off + sizeof(struct udphdr));
                                        if (!m) {
                                                ipseclog((LOG_DEBUG,
                                if (m->m_len < off + sizeof(struct udphdr)) {
                                        m = m_pullup(m, off + sizeof(struct udphdr));
                                        if (!m) {
                                                ipseclog((LOG_DEBUG,

-                                                       "IPv4 ESP input: can't pullup UDP header in esp4_input\n"));
+                                                   "IPv4 ESP input: can't pullup UDP header in esp4_input\n"));

                                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                                goto bad;
                                        }
                                        ip = mtod(m, struct ip *);
                                }
                                udp = (struct udphdr *)(void *)(((u_int8_t *)ip) + off);
                                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                                goto bad;
                                        }
                                        ip = mtod(m, struct ip *);
                                }
                                udp = (struct udphdr *)(void *)(((u_int8_t *)ip) + off);

-                       
+

                                lck_mtx_lock(sadb_mutex);
                                lck_mtx_lock(sadb_mutex);

-                               if (sav->natt_encapsulated_src_port == 0) {     
+                               if (sav->natt_encapsulated_src_port == 0) {

                                        sav->natt_encapsulated_src_port = udp->uh_sport;
                                        sav->natt_encapsulated_src_port = udp->uh_sport;

-                               } else if (sav->natt_encapsulated_src_port != udp->uh_sport) {  /* something wrong */
+                               } else if (sav->natt_encapsulated_src_port != udp->uh_sport) {  /* something wrong */

                                        IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                        lck_mtx_unlock(sadb_mutex);
                                        goto bad;
                                        IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                        lck_mtx_unlock(sadb_mutex);
                                        goto bad;


@@ -748,34 +784,58 @@ noreplaycheck:
                        }
 
                        DTRACE_IP6(receive, struct mbuf *, m, struct inpcb *, NULL,
                        }
 
                        DTRACE_IP6(receive, struct mbuf *, m, struct inpcb *, NULL,

-                               struct ip *, ip, struct ifnet *, m->m_pkthdr.rcvif,
-                               struct ip *, ip, struct ip6_hdr *, NULL);
-
-                       // Input via IPSec interface
-                       if (sav->sah->ipsec_if != NULL) {
+                           struct ip *, ip, struct ifnet *, m->m_pkthdr.rcvif,
+                           struct ip *, ip, struct ip6_hdr *, NULL);
+
+                       // Input via IPsec interface legacy path
+                       lck_mtx_lock(sadb_mutex);
+                       ifnet_t ipsec_if = sav->sah->ipsec_if;
+                       if (ipsec_if != NULL) {
+                               // If an interface is found, add a reference count before dropping the lock
+                               ifnet_reference(ipsec_if);
+                       }
+                       lck_mtx_unlock(sadb_mutex);
+                       if (ipsec_if != NULL) {
+                               int mlen;
+                               if ((mlen = m_length2(m, NULL)) < hlen) {
+                                       ipseclog((LOG_DEBUG,
+                                           "IPv4 ESP input: decrypted packet too short %d < %u\n",
+                                           mlen, hlen));
+                                       IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
+                                       ifnet_release(ipsec_if);
+                                       goto bad;
+                               }

                                ip->ip_len = htons(ip->ip_len + hlen);
                                ip->ip_off = htons(ip->ip_off);
                                ip->ip_sum = 0;
                                ip->ip_sum = ip_cksum_hdr_in(m, hlen);
                                ip->ip_len = htons(ip->ip_len + hlen);
                                ip->ip_off = htons(ip->ip_off);
                                ip->ip_sum = 0;
                                ip->ip_sum = ip_cksum_hdr_in(m, hlen);

-                               if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
-                                       m = NULL;
+
+                               esp_input_log(m, sav, spi, seq);
+                               ipsec_save_wake_packet(m, ntohl(spi), seq);
+
+                               // Return mbuf
+                               if (interface != NULL &&
+                                   interface == ipsec_if) {
+                                       out_m = m;
+                                       ifnet_release(ipsec_if);

                                        goto done;
                                        goto done;

-                               } else {
-                                       goto bad;

                                }
                                }

-                       }
-                       
-                       if (sav->utun_in_fn) {
-                               if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET))) {
+
+                               errno_t inject_error = ipsec_inject_inbound_packet(ipsec_if, m);
+                               ifnet_release(ipsec_if);
+
+                               if (inject_error == 0) {

                                        m = NULL;
                                        m = NULL;

-                                       // we just wanna exit since packet has been completely processed
+                                       goto done;
+                               } else {

                                        goto bad;
                                }
                        }
 
                                        goto bad;
                                }
                        }
 

-                       ip_proto_dispatch_in(m, off, nxt, 0);
-               } else
+                       ip_proto_dispatch_in(m, off, (u_int8_t)nxt, 0);
+               } else {

                        m_freem(m);
                        m_freem(m);

+               }

                m = NULL;
        }
 
                m = NULL;
        }
 


@@ -787,8 +847,7 @@ done:
                key_freesav(sav, KEY_SADB_UNLOCKED);
        }
        IPSEC_STAT_INCREMENT(ipsecstat.in_success);
                key_freesav(sav, KEY_SADB_UNLOCKED);
        }
        IPSEC_STAT_INCREMENT(ipsecstat.in_success);

-       return;
-
+       return out_m;

 bad:
        if (sav) {
                KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
 bad:
        if (sav) {
                KEYDEBUG(KEYDEBUG_IPSEC_STAMP,


@@ -796,16 +855,21 @@ bad:
                    (uint64_t)VM_KERNEL_ADDRPERM(sav)));
                key_freesav(sav, KEY_SADB_UNLOCKED);
        }
                    (uint64_t)VM_KERNEL_ADDRPERM(sav)));
                key_freesav(sav, KEY_SADB_UNLOCKED);
        }

-       if (m)
+       if (m) {

                m_freem(m);
                m_freem(m);

-       KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 4,0,0,0,0);
-       return;
+       }
+       KERNEL_DEBUG(DBG_FNC_ESPIN | DBG_FUNC_END, 4, 0, 0, 0, 0);
+       return out_m;

 }
 }

-#endif /* INET */

 
 

-#if INET6

 int
 esp6_input(struct mbuf **mp, int *offp, int proto)
 int
 esp6_input(struct mbuf **mp, int *offp, int proto)

+{
+       return esp6_input_extended(mp, offp, proto, NULL);
+}
+
+int
+esp6_input_extended(struct mbuf **mp, int *offp, int proto, ifnet_t interface)

 {
 #pragma unused(proto)
        struct mbuf *m = *mp;
 {
 #pragma unused(proto)
        struct mbuf *m = *mp;


@@ -817,18 +881,19 @@ esp6_input(struct mbuf **mp, int *offp, int proto)
        u_int32_t spi;
        u_int32_t seq;
        struct secasvar *sav = NULL;
        u_int32_t spi;
        u_int32_t seq;
        struct secasvar *sav = NULL;

-       size_t taillen;

        u_int16_t nxt;
        char *nproto;
        const struct esp_algorithm *algo;
        int ivlen;
        size_t esplen;
        u_int16_t nxt;
        char *nproto;
        const struct esp_algorithm *algo;
        int ivlen;
        size_t esplen;

+       u_int16_t taillen;

        sa_family_t ifamily;
        sa_family_t ifamily;

+       mbuf_traffic_class_t traffic_class = 0;

 
        /* sanity check for alignment. */
        if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) {
                ipseclog((LOG_ERR, "IPv6 ESP input: packet alignment problem "
 
        /* sanity check for alignment. */
        if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) {
                ipseclog((LOG_ERR, "IPv6 ESP input: packet alignment problem "

-                       "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len));
+                   "(off=%d, pktlen=%d)\n", off, m->m_pkthdr.len));

                IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
                goto bad;
        }
                IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
                goto bad;
        }


@@ -843,6 +908,8 @@ esp6_input(struct mbuf **mp, int *offp, int proto)
                return IPPROTO_DONE;
        }
 #endif
                return IPPROTO_DONE;
        }
 #endif

+       m->m_pkthdr.csum_flags &= ~CSUM_RX_FLAGS;
+

        /* Expect 32-bit data aligned pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 
        /* Expect 32-bit data aligned pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 


@@ -866,12 +933,23 @@ esp6_input(struct mbuf **mp, int *offp, int proto)
        /* find the sassoc. */
        spi = esp->esp_spi;
 
        /* find the sassoc. */
        spi = esp->esp_spi;
 

-       if ((sav = key_allocsa(AF_INET6,
-                             (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst,
-                             IPPROTO_ESP, spi)) == 0) {
+       if ((sav = key_allocsa_extended(AF_INET6,
+           (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst,
+           IPPROTO_ESP, spi, interface)) == 0) {

                ipseclog((LOG_WARNING,
                ipseclog((LOG_WARNING,

-                   "IPv6 ESP input: no key association found for spi %u\n",
-                   (u_int32_t)ntohl(spi)));
+                   "IPv6 ESP input: no key association found for spi %u (0x%08x) seq %u"
+                   " src %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x"
+                   " dst %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x if %s\n",
+                   (u_int32_t)ntohl(spi), (u_int32_t)ntohl(spi), ntohl(((struct newesp *)esp)->esp_seq),
+                   ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[0]), ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[1]),
+                   ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[2]), ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[3]),
+                   ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[4]), ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[5]),
+                   ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[6]), ntohs(ip6->ip6_src.__u6_addr.__u6_addr16[7]),
+                   ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[0]), ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[1]),
+                   ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[2]), ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[3]),
+                   ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[4]), ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[5]),
+                   ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[6]), ntohs(ip6->ip6_dst.__u6_addr.__u6_addr16[7]),
+                   ((interface != NULL) ? if_name(interface) : "NONE")));

                IPSEC_STAT_INCREMENT(ipsec6stat.in_nosa);
                goto bad;
        }
                IPSEC_STAT_INCREMENT(ipsec6stat.in_nosa);
                goto bad;
        }


@@ -879,18 +957,18 @@ esp6_input(struct mbuf **mp, int *offp, int proto)
            printf("DP esp6_input called to allocate SA:0x%llx\n",
            (uint64_t)VM_KERNEL_ADDRPERM(sav)));
        if (sav->state != SADB_SASTATE_MATURE
            printf("DP esp6_input called to allocate SA:0x%llx\n",
            (uint64_t)VM_KERNEL_ADDRPERM(sav)));
        if (sav->state != SADB_SASTATE_MATURE

-        && sav->state != SADB_SASTATE_DYING) {
+           && sav->state != SADB_SASTATE_DYING) {

                ipseclog((LOG_DEBUG,
                ipseclog((LOG_DEBUG,

-                   "IPv6 ESP input: non-mature/dying SA found for spi %u\n",
-                   (u_int32_t)ntohl(spi)));
+                   "IPv6 ESP input: non-mature/dying SA found for spi %u (0x%08x)\n",
+                   (u_int32_t)ntohl(spi), (u_int32_t)ntohl(spi)));

                IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi);
                goto bad;
        }
        algo = esp_algorithm_lookup(sav->alg_enc);
        if (!algo) {
                ipseclog((LOG_DEBUG, "IPv6 ESP input: "
                IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi);
                goto bad;
        }
        algo = esp_algorithm_lookup(sav->alg_enc);
        if (!algo) {
                ipseclog((LOG_DEBUG, "IPv6 ESP input: "

-                   "unsupported encryption algorithm for spi %u\n",
-                   (u_int32_t)ntohl(spi)));
+                   "unsupported encryption algorithm for spi %u (0x%08x)\n",
+                   (u_int32_t)ntohl(spi), (u_int32_t)ntohl(spi)));

                IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi);
                goto bad;
        }
                IPSEC_STAT_INCREMENT(ipsec6stat.in_badspi);
                goto bad;
        }


@@ -906,29 +984,39 @@ esp6_input(struct mbuf **mp, int *offp, int proto)
 
        seq = ntohl(((struct newesp *)esp)->esp_seq);
 
 
        seq = ntohl(((struct newesp *)esp)->esp_seq);
 

+       if ((sav->flags2 & SADB_X_EXT_SA2_SEQ_PER_TRAFFIC_CLASS) ==
+           SADB_X_EXT_SA2_SEQ_PER_TRAFFIC_CLASS) {
+               u_int8_t dscp = (ntohl(ip6->ip6_flow) & IP6FLOW_DSCP_MASK) >> IP6FLOW_DSCP_SHIFT;
+               traffic_class = rfc4594_dscp_to_tc(dscp);
+       }
+

        /* Save ICV from packet for verification later */
        size_t siz = 0;
        unsigned char saved_icv[AH_MAXSUMSIZE];
        if (algo->finalizedecrypt) {
                siz = algo->icvlen;
        /* Save ICV from packet for verification later */
        size_t siz = 0;
        unsigned char saved_icv[AH_MAXSUMSIZE];
        if (algo->finalizedecrypt) {
                siz = algo->icvlen;

-               m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) saved_icv);
+               VERIFY(siz <= UINT16_MAX);
+               m_copydata(m, m->m_pkthdr.len - (int)siz, (int)siz, (caddr_t) saved_icv);

                goto delay_icv;
        }
 
                goto delay_icv;
        }
 

-       if (!((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay
-        && (sav->alg_auth && sav->key_auth)))
+       if (!((sav->flags & SADB_X_EXT_OLD) == 0 &&
+           sav->replay[traffic_class] != NULL &&
+           (sav->alg_auth && sav->key_auth))) {

                goto noreplaycheck;
                goto noreplaycheck;

+       }

 
        if (sav->alg_auth == SADB_X_AALG_NULL ||
 
        if (sav->alg_auth == SADB_X_AALG_NULL ||

-           sav->alg_auth == SADB_AALG_NONE)
+           sav->alg_auth == SADB_AALG_NONE) {

                goto noreplaycheck;
                goto noreplaycheck;

+       }

 
        /*
         * check for sequence number.
         */
 
        /*
         * check for sequence number.
         */

-       if (ipsec_chkreplay(seq, sav))
+       if (ipsec_chkreplay(seq, sav, (u_int8_t)traffic_class)) {

                ; /*okey*/
                ; /*okey*/

-       else {
+       } else {

                IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay);
                ipseclog((LOG_WARNING,
                    "replay packet in IPv6 ESP input: %s %s\n",
                IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay);
                ipseclog((LOG_WARNING,
                    "replay packet in IPv6 ESP input: %s %s\n",


@@ -937,59 +1025,60 @@ esp6_input(struct mbuf **mp, int *offp, int proto)
        }
 
        /* check ICV */
        }
 
        /* check ICV */

-    {
-       u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4)));
-       u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4)));
-       const struct ah_algorithm *sumalgo;
-
-       sumalgo = ah_algorithm_lookup(sav->alg_auth);
-       if (!sumalgo)
-               goto noreplaycheck;
-       siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
-       if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
-               IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
-               goto bad;
-       }
-       if (AH_MAXSUMSIZE < siz) {
-               ipseclog((LOG_DEBUG,
-                   "internal error: AH_MAXSUMSIZE must be larger than %lu\n",
-                   (u_int32_t)siz));
-               IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
-               goto bad;
-       }
+       {
+               u_char sum0[AH_MAXSUMSIZE] __attribute__((aligned(4)));
+               u_char sum[AH_MAXSUMSIZE] __attribute__((aligned(4)));
+               const struct ah_algorithm *sumalgo;
+
+               sumalgo = ah_algorithm_lookup(sav->alg_auth);
+               if (!sumalgo) {
+                       goto noreplaycheck;
+               }
+               siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
+               if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
+                       IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
+                       goto bad;
+               }
+               if (AH_MAXSUMSIZE < siz) {
+                       ipseclog((LOG_DEBUG,
+                           "internal error: AH_MAXSUMSIZE must be larger than %u\n",
+                           (u_int32_t)siz));
+                       IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
+                       goto bad;
+               }

 
 

-       m_copydata(m, m->m_pkthdr.len - siz, siz, (caddr_t) &sum0[0]);
+               m_copydata(m, m->m_pkthdr.len - (int)siz, (int)siz, (caddr_t) &sum0[0]);

 
 

-       if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) {
-               ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n",
-                   ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
-               IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail);
-               goto bad;
-       }
+               if (esp_auth(m, off, m->m_pkthdr.len - off - siz, sav, sum)) {
+                       ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n",
+                           ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
+                       IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail);
+                       goto bad;
+               }

 
 

-       if (bcmp(sum0, sum, siz) != 0) {
-               ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n",
-                   ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
-               IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail);
-               goto bad;
-       }
+               if (cc_cmp_safe(siz, sum0, sum)) {
+                       ipseclog((LOG_WARNING, "auth fail in IPv6 ESP input: %s %s\n",
+                           ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
+                       IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthfail);
+                       goto bad;
+               }

 
 delay_icv:
 
 
 delay_icv:
 

-       /* strip off the authentication data */
-       m_adj(m, -siz);
-       ip6 = mtod(m, struct ip6_hdr *);
-       ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - siz);
+               /* strip off the authentication data */
+               m_adj(m, (int)-siz);
+               ip6 = mtod(m, struct ip6_hdr *);
+               ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - (u_int16_t)siz);

 
 

-       m->m_flags |= M_AUTHIPDGM;
-       IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthsucc);
-    }
+               m->m_flags |= M_AUTHIPDGM;
+               IPSEC_STAT_INCREMENT(ipsec6stat.in_espauthsucc);
+       }

 
        /*
         * update sequence number.
         */
 
        /*
         * update sequence number.
         */

-       if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay) {
-               if (ipsec_updatereplay(seq, sav)) {
+       if ((sav->flags & SADB_X_EXT_OLD) == 0 && sav->replay[traffic_class] != NULL) {
+               if (ipsec_updatereplay(seq, sav, (u_int8_t)traffic_class)) {

                        IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay);
                        goto bad;
                }
                        IPSEC_STAT_INCREMENT(ipsec6stat.in_espreplay);
                        goto bad;
                }


@@ -1003,10 +1092,11 @@ noreplaycheck:
                esplen = sizeof(struct esp);
        } else {
                /* RFC 2406 */
                esplen = sizeof(struct esp);
        } else {
                /* RFC 2406 */

-               if (sav->flags & SADB_X_EXT_DERIV)
+               if (sav->flags & SADB_X_EXT_DERIV) {

                        esplen = sizeof(struct esp);
                        esplen = sizeof(struct esp);

-               else
+               } else {

                        esplen = sizeof(struct newesp);
                        esplen = sizeof(struct newesp);

+               }

        }
 
        if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) {
        }
 
        if (m->m_pkthdr.len < off + esplen + ivlen + sizeof(esptail)) {


@@ -1017,7 +1107,7 @@ noreplaycheck:
        }
 
 #ifndef PULLDOWN_TEST
        }
 
 #ifndef PULLDOWN_TEST

-       IP6_EXTHDR_CHECK(m, off, esplen + ivlen, return IPPROTO_DONE);  /*XXX*/
+       IP6_EXTHDR_CHECK(m, off, (int)(esplen + ivlen), return IPPROTO_DONE);  /*XXX*/

 #else
        IP6_EXTHDR_GET(esp, struct esp *, m, off, esplen + ivlen);
        if (esp == NULL) {
 #else
        IP6_EXTHDR_GET(esp, struct esp *, m, off, esplen + ivlen);
        if (esp == NULL) {


@@ -1026,7 +1116,7 @@ noreplaycheck:
                goto bad;
        }
 #endif
                goto bad;
        }
 #endif

-       ip6 = mtod(m, struct ip6_hdr *);        /*set it again just in case*/
+       ip6 = mtod(m, struct ip6_hdr *);        /*set it again just in case*/

 
        /*
         * pre-compute and cache intermediate key
 
        /*
         * pre-compute and cache intermediate key


@@ -1039,8 +1129,9 @@ noreplaycheck:
        /*
         * decrypt the packet.
         */
        /*
         * decrypt the packet.
         */

-       if (!algo->decrypt)
+       if (!algo->decrypt) {

                panic("internal error: no decrypt function");
                panic("internal error: no decrypt function");

+       }

        if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
                /* m is already freed */
                m = NULL;
        if ((*algo->decrypt)(m, off, sav, algo, ivlen)) {
                /* m is already freed */
                m = NULL;


@@ -1053,33 +1144,25 @@ noreplaycheck:
 
        m->m_flags |= M_DECRYPTED;
 
 
        m->m_flags |= M_DECRYPTED;
 

-       if (algo->finalizedecrypt)
-        {
-           unsigned char tag[algo->icvlen];
-           if ((*algo->finalizedecrypt)(sav, tag, algo->icvlen)) {
-               ipseclog((LOG_ERR, "packet decryption ICV failure\n"));
-               IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
-               KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
-               goto bad;
-           }     
-           if (memcmp(saved_icv, tag, algo->icvlen)) {
-               ipseclog((LOG_ERR, "packet decryption ICV mismatch\n"));
-               IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
-               KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1,0,0,0,0);
-               goto bad;
-           }
+       if (algo->finalizedecrypt) {
+               if ((*algo->finalizedecrypt)(sav, saved_icv, algo->icvlen)) {
+                       ipseclog((LOG_ERR, "esp6 packet decryption ICV failure\n"));
+                       IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
+                       KERNEL_DEBUG(DBG_FNC_DECRYPT | DBG_FUNC_END, 1, 0, 0, 0, 0);
+                       goto bad;
+               }

        }
 
        /*
         * find the trailer of the ESP.
         */
        m_copydata(m, m->m_pkthdr.len - sizeof(esptail), sizeof(esptail),
        }
 
        /*
         * find the trailer of the ESP.
         */
        m_copydata(m, m->m_pkthdr.len - sizeof(esptail), sizeof(esptail),

-            (caddr_t)&esptail);
+           (caddr_t)&esptail);

        nxt = esptail.esp_nxt;
        taillen = esptail.esp_padlen + sizeof(esptail);
 
        if (m->m_pkthdr.len < taillen
        nxt = esptail.esp_nxt;
        taillen = esptail.esp_padlen + sizeof(esptail);
 
        if (m->m_pkthdr.len < taillen

-        || m->m_pkthdr.len - taillen < sizeof(struct ip6_hdr)) {       /*?*/
+           || m->m_pkthdr.len - taillen < sizeof(struct ip6_hdr)) {    /*?*/

                ipseclog((LOG_WARNING,
                    "bad pad length in IPv6 ESP input: %s %s\n",
                    ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));
                ipseclog((LOG_WARNING,
                    "bad pad length in IPv6 ESP input: %s %s\n",
                    ipsec6_logpacketstr(ip6, spi), ipsec_logsastr(sav)));


@@ -1092,27 +1175,17 @@ noreplaycheck:
        ip6 = mtod(m, struct ip6_hdr *);
        ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - taillen);
 
        ip6 = mtod(m, struct ip6_hdr *);
        ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - taillen);
 

-       if (sav->utun_is_keepalive_fn) {
-               if (sav->utun_is_keepalive_fn(sav->utun_pcb, &m, nxt, sav->flags, (off + esplen + ivlen))) {
-                       if (m) {
-                               // not really bad, we just wanna exit
-                               IPSEC_STAT_INCREMENT(ipsec6stat.in_success);
-                               m = NULL;
-                       }
-                       goto bad;
-               }
-       }
-

        if (*nproto == IPPROTO_UDP) {
                // offset includes the outer ip and udp header lengths.
                if (m->m_len < off) {
        if (*nproto == IPPROTO_UDP) {
                // offset includes the outer ip and udp header lengths.
                if (m->m_len < off) {

-                       m = m_pullup(m,  off);
+                       m = m_pullup(m, off);

                        if (!m) {
                                ipseclog((LOG_DEBUG,
                        if (!m) {
                                ipseclog((LOG_DEBUG,

-                                       "IPv6 ESP input: invalid udp encapsulated ESP packet length\n"));
+                                   "IPv6 ESP input: invalid udp encapsulated ESP packet length\n"));

                                IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
                                goto bad;
                        }
                                IPSEC_STAT_INCREMENT(ipsec6stat.in_inval);
                                goto bad;
                        }

+                       ip6 = mtod(m, struct ip6_hdr *);

                }
 
                // check the UDP encap header to detect changes in the source port, and then strip the header
                }
 
                // check the UDP encap header to detect changes in the source port, and then strip the header


@@ -1120,8 +1193,8 @@ noreplaycheck:
                // if peer is behind nat and this is the latest esp packet
                if ((sav->flags & SADB_X_EXT_NATT_DETECTED_PEER) != 0 &&
                    (sav->flags & SADB_X_EXT_OLD) == 0 &&
                // if peer is behind nat and this is the latest esp packet
                if ((sav->flags & SADB_X_EXT_NATT_DETECTED_PEER) != 0 &&
                    (sav->flags & SADB_X_EXT_OLD) == 0 &&

-                   seq && sav->replay &&
-                   seq >= sav->replay->lastseq)  {
+                   seq && sav->replay[traffic_class] &&
+                   seq >= sav->replay[traffic_class]->lastseq) {

                        struct udphdr *encap_uh = (__typeof__(encap_uh))(void *)((caddr_t)ip6 + off);
                        if (encap_uh->uh_sport &&
                            ntohs(encap_uh->uh_sport) != sav->remote_ike_port) {
                        struct udphdr *encap_uh = (__typeof__(encap_uh))(void *)((caddr_t)ip6 + off);
                        if (encap_uh->uh_sport &&
                            ntohs(encap_uh->uh_sport) != sav->remote_ike_port) {


@@ -1134,7 +1207,7 @@ noreplaycheck:
 
 
        /* was it transmitted over the IPsec tunnel SA? */
 
 
        /* was it transmitted over the IPsec tunnel SA? */

-       if (ipsec6_tunnel_validate(m, off + esplen + ivlen, nxt, sav, &ifamily)) {
+       if (ipsec6_tunnel_validate(m, (int)(off + esplen + ivlen), nxt, sav, &ifamily)) {

                ifaddr_t ifa;
                struct sockaddr_storage addr;
 
                ifaddr_t ifa;
                struct sockaddr_storage addr;
 


@@ -1145,10 +1218,12 @@ noreplaycheck:
                 * XXX more sanity checks
                 * XXX relationship with gif?
                 */
                 * XXX more sanity checks
                 * XXX relationship with gif?
                 */

-               u_int32_t flowinfo;     /*net endian*/
+               u_int32_t flowinfo;     /*net endian*/

                flowinfo = ip6->ip6_flow;
                flowinfo = ip6->ip6_flow;

-               m_adj(m, off + esplen + ivlen);
+               m_adj(m, (int)(off + esplen + ivlen));

                if (ifamily == AF_INET6) {
                if (ifamily == AF_INET6) {

+                       struct sockaddr_in6 *ip6addr;
+

                        if (m->m_len < sizeof(*ip6)) {
 #ifndef PULLDOWN_TEST
                                /*
                        if (m->m_len < sizeof(*ip6)) {
 #ifndef PULLDOWN_TEST
                                /*


@@ -1171,7 +1246,7 @@ noreplaycheck:
                                goto bad;
                        }
                        if (!key_checktunnelsanity(sav, AF_INET6,
                                goto bad;
                        }
                        if (!key_checktunnelsanity(sav, AF_INET6,

-                                   (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst)) {
+                           (caddr_t)&ip6->ip6_src, (caddr_t)&ip6->ip6_dst)) {

                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
                                    "in IPv6 ESP input: %s %s\n",
                                    ipsec6_logpacketstr(ip6, spi),
                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
                                    "in IPv6 ESP input: %s %s\n",
                                    ipsec6_logpacketstr(ip6, spi),


@@ -1180,15 +1255,11 @@ noreplaycheck:
                                goto bad;
                        }
 
                                goto bad;
                        }
 

-                       if (ip6_doscopedroute) {
-                               struct sockaddr_in6 *ip6addr;
-
-                               bzero(&addr, sizeof(addr));
-                               ip6addr = (__typeof__(ip6addr))&addr;
-                               ip6addr->sin6_family = AF_INET6;
-                               ip6addr->sin6_len = sizeof(*ip6addr);
-                               ip6addr->sin6_addr = ip6->ip6_dst;
-                       }
+                       bzero(&addr, sizeof(addr));
+                       ip6addr = (__typeof__(ip6addr)) & addr;
+                       ip6addr->sin6_family = AF_INET6;
+                       ip6addr->sin6_len = sizeof(*ip6addr);
+                       ip6addr->sin6_addr = ip6->ip6_dst;

                } else if (ifamily == AF_INET) {
                        struct sockaddr_in *ipaddr;
 
                } else if (ifamily == AF_INET) {
                        struct sockaddr_in *ipaddr;
 


@@ -1212,50 +1283,66 @@ noreplaycheck:
                        }
 
                        if (otos != ip->ip_tos) {
                        }
 
                        if (otos != ip->ip_tos) {

-                           sum = ~ntohs(ip->ip_sum) & 0xffff;
-                           sum += (~otos & 0xffff) + ip->ip_tos;
-                           sum = (sum >> 16) + (sum & 0xffff);
-                           sum += (sum >> 16);  /* add carry */
-                           ip->ip_sum = htons(~sum & 0xffff);
+                               sum = ~ntohs(ip->ip_sum) & 0xffff;
+                               sum += (~otos & 0xffff) + ip->ip_tos;
+                               sum = (sum >> 16) + (sum & 0xffff);
+                               sum += (sum >> 16); /* add carry */
+                               ip->ip_sum = htons(~sum & 0xffff);

                        }
 
                        if (!key_checktunnelsanity(sav, AF_INET,
                            (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst)) {
                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "
                        }
 
                        if (!key_checktunnelsanity(sav, AF_INET,
                            (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst)) {
                                ipseclog((LOG_ERR, "ipsec tunnel address mismatch "

-                           "in ESP input: %s %s\n",
-                           ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));
+                                   "in ESP input: %s %s\n",
+                                   ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));

                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }
 
                                IPSEC_STAT_INCREMENT(ipsecstat.in_inval);
                                goto bad;
                        }
 

-                       if (ip_doscopedroute) {
-                               bzero(&addr, sizeof(addr));
-                               ipaddr = (__typeof__(ipaddr))&addr;
-                               ipaddr->sin_family = AF_INET;
-                               ipaddr->sin_len = sizeof(*ipaddr);
-                               ipaddr->sin_addr = ip->ip_dst;
-                       }
+                       bzero(&addr, sizeof(addr));
+                       ipaddr = (__typeof__(ipaddr)) & addr;
+                       ipaddr->sin_family = AF_INET;
+                       ipaddr->sin_len = sizeof(*ipaddr);
+                       ipaddr->sin_addr = ip->ip_dst;

                }
 
                key_sa_recordxfer(sav, m);
                }
 
                key_sa_recordxfer(sav, m);

-               if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0 || 
+               if (ipsec_addhist(m, IPPROTO_ESP, spi) != 0 ||

                    ipsec_addhist(m, IPPROTO_IPV6, 0) != 0) {
                        IPSEC_STAT_INCREMENT(ipsec6stat.in_nomem);
                        goto bad;
                }
 
                    ipsec_addhist(m, IPPROTO_IPV6, 0) != 0) {
                        IPSEC_STAT_INCREMENT(ipsec6stat.in_nomem);
                        goto bad;
                }
 

-               if (ip_doscopedroute || ip6_doscopedroute) {
-                       // update the receiving interface address based on the inner address
-                       ifa = ifa_ifwithaddr((struct sockaddr *)&addr);
-                       if (ifa) {
-                               m->m_pkthdr.rcvif = ifa->ifa_ifp;
-                               IFA_REMREF(ifa);
-                       }
+               // update the receiving interface address based on the inner address
+               ifa = ifa_ifwithaddr((struct sockaddr *)&addr);
+               if (ifa) {
+                       m->m_pkthdr.rcvif = ifa->ifa_ifp;
+                       IFA_REMREF(ifa);

                }
 
                }
 

-               // Input via IPSec interface
-               if (sav->sah->ipsec_if != NULL) {
-                       if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
+               // Input via IPsec interface
+               lck_mtx_lock(sadb_mutex);
+               ifnet_t ipsec_if = sav->sah->ipsec_if;
+               if (ipsec_if != NULL) {
+                       // If an interface is found, add a reference count before dropping the lock
+                       ifnet_reference(ipsec_if);
+               }
+               lck_mtx_unlock(sadb_mutex);
+               if (ipsec_if != NULL) {
+                       esp_input_log(m, sav, spi, seq);
+                       ipsec_save_wake_packet(m, ntohl(spi), seq);
+
+                       // Return mbuf
+                       if (interface != NULL &&
+                           interface == ipsec_if) {
+                               ifnet_release(ipsec_if);
+                               goto done;
+                       }
+
+                       errno_t inject_error = ipsec_inject_inbound_packet(ipsec_if, m);
+                       ifnet_release(ipsec_if);
+
+                       if (inject_error == 0) {

                                m = NULL;
                                nxt = IPPROTO_DONE;
                                goto done;
                                m = NULL;
                                nxt = IPPROTO_DONE;
                                goto done;


@@ -1263,17 +1350,10 @@ noreplaycheck:
                                goto bad;
                        }
                }
                                goto bad;
                        }
                }

-               
-               if (sav->utun_in_fn) {
-                       if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET6))) {
-                               m = NULL;
-                               // we just wanna exit since packet has been completely processed
-                               goto bad;
-                       }
-               }

 
 

-               if (proto_input(ifamily == AF_INET ? PF_INET : PF_INET6, m) != 0)
+               if (proto_input(ifamily == AF_INET ? PF_INET : PF_INET6, m) != 0) {

                        goto bad;
                        goto bad;

+               }

                nxt = IPPROTO_DONE;
        } else {
                /*
                nxt = IPPROTO_DONE;
        } else {
                /*


@@ -1281,16 +1361,17 @@ noreplaycheck:
                 * even in m_pulldown case, we need to strip off ESP so that
                 * we can always compute checksum for AH correctly.
                 */
                 * even in m_pulldown case, we need to strip off ESP so that
                 * we can always compute checksum for AH correctly.
                 */

-               size_t stripsiz;
+               u_int16_t stripsiz;

                char *prvnxtp;
 
                /*
                 * Set the next header field of the previous header correctly.
                 */
                prvnxtp = ip6_get_prevhdr(m, off); /* XXX */
                char *prvnxtp;
 
                /*
                 * Set the next header field of the previous header correctly.
                 */
                prvnxtp = ip6_get_prevhdr(m, off); /* XXX */

-               *prvnxtp = nxt;
+               *prvnxtp = (u_int8_t)nxt;

 
 

-               stripsiz = esplen + ivlen;
+               VERIFY(esplen + ivlen <= UINT16_MAX);
+               stripsiz = (u_int16_t)(esplen + ivlen);

 
                ip6 = mtod(m, struct ip6_hdr *);
                if (m->m_len >= stripsiz + off) {
 
                ip6 = mtod(m, struct ip6_hdr *);
                if (m->m_len >= stripsiz + off) {


@@ -1327,10 +1408,11 @@ noreplaycheck:
                        struct mbuf *n = NULL;
                        int maxlen;
 
                        struct mbuf *n = NULL;
                        int maxlen;
 

-                       MGETHDR(n, M_DONTWAIT, MT_HEADER);      /* MAC-OK */
+                       MGETHDR(n, M_DONTWAIT, MT_HEADER);      /* MAC-OK */

                        maxlen = MHLEN;
                        maxlen = MHLEN;

-                       if (n)
+                       if (n) {

                                M_COPY_PKTHDR(n, m);
                                M_COPY_PKTHDR(n, m);

+                       }

                        if (n && m->m_pkthdr.len > maxlen) {
                                MCLGET(n, M_DONTWAIT);
                                maxlen = MCLBYTES;
                        if (n && m->m_pkthdr.len > maxlen) {
                                MCLGET(n, M_DONTWAIT);
                                maxlen = MCLBYTES;


@@ -1361,7 +1443,6 @@ noreplaycheck:
                        m = n;
                }
 #endif
                        m = n;
                }
 #endif

-

                ip6 = mtod(m, struct ip6_hdr *);
                ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - stripsiz);
 
                ip6 = mtod(m, struct ip6_hdr *);
                ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - stripsiz);
 


@@ -1380,11 +1461,32 @@ noreplaycheck:
                if (nxt == IPPROTO_TCP || nxt == IPPROTO_UDP) {
                        m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
                        m->m_pkthdr.csum_data = 0xFFFF;
                if (nxt == IPPROTO_TCP || nxt == IPPROTO_UDP) {
                        m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
                        m->m_pkthdr.csum_data = 0xFFFF;

+                       _CASSERT(offsetof(struct pkthdr, csum_data) == offsetof(struct pkthdr, csum_rx_val));

                }
 
                }
 

-               // Input via IPSec interface
-               if (sav->sah->ipsec_if != NULL) {
-                       if (ipsec_inject_inbound_packet(sav->sah->ipsec_if, m) == 0) {
+               // Input via IPsec interface
+               lck_mtx_lock(sadb_mutex);
+               ifnet_t ipsec_if = sav->sah->ipsec_if;
+               if (ipsec_if != NULL) {
+                       // If an interface is found, add a reference count before dropping the lock
+                       ifnet_reference(ipsec_if);
+               }
+               lck_mtx_unlock(sadb_mutex);
+               if (ipsec_if != NULL) {
+                       esp_input_log(m, sav, spi, seq);
+                       ipsec_save_wake_packet(m, ntohl(spi), seq);
+
+                       // Return mbuf
+                       if (interface != NULL &&
+                           interface == ipsec_if) {
+                               ifnet_release(ipsec_if);
+                               goto done;
+                       }
+
+                       errno_t inject_error = ipsec_inject_inbound_packet(ipsec_if, m);
+                       ifnet_release(ipsec_if);
+
+                       if (inject_error == 0) {

                                m = NULL;
                                nxt = IPPROTO_DONE;
                                goto done;
                                m = NULL;
                                nxt = IPPROTO_DONE;
                                goto done;


@@ -1392,14 +1494,6 @@ noreplaycheck:
                                goto bad;
                        }
                }
                                goto bad;
                        }
                }

-               
-               if (sav->utun_in_fn) {
-                       if (!(sav->utun_in_fn(sav->utun_pcb, &m, PF_INET6))) {
-                               m = NULL;
-                               // we just wanna exit since packet has been completely processed
-                               goto bad;
-                       }
-               }

        }
 
 done:
        }
 
 done:


@@ -1421,16 +1515,17 @@ bad:
                    (uint64_t)VM_KERNEL_ADDRPERM(sav)));
                key_freesav(sav, KEY_SADB_UNLOCKED);
        }
                    (uint64_t)VM_KERNEL_ADDRPERM(sav)));
                key_freesav(sav, KEY_SADB_UNLOCKED);
        }

-       if (m)
+       if (m) {

                m_freem(m);
                m_freem(m);

+       }
+       if (interface != NULL) {
+               *mp = NULL;
+       }

        return IPPROTO_DONE;
 }
 
 void
        return IPPROTO_DONE;
 }
 
 void

-esp6_ctlinput(cmd, sa, d)
-       int cmd;
-       struct sockaddr *sa;
-       void *d;
+esp6_ctlinput(int cmd, struct sockaddr *sa, void *d, __unused struct ifnet *ifp)

 {
        const struct newesp *espp;
        struct newesp esp;
 {
        const struct newesp *espp;
        struct newesp esp;


@@ -1438,14 +1533,16 @@ esp6_ctlinput(cmd, sa, d)
        struct secasvar *sav;
        struct ip6_hdr *ip6;
        struct mbuf *m;
        struct secasvar *sav;
        struct ip6_hdr *ip6;
        struct mbuf *m;

-       int off;
+       int off = 0;

        struct sockaddr_in6 *sa6_src, *sa6_dst;
 
        if (sa->sa_family != AF_INET6 ||
        struct sockaddr_in6 *sa6_src, *sa6_dst;
 
        if (sa->sa_family != AF_INET6 ||

-           sa->sa_len != sizeof(struct sockaddr_in6))
+           sa->sa_len != sizeof(struct sockaddr_in6)) {

                return;
                return;

-       if ((unsigned)cmd >= PRC_NCMDS)
+       }
+       if ((unsigned)cmd >= PRC_NCMDS) {

                return;
                return;

+       }

 
        /* if the parameter is from icmp6, decode it. */
        if (d != NULL) {
 
        /* if the parameter is from icmp6, decode it. */
        if (d != NULL) {


@@ -1483,8 +1580,9 @@ esp6_ctlinput(cmd, sa, d)
                 */
 
                /* check if we can safely examine src and dst ports */
                 */
 
                /* check if we can safely examine src and dst ports */

-               if (m->m_pkthdr.len < off + sizeof(esp))
+               if (m->m_pkthdr.len < off + sizeof(esp)) {

                        return;
                        return;

+               }

 
                if (m->m_len < off + sizeof(esp)) {
                        /*
 
                if (m->m_len < off + sizeof(esp)) {
                        /*


@@ -1493,8 +1591,9 @@ esp6_ctlinput(cmd, sa, d)
                         */
                        m_copydata(m, off, sizeof(esp), (caddr_t)&esp);
                        espp = &esp;
                         */
                        m_copydata(m, off, sizeof(esp), (caddr_t)&esp);
                        espp = &esp;

-               } else
+               } else {

                        espp = (struct newesp*)(void *)(mtod(m, caddr_t) + off);
                        espp = (struct newesp*)(void *)(mtod(m, caddr_t) + off);

+               }

 
                if (cmd == PRC_MSGSIZE) {
                        int valid = 0;
 
                if (cmd == PRC_MSGSIZE) {
                        int valid = 0;


@@ -1506,13 +1605,14 @@ esp6_ctlinput(cmd, sa, d)
                        sa6_src = ip6cp->ip6c_src;
                        sa6_dst = (struct sockaddr_in6 *)(void *)sa;
                        sav = key_allocsa(AF_INET6,
                        sa6_src = ip6cp->ip6c_src;
                        sa6_dst = (struct sockaddr_in6 *)(void *)sa;
                        sav = key_allocsa(AF_INET6,

-                                         (caddr_t)&sa6_src->sin6_addr,
-                                         (caddr_t)&sa6_dst->sin6_addr,
-                                         IPPROTO_ESP, espp->esp_spi);
+                           (caddr_t)&sa6_src->sin6_addr,
+                           (caddr_t)&sa6_dst->sin6_addr,
+                           IPPROTO_ESP, espp->esp_spi);

                        if (sav) {
                                if (sav->state == SADB_SASTATE_MATURE ||
                        if (sav) {
                                if (sav->state == SADB_SASTATE_MATURE ||

-                                   sav->state == SADB_SASTATE_DYING)
+                                   sav->state == SADB_SASTATE_DYING) {

                                        valid++;
                                        valid++;

+                               }

                                key_freesav(sav, KEY_SADB_UNLOCKED);
                        }
 
                                key_freesav(sav, KEY_SADB_UNLOCKED);
                        }
 


@@ -1531,4 +1631,3 @@ esp6_ctlinput(cmd, sa, d)
                /* we normally notify any pcb here */
        }
 }
                /* we normally notify any pcb here */
        }
 }

-#endif /* INET6 */