1 /* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */ 2 /*- 3 * The authors of this code are John Ioannidis (ji@tla.org), 4 * Angelos D. Keromytis (kermit@csd.uch.gr) and 5 * Niels Provos (provos@physnet.uni-hamburg.de). 6 * 7 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 8 * in November 1995. 9 * 10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 11 * by Angelos D. Keromytis. 12 * 13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 14 * and Niels Provos. 15 * 16 * Additional features in 1999 by Angelos D. Keromytis. 17 * 18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 19 * Angelos D. Keromytis and Niels Provos. 20 * Copyright (c) 2001, Angelos D. Keromytis. 21 * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org> 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IPsec input processing. 41 */ 42 43 #include <sys/cdefs.h> 44 __FBSDID("$FreeBSD$"); 45 46 #include "opt_inet.h" 47 #include "opt_inet6.h" 48 #include "opt_ipsec.h" 49 50 #include <sys/param.h> 51 #include <sys/systm.h> 52 #include <sys/malloc.h> 53 #include <sys/mbuf.h> 54 #include <sys/domain.h> 55 #include <sys/protosw.h> 56 #include <sys/socket.h> 57 #include <sys/errno.h> 58 #include <sys/hhook.h> 59 #include <sys/syslog.h> 60 61 #include <net/if.h> 62 #include <net/if_var.h> 63 #include <net/if_enc.h> 64 #include <net/netisr.h> 65 #include <net/vnet.h> 66 67 #include <netinet/in.h> 68 #include <netinet/in_systm.h> 69 #include <netinet/ip.h> 70 #include <netinet/ip_var.h> 71 #include <netinet/in_var.h> 72 73 #include <netinet/ip6.h> 74 #ifdef INET6 75 #include <netinet6/ip6_var.h> 76 #endif 77 #include <netinet/in_pcb.h> 78 #ifdef INET6 79 #include <netinet/icmp6.h> 80 #endif 81 82 #include <netipsec/ipsec.h> 83 #ifdef INET6 84 #include <netipsec/ipsec6.h> 85 #endif 86 #include <netipsec/ah_var.h> 87 #include <netipsec/esp.h> 88 #include <netipsec/esp_var.h> 89 #include <netipsec/ipcomp_var.h> 90 91 #include <netipsec/key.h> 92 #include <netipsec/keydb.h> 93 #include <netipsec/key_debug.h> 94 95 #include <netipsec/xform.h> 96 #include <netinet6/ip6protosw.h> 97 98 #include <machine/in_cksum.h> 99 #include <machine/stdarg.h> 100 101 102 #define IPSEC_ISTAT(proto, name) do { \ 103 if ((proto) == IPPROTO_ESP) \ 104 ESPSTAT_INC(esps_##name); \ 105 else if ((proto) == IPPROTO_AH) \ 106 AHSTAT_INC(ahs_##name); \ 107 else \ 108 IPCOMPSTAT_INC(ipcomps_##name); \ 109 } while (0) 110 111 /* 112 * ipsec_common_input gets called when an IPsec-protected packet 113 * is received by IPv4 or IPv6. Its job is to find the right SA 114 * and call the appropriate transform. The transform callback 115 * takes care of further processing (like ingress filtering). 116 */ 117 static int 118 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) 119 { 120 IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]); 121 union sockaddr_union dst_address; 122 struct secasvar *sav; 123 uint32_t spi; 124 int error; 125 126 IPSEC_ISTAT(sproto, input); 127 128 IPSEC_ASSERT(m != NULL, ("null packet")); 129 130 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 131 sproto == IPPROTO_IPCOMP, 132 ("unexpected security protocol %u", sproto)); 133 134 if ((sproto == IPPROTO_ESP && !V_esp_enable) || 135 (sproto == IPPROTO_AH && !V_ah_enable) || 136 (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) { 137 m_freem(m); 138 IPSEC_ISTAT(sproto, pdrops); 139 return EOPNOTSUPP; 140 } 141 142 if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) { 143 m_freem(m); 144 IPSEC_ISTAT(sproto, hdrops); 145 DPRINTF(("%s: packet too small\n", __func__)); 146 return EINVAL; 147 } 148 149 /* Retrieve the SPI from the relevant IPsec header */ 150 if (sproto == IPPROTO_ESP) 151 m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); 152 else if (sproto == IPPROTO_AH) 153 m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t), 154 (caddr_t) &spi); 155 else if (sproto == IPPROTO_IPCOMP) { 156 u_int16_t cpi; 157 m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t), 158 (caddr_t) &cpi); 159 spi = ntohl(htons(cpi)); 160 } 161 162 /* 163 * Find the SA and (indirectly) call the appropriate 164 * kernel crypto routine. The resulting mbuf chain is a valid 165 * IP packet ready to go through input processing. 166 */ 167 bzero(&dst_address, sizeof (dst_address)); 168 dst_address.sa.sa_family = af; 169 switch (af) { 170 #ifdef INET 171 case AF_INET: 172 dst_address.sin.sin_len = sizeof(struct sockaddr_in); 173 m_copydata(m, offsetof(struct ip, ip_dst), 174 sizeof(struct in_addr), 175 (caddr_t) &dst_address.sin.sin_addr); 176 break; 177 #endif /* INET */ 178 #ifdef INET6 179 case AF_INET6: 180 dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6); 181 m_copydata(m, offsetof(struct ip6_hdr, ip6_dst), 182 sizeof(struct in6_addr), 183 (caddr_t) &dst_address.sin6.sin6_addr); 184 /* We keep addresses in SADB without embedded scope id */ 185 if (IN6_IS_SCOPE_LINKLOCAL(&dst_address.sin6.sin6_addr)) { 186 /* XXX: sa6_recoverscope() */ 187 dst_address.sin6.sin6_scope_id = 188 ntohs(dst_address.sin6.sin6_addr.s6_addr16[1]); 189 dst_address.sin6.sin6_addr.s6_addr16[1] = 0; 190 } 191 break; 192 #endif /* INET6 */ 193 default: 194 DPRINTF(("%s: unsupported protocol family %u\n", __func__, af)); 195 m_freem(m); 196 IPSEC_ISTAT(sproto, nopf); 197 return EPFNOSUPPORT; 198 } 199 200 /* NB: only pass dst since key_allocsa follows RFC2401 */ 201 sav = key_allocsa(&dst_address, sproto, spi); 202 if (sav == NULL) { 203 DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n", 204 __func__, ipsec_address(&dst_address, buf, sizeof(buf)), 205 (u_long) ntohl(spi), sproto)); 206 IPSEC_ISTAT(sproto, notdb); 207 m_freem(m); 208 return ENOENT; 209 } 210 211 if (sav->tdb_xform == NULL) { 212 DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n", 213 __func__, ipsec_address(&dst_address, buf, sizeof(buf)), 214 (u_long) ntohl(spi), sproto)); 215 IPSEC_ISTAT(sproto, noxform); 216 key_freesav(&sav); 217 m_freem(m); 218 return ENXIO; 219 } 220 221 /* 222 * Call appropriate transform and return -- callback takes care of 223 * everything else. 224 */ 225 error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff); 226 return (error); 227 } 228 229 #ifdef INET 230 extern struct protosw inetsw[]; 231 232 /* 233 * IPSEC_INPUT() method implementation for IPv4. 234 * 0 - Permitted by inbound security policy for further processing. 235 * EACCES - Forbidden by inbound security policy. 236 * EINPROGRESS - consumed by IPsec. 237 */ 238 int 239 ipsec4_input(struct mbuf *m, int offset, int proto) 240 { 241 242 switch (proto) { 243 case IPPROTO_AH: 244 case IPPROTO_ESP: 245 case IPPROTO_IPCOMP: 246 /* Do inbound IPsec processing for AH/ESP/IPCOMP */ 247 ipsec_common_input(m, offset, 248 offsetof(struct ip, ip_p), AF_INET, proto); 249 return (EINPROGRESS); /* mbuf consumed by IPsec */ 250 default: 251 /* 252 * Protocols with further headers get their IPsec treatment 253 * within the protocol specific processing. 254 */ 255 if ((inetsw[ip_protox[proto]].pr_flags & PR_LASTHDR) == 0) 256 return (0); 257 /* FALLTHROUGH */ 258 }; 259 /* 260 * Enforce IPsec policy checking if we are seeing last header. 261 */ 262 if (ipsec4_in_reject(m, NULL) != 0) { 263 /* Forbidden by inbound security policy */ 264 m_freem(m); 265 return (EACCES); 266 } 267 return (0); 268 } 269 270 /* 271 * IPsec input callback for INET protocols. 272 * This routine is called as the transform callback. 273 * Takes care of filtering and other sanity checks on 274 * the processed packet. 275 */ 276 int 277 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, 278 int protoff) 279 { 280 IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]); 281 struct epoch_tracker et; 282 struct ipsec_ctx_data ctx; 283 struct xform_history *xh; 284 struct secasindex *saidx; 285 struct m_tag *mtag; 286 struct ip *ip; 287 int error, prot, af, sproto, isr_prot; 288 289 IPSEC_ASSERT(sav != NULL, ("null SA")); 290 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 291 saidx = &sav->sah->saidx; 292 af = saidx->dst.sa.sa_family; 293 IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af)); 294 sproto = saidx->proto; 295 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 296 sproto == IPPROTO_IPCOMP, 297 ("unexpected security protocol %u", sproto)); 298 299 if (skip != 0) { 300 /* 301 * Fix IPv4 header 302 */ 303 if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) { 304 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 305 __func__, ipsec_address(&sav->sah->saidx.dst, 306 buf, sizeof(buf)), (u_long) ntohl(sav->spi))); 307 IPSEC_ISTAT(sproto, hdrops); 308 error = ENOBUFS; 309 goto bad; 310 } 311 312 ip = mtod(m, struct ip *); 313 ip->ip_len = htons(m->m_pkthdr.len); 314 ip->ip_sum = 0; 315 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 316 } else { 317 ip = mtod(m, struct ip *); 318 } 319 prot = ip->ip_p; 320 /* 321 * Check that we have NAT-T enabled and apply transport mode 322 * decapsulation NAT procedure (RFC3948). 323 * Do this before invoking into the PFIL. 324 */ 325 if (sav->natt != NULL && 326 (prot == IPPROTO_UDP || prot == IPPROTO_TCP)) 327 udp_ipsec_adjust_cksum(m, sav, prot, skip); 328 329 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, AF_INET, IPSEC_ENC_BEFORE); 330 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 331 goto bad; 332 ip = mtod(m, struct ip *); /* update pointer */ 333 334 /* IP-in-IP encapsulation */ 335 if (prot == IPPROTO_IPIP && 336 saidx->mode != IPSEC_MODE_TRANSPORT) { 337 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 338 IPSEC_ISTAT(sproto, hdrops); 339 error = EINVAL; 340 goto bad; 341 } 342 /* enc0: strip outer IPv4 header */ 343 m_striphdr(m, 0, ip->ip_hl << 2); 344 } 345 #ifdef INET6 346 /* IPv6-in-IP encapsulation. */ 347 else if (prot == IPPROTO_IPV6 && 348 saidx->mode != IPSEC_MODE_TRANSPORT) { 349 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 350 IPSEC_ISTAT(sproto, hdrops); 351 error = EINVAL; 352 goto bad; 353 } 354 /* enc0: strip IPv4 header, keep IPv6 header only */ 355 m_striphdr(m, 0, ip->ip_hl << 2); 356 } 357 #endif /* INET6 */ 358 else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) { 359 /* 360 * When mode is wildcard, inner protocol is IPv6 and 361 * we have no INET6 support - drop this packet a bit later. 362 * In other cases we assume transport mode. Set prot to 363 * correctly choose netisr. 364 */ 365 prot = IPPROTO_IPIP; 366 } 367 368 /* 369 * Record what we've done to the packet (under what SA it was 370 * processed). 371 */ 372 if (sproto != IPPROTO_IPCOMP) { 373 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 374 sizeof(struct xform_history), M_NOWAIT); 375 if (mtag == NULL) { 376 DPRINTF(("%s: failed to get tag\n", __func__)); 377 IPSEC_ISTAT(sproto, hdrops); 378 error = ENOMEM; 379 goto bad; 380 } 381 382 xh = (struct xform_history *)(mtag + 1); 383 bcopy(&saidx->dst, &xh->dst, saidx->dst.sa.sa_len); 384 xh->spi = sav->spi; 385 xh->proto = sproto; 386 xh->mode = saidx->mode; 387 m_tag_prepend(m, mtag); 388 } 389 390 key_sa_recordxfer(sav, m); /* record data transfer */ 391 392 /* 393 * In transport mode requeue decrypted mbuf back to IPv4 protocol 394 * handler. This is necessary to correctly expose rcvif. 395 */ 396 if (saidx->mode == IPSEC_MODE_TRANSPORT) 397 prot = IPPROTO_IPIP; 398 /* 399 * Re-dispatch via software interrupt. 400 */ 401 switch (prot) { 402 case IPPROTO_IPIP: 403 isr_prot = NETISR_IP; 404 af = AF_INET; 405 break; 406 #ifdef INET6 407 case IPPROTO_IPV6: 408 isr_prot = NETISR_IPV6; 409 af = AF_INET6; 410 break; 411 #endif 412 default: 413 DPRINTF(("%s: cannot handle inner ip proto %d\n", 414 __func__, prot)); 415 IPSEC_ISTAT(sproto, nopf); 416 error = EPFNOSUPPORT; 417 goto bad; 418 } 419 420 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER); 421 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 422 goto bad; 423 424 /* Handle virtual tunneling interfaces */ 425 if (saidx->mode == IPSEC_MODE_TUNNEL) 426 error = ipsec_if_input(m, sav, af); 427 if (error == 0) { 428 NET_EPOCH_ENTER(et); 429 error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m); 430 NET_EPOCH_EXIT(et); 431 if (error) { 432 IPSEC_ISTAT(sproto, qfull); 433 DPRINTF(("%s: queue full; proto %u packet dropped\n", 434 __func__, sproto)); 435 } 436 } 437 key_freesav(&sav); 438 return (error); 439 bad: 440 key_freesav(&sav); 441 if (m != NULL) 442 m_freem(m); 443 return (error); 444 } 445 #endif /* INET */ 446 447 #ifdef INET6 448 /* 449 * IPSEC_INPUT() method implementation for IPv6. 450 * 0 - Permitted by inbound security policy for further processing. 451 * EACCES - Forbidden by inbound security policy. 452 * EINPROGRESS - consumed by IPsec. 453 */ 454 int 455 ipsec6_input(struct mbuf *m, int offset, int proto) 456 { 457 458 switch (proto) { 459 case IPPROTO_AH: 460 case IPPROTO_ESP: 461 case IPPROTO_IPCOMP: 462 /* Do inbound IPsec processing for AH/ESP/IPCOMP */ 463 ipsec_common_input(m, offset, 464 offsetof(struct ip6_hdr, ip6_nxt), AF_INET6, proto); 465 return (EINPROGRESS); /* mbuf consumed by IPsec */ 466 default: 467 /* 468 * Protocols with further headers get their IPsec treatment 469 * within the protocol specific processing. 470 */ 471 if ((inet6sw[ip6_protox[proto]].pr_flags & PR_LASTHDR) == 0) 472 return (0); 473 /* FALLTHROUGH */ 474 }; 475 /* 476 * Enforce IPsec policy checking if we are seeing last header. 477 */ 478 if (ipsec6_in_reject(m, NULL) != 0) { 479 /* Forbidden by inbound security policy */ 480 m_freem(m); 481 return (EACCES); 482 } 483 return (0); 484 } 485 486 /* 487 * IPsec input callback, called by the transform callback. Takes care of 488 * filtering and other sanity checks on the processed packet. 489 */ 490 int 491 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, 492 int protoff) 493 { 494 IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]); 495 struct epoch_tracker et; 496 struct ipsec_ctx_data ctx; 497 struct xform_history *xh; 498 struct secasindex *saidx; 499 struct ip6_hdr *ip6; 500 struct m_tag *mtag; 501 int prot, af, sproto; 502 int nxt, isr_prot; 503 int error, nest; 504 uint8_t nxt8; 505 506 IPSEC_ASSERT(sav != NULL, ("null SA")); 507 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 508 saidx = &sav->sah->saidx; 509 af = saidx->dst.sa.sa_family; 510 IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af)); 511 sproto = saidx->proto; 512 IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH || 513 sproto == IPPROTO_IPCOMP, 514 ("unexpected security protocol %u", sproto)); 515 516 /* Fix IPv6 header */ 517 if (m->m_len < sizeof(struct ip6_hdr) && 518 (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 519 520 DPRINTF(("%s: processing failed for SA %s/%08lx\n", 521 __func__, ipsec_address(&sav->sah->saidx.dst, buf, 522 sizeof(buf)), (u_long) ntohl(sav->spi))); 523 524 IPSEC_ISTAT(sproto, hdrops); 525 error = EACCES; 526 goto bad; 527 } 528 529 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_BEFORE); 530 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 531 goto bad; 532 533 ip6 = mtod(m, struct ip6_hdr *); 534 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 535 536 /* Save protocol */ 537 m_copydata(m, protoff, 1, &nxt8); 538 prot = nxt8; 539 540 /* IPv6-in-IP encapsulation */ 541 if (prot == IPPROTO_IPV6 && 542 saidx->mode != IPSEC_MODE_TRANSPORT) { 543 if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) { 544 IPSEC_ISTAT(sproto, hdrops); 545 error = EINVAL; 546 goto bad; 547 } 548 /* ip6n will now contain the inner IPv6 header. */ 549 m_striphdr(m, 0, skip); 550 skip = 0; 551 } 552 #ifdef INET 553 /* IP-in-IP encapsulation */ 554 else if (prot == IPPROTO_IPIP && 555 saidx->mode != IPSEC_MODE_TRANSPORT) { 556 if (m->m_pkthdr.len - skip < sizeof(struct ip)) { 557 IPSEC_ISTAT(sproto, hdrops); 558 error = EINVAL; 559 goto bad; 560 } 561 /* ipn will now contain the inner IPv4 header */ 562 m_striphdr(m, 0, skip); 563 skip = 0; 564 } 565 #endif /* INET */ 566 else { 567 prot = IPPROTO_IPV6; /* for correct BPF processing */ 568 } 569 570 /* 571 * Record what we've done to the packet (under what SA it was 572 * processed). 573 */ 574 if (sproto != IPPROTO_IPCOMP) { 575 mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE, 576 sizeof(struct xform_history), M_NOWAIT); 577 if (mtag == NULL) { 578 DPRINTF(("%s: failed to get tag\n", __func__)); 579 IPSEC_ISTAT(sproto, hdrops); 580 error = ENOMEM; 581 goto bad; 582 } 583 584 xh = (struct xform_history *)(mtag + 1); 585 bcopy(&saidx->dst, &xh->dst, saidx->dst.sa.sa_len); 586 xh->spi = sav->spi; 587 xh->proto = sproto; 588 xh->mode = saidx->mode; 589 m_tag_prepend(m, mtag); 590 } 591 592 key_sa_recordxfer(sav, m); 593 594 #ifdef INET 595 if (prot == IPPROTO_IPIP) 596 af = AF_INET; 597 else 598 #endif 599 af = AF_INET6; 600 IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER); 601 if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0) 602 goto bad; 603 if (skip == 0) { 604 /* 605 * We stripped outer IPv6 header. 606 * Now we should requeue decrypted packet via netisr. 607 */ 608 switch (prot) { 609 #ifdef INET 610 case IPPROTO_IPIP: 611 isr_prot = NETISR_IP; 612 break; 613 #endif 614 case IPPROTO_IPV6: 615 isr_prot = NETISR_IPV6; 616 break; 617 default: 618 DPRINTF(("%s: cannot handle inner ip proto %d\n", 619 __func__, prot)); 620 IPSEC_ISTAT(sproto, nopf); 621 error = EPFNOSUPPORT; 622 goto bad; 623 } 624 /* Handle virtual tunneling interfaces */ 625 if (saidx->mode == IPSEC_MODE_TUNNEL) 626 error = ipsec_if_input(m, sav, af); 627 if (error == 0) { 628 NET_EPOCH_ENTER(et); 629 error = netisr_queue_src(isr_prot, 630 (uintptr_t)sav->spi, m); 631 NET_EPOCH_EXIT(et); 632 if (error) { 633 IPSEC_ISTAT(sproto, qfull); 634 DPRINTF(("%s: queue full; proto %u packet" 635 " dropped\n", __func__, sproto)); 636 } 637 } 638 key_freesav(&sav); 639 return (error); 640 } 641 /* 642 * See the end of ip6_input for this logic. 643 * IPPROTO_IPV[46] case will be processed just like other ones 644 */ 645 nest = 0; 646 nxt = nxt8; 647 NET_EPOCH_ENTER(et); 648 while (nxt != IPPROTO_DONE) { 649 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 650 IP6STAT_INC(ip6s_toomanyhdr); 651 error = EINVAL; 652 goto bad_epoch; 653 } 654 655 /* 656 * Protection against faulty packet - there should be 657 * more sanity checks in header chain processing. 658 */ 659 if (m->m_pkthdr.len < skip) { 660 IP6STAT_INC(ip6s_tooshort); 661 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 662 error = EINVAL; 663 goto bad_epoch; 664 } 665 /* 666 * Enforce IPsec policy checking if we are seeing last header. 667 * note that we do not visit this with protocols with pcb layer 668 * code - like udp/tcp/raw ip. 669 */ 670 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 671 ipsec6_in_reject(m, NULL)) { 672 error = EINVAL; 673 goto bad_epoch; 674 } 675 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt); 676 } 677 NET_EPOCH_EXIT(et); 678 key_freesav(&sav); 679 return (0); 680 bad_epoch: 681 NET_EPOCH_EXIT(et); 682 bad: 683 key_freesav(&sav); 684 if (m) 685 m_freem(m); 686 return (error); 687 } 688 #endif /* INET6 */ 689