xref: /freebsd/sys/netipsec/ipsec_input.c (revision ee7b0571c2c18bdec848ed2044223cc88db29bd8)
1 /*	$FreeBSD$	*/
2 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
3 /*-
4  * The authors of this code are John Ioannidis (ji@tla.org),
5  * Angelos D. Keromytis (kermit@csd.uch.gr) and
6  * Niels Provos (provos@physnet.uni-hamburg.de).
7  *
8  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
9  * in November 1995.
10  *
11  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12  * by Angelos D. Keromytis.
13  *
14  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
15  * and Niels Provos.
16  *
17  * Additional features in 1999 by Angelos D. Keromytis.
18  *
19  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
20  * Angelos D. Keromytis and Niels Provos.
21  * Copyright (c) 2001, Angelos D. Keromytis.
22  *
23  * Permission to use, copy, and modify this software with or without fee
24  * is hereby granted, provided that this entire notice is included in
25  * all copies of any software which is or includes a copy or
26  * modification of this software.
27  * You may use this code under the GNU public license if you so wish. Please
28  * contribute changes back to the authors under this freer than GPL license
29  * so that we may further the use of strong encryption without limitations to
30  * all.
31  *
32  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
33  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
34  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
35  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
36  * PURPOSE.
37  */
38 
39 /*
40  * IPsec input processing.
41  */
42 
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "opt_ipsec.h"
46 #include "opt_enc.h"
47 
48 #include <sys/param.h>
49 #include <sys/systm.h>
50 #include <sys/malloc.h>
51 #include <sys/mbuf.h>
52 #include <sys/domain.h>
53 #include <sys/protosw.h>
54 #include <sys/socket.h>
55 #include <sys/errno.h>
56 #include <sys/syslog.h>
57 
58 #include <net/if.h>
59 #include <net/if_var.h>
60 #include <net/pfil.h>
61 #include <net/route.h>
62 #include <net/netisr.h>
63 #include <net/vnet.h>
64 
65 #include <netinet/in.h>
66 #include <netinet/in_systm.h>
67 #include <netinet/ip.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/in_var.h>
70 
71 #include <netinet/ip6.h>
72 #ifdef INET6
73 #include <netinet6/ip6_var.h>
74 #endif
75 #include <netinet/in_pcb.h>
76 #ifdef INET6
77 #include <netinet/icmp6.h>
78 #endif
79 
80 #include <netipsec/ipsec.h>
81 #ifdef INET6
82 #include <netipsec/ipsec6.h>
83 #endif
84 #include <netipsec/ah_var.h>
85 #include <netipsec/esp.h>
86 #include <netipsec/esp_var.h>
87 #include <netipsec/ipcomp_var.h>
88 
89 #include <netipsec/key.h>
90 #include <netipsec/keydb.h>
91 
92 #include <netipsec/xform.h>
93 #include <netinet6/ip6protosw.h>
94 
95 #include <machine/in_cksum.h>
96 #include <machine/stdarg.h>
97 
98 #ifdef DEV_ENC
99 #include <net/if_enc.h>
100 #endif
101 
102 
103 #define	IPSEC_ISTAT(proto, name)	do {	\
104 	if ((proto) == IPPROTO_ESP)		\
105 		ESPSTAT_INC(esps_##name);	\
106 	else if ((proto) == IPPROTO_AH)		\
107 		AHSTAT_INC(ahs_##name);		\
108 	else					\
109 		IPCOMPSTAT_INC(ipcomps_##name);	\
110 } while (0)
111 
112 #ifdef INET
113 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int);
114 #endif
115 
116 /*
117  * ipsec_common_input gets called when an IPsec-protected packet
118  * is received by IPv4 or IPv6.  Its job is to find the right SA
119  * and call the appropriate transform.  The transform callback
120  * takes care of further processing (like ingress filtering).
121  */
122 static int
123 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
124 {
125 	union sockaddr_union dst_address;
126 	struct secasvar *sav;
127 	u_int32_t spi;
128 	int error;
129 #ifdef INET
130 #ifdef IPSEC_NAT_T
131 	struct m_tag *tag;
132 #endif
133 #endif
134 
135 	IPSEC_ISTAT(sproto, input);
136 
137 	IPSEC_ASSERT(m != NULL, ("null packet"));
138 
139 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
140 		sproto == IPPROTO_IPCOMP,
141 		("unexpected security protocol %u", sproto));
142 
143 	if ((sproto == IPPROTO_ESP && !V_esp_enable) ||
144 	    (sproto == IPPROTO_AH && !V_ah_enable) ||
145 	    (sproto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
146 		m_freem(m);
147 		IPSEC_ISTAT(sproto, pdrops);
148 		return EOPNOTSUPP;
149 	}
150 
151 	if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
152 		m_freem(m);
153 		IPSEC_ISTAT(sproto, hdrops);
154 		DPRINTF(("%s: packet too small\n", __func__));
155 		return EINVAL;
156 	}
157 
158 	/* Retrieve the SPI from the relevant IPsec header */
159 	if (sproto == IPPROTO_ESP)
160 		m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
161 	else if (sproto == IPPROTO_AH)
162 		m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
163 		    (caddr_t) &spi);
164 	else if (sproto == IPPROTO_IPCOMP) {
165 		u_int16_t cpi;
166 		m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
167 		    (caddr_t) &cpi);
168 		spi = ntohl(htons(cpi));
169 	}
170 
171 	/*
172 	 * Find the SA and (indirectly) call the appropriate
173 	 * kernel crypto routine. The resulting mbuf chain is a valid
174 	 * IP packet ready to go through input processing.
175 	 */
176 	bzero(&dst_address, sizeof (dst_address));
177 	dst_address.sa.sa_family = af;
178 	switch (af) {
179 #ifdef INET
180 	case AF_INET:
181 		dst_address.sin.sin_len = sizeof(struct sockaddr_in);
182 		m_copydata(m, offsetof(struct ip, ip_dst),
183 		    sizeof(struct in_addr),
184 		    (caddr_t) &dst_address.sin.sin_addr);
185 #ifdef IPSEC_NAT_T
186 		/* Find the source port for NAT-T; see udp*_espdecap. */
187 		tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL);
188 		if (tag != NULL)
189 			dst_address.sin.sin_port = ((u_int16_t *)(tag + 1))[1];
190 #endif /* IPSEC_NAT_T */
191 		break;
192 #endif /* INET */
193 #ifdef INET6
194 	case AF_INET6:
195 		dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
196 		m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
197 		    sizeof(struct in6_addr),
198 		    (caddr_t) &dst_address.sin6.sin6_addr);
199 		break;
200 #endif /* INET6 */
201 	default:
202 		DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
203 		m_freem(m);
204 		IPSEC_ISTAT(sproto, nopf);
205 		return EPFNOSUPPORT;
206 	}
207 
208 	/* NB: only pass dst since key_allocsa follows RFC2401 */
209 	sav = KEY_ALLOCSA(&dst_address, sproto, spi);
210 	if (sav == NULL) {
211 		DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
212 			  __func__, ipsec_address(&dst_address),
213 			  (u_long) ntohl(spi), sproto));
214 		IPSEC_ISTAT(sproto, notdb);
215 		m_freem(m);
216 		return ENOENT;
217 	}
218 
219 	if (sav->tdb_xform == NULL) {
220 		DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
221 			 __func__, ipsec_address(&dst_address),
222 			 (u_long) ntohl(spi), sproto));
223 		IPSEC_ISTAT(sproto, noxform);
224 		KEY_FREESAV(&sav);
225 		m_freem(m);
226 		return ENXIO;
227 	}
228 
229 	/*
230 	 * Call appropriate transform and return -- callback takes care of
231 	 * everything else.
232 	 */
233 	error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
234 	KEY_FREESAV(&sav);
235 	return error;
236 }
237 
238 #ifdef INET
239 /*
240  * Common input handler for IPv4 AH, ESP, and IPCOMP.
241  */
242 int
243 ipsec4_common_input(struct mbuf *m, ...)
244 {
245 	va_list ap;
246 	int off, nxt;
247 
248 	va_start(ap, m);
249 	off = va_arg(ap, int);
250 	nxt = va_arg(ap, int);
251 	va_end(ap);
252 
253 	return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
254 				  AF_INET, nxt);
255 }
256 
257 void
258 ah4_input(struct mbuf *m, int off)
259 {
260 	ipsec4_common_input(m, off, IPPROTO_AH);
261 }
262 void
263 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
264 {
265 	if (sa->sa_family == AF_INET &&
266 	    sa->sa_len == sizeof(struct sockaddr_in))
267 		ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH);
268 }
269 
270 void
271 esp4_input(struct mbuf *m, int off)
272 {
273 	ipsec4_common_input(m, off, IPPROTO_ESP);
274 }
275 void
276 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
277 {
278 	if (sa->sa_family == AF_INET &&
279 	    sa->sa_len == sizeof(struct sockaddr_in))
280 		ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP);
281 }
282 
283 void
284 ipcomp4_input(struct mbuf *m, int off)
285 {
286 	ipsec4_common_input(m, off, IPPROTO_IPCOMP);
287 }
288 
289 /*
290  * IPsec input callback for INET protocols.
291  * This routine is called as the transform callback.
292  * Takes care of filtering and other sanity checks on
293  * the processed packet.
294  */
295 int
296 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
297 			int skip, int protoff, struct m_tag *mt)
298 {
299 	int prot, af, sproto, isr_prot;
300 	struct ip *ip;
301 	struct m_tag *mtag;
302 	struct tdb_ident *tdbi;
303 	struct secasindex *saidx;
304 	int error;
305 #ifdef INET6
306 #ifdef notyet
307 	char ip6buf[INET6_ADDRSTRLEN];
308 #endif
309 #endif
310 
311 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
312 	IPSEC_ASSERT(sav != NULL, ("null SA"));
313 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
314 	saidx = &sav->sah->saidx;
315 	af = saidx->dst.sa.sa_family;
316 	IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
317 	sproto = saidx->proto;
318 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
319 		sproto == IPPROTO_IPCOMP,
320 		("unexpected security protocol %u", sproto));
321 
322 	/* Sanity check */
323 	if (m == NULL) {
324 		DPRINTF(("%s: null mbuf", __func__));
325 		IPSEC_ISTAT(sproto, badkcr);
326 		KEY_FREESAV(&sav);
327 		return EINVAL;
328 	}
329 
330 	if (skip != 0) {
331 		/*
332 		 * Fix IPv4 header
333 		 * XXXGL: do we need this entire block?
334 		 */
335 		if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
336 			DPRINTF(("%s: processing failed for SA %s/%08lx\n",
337 			    __func__, ipsec_address(&sav->sah->saidx.dst),
338 			    (u_long) ntohl(sav->spi)));
339 			IPSEC_ISTAT(sproto, hdrops);
340 			error = ENOBUFS;
341 			goto bad;
342 		}
343 
344 		ip = mtod(m, struct ip *);
345 		ip->ip_len = htons(m->m_pkthdr.len);
346 		ip->ip_sum = 0;
347 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
348 	} else {
349 		ip = mtod(m, struct ip *);
350 	}
351 	prot = ip->ip_p;
352 
353 #ifdef DEV_ENC
354 	encif->if_ipackets++;
355 	encif->if_ibytes += m->m_pkthdr.len;
356 
357 	/*
358 	 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
359 	 * packet later after it has been decapsulated.
360 	 */
361 	ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
362 
363 	if (prot != IPPROTO_IPIP)
364 		if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
365 			return (error);
366 #endif /* DEV_ENC */
367 
368 	/* IP-in-IP encapsulation */
369 	if (prot == IPPROTO_IPIP) {
370 
371 		if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
372 			IPSEC_ISTAT(sproto, hdrops);
373 			error = EINVAL;
374 			goto bad;
375 		}
376 		/* enc0: strip outer IPv4 header */
377 		m_striphdr(m, 0, ip->ip_hl << 2);
378 
379 #ifdef notyet
380 		/* XXX PROXY address isn't recorded in SAH */
381 		/*
382 		 * Check that the inner source address is the same as
383 		 * the proxy address, if available.
384 		 */
385 		if ((saidx->proxy.sa.sa_family == AF_INET &&
386 		    saidx->proxy.sin.sin_addr.s_addr !=
387 		    INADDR_ANY &&
388 		    ipn.ip_src.s_addr !=
389 		    saidx->proxy.sin.sin_addr.s_addr) ||
390 		    (saidx->proxy.sa.sa_family != AF_INET &&
391 			saidx->proxy.sa.sa_family != 0)) {
392 
393 			DPRINTF(("%s: inner source address %s doesn't "
394 			    "correspond to expected proxy source %s, "
395 			    "SA %s/%08lx\n", __func__,
396 			    inet_ntoa4(ipn.ip_src),
397 			    ipsp_address(saidx->proxy),
398 			    ipsp_address(saidx->dst),
399 			    (u_long) ntohl(sav->spi)));
400 
401 			IPSEC_ISTAT(sproto, pdrops);
402 			error = EACCES;
403 			goto bad;
404 		}
405 #endif /* notyet */
406 	}
407 #ifdef INET6
408 	/* IPv6-in-IP encapsulation. */
409 	if (prot == IPPROTO_IPV6) {
410 
411 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
412 			IPSEC_ISTAT(sproto, hdrops);
413 			error = EINVAL;
414 			goto bad;
415 		}
416 		/* enc0: strip IPv4 header, keep IPv6 header only */
417 		m_striphdr(m, 0, ip->ip_hl << 2);
418 #ifdef notyet
419 		/*
420 		 * Check that the inner source address is the same as
421 		 * the proxy address, if available.
422 		 */
423 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
424 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
425 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
426 			&saidx->proxy.sin6.sin6_addr)) ||
427 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
428 			saidx->proxy.sa.sa_family != 0)) {
429 
430 			DPRINTF(("%s: inner source address %s doesn't "
431 			    "correspond to expected proxy source %s, "
432 			    "SA %s/%08lx\n", __func__,
433 			    ip6_sprintf(ip6buf, &ip6n.ip6_src),
434 			    ipsec_address(&saidx->proxy),
435 			    ipsec_address(&saidx->dst),
436 			    (u_long) ntohl(sav->spi)));
437 
438 			IPSEC_ISTAT(sproto, pdrops);
439 			error = EACCES;
440 			goto bad;
441 		}
442 #endif /* notyet */
443 	}
444 #endif /* INET6 */
445 
446 	/*
447 	 * Record what we've done to the packet (under what SA it was
448 	 * processed). If we've been passed an mtag, it means the packet
449 	 * was already processed by an ethernet/crypto combo card and
450 	 * thus has a tag attached with all the right information, but
451 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
452 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
453 	 */
454 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
455 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
456 		    sizeof(struct tdb_ident), M_NOWAIT);
457 		if (mtag == NULL) {
458 			DPRINTF(("%s: failed to get tag\n", __func__));
459 			IPSEC_ISTAT(sproto, hdrops);
460 			error = ENOMEM;
461 			goto bad;
462 		}
463 
464 		tdbi = (struct tdb_ident *)(mtag + 1);
465 		bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
466 		tdbi->proto = sproto;
467 		tdbi->spi = sav->spi;
468 		/* Cache those two for enc(4) in xform_ipip. */
469 		tdbi->alg_auth = sav->alg_auth;
470 		tdbi->alg_enc = sav->alg_enc;
471 
472 		m_tag_prepend(m, mtag);
473 	} else if (mt != NULL) {
474 		mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
475 		/* XXX do we need to mark m_flags??? */
476 	}
477 
478 	key_sa_recordxfer(sav, m);		/* record data transfer */
479 
480 #ifdef DEV_ENC
481 	/*
482 	 * Pass the mbuf to enc0 for bpf and pfil.
483 	 */
484 	if (prot == IPPROTO_IPIP)
485 		ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER);
486 #ifdef INET6
487 	if (prot == IPPROTO_IPV6)
488 		ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER);
489 #endif
490 
491 	if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0)
492 		return (error);
493 #endif /* DEV_ENC */
494 
495 	/*
496 	 * Re-dispatch via software interrupt.
497 	 */
498 
499 	switch (prot) {
500 	case IPPROTO_IPIP:
501 		isr_prot = NETISR_IP;
502 		break;
503 #ifdef INET6
504 	case IPPROTO_IPV6:
505 		isr_prot = NETISR_IPV6;
506 		break;
507 #endif
508 	default:
509 		DPRINTF(("%s: cannot handle inner ip proto %d\n",
510 			    __func__, prot));
511 		IPSEC_ISTAT(sproto, nopf);
512 		error = EPFNOSUPPORT;
513 		goto bad;
514 	}
515 
516 	error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m);
517 	if (error) {
518 		IPSEC_ISTAT(sproto, qfull);
519 		DPRINTF(("%s: queue full; proto %u packet dropped\n",
520 			__func__, sproto));
521 		return error;
522 	}
523 	return 0;
524 bad:
525 	m_freem(m);
526 	return error;
527 }
528 
529 void
530 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
531 {
532 	/* XXX nothing just yet */
533 }
534 #endif /* INET */
535 
536 #ifdef INET6
537 /* IPv6 AH wrapper. */
538 int
539 ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
540 {
541 	int l = 0;
542 	int protoff;
543 	struct ip6_ext ip6e;
544 
545 	if (*offp < sizeof(struct ip6_hdr)) {
546 		DPRINTF(("%s: bad offset %u\n", __func__, *offp));
547 		return IPPROTO_DONE;
548 	} else if (*offp == sizeof(struct ip6_hdr)) {
549 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
550 	} else {
551 		/* Chase down the header chain... */
552 		protoff = sizeof(struct ip6_hdr);
553 
554 		do {
555 			protoff += l;
556 			m_copydata(*mp, protoff, sizeof(ip6e),
557 			    (caddr_t) &ip6e);
558 
559 			if (ip6e.ip6e_nxt == IPPROTO_AH)
560 				l = (ip6e.ip6e_len + 2) << 2;
561 			else
562 				l = (ip6e.ip6e_len + 1) << 3;
563 			IPSEC_ASSERT(l > 0, ("l went zero or negative"));
564 		} while (protoff + l < *offp);
565 
566 		/* Malformed packet check */
567 		if (protoff + l != *offp) {
568 			DPRINTF(("%s: bad packet header chain, protoff %u, "
569 				"l %u, off %u\n", __func__, protoff, l, *offp));
570 			IPSEC_ISTAT(proto, hdrops);
571 			m_freem(*mp);
572 			*mp = NULL;
573 			return IPPROTO_DONE;
574 		}
575 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
576 	}
577 	(void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
578 	return IPPROTO_DONE;
579 }
580 
581 /*
582  * IPsec input callback, called by the transform callback. Takes care of
583  * filtering and other sanity checks on the processed packet.
584  */
585 int
586 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
587     struct m_tag *mt)
588 {
589 	int prot, af, sproto;
590 	struct ip6_hdr *ip6;
591 	struct m_tag *mtag;
592 	struct tdb_ident *tdbi;
593 	struct secasindex *saidx;
594 	int nxt;
595 	u_int8_t nxt8;
596 	int error, nest;
597 #ifdef notyet
598 	char ip6buf[INET6_ADDRSTRLEN];
599 #endif
600 
601 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
602 	IPSEC_ASSERT(sav != NULL, ("null SA"));
603 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
604 	saidx = &sav->sah->saidx;
605 	af = saidx->dst.sa.sa_family;
606 	IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
607 	sproto = saidx->proto;
608 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
609 		sproto == IPPROTO_IPCOMP,
610 		("unexpected security protocol %u", sproto));
611 
612 	/* Sanity check */
613 	if (m == NULL) {
614 		DPRINTF(("%s: null mbuf", __func__));
615 		IPSEC_ISTAT(sproto, badkcr);
616 		error = EINVAL;
617 		goto bad;
618 	}
619 
620 	/* Fix IPv6 header */
621 	if (m->m_len < sizeof(struct ip6_hdr) &&
622 	    (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
623 
624 		DPRINTF(("%s: processing failed for SA %s/%08lx\n",
625 		    __func__, ipsec_address(&sav->sah->saidx.dst),
626 		    (u_long) ntohl(sav->spi)));
627 
628 		IPSEC_ISTAT(sproto, hdrops);
629 		error = EACCES;
630 		goto bad;
631 	}
632 
633 	ip6 = mtod(m, struct ip6_hdr *);
634 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
635 
636 	/* Save protocol */
637 	prot = 0;
638 	m_copydata(m, protoff, 1, (unsigned char *) &prot);
639 
640 #ifdef DEV_ENC
641 	encif->if_ipackets++;
642 	encif->if_ibytes += m->m_pkthdr.len;
643 
644 	/*
645 	 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
646 	 * packet later after it has been decapsulated.
647 	 */
648 	ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
649 
650 	/* XXX-BZ does not make sense. */
651 	if (prot != IPPROTO_IPIP)
652 		if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
653 			return (error);
654 #endif /* DEV_ENC */
655 
656 #ifdef INET
657 	/* IP-in-IP encapsulation */
658 	if (prot == IPPROTO_IPIP) {
659 		if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
660 			IPSEC_ISTAT(sproto, hdrops);
661 			error = EINVAL;
662 			goto bad;
663 		}
664 		/* ipn will now contain the inner IPv4 header */
665 	 	m_striphdr(m, 0, skip);
666 		skip = 0;
667 #ifdef notyet
668 		/*
669 		 * Check that the inner source address is the same as
670 		 * the proxy address, if available.
671 		 */
672 		if ((saidx->proxy.sa.sa_family == AF_INET &&
673 		    saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
674 		    ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
675 		    (saidx->proxy.sa.sa_family != AF_INET &&
676 			saidx->proxy.sa.sa_family != 0)) {
677 
678 			DPRINTF(("%s: inner source address %s doesn't "
679 			    "correspond to expected proxy source %s, "
680 			    "SA %s/%08lx\n", __func__,
681 			    inet_ntoa4(ipn.ip_src),
682 			    ipsec_address(&saidx->proxy),
683 			    ipsec_address(&saidx->dst),
684 			    (u_long) ntohl(sav->spi)));
685 
686 			IPSEC_ISTAT(sproto, pdrops);
687 			error = EACCES;
688 			goto bad;
689 		}
690 #endif /* notyet */
691 	}
692 #endif /* INET */
693 	/* IPv6-in-IP encapsulation */
694 	if (prot == IPPROTO_IPV6) {
695 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
696 			IPSEC_ISTAT(sproto, hdrops);
697 			error = EINVAL;
698 			goto bad;
699 		}
700 		/* ip6n will now contain the inner IPv6 header. */
701 		m_striphdr(m, 0, skip);
702 		skip = 0;
703 #ifdef notyet
704 		/*
705 		 * Check that the inner source address is the same as
706 		 * the proxy address, if available.
707 		 */
708 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
709 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
710 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
711 			&saidx->proxy.sin6.sin6_addr)) ||
712 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
713 			saidx->proxy.sa.sa_family != 0)) {
714 
715 			DPRINTF(("%s: inner source address %s doesn't "
716 			    "correspond to expected proxy source %s, "
717 			    "SA %s/%08lx\n", __func__,
718 			    ip6_sprintf(ip6buf, &ip6n.ip6_src),
719 			    ipsec_address(&saidx->proxy),
720 			    ipsec_address(&saidx->dst),
721 			    (u_long) ntohl(sav->spi)));
722 
723 			IPSEC_ISTAT(sproto, pdrops);
724 			error = EACCES;
725 			goto bad;
726 		}
727 #endif /* notyet */
728 	}
729 
730 	/*
731 	 * Record what we've done to the packet (under what SA it was
732 	 * processed). If we've been passed an mtag, it means the packet
733 	 * was already processed by an ethernet/crypto combo card and
734 	 * thus has a tag attached with all the right information, but
735 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
736 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
737 	 */
738 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
739 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
740 		    sizeof(struct tdb_ident), M_NOWAIT);
741 		if (mtag == NULL) {
742 			DPRINTF(("%s: failed to get tag\n", __func__));
743 			IPSEC_ISTAT(sproto, hdrops);
744 			error = ENOMEM;
745 			goto bad;
746 		}
747 
748 		tdbi = (struct tdb_ident *)(mtag + 1);
749 		bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
750 		tdbi->proto = sproto;
751 		tdbi->spi = sav->spi;
752 		/* Cache those two for enc(4) in xform_ipip. */
753 		tdbi->alg_auth = sav->alg_auth;
754 		tdbi->alg_enc = sav->alg_enc;
755 
756 		m_tag_prepend(m, mtag);
757 	} else {
758 		if (mt != NULL)
759 			mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
760 		/* XXX do we need to mark m_flags??? */
761 	}
762 
763 	key_sa_recordxfer(sav, m);
764 
765 #ifdef DEV_ENC
766 	/*
767 	 * Pass the mbuf to enc0 for bpf and pfil.
768 	 */
769 #ifdef INET
770 	if (prot == IPPROTO_IPIP)
771 		ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER);
772 #endif
773 	if (prot == IPPROTO_IPV6)
774 		ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER);
775 
776 	if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0)
777 		return (error);
778 #endif /* DEV_ENC */
779 	/* Retrieve new protocol */
780 	/* We have stripped the IP6 header from the mbuf, we have to use the backuped proto value instead */
781 	nxt8 = prot;
782 
783 	/*
784 	 * See the end of ip6_input for this logic.
785 	 * IPPROTO_IPV[46] case will be processed just like other ones
786 	 */
787 	nest = 0;
788 	nxt = nxt8;
789 	while (nxt != IPPROTO_DONE) {
790 		if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) {
791 			IP6STAT_INC(ip6s_toomanyhdr);
792 			error = EINVAL;
793 			goto bad;
794 		}
795 
796 		/*
797 		 * Protection against faulty packet - there should be
798 		 * more sanity checks in header chain processing.
799 		 */
800 		if (m->m_pkthdr.len < skip) {
801 			IP6STAT_INC(ip6s_tooshort);
802 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
803 			error = EINVAL;
804 			goto bad;
805 		}
806 		/*
807 		 * Enforce IPsec policy checking if we are seeing last header.
808 		 * note that we do not visit this with protocols with pcb layer
809 		 * code - like udp/tcp/raw ip.
810 		 */
811 		if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
812 		    ipsec6_in_reject(m, NULL)) {
813 			error = EINVAL;
814 			goto bad;
815 		}
816 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
817 	}
818 	return 0;
819 bad:
820 	if (m)
821 		m_freem(m);
822 	return error;
823 }
824 
825 void
826 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
827 {
828 	struct ip6ctlparam *ip6cp = NULL;
829 	struct mbuf *m = NULL;
830 	struct ip6_hdr *ip6;
831 	int off;
832 
833 	if (sa->sa_family != AF_INET6 ||
834 	    sa->sa_len != sizeof(struct sockaddr_in6))
835 		return;
836 	if ((unsigned)cmd >= PRC_NCMDS)
837 		return;
838 
839 	/* if the parameter is from icmp6, decode it. */
840 	if (d != NULL) {
841 		ip6cp = (struct ip6ctlparam *)d;
842 		m = ip6cp->ip6c_m;
843 		ip6 = ip6cp->ip6c_ip6;
844 		off = ip6cp->ip6c_off;
845 	} else {
846 		m = NULL;
847 		ip6 = NULL;
848 		off = 0;	/* calm gcc */
849 	}
850 
851 	if (ip6 != NULL) {
852 
853 		struct ip6ctlparam ip6cp1;
854 
855 		/*
856 		 * Notify the error to all possible sockets via pfctlinput2.
857 		 * Since the upper layer information (such as protocol type,
858 		 * source and destination ports) is embedded in the encrypted
859 		 * data and might have been cut, we can't directly call
860 		 * an upper layer ctlinput function. However, the pcbnotify
861 		 * function will consider source and destination addresses
862 		 * as well as the flow info value, and may be able to find
863 		 * some PCB that should be notified.
864 		 * Although pfctlinput2 will call esp6_ctlinput(), there is
865 		 * no possibility of an infinite loop of function calls,
866 		 * because we don't pass the inner IPv6 header.
867 		 */
868 		bzero(&ip6cp1, sizeof(ip6cp1));
869 		ip6cp1.ip6c_src = ip6cp->ip6c_src;
870 		pfctlinput2(cmd, sa, (void *)&ip6cp1);
871 
872 		/*
873 		 * Then go to special cases that need ESP header information.
874 		 * XXX: We assume that when ip6 is non NULL,
875 		 * M and OFF are valid.
876 		 */
877 
878 		if (cmd == PRC_MSGSIZE) {
879 			struct secasvar *sav;
880 			u_int32_t spi;
881 			int valid;
882 
883 			/* check header length before using m_copydata */
884 			if (m->m_pkthdr.len < off + sizeof (struct esp))
885 				return;
886 			m_copydata(m, off + offsetof(struct esp, esp_spi),
887 				sizeof(u_int32_t), (caddr_t) &spi);
888 			/*
889 			 * Check to see if we have a valid SA corresponding to
890 			 * the address in the ICMP message payload.
891 			 */
892 			sav = KEY_ALLOCSA((union sockaddr_union *)sa,
893 					IPPROTO_ESP, spi);
894 			valid = (sav != NULL);
895 			if (sav)
896 				KEY_FREESAV(&sav);
897 
898 			/* XXX Further validation? */
899 
900 			/*
901 			 * Depending on whether the SA is "valid" and
902 			 * routing table size (mtudisc_{hi,lo}wat), we will:
903 			 * - recalcurate the new MTU and create the
904 			 *   corresponding routing entry, or
905 			 * - ignore the MTU change notification.
906 			 */
907 			icmp6_mtudisc_update(ip6cp, valid);
908 		}
909 	} else {
910 		/* we normally notify any pcb here */
911 	}
912 }
913 #endif /* INET6 */
914