+ state->tunneled = 4; /* must not process any further in ip6_output */
+ error = ipsec64_encapsulate(state->m, sav);
+ if (error) {
+ state->m = 0;
+ goto bad;
+ }
+ /* Now we have an IPv4 packet */
+ ip = mtod(state->m, struct ip *);
+
+ // grab sadb_mutex, to update sah's route cache and get a local copy of it
+ lck_mtx_lock(sadb_mutex);
+ ro4 = &sav->sah->sa_route;
+ dst4 = (struct sockaddr_in *)(void *)&ro4->ro_dst;
+ if (ro4->ro_rt) {
+ RT_LOCK(ro4->ro_rt);
+ }
+ if (ROUTE_UNUSABLE(ro4) ||
+ dst4->sin_addr.s_addr != ip->ip_dst.s_addr) {
+ if (ro4->ro_rt != NULL)
+ RT_UNLOCK(ro4->ro_rt);
+ ROUTE_RELEASE(ro4);
+ }
+ if (ro4->ro_rt == NULL) {
+ dst4->sin_family = AF_INET;
+ dst4->sin_len = sizeof(*dst4);
+ dst4->sin_addr = ip->ip_dst;
+ } else {
+ RT_UNLOCK(ro4->ro_rt);
+ }
+ route_copyout(&ro4_copy, ro4, sizeof(ro4_copy));
+ // release sadb_mutex, after updating sah's route cache and getting a local copy
+ lck_mtx_unlock(sadb_mutex);
+ state->m = ipsec4_splithdr(state->m);
+ if (!state->m) {
+ error = ENOMEM;
+ ROUTE_RELEASE(&ro4_copy);
+ goto bad;
+ }
+ switch (sav->sah->saidx.proto) {
+ case IPPROTO_ESP:
+#if IPSEC_ESP
+ if ((error = esp4_output(state->m, sav)) != 0) {
+ state->m = NULL;
+ ROUTE_RELEASE(&ro4_copy);
+ goto bad;
+ }
+ break;
+
+#else
+ m_freem(state->m);
+ state->m = NULL;
+ error = EINVAL;
+ ROUTE_RELEASE(&ro4_copy);
+ goto bad;
+#endif
+ case IPPROTO_AH:
+ if ((error = ah4_output(state->m, sav)) != 0) {
+ state->m = NULL;
+ ROUTE_RELEASE(&ro4_copy);
+ goto bad;
+ }
+ break;
+ case IPPROTO_IPCOMP:
+ if ((error = ipcomp4_output(state->m, sav)) != 0) {
+ state->m = NULL;
+ ROUTE_RELEASE(&ro4_copy);
+ goto bad;
+ }
+ break;
+ default:
+ ipseclog((LOG_ERR,
+ "ipsec4_output: unknown ipsec protocol %d\n",
+ sav->sah->saidx.proto));
+ m_freem(state->m);
+ state->m = NULL;
+ error = EINVAL;
+ ROUTE_RELEASE(&ro4_copy);
+ goto bad;
+ }
+
+ if (state->m == 0) {
+ error = ENOMEM;
+ ROUTE_RELEASE(&ro4_copy);
+ goto bad;
+ }
+ ipsec_set_pkthdr_for_interface(sav->sah->ipsec_if, state->m, AF_INET);
+ ip = mtod(state->m, struct ip *);
+ ip->ip_len = ntohs(ip->ip_len); /* flip len field before calling ip_output */
+ error = ip_output(state->m, NULL, &ro4_copy, IP_OUTARGS, NULL, &ipoa);
+ state->m = NULL;
+ // grab sadb_mutex, to synchronize the sah's route cache with the local copy
+ lck_mtx_lock(sadb_mutex);
+ route_copyin(&ro4_copy, ro4, sizeof(ro4_copy));
+ lck_mtx_unlock(sadb_mutex);
+ if (error != 0)
+ goto bad;
+ goto done;
+ } else {
+ ipseclog((LOG_ERR, "ipsec6_output_tunnel: "
+ "unsupported inner family, spi=%u\n",
+ (u_int32_t)ntohl(sav->spi)));
+ IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
+ error = EAFNOSUPPORT;
+ goto bad;
+ }
+
+ // grab sadb_mutex, before updating sah's route cache
+ lck_mtx_lock(sadb_mutex);
+ ro6 = &sav->sah->sa_route;
+ dst6 = (struct sockaddr_in6 *)(void *)&ro6->ro_dst;
+ if (ro6->ro_rt) {
+ RT_LOCK(ro6->ro_rt);
+ }
+ if (ROUTE_UNUSABLE(ro6) ||
+ !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst)) {
+ if (ro6->ro_rt != NULL)
+ RT_UNLOCK(ro6->ro_rt);
+ ROUTE_RELEASE(ro6);
+ }
+ if (ro6->ro_rt == 0) {
+ bzero(dst6, sizeof(*dst6));
+ dst6->sin6_family = AF_INET6;
+ dst6->sin6_len = sizeof(*dst6);
+ dst6->sin6_addr = ip6->ip6_dst;
+ rtalloc(ro6);
+ if (ro6->ro_rt) {
+ RT_LOCK(ro6->ro_rt);
+ }
+ }
+ if (ro6->ro_rt == 0) {
+ ip6stat.ip6s_noroute++;
+ IPSEC_STAT_INCREMENT(ipsec6stat.out_noroute);
+ error = EHOSTUNREACH;
+ // release sadb_mutex, after updating sah's route cache
+ lck_mtx_unlock(sadb_mutex);
+ goto bad;
+ }
+
+ /*
+ * adjust state->dst if tunnel endpoint is offlink
+ *
+ * XXX: caching rt_gateway value in the state is
+ * not really good, since it may point elsewhere
+ * when the gateway gets modified to a larger
+ * sockaddr via rt_setgate(). This is currently
+ * addressed by SA_SIZE roundup in that routine.
+ */
+ if (ro6->ro_rt->rt_flags & RTF_GATEWAY)
+ dst6 = (struct sockaddr_in6 *)(void *)ro6->ro_rt->rt_gateway;
+ RT_UNLOCK(ro6->ro_rt);
+ ROUTE_RELEASE(&state->ro);
+ route_copyout(&state->ro, ro6, sizeof(state->ro));
+ state->dst = (struct sockaddr *)dst6;
+ state->tunneled = 6;
+ // release sadb_mutex, after updating sah's route cache
+ lck_mtx_unlock(sadb_mutex);
+ }
+
+ state->m = ipsec6_splithdr(state->m);
+ if (!state->m) {
+ IPSEC_STAT_INCREMENT(ipsec6stat.out_nomem);
+ error = ENOMEM;
+ goto bad;
+ }
+ ip6 = mtod(state->m, struct ip6_hdr *);
+ switch (sav->sah->saidx.proto) {
projects / apple / xnu.git / blobdiff