1 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 2 /*- 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org> 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IPsec input processing. 41 */ 42 43 #include <sys/cdefs.h> 44 __FBSDID("$FreeBSD$"); 45 46 #include "opt_inet.h" 47 #include "opt_inet6.h" 48 #include "opt_ipsec.h" 49 50 #include <sys/param.h> 51 #include <sys/systm.h> 52 #include <sys/malloc.h> 53 #include <sys/mbuf.h> 54 #include <sys/domain.h> 55 #include <sys/protosw.h> 56 #include <sys/socket.h> 57 #include <sys/errno.h> 58 #include <sys/hhook.h> 59 #include <sys/syslog.h> 60 61 #include <net/if.h> 62 #include <net/if_var.h> 63 #include <net/if_enc.h> 64 #include <net/netisr.h> 65 #include <net/vnet.h> 66 67 #include <netinet/in.h> 68 #include <netinet/in_systm.h> 69 #include <netinet/ip.h> 70 #include <netinet/ip_var.h> 71 #include <netinet/in_var.h> 72 73 #include <netinet/ip6.h> 74 #ifdef INET6 75 #include <netinet6/ip6_var.h> 76 #endif 77 #include <netinet/in_pcb.h> 78 #ifdef INET6 79 #include <netinet/icmp6.h> 80 #endif 81 82 #include <netipsec/ipsec.h> 83 #ifdef INET6 84 #include <netipsec/ipsec6.h> 85 #endif 86 #include <netipsec/ah_var.h> 87 #include <netipsec/esp.h> 88 #include <netipsec/esp_var.h> 89 #include <netipsec/ipcomp_var.h> 90 91 #include <netipsec/key.h> 92 #include <netipsec/keydb.h> 93 #include <netipsec/key_debug.h> 94 95 #include <netipsec/xform.h> 96 #include <netinet6/ip6protosw.h> 97 98 #include <machine/in_cksum.h> 99 #include <machine/stdarg.h> 100 101 #define IPSEC_ISTAT(proto, name) do { \ 102 if ((proto) == IPPROTO_ESP) \ 103 ESPSTAT_INC(esps_##name); \ 104 else if ((proto) == IPPROTO_AH) \ 105 AHSTAT_INC(ahs_##name); \ 106 else \ 107 IPCOMPSTAT_INC(ipcomps_##name); \ 108 } while (0) 109 110 /* 111 * ipsec_common_input gets called when an IPsec-protected packet 112 * is received by IPv4 or IPv6. Its job is to find the right SA 113 * and call the appropriate transform. The transform callback 114 * takes care of further processing (like ingress filtering). 115 */ 116 static int 117 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 118 { 119 IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]); 120 union sockaddr_union dst_address; 121 struct secasvar *sav; 122 uint32_t spi; 123 int error; 124 125 IPSEC_ISTAT(sproto, input); 126 127 IPSEC_ASSERT(m != NULL, ("null packet")); 128 129 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 130 sproto == IPPROTO_IPCOMP, 131 ("unexpected security protocol %u", sproto)); 132 133 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 134 (sproto == IPPROTO_AH && !V_ah_enable) || 135 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 136 m_freem(m); 137 IPSEC_ISTAT(sproto, pdrops); 138 return EOPNOTSUPP; 139 } 140 141 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 142 m_freem(m); 143 IPSEC_ISTAT(sproto, hdrops); 144 DPRINTF(("%s: packet too small\n", __func__)); 145 return EINVAL; 146 } 147 148 /* Retrieve the SPI from the relevant IPsec header */ 149 if (sproto == IPPROTO_ESP) 150 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 151 else if (sproto == IPPROTO_AH) 152 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 153 (caddr_t) &spi); 154 else if (sproto == IPPROTO_IPCOMP) { 155 u_int16_t cpi; 156 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 157 (caddr_t) &cpi); 158 spi = ntohl(htons(cpi)); 159 } 160 161 /* 162 * Find the SA and (indirectly) call the appropriate 163 * kernel crypto routine. The resulting mbuf chain is a valid 164 * IP packet ready to go through input processing. 165 */ 166 bzero(&dst_address, sizeof (dst_address)); 167 dst_address.sa.sa_family = af; 168 switch (af) { 169 #ifdef INET 170 case AF_INET: 171 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 172 m_copydata(m, offsetof(struct ip, ip_dst), 173 sizeof(struct in_addr), 174 (caddr_t) &dst_address.sin.sin_addr); 175 break; 176 #endif /* INET */ 177 #ifdef INET6 178 case AF_INET6: 179 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 180 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 181 sizeof(struct in6_addr), 182 (caddr_t) &dst_address.sin6.sin6_addr); 183 /* We keep addresses in SADB without embedded scope id */ 184 if (IN6_IS_SCOPE_LINKLOCAL(&dst_address.sin6.sin6_addr)) { 185 /* XXX: sa6_recoverscope() */ 186 dst_address.sin6.sin6_scope_id = 187 ntohs(dst_address.sin6.sin6_addr.s6_addr16[1]); 188 dst_address.sin6.sin6_addr.s6_addr16[1] = 0; 189 } 190 break; 191 #endif /* INET6 */ 192 default: 193 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 194 m_freem(m); 195 IPSEC_ISTAT(sproto, nopf); 196 return EPFNOSUPPORT; 197 } 198 199 /* NB: only pass dst since key_allocsa follows RFC2401 */ 200 sav = key_allocsa(&dst_address, sproto, spi); 201 if (sav == NULL) { 202 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 203 __func__, ipsec_address(&dst_address, buf, sizeof(buf)), 204 (u_long) ntohl(spi), sproto)); 205 IPSEC_ISTAT(sproto, notdb); 206 m_freem(m); 207 return ENOENT; 208 } 209 210 if (sav->tdb_xform == NULL) { 211 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 212 __func__, ipsec_address(&dst_address, buf, sizeof(buf)), 213 (u_long) ntohl(spi), sproto)); 214 IPSEC_ISTAT(sproto, noxform); 215 key_freesav(&sav); 216 m_freem(m); 217 return ENXIO; 218 } 219 220 /* 221 * Call appropriate transform and return -- callback takes care of 222 * everything else. 223 */ 224 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 225 return (error); 226 } 227 228 #ifdef INET 229 extern struct protosw inetsw[]; 230 231 /* 232 * IPSEC_INPUT() method implementation for IPv4. 233 * 0 - Permitted by inbound security policy for further processing. 234 * EACCES - Forbidden by inbound security policy. 235 * EINPROGRESS - consumed by IPsec. 236 */ 237 int 238 ipsec4_input(struct mbuf *m, int offset, int proto) 239 { 240 241 switch (proto) { 242 case IPPROTO_AH: 243 case IPPROTO_ESP: 244 case IPPROTO_IPCOMP: 245 /* Do inbound IPsec processing for AH/ESP/IPCOMP */ 246 ipsec_common_input(m, offset, 247 offsetof(struct ip, ip_p), AF_INET, proto); 248 return (EINPROGRESS); /* mbuf consumed by IPsec */ 249 default: 250 /* 251 * Protocols with further headers get their IPsec treatment 252 * within the protocol specific processing. 253 */ 254 if ((inetsw[ip_protox[proto]].pr_flags & PR_LASTHDR) == 0) 255 return (0); 256 /* FALLTHROUGH */ 257 }; 258 /* 259 * Enforce IPsec policy checking if we are seeing last header. 260 */ 261 if (ipsec4_in_reject(m, NULL) != 0) { 262 /* Forbidden by inbound security policy */ 263 m_freem(m); 264 return (EACCES); 265 } 266 return (0); 267 } 268 269 /* 270 * IPsec input callback for INET protocols. 271 * This routine is called as the transform callback. 272 * Takes care of filtering and other sanity checks on 273 * the processed packet. 274 */ 275 int 276 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, 277 int protoff) 278 { 279 IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]); 280 struct epoch_tracker et; 281 struct ipsec_ctx_data ctx; 282 struct xform_history *xh; 283 struct secasindex *saidx; 284 struct m_tag *mtag; 285 struct ip *ip; 286 int error, prot, af, sproto, isr_prot; 287 288 IPSEC_ASSERT(sav != NULL, ("null SA")); 289 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 290 saidx = &sav->sah->saidx; 291 af = saidx->dst.sa.sa_family; 292 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 293 sproto = saidx->proto; 294 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 295 sproto == IPPROTO_IPCOMP, 296 ("unexpected security protocol %u", sproto)); 297 298 if (skip != 0) { 299 /* 300 * Fix IPv4 header 301 */ 302 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 303 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 304 __func__, ipsec_address(&sav->sah->saidx.dst, 305 buf, sizeof(buf)), (u_long) ntohl(sav->spi))); 306 IPSEC_ISTAT(sproto, hdrops); 307 error = ENOBUFS; 308 goto bad; 309 } 310 311 ip = mtod(m, struct ip *); 312 ip->ip_len = htons(m->m_pkthdr.len); 313 ip->ip_sum = 0; 314 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 315 } else { 316 ip = mtod(m, struct ip *); 317 } 318 prot = ip->ip_p; 319 /* 320 * Check that we have NAT-T enabled and apply transport mode 321 * decapsulation NAT procedure (RFC3948). 322 * Do this before invoking into the PFIL. 323 */ 324 if (sav->natt != NULL && 325 (prot == IPPROTO_UDP || prot == IPPROTO_TCP)) 326 udp_ipsec_adjust_cksum(m, sav, prot, skip); 327 328 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, AF_INET, IPSEC_ENC_BEFORE); 329 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 330 goto bad; 331 ip = mtod(m, struct ip *); /* update pointer */ 332 333 /* IP-in-IP encapsulation */ 334 if (prot == IPPROTO_IPIP && 335 saidx->mode != IPSEC_MODE_TRANSPORT) { 336 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 337 IPSEC_ISTAT(sproto, hdrops); 338 error = EINVAL; 339 goto bad; 340 } 341 /* enc0: strip outer IPv4 header */ 342 m_striphdr(m, 0, ip->ip_hl << 2); 343 } 344 #ifdef INET6 345 /* IPv6-in-IP encapsulation. */ 346 else if (prot == IPPROTO_IPV6 && 347 saidx->mode != IPSEC_MODE_TRANSPORT) { 348 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 349 IPSEC_ISTAT(sproto, hdrops); 350 error = EINVAL; 351 goto bad; 352 } 353 /* enc0: strip IPv4 header, keep IPv6 header only */ 354 m_striphdr(m, 0, ip->ip_hl << 2); 355 } 356 #endif /* INET6 */ 357 else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) { 358 /* 359 * When mode is wildcard, inner protocol is IPv6 and 360 * we have no INET6 support - drop this packet a bit later. 361 * In other cases we assume transport mode. Set prot to 362 * correctly choose netisr. 363 */ 364 prot = IPPROTO_IPIP; 365 } 366 367 /* 368 * Record what we've done to the packet (under what SA it was 369 * processed). 370 */ 371 if (sproto != IPPROTO_IPCOMP) { 372 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 373 sizeof(struct xform_history), M_NOWAIT); 374 if (mtag == NULL) { 375 DPRINTF(("%s: failed to get tag\n", __func__)); 376 IPSEC_ISTAT(sproto, hdrops); 377 error = ENOMEM; 378 goto bad; 379 } 380 381 xh = (struct xform_history *)(mtag + 1); 382 bcopy(&saidx->dst, &xh->dst, saidx->dst.sa.sa_len); 383 xh->spi = sav->spi; 384 xh->proto = sproto; 385 xh->mode = saidx->mode; 386 m_tag_prepend(m, mtag); 387 } 388 389 key_sa_recordxfer(sav, m); /* record data transfer */ 390 391 /* 392 * In transport mode requeue decrypted mbuf back to IPv4 protocol 393 * handler. This is necessary to correctly expose rcvif. 394 */ 395 if (saidx->mode == IPSEC_MODE_TRANSPORT) 396 prot = IPPROTO_IPIP; 397 /* 398 * Re-dispatch via software interrupt. 399 */ 400 switch (prot) { 401 case IPPROTO_IPIP: 402 isr_prot = NETISR_IP; 403 af = AF_INET; 404 break; 405 #ifdef INET6 406 case IPPROTO_IPV6: 407 isr_prot = NETISR_IPV6; 408 af = AF_INET6; 409 break; 410 #endif 411 default: 412 DPRINTF(("%s: cannot handle inner ip proto %d\n", 413 __func__, prot)); 414 IPSEC_ISTAT(sproto, nopf); 415 error = EPFNOSUPPORT; 416 goto bad; 417 } 418 419 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER); 420 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 421 goto bad; 422 423 /* Handle virtual tunneling interfaces */ 424 if (saidx->mode == IPSEC_MODE_TUNNEL) 425 error = ipsec_if_input(m, sav, af); 426 if (error == 0) { 427 NET_EPOCH_ENTER(et); 428 error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m); 429 NET_EPOCH_EXIT(et); 430 if (error) { 431 IPSEC_ISTAT(sproto, qfull); 432 DPRINTF(("%s: queue full; proto %u packet dropped\n", 433 __func__, sproto)); 434 } 435 } 436 key_freesav(&sav); 437 return (error); 438 bad: 439 key_freesav(&sav); 440 if (m != NULL) 441 m_freem(m); 442 return (error); 443 } 444 #endif /* INET */ 445 446 #ifdef INET6 447 /* 448 * IPSEC_INPUT() method implementation for IPv6. 449 * 0 - Permitted by inbound security policy for further processing. 450 * EACCES - Forbidden by inbound security policy. 451 * EINPROGRESS - consumed by IPsec. 452 */ 453 int 454 ipsec6_input(struct mbuf *m, int offset, int proto) 455 { 456 457 switch (proto) { 458 case IPPROTO_AH: 459 case IPPROTO_ESP: 460 case IPPROTO_IPCOMP: 461 /* Do inbound IPsec processing for AH/ESP/IPCOMP */ 462 ipsec_common_input(m, offset, 463 offsetof(struct ip6_hdr, ip6_nxt), AF_INET6, proto); 464 return (EINPROGRESS); /* mbuf consumed by IPsec */ 465 default: 466 /* 467 * Protocols with further headers get their IPsec treatment 468 * within the protocol specific processing. 469 */ 470 if ((inet6sw[ip6_protox[proto]].pr_flags & PR_LASTHDR) == 0) 471 return (0); 472 /* FALLTHROUGH */ 473 }; 474 /* 475 * Enforce IPsec policy checking if we are seeing last header. 476 */ 477 if (ipsec6_in_reject(m, NULL) != 0) { 478 /* Forbidden by inbound security policy */ 479 m_freem(m); 480 return (EACCES); 481 } 482 return (0); 483 } 484 485 /* 486 * IPsec input callback, called by the transform callback. Takes care of 487 * filtering and other sanity checks on the processed packet. 488 */ 489 int 490 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, 491 int protoff) 492 { 493 IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]); 494 struct epoch_tracker et; 495 struct ipsec_ctx_data ctx; 496 struct xform_history *xh; 497 struct secasindex *saidx; 498 struct ip6_hdr *ip6; 499 struct m_tag *mtag; 500 int prot, af, sproto; 501 int nxt, isr_prot; 502 int error, nest; 503 uint8_t nxt8; 504 505 IPSEC_ASSERT(sav != NULL, ("null SA")); 506 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 507 saidx = &sav->sah->saidx; 508 af = saidx->dst.sa.sa_family; 509 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 510 sproto = saidx->proto; 511 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 512 sproto == IPPROTO_IPCOMP, 513 ("unexpected security protocol %u", sproto)); 514 515 /* Fix IPv6 header */ 516 if (m->m_len < sizeof(struct ip6_hdr) && 517 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 518 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 519 __func__, ipsec_address(&sav->sah->saidx.dst, buf, 520 sizeof(buf)), (u_long) ntohl(sav->spi))); 521 522 IPSEC_ISTAT(sproto, hdrops); 523 error = EACCES; 524 goto bad; 525 } 526 527 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_BEFORE); 528 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 529 goto bad; 530 531 ip6 = mtod(m, struct ip6_hdr *); 532 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 533 534 /* Save protocol */ 535 m_copydata(m, protoff, 1, &nxt8); 536 prot = nxt8; 537 538 /* IPv6-in-IP encapsulation */ 539 if (prot == IPPROTO_IPV6 && 540 saidx->mode != IPSEC_MODE_TRANSPORT) { 541 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 542 IPSEC_ISTAT(sproto, hdrops); 543 error = EINVAL; 544 goto bad; 545 } 546 /* ip6n will now contain the inner IPv6 header. */ 547 m_striphdr(m, 0, skip); 548 skip = 0; 549 } 550 #ifdef INET 551 /* IP-in-IP encapsulation */ 552 else if (prot == IPPROTO_IPIP && 553 saidx->mode != IPSEC_MODE_TRANSPORT) { 554 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 555 IPSEC_ISTAT(sproto, hdrops); 556 error = EINVAL; 557 goto bad; 558 } 559 /* ipn will now contain the inner IPv4 header */ 560 m_striphdr(m, 0, skip); 561 skip = 0; 562 } 563 #endif /* INET */ 564 else { 565 prot = IPPROTO_IPV6; /* for correct BPF processing */ 566 } 567 568 /* 569 * Record what we've done to the packet (under what SA it was 570 * processed). 571 */ 572 if (sproto != IPPROTO_IPCOMP) { 573 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 574 sizeof(struct xform_history), M_NOWAIT); 575 if (mtag == NULL) { 576 DPRINTF(("%s: failed to get tag\n", __func__)); 577 IPSEC_ISTAT(sproto, hdrops); 578 error = ENOMEM; 579 goto bad; 580 } 581 582 xh = (struct xform_history *)(mtag + 1); 583 bcopy(&saidx->dst, &xh->dst, saidx->dst.sa.sa_len); 584 xh->spi = sav->spi; 585 xh->proto = sproto; 586 xh->mode = saidx->mode; 587 m_tag_prepend(m, mtag); 588 } 589 590 key_sa_recordxfer(sav, m); 591 592 #ifdef INET 593 if (prot == IPPROTO_IPIP) 594 af = AF_INET; 595 else 596 #endif 597 af = AF_INET6; 598 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER); 599 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 600 goto bad; 601 if (skip == 0) { 602 /* 603 * We stripped outer IPv6 header. 604 * Now we should requeue decrypted packet via netisr. 605 */ 606 switch (prot) { 607 #ifdef INET 608 case IPPROTO_IPIP: 609 isr_prot = NETISR_IP; 610 break; 611 #endif 612 case IPPROTO_IPV6: 613 isr_prot = NETISR_IPV6; 614 break; 615 default: 616 DPRINTF(("%s: cannot handle inner ip proto %d\n", 617 __func__, prot)); 618 IPSEC_ISTAT(sproto, nopf); 619 error = EPFNOSUPPORT; 620 goto bad; 621 } 622 /* Handle virtual tunneling interfaces */ 623 if (saidx->mode == IPSEC_MODE_TUNNEL) 624 error = ipsec_if_input(m, sav, af); 625 if (error == 0) { 626 NET_EPOCH_ENTER(et); 627 error = netisr_queue_src(isr_prot, 628 (uintptr_t)sav->spi, m); 629 NET_EPOCH_EXIT(et); 630 if (error) { 631 IPSEC_ISTAT(sproto, qfull); 632 DPRINTF(("%s: queue full; proto %u packet" 633 " dropped\n", __func__, sproto)); 634 } 635 } 636 key_freesav(&sav); 637 return (error); 638 } 639 /* 640 * See the end of ip6_input for this logic. 641 * IPPROTO_IPV[46] case will be processed just like other ones 642 */ 643 nest = 0; 644 nxt = nxt8; 645 NET_EPOCH_ENTER(et); 646 while (nxt != IPPROTO_DONE) { 647 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 648 IP6STAT_INC(ip6s_toomanyhdr); 649 error = EINVAL; 650 goto bad_epoch; 651 } 652 653 /* 654 * Protection against faulty packet - there should be 655 * more sanity checks in header chain processing. 656 */ 657 if (m->m_pkthdr.len < skip) { 658 IP6STAT_INC(ip6s_tooshort); 659 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 660 error = EINVAL; 661 goto bad_epoch; 662 } 663 /* 664 * Enforce IPsec policy checking if we are seeing last header. 665 * note that we do not visit this with protocols with pcb layer 666 * code - like udp/tcp/raw ip. 667 */ 668 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 669 ipsec6_in_reject(m, NULL)) { 670 error = EINVAL; 671 goto bad_epoch; 672 } 673 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 674 } 675 NET_EPOCH_EXIT(et); 676 key_freesav(&sav); 677 return (0); 678 bad_epoch: 679 NET_EPOCH_EXIT(et); 680 bad: 681 key_freesav(&sav); 682 if (m) 683 m_freem(m); 684 return (error); 685 } 686 #endif /* INET6 */ 687