xref: /freebsd/sys/netipsec/ipsec.c (revision f9218d3d4fd34f082473b3a021c6d4d109fb47cf)
1 /*	$FreeBSD$	*/
2 /*	$KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * IPsec controller part.
35  */
36 
37 #include "opt_inet.h"
38 #include "opt_inet6.h"
39 #include "opt_ipsec.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/domain.h>
46 #include <sys/protosw.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
49 #include <sys/errno.h>
50 #include <sys/time.h>
51 #include <sys/kernel.h>
52 #include <sys/syslog.h>
53 #include <sys/sysctl.h>
54 #include <sys/proc.h>
55 
56 #include <net/if.h>
57 #include <net/route.h>
58 
59 #include <netinet/in.h>
60 #include <netinet/in_systm.h>
61 #include <netinet/ip.h>
62 #include <netinet/ip_var.h>
63 #include <netinet/in_var.h>
64 #include <netinet/udp.h>
65 #include <netinet/udp_var.h>
66 #include <netinet/tcp.h>
67 #include <netinet/udp.h>
68 
69 #include <netinet/ip6.h>
70 #ifdef INET6
71 #include <netinet6/ip6_var.h>
72 #endif
73 #include <netinet/in_pcb.h>
74 #ifdef INET6
75 #include <netinet/icmp6.h>
76 #endif
77 
78 #include <netipsec/ipsec.h>
79 #ifdef INET6
80 #include <netipsec/ipsec6.h>
81 #endif
82 #include <netipsec/ah_var.h>
83 #include <netipsec/esp_var.h>
84 #include <netipsec/ipcomp.h>		/*XXX*/
85 #include <netipsec/ipcomp_var.h>
86 
87 #include <netipsec/key.h>
88 #include <netipsec/keydb.h>
89 #include <netipsec/key_debug.h>
90 
91 #include <netipsec/xform.h>
92 
93 #include <machine/in_cksum.h>
94 
95 #include <net/net_osdep.h>
96 
97 #ifdef IPSEC_DEBUG
98 int ipsec_debug = 1;
99 #else
100 int ipsec_debug = 0;
101 #endif
102 
103 /* NB: name changed so netstat doesn't use it */
104 struct newipsecstat newipsecstat;
105 int ip4_ah_offsetmask = 0;	/* maybe IP_DF? */
106 int ip4_ipsec_dfbit = 0;	/* DF bit on encap. 0: clear 1: set 2: copy */
107 int ip4_esp_trans_deflev = IPSEC_LEVEL_USE;
108 int ip4_esp_net_deflev = IPSEC_LEVEL_USE;
109 int ip4_ah_trans_deflev = IPSEC_LEVEL_USE;
110 int ip4_ah_net_deflev = IPSEC_LEVEL_USE;
111 struct secpolicy ip4_def_policy;
112 int ip4_ipsec_ecn = 0;		/* ECN ignore(-1)/forbidden(0)/allowed(1) */
113 int ip4_esp_randpad = -1;
114 /*
115  * Crypto support requirements:
116  *
117  *  1	require hardware support
118  * -1	require software support
119  *  0	take anything
120  */
121 int	crypto_support = 0;
122 
123 SYSCTL_DECL(_net_inet_ipsec);
124 
125 /* net.inet.ipsec */
126 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_POLICY,
127 	def_policy, CTLFLAG_RW,	&ip4_def_policy.policy,	0, "");
128 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
129 	CTLFLAG_RW, &ip4_esp_trans_deflev,	0, "");
130 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
131 	CTLFLAG_RW, &ip4_esp_net_deflev,	0, "");
132 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
133 	CTLFLAG_RW, &ip4_ah_trans_deflev,	0, "");
134 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
135 	CTLFLAG_RW, &ip4_ah_net_deflev,	0, "");
136 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS,
137 	ah_cleartos, CTLFLAG_RW,	&ah_cleartos,	0, "");
138 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_OFFSETMASK,
139 	ah_offsetmask, CTLFLAG_RW,	&ip4_ah_offsetmask,	0, "");
140 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT,
141 	dfbit, CTLFLAG_RW,	&ip4_ipsec_dfbit,	0, "");
142 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN,
143 	ecn, CTLFLAG_RW,	&ip4_ipsec_ecn,	0, "");
144 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEBUG,
145 	debug, CTLFLAG_RW,	&ipsec_debug,	0, "");
146 SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ESP_RANDPAD,
147 	esp_randpad, CTLFLAG_RW,	&ip4_esp_randpad,	0, "");
148 SYSCTL_INT(_net_inet_ipsec, OID_AUTO,
149 	crypto_support,	CTLFLAG_RW,	&crypto_support,0, "");
150 SYSCTL_STRUCT(_net_inet_ipsec, OID_AUTO,
151 	ipsecstats,	CTLFLAG_RD,	&newipsecstat,	newipsecstat, "");
152 
153 #ifdef INET6
154 int ip6_esp_trans_deflev = IPSEC_LEVEL_USE;
155 int ip6_esp_net_deflev = IPSEC_LEVEL_USE;
156 int ip6_ah_trans_deflev = IPSEC_LEVEL_USE;
157 int ip6_ah_net_deflev = IPSEC_LEVEL_USE;
158 int ip6_ipsec_ecn = 0;		/* ECN ignore(-1)/forbidden(0)/allowed(1) */
159 int ip6_esp_randpad = -1;
160 
161 SYSCTL_DECL(_net_inet6_ipsec6);
162 
163 /* net.inet6.ipsec6 */
164 #ifdef COMPAT_KAME
165 SYSCTL_OID(_net_inet6_ipsec6, IPSECCTL_STATS, stats, CTLFLAG_RD,
166 	0,0, compat_ipsecstats_sysctl, "S", "");
167 #endif /* COMPAT_KAME */
168 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY,
169 	def_policy, CTLFLAG_RW,	&ip4_def_policy.policy,	0, "");
170 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
171 	CTLFLAG_RW, &ip6_esp_trans_deflev,	0, "");
172 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_NETLEV, esp_net_deflev,
173 	CTLFLAG_RW, &ip6_esp_net_deflev,	0, "");
174 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_TRANSLEV, ah_trans_deflev,
175 	CTLFLAG_RW, &ip6_ah_trans_deflev,	0, "");
176 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_AH_NETLEV, ah_net_deflev,
177 	CTLFLAG_RW, &ip6_ah_net_deflev,	0, "");
178 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ECN,
179 	ecn, CTLFLAG_RW,	&ip6_ipsec_ecn,	0, "");
180 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG,
181 	debug, CTLFLAG_RW,	&ipsec_debug,	0, "");
182 SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_ESP_RANDPAD,
183 	esp_randpad, CTLFLAG_RW,	&ip6_esp_randpad,	0, "");
184 #endif /* INET6 */
185 
186 static int ipsec4_setspidx_inpcb __P((struct mbuf *, struct inpcb *pcb));
187 #ifdef INET6
188 static int ipsec6_setspidx_in6pcb __P((struct mbuf *, struct in6pcb *pcb));
189 #endif
190 static int ipsec_setspidx __P((struct mbuf *, struct secpolicyindex *, int));
191 static void ipsec4_get_ulp __P((struct mbuf *m, struct secpolicyindex *, int));
192 static int ipsec4_setspidx_ipaddr __P((struct mbuf *, struct secpolicyindex *));
193 #ifdef INET6
194 static void ipsec6_get_ulp __P((struct mbuf *m, struct secpolicyindex *, int));
195 static int ipsec6_setspidx_ipaddr __P((struct mbuf *, struct secpolicyindex *));
196 #endif
197 static void ipsec_delpcbpolicy __P((struct inpcbpolicy *));
198 static struct secpolicy *ipsec_deepcopy_policy __P((struct secpolicy *src));
199 static int ipsec_set_policy __P((struct secpolicy **pcb_sp,
200 	int optname, caddr_t request, size_t len, int priv));
201 static int ipsec_get_policy __P((struct secpolicy *pcb_sp, struct mbuf **mp));
202 static void vshiftl __P((unsigned char *, int, int));
203 static size_t ipsec_hdrsiz __P((struct secpolicy *));
204 
205 /*
206  * Return a held reference to the default SP.
207  */
208 static struct secpolicy *
209 key_allocsp_default(const char* where, int tag)
210 {
211 	struct secpolicy *sp;
212 
213 	KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
214 		printf("DP key_allocsp_default from %s:%u\n", where, tag));
215 
216 	sp = &ip4_def_policy;
217 	if (sp->policy != IPSEC_POLICY_DISCARD &&
218 	    sp->policy != IPSEC_POLICY_NONE) {
219 		ipseclog((LOG_INFO, "fixed system default policy: %d->%d\n",
220 		    sp->policy, IPSEC_POLICY_NONE));
221 		sp->policy = IPSEC_POLICY_NONE;
222 	}
223 	sp->refcnt++;
224 
225 	KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
226 		printf("DP key_allocsp_default returns SP:%p (%u)\n",
227 			sp, sp->refcnt));
228 	return sp;
229 }
230 #define	KEY_ALLOCSP_DEFAULT() \
231 	key_allocsp_default(__FILE__, __LINE__)
232 
233 /*
234  * For OUTBOUND packet having a socket. Searching SPD for packet,
235  * and return a pointer to SP.
236  * OUT:	NULL:	no apropreate SP found, the following value is set to error.
237  *		0	: bypass
238  *		EACCES	: discard packet.
239  *		ENOENT	: ipsec_acquire() in progress, maybe.
240  *		others	: error occured.
241  *	others:	a pointer to SP
242  *
243  * NOTE: IPv6 mapped adddress concern is implemented here.
244  */
245 struct secpolicy *
246 ipsec_getpolicy(struct tdb_ident *tdbi, u_int dir)
247 {
248 	struct secpolicy *sp;
249 
250 	KASSERT(tdbi != NULL, ("ipsec_getpolicy: null tdbi"));
251 	KASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
252 		("ipsec_getpolicy: invalid direction %u", dir));
253 
254 	sp = KEY_ALLOCSP2(tdbi->spi, &tdbi->dst, tdbi->proto, dir);
255 	if (sp == NULL)			/*XXX????*/
256 		sp = KEY_ALLOCSP_DEFAULT();
257 	KASSERT(sp != NULL, ("ipsec_getpolicy: null SP"));
258 	return sp;
259 }
260 
261 /*
262  * For OUTBOUND packet having a socket. Searching SPD for packet,
263  * and return a pointer to SP.
264  * OUT:	NULL:	no apropreate SP found, the following value is set to error.
265  *		0	: bypass
266  *		EACCES	: discard packet.
267  *		ENOENT	: ipsec_acquire() in progress, maybe.
268  *		others	: error occured.
269  *	others:	a pointer to SP
270  *
271  * NOTE: IPv6 mapped adddress concern is implemented here.
272  */
273 struct secpolicy *
274 ipsec_getpolicybysock(m, dir, inp, error)
275 	struct mbuf *m;
276 	u_int dir;
277 	struct inpcb *inp;
278 	int *error;
279 {
280 	struct inpcbpolicy *pcbsp = NULL;
281 	struct secpolicy *currsp = NULL;	/* policy on socket */
282 	struct secpolicy *sp;
283 
284 	KASSERT(m != NULL, ("ipsec_getpolicybysock: null mbuf"));
285 	KASSERT(inp != NULL, ("ipsec_getpolicybysock: null inpcb"));
286 	KASSERT(error != NULL, ("ipsec_getpolicybysock: null error"));
287 	KASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
288 		("ipsec_getpolicybysock: invalid direction %u", dir));
289 
290 	/* set spidx in pcb */
291 	if (inp->inp_vflag & INP_IPV6PROTO) {
292 #ifdef INET6
293 		*error = ipsec6_setspidx_in6pcb(m, inp);
294 		pcbsp = inp->in6p_sp;
295 #else
296 		*error = EINVAL;		/* should not happen */
297 #endif
298 	} else {
299 		*error = ipsec4_setspidx_inpcb(m, inp);
300 		pcbsp = inp->inp_sp;
301 	}
302 	if (*error)
303 		return NULL;
304 
305 	KASSERT(pcbsp != NULL, ("ipsec_getpolicybysock: null pcbsp"));
306 	switch (dir) {
307 	case IPSEC_DIR_INBOUND:
308 		currsp = pcbsp->sp_in;
309 		break;
310 	case IPSEC_DIR_OUTBOUND:
311 		currsp = pcbsp->sp_out;
312 		break;
313 	}
314 	KASSERT(currsp != NULL, ("ipsec_getpolicybysock: null currsp"));
315 
316 	if (pcbsp->priv) {			/* when privilieged socket */
317 		switch (currsp->policy) {
318 		case IPSEC_POLICY_BYPASS:
319 		case IPSEC_POLICY_IPSEC:
320 			currsp->refcnt++;
321 			sp = currsp;
322 			break;
323 
324 		case IPSEC_POLICY_ENTRUST:
325 			/* look for a policy in SPD */
326 			sp = KEY_ALLOCSP(&currsp->spidx, dir);
327 			if (sp == NULL)		/* no SP found */
328 				sp = KEY_ALLOCSP_DEFAULT();
329 			break;
330 
331 		default:
332 			ipseclog((LOG_ERR, "ipsec_getpolicybysock: "
333 			      "Invalid policy for PCB %d\n", currsp->policy));
334 			*error = EINVAL;
335 			return NULL;
336 		}
337 	} else {				/* unpriv, SPD has policy */
338 		sp = KEY_ALLOCSP(&currsp->spidx, dir);
339 		if (sp == NULL) {		/* no SP found */
340 			switch (currsp->policy) {
341 			case IPSEC_POLICY_BYPASS:
342 				ipseclog((LOG_ERR, "ipsec_getpolicybysock: "
343 				       "Illegal policy for non-priviliged defined %d\n",
344 					currsp->policy));
345 				*error = EINVAL;
346 				return NULL;
347 
348 			case IPSEC_POLICY_ENTRUST:
349 				sp = KEY_ALLOCSP_DEFAULT();
350 				break;
351 
352 			case IPSEC_POLICY_IPSEC:
353 				currsp->refcnt++;
354 				sp = currsp;
355 				break;
356 
357 			default:
358 				ipseclog((LOG_ERR, "ipsec_getpolicybysock: "
359 				   "Invalid policy for PCB %d\n", currsp->policy));
360 				*error = EINVAL;
361 				return NULL;
362 			}
363 		}
364 	}
365 	KASSERT(sp != NULL,
366 		("ipsec_getpolicybysock: null SP (priv %u policy %u",
367 		 pcbsp->priv, currsp->policy));
368 	KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
369 		printf("DP ipsec_getpolicybysock (priv %u policy %u) allocates "
370 		       "SP:%p (refcnt %u)\n", pcbsp->priv, currsp->policy,
371 		       sp, sp->refcnt));
372 	return sp;
373 }
374 
375 /*
376  * For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
377  * and return a pointer to SP.
378  * OUT:	positive: a pointer to the entry for security policy leaf matched.
379  *	NULL:	no apropreate SP found, the following value is set to error.
380  *		0	: bypass
381  *		EACCES	: discard packet.
382  *		ENOENT	: ipsec_acquire() in progress, maybe.
383  *		others	: error occured.
384  */
385 struct secpolicy *
386 ipsec_getpolicybyaddr(m, dir, flag, error)
387 	struct mbuf *m;
388 	u_int dir;
389 	int flag;
390 	int *error;
391 {
392 	struct secpolicyindex spidx;
393 	struct secpolicy *sp;
394 
395 	KASSERT(m != NULL, ("ipsec_getpolicybyaddr: null mbuf"));
396 	KASSERT(error != NULL, ("ipsec_getpolicybyaddr: null error"));
397 	KASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
398 		("ipsec4_getpolicybaddr: invalid direction %u", dir));
399 
400 	sp = NULL;
401 	if (key_havesp(dir)) {
402 		/* Make an index to look for a policy. */
403 		*error = ipsec_setspidx(m, &spidx,
404 					(flag & IP_FORWARDING) ? 0 : 1);
405 		if (*error != 0) {
406 			DPRINTF(("ipsec_getpolicybyaddr: setpidx failed,"
407 				" dir %u flag %u\n", dir, flag));
408 			bzero(&spidx, sizeof (spidx));
409 			return NULL;
410 		}
411 		spidx.dir = dir;
412 
413 		sp = KEY_ALLOCSP(&spidx, dir);
414 	}
415 	if (sp == NULL)			/* no SP found, use system default */
416 		sp = KEY_ALLOCSP_DEFAULT();
417 	KASSERT(sp != NULL, ("ipsec_getpolicybyaddr: null SP"));
418 	return sp;
419 }
420 
421 struct secpolicy *
422 ipsec4_checkpolicy(m, dir, flag, error, inp)
423 	struct mbuf *m;
424 	u_int dir, flag;
425 	int *error;
426 	struct inpcb *inp;
427 {
428 	struct secpolicy *sp;
429 
430 	*error = 0;
431 	if (inp == NULL)
432 		sp = ipsec_getpolicybyaddr(m, dir, flag, error);
433 	else
434 		sp = ipsec_getpolicybysock(m, dir, inp, error);
435 	if (sp == NULL) {
436 		KASSERT(*error != 0,
437 			("ipsec4_checkpolicy: getpolicy failed w/o error"));
438 		newipsecstat.ips_out_inval++;
439 		return NULL;
440 	}
441 	KASSERT(*error == 0,
442 		("ipsec4_checkpolicy: sp w/ error set to %u", *error));
443 	switch (sp->policy) {
444 	case IPSEC_POLICY_ENTRUST:
445 	default:
446 		printf("ipsec4_checkpolicy: invalid policy %u\n", sp->policy);
447 		/* fall thru... */
448 	case IPSEC_POLICY_DISCARD:
449 		newipsecstat.ips_out_polvio++;
450 		*error = -EINVAL;	/* packet is discarded by caller */
451 		break;
452 	case IPSEC_POLICY_BYPASS:
453 	case IPSEC_POLICY_NONE:
454 		KEY_FREESP(&sp);
455 		sp = NULL;		/* NB: force NULL result */
456 		break;
457 	case IPSEC_POLICY_IPSEC:
458 		if (sp->req == NULL)	/* acquire an SA */
459 			*error = key_spdacquire(sp);
460 		break;
461 	}
462 	if (*error != 0) {
463 		KEY_FREESP(&sp);
464 		sp = NULL;
465 	}
466 	return sp;
467 }
468 
469 static int
470 ipsec4_setspidx_inpcb(m, pcb)
471 	struct mbuf *m;
472 	struct inpcb *pcb;
473 {
474 	int error;
475 
476 	KASSERT(pcb != NULL, ("ipsec4_setspidx_inpcb: null pcb"));
477 	KASSERT(pcb->inp_sp != NULL, ("ipsec4_setspidx_inpcb: null inp_sp"));
478 	KASSERT(pcb->inp_sp->sp_out != NULL && pcb->inp_sp->sp_in != NULL,
479 		("ipsec4_setspidx_inpcb: null sp_in || sp_out"));
480 
481 	error = ipsec_setspidx(m, &pcb->inp_sp->sp_in->spidx, 1);
482 	if (error == 0) {
483 		pcb->inp_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND;
484 		pcb->inp_sp->sp_out->spidx = pcb->inp_sp->sp_in->spidx;
485 		pcb->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND;
486 	} else {
487 		bzero(&pcb->inp_sp->sp_in->spidx,
488 			sizeof (pcb->inp_sp->sp_in->spidx));
489 		bzero(&pcb->inp_sp->sp_out->spidx,
490 			sizeof (pcb->inp_sp->sp_in->spidx));
491 	}
492 	return error;
493 }
494 
495 #ifdef INET6
496 static int
497 ipsec6_setspidx_in6pcb(m, pcb)
498 	struct mbuf *m;
499 	struct in6pcb *pcb;
500 {
501 	struct secpolicyindex *spidx;
502 	int error;
503 
504 	KASSERT(pcb != NULL, ("ipsec6_setspidx_in6pcb: null pcb"));
505 	KASSERT(pcb->in6p_sp != NULL, ("ipsec6_setspidx_in6pcb: null inp_sp"));
506 	KASSERT(pcb->in6p_sp->sp_out != NULL && pcb->in6p_sp->sp_in != NULL,
507 		("ipsec6_setspidx_in6pcb: null sp_in || sp_out"));
508 
509 	bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
510 	bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
511 
512 	spidx = &pcb->in6p_sp->sp_in->spidx;
513 	error = ipsec_setspidx(m, spidx, 1);
514 	if (error)
515 		goto bad;
516 	spidx->dir = IPSEC_DIR_INBOUND;
517 
518 	spidx = &pcb->in6p_sp->sp_out->spidx;
519 	error = ipsec_setspidx(m, spidx, 1);
520 	if (error)
521 		goto bad;
522 	spidx->dir = IPSEC_DIR_OUTBOUND;
523 
524 	return 0;
525 
526 bad:
527 	bzero(&pcb->in6p_sp->sp_in->spidx, sizeof(*spidx));
528 	bzero(&pcb->in6p_sp->sp_out->spidx, sizeof(*spidx));
529 	return error;
530 }
531 #endif
532 
533 /*
534  * configure security policy index (src/dst/proto/sport/dport)
535  * by looking at the content of mbuf.
536  * the caller is responsible for error recovery (like clearing up spidx).
537  */
538 static int
539 ipsec_setspidx(m, spidx, needport)
540 	struct mbuf *m;
541 	struct secpolicyindex *spidx;
542 	int needport;
543 {
544 	struct ip *ip = NULL;
545 	struct ip ipbuf;
546 	u_int v;
547 	struct mbuf *n;
548 	int len;
549 	int error;
550 
551 	KASSERT(m != NULL, ("ipsec_setspidx: null mbuf"));
552 
553 	/*
554 	 * validate m->m_pkthdr.len.  we see incorrect length if we
555 	 * mistakenly call this function with inconsistent mbuf chain
556 	 * (like 4.4BSD tcp/udp processing).  XXX should we panic here?
557 	 */
558 	len = 0;
559 	for (n = m; n; n = n->m_next)
560 		len += n->m_len;
561 	if (m->m_pkthdr.len != len) {
562 		KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
563 			printf("ipsec_setspidx: "
564 			       "total of m_len(%d) != pkthdr.len(%d), "
565 			       "ignored.\n",
566 				len, m->m_pkthdr.len));
567 		return EINVAL;
568 	}
569 
570 	if (m->m_pkthdr.len < sizeof(struct ip)) {
571 		KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
572 			printf("ipsec_setspidx: "
573 			    "pkthdr.len(%d) < sizeof(struct ip), ignored.\n",
574 			    m->m_pkthdr.len));
575 		return EINVAL;
576 	}
577 
578 	if (m->m_len >= sizeof(*ip))
579 		ip = mtod(m, struct ip *);
580 	else {
581 		m_copydata(m, 0, sizeof(ipbuf), (caddr_t)&ipbuf);
582 		ip = &ipbuf;
583 	}
584 #ifdef _IP_VHL
585 	v = _IP_VHL_V(ip->ip_vhl);
586 #else
587 	v = ip->ip_v;
588 #endif
589 	switch (v) {
590 	case 4:
591 		error = ipsec4_setspidx_ipaddr(m, spidx);
592 		if (error)
593 			return error;
594 		ipsec4_get_ulp(m, spidx, needport);
595 		return 0;
596 #ifdef INET6
597 	case 6:
598 		if (m->m_pkthdr.len < sizeof(struct ip6_hdr)) {
599 			KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
600 				printf("ipsec_setspidx: "
601 				    "pkthdr.len(%d) < sizeof(struct ip6_hdr), "
602 				    "ignored.\n", m->m_pkthdr.len));
603 			return EINVAL;
604 		}
605 		error = ipsec6_setspidx_ipaddr(m, spidx);
606 		if (error)
607 			return error;
608 		ipsec6_get_ulp(m, spidx, needport);
609 		return 0;
610 #endif
611 	default:
612 		KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
613 			printf("ipsec_setspidx: "
614 			    "unknown IP version %u, ignored.\n", v));
615 		return EINVAL;
616 	}
617 }
618 
619 static void
620 ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *spidx, int needport)
621 {
622 	u_int8_t nxt;
623 	int off;
624 
625 	/* sanity check */
626 	KASSERT(m != NULL, ("ipsec4_get_ulp: null mbuf"));
627 	KASSERT(m->m_pkthdr.len >= sizeof(struct ip),
628 		("ipsec4_get_ulp: packet too short"));
629 
630 	/* NB: ip_input() flips it into host endian XXX need more checking */
631 	if (m->m_len < sizeof (struct ip)) {
632 		struct ip *ip = mtod(m, struct ip *);
633 		if (ip->ip_off & (IP_MF | IP_OFFMASK))
634 			goto done;
635 #ifdef _IP_VHL
636 		off = _IP_VHL_HL(ip->ip_vhl) << 2;
637 #else
638 		off = ip->ip_hl << 2;
639 #endif
640 		nxt = ip->ip_p;
641 	} else {
642 		struct ip ih;
643 
644 		m_copydata(m, 0, sizeof (struct ip), (caddr_t) &ih);
645 		if (ih.ip_off & (IP_MF | IP_OFFMASK))
646 			goto done;
647 #ifdef _IP_VHL
648 		off = _IP_VHL_HL(ih.ip_vhl) << 2;
649 #else
650 		off = ih.ip_hl << 2;
651 #endif
652 		nxt = ih.ip_p;
653 	}
654 
655 	while (off < m->m_pkthdr.len) {
656 		struct ip6_ext ip6e;
657 		struct tcphdr th;
658 		struct udphdr uh;
659 
660 		switch (nxt) {
661 		case IPPROTO_TCP:
662 			spidx->ul_proto = nxt;
663 			if (!needport)
664 				goto done_proto;
665 			if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
666 				goto done;
667 			m_copydata(m, off, sizeof (th), (caddr_t) &th);
668 			spidx->src.sin.sin_port = th.th_sport;
669 			spidx->dst.sin.sin_port = th.th_dport;
670 			return;
671 		case IPPROTO_UDP:
672 			spidx->ul_proto = nxt;
673 			if (!needport)
674 				goto done_proto;
675 			if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
676 				goto done;
677 			m_copydata(m, off, sizeof (uh), (caddr_t) &uh);
678 			spidx->src.sin.sin_port = uh.uh_sport;
679 			spidx->dst.sin.sin_port = uh.uh_dport;
680 			return;
681 		case IPPROTO_AH:
682 			if (m->m_pkthdr.len > off + sizeof(ip6e))
683 				goto done;
684 			/* XXX sigh, this works but is totally bogus */
685 			m_copydata(m, off, sizeof(ip6e), (caddr_t) &ip6e);
686 			off += (ip6e.ip6e_len + 2) << 2;
687 			nxt = ip6e.ip6e_nxt;
688 			break;
689 		case IPPROTO_ICMP:
690 		default:
691 			/* XXX intermediate headers??? */
692 			spidx->ul_proto = nxt;
693 			goto done_proto;
694 		}
695 	}
696 done:
697 	spidx->ul_proto = IPSEC_ULPROTO_ANY;
698 done_proto:
699 	spidx->src.sin.sin_port = IPSEC_PORT_ANY;
700 	spidx->dst.sin.sin_port = IPSEC_PORT_ANY;
701 }
702 
703 /* assumes that m is sane */
704 static int
705 ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
706 {
707 	static const struct sockaddr_in template = {
708 		sizeof (struct sockaddr_in),
709 		AF_INET,
710 		0, { 0 }, { 0, 0, 0, 0, 0, 0, 0, 0 }
711 	};
712 
713 	spidx->src.sin = template;
714 	spidx->dst.sin = template;
715 
716 	if (m->m_len < sizeof (struct ip)) {
717 		m_copydata(m, offsetof(struct ip, ip_src),
718 			   sizeof (struct  in_addr),
719 			   (caddr_t) &spidx->src.sin.sin_addr);
720 		m_copydata(m, offsetof(struct ip, ip_dst),
721 			   sizeof (struct  in_addr),
722 			   (caddr_t) &spidx->dst.sin.sin_addr);
723 	} else {
724 		struct ip *ip = mtod(m, struct ip *);
725 		spidx->src.sin.sin_addr = ip->ip_src;
726 		spidx->dst.sin.sin_addr = ip->ip_dst;
727 	}
728 
729 	spidx->prefs = sizeof(struct in_addr) << 3;
730 	spidx->prefd = sizeof(struct in_addr) << 3;
731 
732 	return 0;
733 }
734 
735 #ifdef INET6
736 static void
737 ipsec6_get_ulp(m, spidx, needport)
738 	struct mbuf *m;
739 	struct secpolicyindex *spidx;
740 	int needport;
741 {
742 	int off, nxt;
743 	struct tcphdr th;
744 	struct udphdr uh;
745 
746 	/* sanity check */
747 	if (m == NULL)
748 		panic("ipsec6_get_ulp: NULL pointer was passed.\n");
749 
750 	KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
751 		printf("ipsec6_get_ulp:\n"); kdebug_mbuf(m));
752 
753 	/* set default */
754 	spidx->ul_proto = IPSEC_ULPROTO_ANY;
755 	((struct sockaddr_in6 *)&spidx->src)->sin6_port = IPSEC_PORT_ANY;
756 	((struct sockaddr_in6 *)&spidx->dst)->sin6_port = IPSEC_PORT_ANY;
757 
758 	nxt = -1;
759 	off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
760 	if (off < 0 || m->m_pkthdr.len < off)
761 		return;
762 
763 	switch (nxt) {
764 	case IPPROTO_TCP:
765 		spidx->ul_proto = nxt;
766 		if (!needport)
767 			break;
768 		if (off + sizeof(struct tcphdr) > m->m_pkthdr.len)
769 			break;
770 		m_copydata(m, off, sizeof(th), (caddr_t)&th);
771 		((struct sockaddr_in6 *)&spidx->src)->sin6_port = th.th_sport;
772 		((struct sockaddr_in6 *)&spidx->dst)->sin6_port = th.th_dport;
773 		break;
774 	case IPPROTO_UDP:
775 		spidx->ul_proto = nxt;
776 		if (!needport)
777 			break;
778 		if (off + sizeof(struct udphdr) > m->m_pkthdr.len)
779 			break;
780 		m_copydata(m, off, sizeof(uh), (caddr_t)&uh);
781 		((struct sockaddr_in6 *)&spidx->src)->sin6_port = uh.uh_sport;
782 		((struct sockaddr_in6 *)&spidx->dst)->sin6_port = uh.uh_dport;
783 		break;
784 	case IPPROTO_ICMPV6:
785 	default:
786 		/* XXX intermediate headers??? */
787 		spidx->ul_proto = nxt;
788 		break;
789 	}
790 }
791 
792 /* assumes that m is sane */
793 static int
794 ipsec6_setspidx_ipaddr(m, spidx)
795 	struct mbuf *m;
796 	struct secpolicyindex *spidx;
797 {
798 	struct ip6_hdr *ip6 = NULL;
799 	struct ip6_hdr ip6buf;
800 	struct sockaddr_in6 *sin6;
801 
802 	if (m->m_len >= sizeof(*ip6))
803 		ip6 = mtod(m, struct ip6_hdr *);
804 	else {
805 		m_copydata(m, 0, sizeof(ip6buf), (caddr_t)&ip6buf);
806 		ip6 = &ip6buf;
807 	}
808 
809 	sin6 = (struct sockaddr_in6 *)&spidx->src;
810 	bzero(sin6, sizeof(*sin6));
811 	sin6->sin6_family = AF_INET6;
812 	sin6->sin6_len = sizeof(struct sockaddr_in6);
813 	bcopy(&ip6->ip6_src, &sin6->sin6_addr, sizeof(ip6->ip6_src));
814 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
815 		sin6->sin6_addr.s6_addr16[1] = 0;
816 		sin6->sin6_scope_id = ntohs(ip6->ip6_src.s6_addr16[1]);
817 	}
818 	spidx->prefs = sizeof(struct in6_addr) << 3;
819 
820 	sin6 = (struct sockaddr_in6 *)&spidx->dst;
821 	bzero(sin6, sizeof(*sin6));
822 	sin6->sin6_family = AF_INET6;
823 	sin6->sin6_len = sizeof(struct sockaddr_in6);
824 	bcopy(&ip6->ip6_dst, &sin6->sin6_addr, sizeof(ip6->ip6_dst));
825 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
826 		sin6->sin6_addr.s6_addr16[1] = 0;
827 		sin6->sin6_scope_id = ntohs(ip6->ip6_dst.s6_addr16[1]);
828 	}
829 	spidx->prefd = sizeof(struct in6_addr) << 3;
830 
831 	return 0;
832 }
833 #endif
834 
835 static void
836 ipsec_delpcbpolicy(p)
837 	struct inpcbpolicy *p;
838 {
839 	free(p, M_SECA);
840 }
841 
842 /* initialize policy in PCB */
843 int
844 ipsec_init_policy(so, pcb_sp)
845 	struct socket *so;
846 	struct inpcbpolicy **pcb_sp;
847 {
848 	struct inpcbpolicy *new;
849 
850 	/* sanity check. */
851 	if (so == NULL || pcb_sp == NULL)
852 		panic("ipsec_init_policy: NULL pointer was passed.\n");
853 
854 	new = (struct inpcbpolicy *) malloc(sizeof(struct inpcbpolicy),
855 					    M_SECA, M_NOWAIT|M_ZERO);
856 	if (new == NULL) {
857 		ipseclog((LOG_DEBUG, "ipsec_init_policy: No more memory.\n"));
858 		return ENOBUFS;
859 	}
860 
861 	if (so->so_cred != 0 && so->so_cred->cr_uid == 0)
862 		new->priv = 1;
863 	else
864 		new->priv = 0;
865 
866 	if ((new->sp_in = KEY_NEWSP()) == NULL) {
867 		ipsec_delpcbpolicy(new);
868 		return ENOBUFS;
869 	}
870 	new->sp_in->state = IPSEC_SPSTATE_ALIVE;
871 	new->sp_in->policy = IPSEC_POLICY_ENTRUST;
872 
873 	if ((new->sp_out = KEY_NEWSP()) == NULL) {
874 		KEY_FREESP(&new->sp_in);
875 		ipsec_delpcbpolicy(new);
876 		return ENOBUFS;
877 	}
878 	new->sp_out->state = IPSEC_SPSTATE_ALIVE;
879 	new->sp_out->policy = IPSEC_POLICY_ENTRUST;
880 
881 	*pcb_sp = new;
882 
883 	return 0;
884 }
885 
886 /* copy old ipsec policy into new */
887 int
888 ipsec_copy_policy(old, new)
889 	struct inpcbpolicy *old, *new;
890 {
891 	struct secpolicy *sp;
892 
893 	sp = ipsec_deepcopy_policy(old->sp_in);
894 	if (sp) {
895 		KEY_FREESP(&new->sp_in);
896 		new->sp_in = sp;
897 	} else
898 		return ENOBUFS;
899 
900 	sp = ipsec_deepcopy_policy(old->sp_out);
901 	if (sp) {
902 		KEY_FREESP(&new->sp_out);
903 		new->sp_out = sp;
904 	} else
905 		return ENOBUFS;
906 
907 	new->priv = old->priv;
908 
909 	return 0;
910 }
911 
912 /* deep-copy a policy in PCB */
913 static struct secpolicy *
914 ipsec_deepcopy_policy(src)
915 	struct secpolicy *src;
916 {
917 	struct ipsecrequest *newchain = NULL;
918 	struct ipsecrequest *p;
919 	struct ipsecrequest **q;
920 	struct ipsecrequest *r;
921 	struct secpolicy *dst;
922 
923 	if (src == NULL)
924 		return NULL;
925 	dst = KEY_NEWSP();
926 	if (dst == NULL)
927 		return NULL;
928 
929 	/*
930 	 * deep-copy IPsec request chain.  This is required since struct
931 	 * ipsecrequest is not reference counted.
932 	 */
933 	q = &newchain;
934 	for (p = src->req; p; p = p->next) {
935 		*q = (struct ipsecrequest *)malloc(sizeof(struct ipsecrequest),
936 			M_SECA, M_NOWAIT);
937 		if (*q == NULL)
938 			goto fail;
939 		bzero(*q, sizeof(**q));
940 		(*q)->next = NULL;
941 
942 		(*q)->saidx.proto = p->saidx.proto;
943 		(*q)->saidx.mode = p->saidx.mode;
944 		(*q)->level = p->level;
945 		(*q)->saidx.reqid = p->saidx.reqid;
946 
947 		bcopy(&p->saidx.src, &(*q)->saidx.src, sizeof((*q)->saidx.src));
948 		bcopy(&p->saidx.dst, &(*q)->saidx.dst, sizeof((*q)->saidx.dst));
949 
950 		(*q)->sav = NULL;
951 		(*q)->sp = dst;
952 
953 		q = &((*q)->next);
954 	}
955 
956 	dst->req = newchain;
957 	dst->state = src->state;
958 	dst->policy = src->policy;
959 	/* do not touch the refcnt fields */
960 
961 	return dst;
962 
963 fail:
964 	for (p = newchain; p; p = r) {
965 		r = p->next;
966 		free(p, M_SECA);
967 		p = NULL;
968 	}
969 	return NULL;
970 }
971 
972 /* set policy and ipsec request if present. */
973 static int
974 ipsec_set_policy(pcb_sp, optname, request, len, priv)
975 	struct secpolicy **pcb_sp;
976 	int optname;
977 	caddr_t request;
978 	size_t len;
979 	int priv;
980 {
981 	struct sadb_x_policy *xpl;
982 	struct secpolicy *newsp = NULL;
983 	int error;
984 
985 	/* sanity check. */
986 	if (pcb_sp == NULL || *pcb_sp == NULL || request == NULL)
987 		return EINVAL;
988 	if (len < sizeof(*xpl))
989 		return EINVAL;
990 	xpl = (struct sadb_x_policy *)request;
991 
992 	KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
993 		printf("ipsec_set_policy: passed policy\n");
994 		kdebug_sadb_x_policy((struct sadb_ext *)xpl));
995 
996 	/* check policy type */
997 	/* ipsec_set_policy() accepts IPSEC, ENTRUST and BYPASS. */
998 	if (xpl->sadb_x_policy_type == IPSEC_POLICY_DISCARD
999 	 || xpl->sadb_x_policy_type == IPSEC_POLICY_NONE)
1000 		return EINVAL;
1001 
1002 	/* check privileged socket */
1003 	if (priv == 0 && xpl->sadb_x_policy_type == IPSEC_POLICY_BYPASS)
1004 		return EACCES;
1005 
1006 	/* allocation new SP entry */
1007 	if ((newsp = key_msg2sp(xpl, len, &error)) == NULL)
1008 		return error;
1009 
1010 	newsp->state = IPSEC_SPSTATE_ALIVE;
1011 
1012 	/* clear old SP and set new SP */
1013 	KEY_FREESP(pcb_sp);
1014 	*pcb_sp = newsp;
1015 	KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1016 		printf("ipsec_set_policy: new policy\n");
1017 		kdebug_secpolicy(newsp));
1018 
1019 	return 0;
1020 }
1021 
1022 static int
1023 ipsec_get_policy(pcb_sp, mp)
1024 	struct secpolicy *pcb_sp;
1025 	struct mbuf **mp;
1026 {
1027 
1028 	/* sanity check. */
1029 	if (pcb_sp == NULL || mp == NULL)
1030 		return EINVAL;
1031 
1032 	*mp = key_sp2msg(pcb_sp);
1033 	if (!*mp) {
1034 		ipseclog((LOG_DEBUG, "ipsec_get_policy: No more memory.\n"));
1035 		return ENOBUFS;
1036 	}
1037 
1038 	(*mp)->m_type = MT_DATA;
1039 	KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1040 		printf("ipsec_get_policy:\n");
1041 		kdebug_mbuf(*mp));
1042 
1043 	return 0;
1044 }
1045 
1046 int
1047 ipsec4_set_policy(inp, optname, request, len, priv)
1048 	struct inpcb *inp;
1049 	int optname;
1050 	caddr_t request;
1051 	size_t len;
1052 	int priv;
1053 {
1054 	struct sadb_x_policy *xpl;
1055 	struct secpolicy **pcb_sp;
1056 
1057 	/* sanity check. */
1058 	if (inp == NULL || request == NULL)
1059 		return EINVAL;
1060 	if (len < sizeof(*xpl))
1061 		return EINVAL;
1062 	xpl = (struct sadb_x_policy *)request;
1063 
1064 	/* select direction */
1065 	switch (xpl->sadb_x_policy_dir) {
1066 	case IPSEC_DIR_INBOUND:
1067 		pcb_sp = &inp->inp_sp->sp_in;
1068 		break;
1069 	case IPSEC_DIR_OUTBOUND:
1070 		pcb_sp = &inp->inp_sp->sp_out;
1071 		break;
1072 	default:
1073 		ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1074 			xpl->sadb_x_policy_dir));
1075 		return EINVAL;
1076 	}
1077 
1078 	return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1079 }
1080 
1081 int
1082 ipsec4_get_policy(inp, request, len, mp)
1083 	struct inpcb *inp;
1084 	caddr_t request;
1085 	size_t len;
1086 	struct mbuf **mp;
1087 {
1088 	struct sadb_x_policy *xpl;
1089 	struct secpolicy *pcb_sp;
1090 
1091 	/* sanity check. */
1092 	if (inp == NULL || request == NULL || mp == NULL)
1093 		return EINVAL;
1094 	KASSERT(inp->inp_sp != NULL, ("ipsec4_get_policy: null inp_sp"));
1095 	if (len < sizeof(*xpl))
1096 		return EINVAL;
1097 	xpl = (struct sadb_x_policy *)request;
1098 
1099 	/* select direction */
1100 	switch (xpl->sadb_x_policy_dir) {
1101 	case IPSEC_DIR_INBOUND:
1102 		pcb_sp = inp->inp_sp->sp_in;
1103 		break;
1104 	case IPSEC_DIR_OUTBOUND:
1105 		pcb_sp = inp->inp_sp->sp_out;
1106 		break;
1107 	default:
1108 		ipseclog((LOG_ERR, "ipsec4_set_policy: invalid direction=%u\n",
1109 			xpl->sadb_x_policy_dir));
1110 		return EINVAL;
1111 	}
1112 
1113 	return ipsec_get_policy(pcb_sp, mp);
1114 }
1115 
1116 /* delete policy in PCB */
1117 int
1118 ipsec4_delete_pcbpolicy(inp)
1119 	struct inpcb *inp;
1120 {
1121 	KASSERT(inp != NULL, ("ipsec4_delete_pcbpolicy: null inp"));
1122 
1123 	if (inp->inp_sp == NULL)
1124 		return 0;
1125 
1126 	if (inp->inp_sp->sp_in != NULL)
1127 		KEY_FREESP(&inp->inp_sp->sp_in);
1128 
1129 	if (inp->inp_sp->sp_out != NULL)
1130 		KEY_FREESP(&inp->inp_sp->sp_out);
1131 
1132 	ipsec_delpcbpolicy(inp->inp_sp);
1133 	inp->inp_sp = NULL;
1134 
1135 	return 0;
1136 }
1137 
1138 #ifdef INET6
1139 int
1140 ipsec6_set_policy(in6p, optname, request, len, priv)
1141 	struct in6pcb *in6p;
1142 	int optname;
1143 	caddr_t request;
1144 	size_t len;
1145 	int priv;
1146 {
1147 	struct sadb_x_policy *xpl;
1148 	struct secpolicy **pcb_sp;
1149 
1150 	/* sanity check. */
1151 	if (in6p == NULL || request == NULL)
1152 		return EINVAL;
1153 	if (len < sizeof(*xpl))
1154 		return EINVAL;
1155 	xpl = (struct sadb_x_policy *)request;
1156 
1157 	/* select direction */
1158 	switch (xpl->sadb_x_policy_dir) {
1159 	case IPSEC_DIR_INBOUND:
1160 		pcb_sp = &in6p->in6p_sp->sp_in;
1161 		break;
1162 	case IPSEC_DIR_OUTBOUND:
1163 		pcb_sp = &in6p->in6p_sp->sp_out;
1164 		break;
1165 	default:
1166 		ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1167 			xpl->sadb_x_policy_dir));
1168 		return EINVAL;
1169 	}
1170 
1171 	return ipsec_set_policy(pcb_sp, optname, request, len, priv);
1172 }
1173 
1174 int
1175 ipsec6_get_policy(in6p, request, len, mp)
1176 	struct in6pcb *in6p;
1177 	caddr_t request;
1178 	size_t len;
1179 	struct mbuf **mp;
1180 {
1181 	struct sadb_x_policy *xpl;
1182 	struct secpolicy *pcb_sp;
1183 
1184 	/* sanity check. */
1185 	if (in6p == NULL || request == NULL || mp == NULL)
1186 		return EINVAL;
1187 	KASSERT(in6p->in6p_sp != NULL, ("ipsec6_get_policy: null in6p_sp"));
1188 	if (len < sizeof(*xpl))
1189 		return EINVAL;
1190 	xpl = (struct sadb_x_policy *)request;
1191 
1192 	/* select direction */
1193 	switch (xpl->sadb_x_policy_dir) {
1194 	case IPSEC_DIR_INBOUND:
1195 		pcb_sp = in6p->in6p_sp->sp_in;
1196 		break;
1197 	case IPSEC_DIR_OUTBOUND:
1198 		pcb_sp = in6p->in6p_sp->sp_out;
1199 		break;
1200 	default:
1201 		ipseclog((LOG_ERR, "ipsec6_set_policy: invalid direction=%u\n",
1202 			xpl->sadb_x_policy_dir));
1203 		return EINVAL;
1204 	}
1205 
1206 	return ipsec_get_policy(pcb_sp, mp);
1207 }
1208 
1209 int
1210 ipsec6_delete_pcbpolicy(in6p)
1211 	struct in6pcb *in6p;
1212 {
1213 	KASSERT(in6p != NULL, ("ipsec6_delete_pcbpolicy: null in6p"));
1214 
1215 	if (in6p->in6p_sp == NULL)
1216 		return 0;
1217 
1218 	if (in6p->in6p_sp->sp_in != NULL)
1219 		KEY_FREESP(&in6p->in6p_sp->sp_in);
1220 
1221 	if (in6p->in6p_sp->sp_out != NULL)
1222 		KEY_FREESP(&in6p->in6p_sp->sp_out);
1223 
1224 	ipsec_delpcbpolicy(in6p->in6p_sp);
1225 	in6p->in6p_sp = NULL;
1226 
1227 	return 0;
1228 }
1229 #endif
1230 
1231 /*
1232  * return current level.
1233  * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned.
1234  */
1235 u_int
1236 ipsec_get_reqlevel(isr)
1237 	struct ipsecrequest *isr;
1238 {
1239 	u_int level = 0;
1240 	u_int esp_trans_deflev, esp_net_deflev;
1241 	u_int ah_trans_deflev, ah_net_deflev;
1242 
1243 	KASSERT(isr != NULL && isr->sp != NULL,
1244 		("ipsec_get_reqlevel: null argument"));
1245 	KASSERT(isr->sp->spidx.src.sa.sa_family == isr->sp->spidx.dst.sa.sa_family,
1246 		("ipsec_get_reqlevel: af family mismatch, src %u, dst %u",
1247 		 isr->sp->spidx.src.sa.sa_family,
1248 		 isr->sp->spidx.dst.sa.sa_family));
1249 
1250 /* XXX note that we have ipseclog() expanded here - code sync issue */
1251 #define IPSEC_CHECK_DEFAULT(lev) \
1252 	(((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE	      \
1253 			&& (lev) != IPSEC_LEVEL_UNIQUE)			      \
1254 		? (ipsec_debug						      \
1255 			? log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\
1256 				(lev), IPSEC_LEVEL_REQUIRE)		      \
1257 			: 0),						      \
1258 			(lev) = IPSEC_LEVEL_REQUIRE,			      \
1259 			(lev)						      \
1260 		: (lev))
1261 
1262 	/* set default level */
1263 	switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) {
1264 #ifdef INET
1265 	case AF_INET:
1266 		esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_trans_deflev);
1267 		esp_net_deflev = IPSEC_CHECK_DEFAULT(ip4_esp_net_deflev);
1268 		ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_trans_deflev);
1269 		ah_net_deflev = IPSEC_CHECK_DEFAULT(ip4_ah_net_deflev);
1270 		break;
1271 #endif
1272 #ifdef INET6
1273 	case AF_INET6:
1274 		esp_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_trans_deflev);
1275 		esp_net_deflev = IPSEC_CHECK_DEFAULT(ip6_esp_net_deflev);
1276 		ah_trans_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_trans_deflev);
1277 		ah_net_deflev = IPSEC_CHECK_DEFAULT(ip6_ah_net_deflev);
1278 		break;
1279 #endif /* INET6 */
1280 	default:
1281 		panic("key_get_reqlevel: unknown af %u",
1282 			isr->sp->spidx.src.sa.sa_family);
1283 	}
1284 
1285 #undef IPSEC_CHECK_DEFAULT
1286 
1287 	/* set level */
1288 	switch (isr->level) {
1289 	case IPSEC_LEVEL_DEFAULT:
1290 		switch (isr->saidx.proto) {
1291 		case IPPROTO_ESP:
1292 			if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1293 				level = esp_net_deflev;
1294 			else
1295 				level = esp_trans_deflev;
1296 			break;
1297 		case IPPROTO_AH:
1298 			if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
1299 				level = ah_net_deflev;
1300 			else
1301 				level = ah_trans_deflev;
1302 		case IPPROTO_IPCOMP:
1303 			/*
1304 			 * we don't really care, as IPcomp document says that
1305 			 * we shouldn't compress small packets
1306 			 */
1307 			level = IPSEC_LEVEL_USE;
1308 			break;
1309 		default:
1310 			panic("ipsec_get_reqlevel: "
1311 				"Illegal protocol defined %u\n",
1312 				isr->saidx.proto);
1313 		}
1314 		break;
1315 
1316 	case IPSEC_LEVEL_USE:
1317 	case IPSEC_LEVEL_REQUIRE:
1318 		level = isr->level;
1319 		break;
1320 	case IPSEC_LEVEL_UNIQUE:
1321 		level = IPSEC_LEVEL_REQUIRE;
1322 		break;
1323 
1324 	default:
1325 		panic("ipsec_get_reqlevel: Illegal IPsec level %u\n",
1326 			isr->level);
1327 	}
1328 
1329 	return level;
1330 }
1331 
1332 /*
1333  * Check security policy requirements against the actual
1334  * packet contents.  Return one if the packet should be
1335  * reject as "invalid"; otherwiser return zero to have the
1336  * packet treated as "valid".
1337  *
1338  * OUT:
1339  *	0: valid
1340  *	1: invalid
1341  */
1342 int
1343 ipsec_in_reject(struct secpolicy *sp, struct mbuf *m)
1344 {
1345 	struct ipsecrequest *isr;
1346 	int need_auth;
1347 
1348 	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1349 		printf("ipsec_in_reject: using SP\n");
1350 		kdebug_secpolicy(sp));
1351 
1352 	/* check policy */
1353 	switch (sp->policy) {
1354 	case IPSEC_POLICY_DISCARD:
1355 		return 1;
1356 	case IPSEC_POLICY_BYPASS:
1357 	case IPSEC_POLICY_NONE:
1358 		return 0;
1359 	}
1360 
1361 	KASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1362 		("ipsec_in_reject: invalid policy %u", sp->policy));
1363 
1364 	/* XXX should compare policy against ipsec header history */
1365 
1366 	need_auth = 0;
1367 	for (isr = sp->req; isr != NULL; isr = isr->next) {
1368 		if (ipsec_get_reqlevel(isr) != IPSEC_LEVEL_REQUIRE)
1369 			continue;
1370 		switch (isr->saidx.proto) {
1371 		case IPPROTO_ESP:
1372 			if ((m->m_flags & M_DECRYPTED) == 0) {
1373 				KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1374 				    printf("ipsec_in_reject: ESP m_flags:%x\n",
1375 					    m->m_flags));
1376 				return 1;
1377 			}
1378 
1379 			if (!need_auth &&
1380 			    isr->sav != NULL &&
1381 			    isr->sav->tdb_authalgxform != NULL &&
1382 			    (m->m_flags & M_AUTHIPDGM) == 0) {
1383 				KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1384 				    printf("ipsec_in_reject: ESP/AH m_flags:%x\n",
1385 					    m->m_flags));
1386 				return 1;
1387 			}
1388 			break;
1389 		case IPPROTO_AH:
1390 			need_auth = 1;
1391 			if ((m->m_flags & M_AUTHIPHDR) == 0) {
1392 				KEYDEBUG(KEYDEBUG_IPSEC_DUMP,
1393 				    printf("ipsec_in_reject: AH m_flags:%x\n",
1394 					    m->m_flags));
1395 				return 1;
1396 			}
1397 			break;
1398 		case IPPROTO_IPCOMP:
1399 			/*
1400 			 * we don't really care, as IPcomp document
1401 			 * says that we shouldn't compress small
1402 			 * packets, IPComp policy should always be
1403 			 * treated as being in "use" level.
1404 			 */
1405 			break;
1406 		}
1407 	}
1408 	return 0;		/* valid */
1409 }
1410 
1411 /*
1412  * Check AH/ESP integrity.
1413  * This function is called from tcp_input(), udp_input(),
1414  * and {ah,esp}4_input for tunnel mode
1415  */
1416 int
1417 ipsec4_in_reject(m, inp)
1418 	struct mbuf *m;
1419 	struct inpcb *inp;
1420 {
1421 	struct secpolicy *sp;
1422 	int error;
1423 	int result;
1424 
1425 	KASSERT(m != NULL, ("ipsec4_in_reject_so: null mbuf"));
1426 
1427 	/* get SP for this packet.
1428 	 * When we are called from ip_forward(), we call
1429 	 * ipsec_getpolicybyaddr() with IP_FORWARDING flag.
1430 	 */
1431 	if (inp == NULL)
1432 		sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
1433 	else
1434 		sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, inp, &error);
1435 
1436 	if (sp != NULL) {
1437 		result = ipsec_in_reject(sp, m);
1438 		if (result)
1439 			newipsecstat.ips_in_polvio++;
1440 		KEY_FREESP(&sp);
1441 	} else {
1442 		result = 0;	/* XXX should be panic ?
1443 				 * -> No, there may be error. */
1444 	}
1445 	return result;
1446 }
1447 
1448 #ifdef INET6
1449 /*
1450  * Check AH/ESP integrity.
1451  * This function is called from tcp6_input(), udp6_input(),
1452  * and {ah,esp}6_input for tunnel mode
1453  */
1454 int
1455 ipsec6_in_reject(m, inp)
1456 	struct mbuf *m;
1457 	struct inpcb *inp;
1458 {
1459 	struct secpolicy *sp = NULL;
1460 	int error;
1461 	int result;
1462 
1463 	/* sanity check */
1464 	if (m == NULL)
1465 		return 0;	/* XXX should be panic ? */
1466 
1467 	/* get SP for this packet.
1468 	 * When we are called from ip_forward(), we call
1469 	 * ipsec_getpolicybyaddr() with IP_FORWARDING flag.
1470 	 */
1471 	if (inp == NULL)
1472 		sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, IP_FORWARDING, &error);
1473 	else
1474 		sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, inp, &error);
1475 
1476 	if (sp != NULL) {
1477 		result = ipsec_in_reject(sp, m);
1478 		if (result)
1479 			newipsecstat.ips_in_polvio++;
1480 		KEY_FREESP(&sp);
1481 	} else {
1482 		result = 0;
1483 	}
1484 	return result;
1485 }
1486 #endif
1487 
1488 /*
1489  * compute the byte size to be occupied by IPsec header.
1490  * in case it is tunneled, it includes the size of outer IP header.
1491  * NOTE: SP passed is free in this function.
1492  */
1493 static size_t
1494 ipsec_hdrsiz(struct secpolicy *sp)
1495 {
1496 	struct ipsecrequest *isr;
1497 	size_t siz;
1498 
1499 	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1500 		printf("ipsec_hdrsiz: using SP\n");
1501 		kdebug_secpolicy(sp));
1502 
1503 	switch (sp->policy) {
1504 	case IPSEC_POLICY_DISCARD:
1505 	case IPSEC_POLICY_BYPASS:
1506 	case IPSEC_POLICY_NONE:
1507 		return 0;
1508 	}
1509 
1510 	KASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1511 		("ipsec_hdrsiz: invalid policy %u", sp->policy));
1512 
1513 	siz = 0;
1514 	for (isr = sp->req; isr != NULL; isr = isr->next) {
1515 		size_t clen = 0;
1516 
1517 		switch (isr->saidx.proto) {
1518 		case IPPROTO_ESP:
1519 			clen = esp_hdrsiz(isr->sav);
1520 			break;
1521 		case IPPROTO_AH:
1522 			clen = ah_hdrsiz(isr->sav);
1523 			break;
1524 		case IPPROTO_IPCOMP:
1525 			clen = sizeof(struct ipcomp);
1526 			break;
1527 		}
1528 
1529 		if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
1530 			switch (isr->saidx.dst.sa.sa_family) {
1531 			case AF_INET:
1532 				clen += sizeof(struct ip);
1533 				break;
1534 #ifdef INET6
1535 			case AF_INET6:
1536 				clen += sizeof(struct ip6_hdr);
1537 				break;
1538 #endif
1539 			default:
1540 				ipseclog((LOG_ERR, "ipsec_hdrsiz: "
1541 				    "unknown AF %d in IPsec tunnel SA\n",
1542 				    ((struct sockaddr *)&isr->saidx.dst)->sa_family));
1543 				break;
1544 			}
1545 		}
1546 		siz += clen;
1547 	}
1548 
1549 	return siz;
1550 }
1551 
1552 /* This function is called from ip_forward() and ipsec4_hdrsize_tcp(). */
1553 size_t
1554 ipsec4_hdrsiz(m, dir, inp)
1555 	struct mbuf *m;
1556 	u_int dir;
1557 	struct inpcb *inp;
1558 {
1559 	struct secpolicy *sp;
1560 	int error;
1561 	size_t size;
1562 
1563 	KASSERT(m != NULL, ("ipsec4_hdrsiz: null mbuf"));
1564 
1565 	/* get SP for this packet.
1566 	 * When we are called from ip_forward(), we call
1567 	 * ipsec_getpolicybyaddr() with IP_FORWARDING flag.
1568 	 */
1569 	if (inp == NULL)
1570 		sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1571 	else
1572 		sp = ipsec_getpolicybysock(m, dir, inp, &error);
1573 
1574 	if (sp != NULL) {
1575 		size = ipsec_hdrsiz(sp);
1576 		KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1577 			printf("ipsec4_hdrsiz: size:%lu.\n",
1578 				(unsigned long)size));
1579 
1580 		KEY_FREESP(&sp);
1581 	} else {
1582 		size = 0;	/* XXX should be panic ? */
1583 	}
1584 	return size;
1585 }
1586 
1587 #ifdef INET6
1588 /* This function is called from ipsec6_hdrsize_tcp(),
1589  * and maybe from ip6_forward.()
1590  */
1591 size_t
1592 ipsec6_hdrsiz(m, dir, in6p)
1593 	struct mbuf *m;
1594 	u_int dir;
1595 	struct in6pcb *in6p;
1596 {
1597 	struct secpolicy *sp;
1598 	int error;
1599 	size_t size;
1600 
1601 	KASSERT(m != NULL, ("ipsec6_hdrsiz: null mbuf"));
1602 	KASSERT(in6p == NULL || in6p->in6p_socket != NULL,
1603 		("ipsec6_hdrsize: socket w/o inpcb"));
1604 
1605 	/* get SP for this packet */
1606 	/* XXX Is it right to call with IP_FORWARDING. */
1607 	if (in6p == NULL)
1608 		sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1609 	else
1610 		sp = ipsec_getpolicybysock(m, dir, in6p, &error);
1611 
1612 	if (sp == NULL)
1613 		return 0;
1614 	size = ipsec_hdrsiz(sp);
1615 	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
1616 		printf("ipsec6_hdrsiz: size:%lu.\n", (unsigned long)size));
1617 	KEY_FREESP(&sp);
1618 
1619 	return size;
1620 }
1621 #endif /*INET6*/
1622 
1623 /*
1624  * Check the variable replay window.
1625  * ipsec_chkreplay() performs replay check before ICV verification.
1626  * ipsec_updatereplay() updates replay bitmap.  This must be called after
1627  * ICV verification (it also performs replay check, which is usually done
1628  * beforehand).
1629  * 0 (zero) is returned if packet disallowed, 1 if packet permitted.
1630  *
1631  * based on RFC 2401.
1632  */
1633 int
1634 ipsec_chkreplay(seq, sav)
1635 	u_int32_t seq;
1636 	struct secasvar *sav;
1637 {
1638 	const struct secreplay *replay;
1639 	u_int32_t diff;
1640 	int fr;
1641 	u_int32_t wsizeb;	/* constant: bits of window size */
1642 	int frlast;		/* constant: last frame */
1643 
1644 #if 0
1645 	SPLASSERT(net, "ipsec_chkreplay");
1646 #endif
1647 
1648 	KASSERT(sav != NULL, ("ipsec_chkreplay: Null SA"));
1649 	KASSERT(sav->replay != NULL, ("ipsec_chkreplay: Null replay state"));
1650 
1651 	replay = sav->replay;
1652 
1653 	if (replay->wsize == 0)
1654 		return 1;	/* no need to check replay. */
1655 
1656 	/* constant */
1657 	frlast = replay->wsize - 1;
1658 	wsizeb = replay->wsize << 3;
1659 
1660 	/* sequence number of 0 is invalid */
1661 	if (seq == 0)
1662 		return 0;
1663 
1664 	/* first time is always okay */
1665 	if (replay->count == 0)
1666 		return 1;
1667 
1668 	if (seq > replay->lastseq) {
1669 		/* larger sequences are okay */
1670 		return 1;
1671 	} else {
1672 		/* seq is equal or less than lastseq. */
1673 		diff = replay->lastseq - seq;
1674 
1675 		/* over range to check, i.e. too old or wrapped */
1676 		if (diff >= wsizeb)
1677 			return 0;
1678 
1679 		fr = frlast - diff / 8;
1680 
1681 		/* this packet already seen ? */
1682 		if ((replay->bitmap)[fr] & (1 << (diff % 8)))
1683 			return 0;
1684 
1685 		/* out of order but good */
1686 		return 1;
1687 	}
1688 }
1689 
1690 /*
1691  * check replay counter whether to update or not.
1692  * OUT:	0:	OK
1693  *	1:	NG
1694  */
1695 int
1696 ipsec_updatereplay(seq, sav)
1697 	u_int32_t seq;
1698 	struct secasvar *sav;
1699 {
1700 	struct secreplay *replay;
1701 	u_int32_t diff;
1702 	int fr;
1703 	u_int32_t wsizeb;	/* constant: bits of window size */
1704 	int frlast;		/* constant: last frame */
1705 
1706 #if 0
1707 	SPLASSERT(net, "ipsec_updatereplay");
1708 #endif
1709 
1710 	KASSERT(sav != NULL, ("ipsec_updatereplay: Null SA"));
1711 	KASSERT(sav->replay != NULL, ("ipsec_updatereplay: Null replay state"));
1712 
1713 	replay = sav->replay;
1714 
1715 	if (replay->wsize == 0)
1716 		goto ok;	/* no need to check replay. */
1717 
1718 	/* constant */
1719 	frlast = replay->wsize - 1;
1720 	wsizeb = replay->wsize << 3;
1721 
1722 	/* sequence number of 0 is invalid */
1723 	if (seq == 0)
1724 		return 1;
1725 
1726 	/* first time */
1727 	if (replay->count == 0) {
1728 		replay->lastseq = seq;
1729 		bzero(replay->bitmap, replay->wsize);
1730 		(replay->bitmap)[frlast] = 1;
1731 		goto ok;
1732 	}
1733 
1734 	if (seq > replay->lastseq) {
1735 		/* seq is larger than lastseq. */
1736 		diff = seq - replay->lastseq;
1737 
1738 		/* new larger sequence number */
1739 		if (diff < wsizeb) {
1740 			/* In window */
1741 			/* set bit for this packet */
1742 			vshiftl(replay->bitmap, diff, replay->wsize);
1743 			(replay->bitmap)[frlast] |= 1;
1744 		} else {
1745 			/* this packet has a "way larger" */
1746 			bzero(replay->bitmap, replay->wsize);
1747 			(replay->bitmap)[frlast] = 1;
1748 		}
1749 		replay->lastseq = seq;
1750 
1751 		/* larger is good */
1752 	} else {
1753 		/* seq is equal or less than lastseq. */
1754 		diff = replay->lastseq - seq;
1755 
1756 		/* over range to check, i.e. too old or wrapped */
1757 		if (diff >= wsizeb)
1758 			return 1;
1759 
1760 		fr = frlast - diff / 8;
1761 
1762 		/* this packet already seen ? */
1763 		if ((replay->bitmap)[fr] & (1 << (diff % 8)))
1764 			return 1;
1765 
1766 		/* mark as seen */
1767 		(replay->bitmap)[fr] |= (1 << (diff % 8));
1768 
1769 		/* out of order but good */
1770 	}
1771 
1772 ok:
1773 	if (replay->count == ~0) {
1774 
1775 		/* set overflow flag */
1776 		replay->overflow++;
1777 
1778 		/* don't increment, no more packets accepted */
1779 		if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0)
1780 			return 1;
1781 
1782 		ipseclog((LOG_WARNING, "replay counter made %d cycle. %s\n",
1783 		    replay->overflow, ipsec_logsastr(sav)));
1784 	}
1785 
1786 	replay->count++;
1787 
1788 	return 0;
1789 }
1790 
1791 /*
1792  * shift variable length bunffer to left.
1793  * IN:	bitmap: pointer to the buffer
1794  * 	nbit:	the number of to shift.
1795  *	wsize:	buffer size (bytes).
1796  */
1797 static void
1798 vshiftl(bitmap, nbit, wsize)
1799 	unsigned char *bitmap;
1800 	int nbit, wsize;
1801 {
1802 	int s, j, i;
1803 	unsigned char over;
1804 
1805 	for (j = 0; j < nbit; j += 8) {
1806 		s = (nbit - j < 8) ? (nbit - j): 8;
1807 		bitmap[0] <<= s;
1808 		for (i = 1; i < wsize; i++) {
1809 			over = (bitmap[i] >> (8 - s));
1810 			bitmap[i] <<= s;
1811 			bitmap[i-1] |= over;
1812 		}
1813 	}
1814 
1815 	return;
1816 }
1817 
1818 /* Return a printable string for the IPv4 address. */
1819 static char *
1820 inet_ntoa4(struct in_addr ina)
1821 {
1822 	static char buf[4][4 * sizeof "123" + 4];
1823 	unsigned char *ucp = (unsigned char *) &ina;
1824 	static int i = 3;
1825 
1826 	i = (i + 1) % 4;
1827 	sprintf(buf[i], "%d.%d.%d.%d", ucp[0] & 0xff, ucp[1] & 0xff,
1828 	    ucp[2] & 0xff, ucp[3] & 0xff);
1829 	return (buf[i]);
1830 }
1831 
1832 /* Return a printable string for the address. */
1833 char *
1834 ipsec_address(union sockaddr_union* sa)
1835 {
1836 	switch (sa->sa.sa_family) {
1837 #if INET
1838 	case AF_INET:
1839 		return inet_ntoa4(sa->sin.sin_addr);
1840 #endif /* INET */
1841 
1842 #if INET6
1843 	case AF_INET6:
1844 		return ip6_sprintf(&sa->sin6.sin6_addr);
1845 #endif /* INET6 */
1846 
1847 	default:
1848 		return "(unknown address family)";
1849 	}
1850 }
1851 
1852 const char *
1853 ipsec_logsastr(sav)
1854 	struct secasvar *sav;
1855 {
1856 	static char buf[256];
1857 	char *p;
1858 	struct secasindex *saidx = &sav->sah->saidx;
1859 
1860 	KASSERT(saidx->src.sa.sa_family == saidx->dst.sa.sa_family,
1861 		("ipsec_logsastr: address family mismatch"));
1862 
1863 	p = buf;
1864 	snprintf(buf, sizeof(buf), "SA(SPI=%u ", (u_int32_t)ntohl(sav->spi));
1865 	while (p && *p)
1866 		p++;
1867 	/* NB: only use ipsec_address on one address at a time */
1868 	snprintf(p, sizeof (buf) - (p - buf), "src=%s ",
1869 		ipsec_address(&saidx->src));
1870 	while (p && *p)
1871 		p++;
1872 	snprintf(p, sizeof (buf) - (p - buf), "dst=%s)",
1873 		ipsec_address(&saidx->dst));
1874 
1875 	return buf;
1876 }
1877 
1878 void
1879 ipsec_dumpmbuf(m)
1880 	struct mbuf *m;
1881 {
1882 	int totlen;
1883 	int i;
1884 	u_char *p;
1885 
1886 	totlen = 0;
1887 	printf("---\n");
1888 	while (m) {
1889 		p = mtod(m, u_char *);
1890 		for (i = 0; i < m->m_len; i++) {
1891 			printf("%02x ", p[i]);
1892 			totlen++;
1893 			if (totlen % 16 == 0)
1894 				printf("\n");
1895 		}
1896 		m = m->m_next;
1897 	}
1898 	if (totlen % 16 != 0)
1899 		printf("\n");
1900 	printf("---\n");
1901 }
1902 
1903 /* XXX this stuff doesn't belong here... */
1904 
1905 static	struct xformsw* xforms = NULL;
1906 
1907 /*
1908  * Register a transform; typically at system startup.
1909  */
1910 void
1911 xform_register(struct xformsw* xsp)
1912 {
1913 	xsp->xf_next = xforms;
1914 	xforms = xsp;
1915 }
1916 
1917 /*
1918  * Initialize transform support in an sav.
1919  */
1920 int
1921 xform_init(struct secasvar *sav, int xftype)
1922 {
1923 	struct xformsw *xsp;
1924 
1925 	for (xsp = xforms; xsp; xsp = xsp->xf_next)
1926 		if (xsp->xf_type == xftype)
1927 			return (*xsp->xf_init)(sav, xsp);
1928 	return EINVAL;
1929 }
1930