xref: /freebsd/sys/netipsec/ipsec_output.c (revision e68b3792440cac248347afe08ba5881a00ba6523)
1aaea26efSSam Leffler /*-
2fe267a55SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3fe267a55SPedro F. Giffuni  *
4aaea26efSSam Leffler  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
5fcf59617SAndrey V. Elsukov  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
6aaea26efSSam Leffler  * All rights reserved.
7aaea26efSSam Leffler  *
8aaea26efSSam Leffler  * Redistribution and use in source and binary forms, with or without
9aaea26efSSam Leffler  * modification, are permitted provided that the following conditions
10aaea26efSSam Leffler  * are met:
11aaea26efSSam Leffler  * 1. Redistributions of source code must retain the above copyright
12aaea26efSSam Leffler  *    notice, this list of conditions and the following disclaimer.
13aaea26efSSam Leffler  * 2. Redistributions in binary form must reproduce the above copyright
14aaea26efSSam Leffler  *    notice, this list of conditions and the following disclaimer in the
15aaea26efSSam Leffler  *    documentation and/or other materials provided with the distribution.
16aaea26efSSam Leffler  *
17aaea26efSSam Leffler  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18aaea26efSSam Leffler  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19aaea26efSSam Leffler  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20aaea26efSSam Leffler  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21aaea26efSSam Leffler  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22aaea26efSSam Leffler  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23aaea26efSSam Leffler  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24aaea26efSSam Leffler  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25aaea26efSSam Leffler  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26aaea26efSSam Leffler  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27aaea26efSSam Leffler  * SUCH DAMAGE.
28aaea26efSSam Leffler  *
29aaea26efSSam Leffler  * $FreeBSD$
30aaea26efSSam Leffler  */
3188768458SSam Leffler 
3288768458SSam Leffler /*
3388768458SSam Leffler  * IPsec output processing.
3488768458SSam Leffler  */
3588768458SSam Leffler #include "opt_inet.h"
3688768458SSam Leffler #include "opt_inet6.h"
3788768458SSam Leffler #include "opt_ipsec.h"
38fcf59617SAndrey V. Elsukov #include "opt_sctp.h"
3988768458SSam Leffler 
4088768458SSam Leffler #include <sys/param.h>
4188768458SSam Leffler #include <sys/systm.h>
4288768458SSam Leffler #include <sys/mbuf.h>
4388768458SSam Leffler #include <sys/domain.h>
4488768458SSam Leffler #include <sys/protosw.h>
4588768458SSam Leffler #include <sys/socket.h>
4688768458SSam Leffler #include <sys/errno.h>
47ef91a976SAndrey V. Elsukov #include <sys/hhook.h>
4888768458SSam Leffler #include <sys/syslog.h>
4988768458SSam Leffler 
5088768458SSam Leffler #include <net/if.h>
51ef91a976SAndrey V. Elsukov #include <net/if_enc.h>
5276039bc8SGleb Smirnoff #include <net/if_var.h>
53eddfbb76SRobert Watson #include <net/vnet.h>
5488768458SSam Leffler 
5588768458SSam Leffler #include <netinet/in.h>
56*e68b3792SGleb Smirnoff #include <netinet/in_pcb.h>
5788768458SSam Leffler #include <netinet/in_systm.h>
5888768458SSam Leffler #include <netinet/ip.h>
5988768458SSam Leffler #include <netinet/ip_var.h>
6088768458SSam Leffler #include <netinet/in_var.h>
6188768458SSam Leffler #include <netinet/ip_ecn.h>
6288768458SSam Leffler #ifdef INET6
6388768458SSam Leffler #include <netinet6/ip6_ecn.h>
6488768458SSam Leffler #endif
656b66194bSKornel Duleba #include <netinet/ip_icmp.h>
666b66194bSKornel Duleba #include <netinet/tcp_var.h>
6788768458SSam Leffler 
6888768458SSam Leffler #include <netinet/ip6.h>
6988768458SSam Leffler #ifdef INET6
7088768458SSam Leffler #include <netinet6/ip6_var.h>
7161f37615SAndrey V. Elsukov #include <netinet6/scope6_var.h>
7288768458SSam Leffler #endif
7388768458SSam Leffler #include <netinet/in_pcb.h>
7488768458SSam Leffler #ifdef INET6
7588768458SSam Leffler #include <netinet/icmp6.h>
7688768458SSam Leffler #endif
7795033af9SMark Johnston #if defined(SCTP) || defined(SCTP_SUPPORT)
78fcf59617SAndrey V. Elsukov #include <netinet/sctp_crc32.h>
79fcf59617SAndrey V. Elsukov #endif
8088768458SSam Leffler 
81fcf59617SAndrey V. Elsukov #include <netinet/udp.h>
82fcf59617SAndrey V. Elsukov #include <netipsec/ah.h>
83fcf59617SAndrey V. Elsukov #include <netipsec/esp.h>
8488768458SSam Leffler #include <netipsec/ipsec.h>
8588768458SSam Leffler #ifdef INET6
8688768458SSam Leffler #include <netipsec/ipsec6.h>
8788768458SSam Leffler #endif
88809fef29SGleb Smirnoff #include <netipsec/ipsec_support.h>
8988768458SSam Leffler #include <netipsec/ah_var.h>
9088768458SSam Leffler #include <netipsec/esp_var.h>
9188768458SSam Leffler #include <netipsec/ipcomp_var.h>
9288768458SSam Leffler 
9388768458SSam Leffler #include <netipsec/xform.h>
9488768458SSam Leffler 
9588768458SSam Leffler #include <netipsec/key.h>
9688768458SSam Leffler #include <netipsec/keydb.h>
9788768458SSam Leffler #include <netipsec/key_debug.h>
9888768458SSam Leffler 
9988768458SSam Leffler #include <machine/in_cksum.h>
10088768458SSam Leffler 
101fcf59617SAndrey V. Elsukov #define	IPSEC_OSTAT_INC(proto, name)	do {		\
102fcf59617SAndrey V. Elsukov 	if ((proto) == IPPROTO_ESP)	\
103fcf59617SAndrey V. Elsukov 		ESPSTAT_INC(esps_##name);	\
104fcf59617SAndrey V. Elsukov 	else if ((proto) == IPPROTO_AH)\
105fcf59617SAndrey V. Elsukov 		AHSTAT_INC(ahs_##name);		\
106fcf59617SAndrey V. Elsukov 	else					\
107fcf59617SAndrey V. Elsukov 		IPCOMPSTAT_INC(ipcomps_##name);	\
108fcf59617SAndrey V. Elsukov } while (0)
109fcf59617SAndrey V. Elsukov 
110fcf59617SAndrey V. Elsukov static int ipsec_encap(struct mbuf **mp, struct secasindex *saidx);
1119dfc8606SBartlomiej Grzesik static size_t ipsec_get_pmtu(struct secasvar *sav);
112fcf59617SAndrey V. Elsukov 
113fcf59617SAndrey V. Elsukov #ifdef INET
114fcf59617SAndrey V. Elsukov static struct secasvar *
115fcf59617SAndrey V. Elsukov ipsec4_allocsa(struct mbuf *m, struct secpolicy *sp, u_int *pidx, int *error)
116fcf59617SAndrey V. Elsukov {
117fcf59617SAndrey V. Elsukov 	struct secasindex *saidx, tmpsaidx;
118fcf59617SAndrey V. Elsukov 	struct ipsecrequest *isr;
119fcf59617SAndrey V. Elsukov 	struct sockaddr_in *sin;
120fcf59617SAndrey V. Elsukov 	struct secasvar *sav;
121fcf59617SAndrey V. Elsukov 	struct ip *ip;
122fcf59617SAndrey V. Elsukov 
123fcf59617SAndrey V. Elsukov 	/*
124fcf59617SAndrey V. Elsukov 	 * Check system global policy controls.
125fcf59617SAndrey V. Elsukov 	 */
126fcf59617SAndrey V. Elsukov next:
127fcf59617SAndrey V. Elsukov 	isr = sp->req[*pidx];
128fcf59617SAndrey V. Elsukov 	if ((isr->saidx.proto == IPPROTO_ESP && !V_esp_enable) ||
129fcf59617SAndrey V. Elsukov 	    (isr->saidx.proto == IPPROTO_AH && !V_ah_enable) ||
130fcf59617SAndrey V. Elsukov 	    (isr->saidx.proto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
131fcf59617SAndrey V. Elsukov 		DPRINTF(("%s: IPsec outbound packet dropped due"
132fcf59617SAndrey V. Elsukov 			" to policy (check your sysctls)\n", __func__));
133fcf59617SAndrey V. Elsukov 		IPSEC_OSTAT_INC(isr->saidx.proto, pdrops);
134fcf59617SAndrey V. Elsukov 		*error = EHOSTUNREACH;
135fcf59617SAndrey V. Elsukov 		return (NULL);
136fcf59617SAndrey V. Elsukov 	}
137fcf59617SAndrey V. Elsukov 	/*
138fcf59617SAndrey V. Elsukov 	 * Craft SA index to search for proper SA.  Note that
139fcf59617SAndrey V. Elsukov 	 * we only initialize unspecified SA peers for transport
140fcf59617SAndrey V. Elsukov 	 * mode; for tunnel mode they must already be filled in.
141fcf59617SAndrey V. Elsukov 	 */
142fcf59617SAndrey V. Elsukov 	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
143fcf59617SAndrey V. Elsukov 		saidx = &tmpsaidx;
144fcf59617SAndrey V. Elsukov 		*saidx = isr->saidx;
145fcf59617SAndrey V. Elsukov 		ip = mtod(m, struct ip *);
146fcf59617SAndrey V. Elsukov 		if (saidx->src.sa.sa_len == 0) {
147fcf59617SAndrey V. Elsukov 			sin = &saidx->src.sin;
148fcf59617SAndrey V. Elsukov 			sin->sin_len = sizeof(*sin);
149fcf59617SAndrey V. Elsukov 			sin->sin_family = AF_INET;
150fcf59617SAndrey V. Elsukov 			sin->sin_port = IPSEC_PORT_ANY;
151fcf59617SAndrey V. Elsukov 			sin->sin_addr = ip->ip_src;
152fcf59617SAndrey V. Elsukov 		}
153fcf59617SAndrey V. Elsukov 		if (saidx->dst.sa.sa_len == 0) {
154fcf59617SAndrey V. Elsukov 			sin = &saidx->dst.sin;
155fcf59617SAndrey V. Elsukov 			sin->sin_len = sizeof(*sin);
156fcf59617SAndrey V. Elsukov 			sin->sin_family = AF_INET;
157fcf59617SAndrey V. Elsukov 			sin->sin_port = IPSEC_PORT_ANY;
158fcf59617SAndrey V. Elsukov 			sin->sin_addr = ip->ip_dst;
159fcf59617SAndrey V. Elsukov 		}
160fcf59617SAndrey V. Elsukov 	} else
161fcf59617SAndrey V. Elsukov 		saidx = &sp->req[*pidx]->saidx;
162fcf59617SAndrey V. Elsukov 	/*
163fcf59617SAndrey V. Elsukov 	 * Lookup SA and validate it.
164fcf59617SAndrey V. Elsukov 	 */
165fcf59617SAndrey V. Elsukov 	sav = key_allocsa_policy(sp, saidx, error);
166fcf59617SAndrey V. Elsukov 	if (sav == NULL) {
167fcf59617SAndrey V. Elsukov 		IPSECSTAT_INC(ips_out_nosa);
168fcf59617SAndrey V. Elsukov 		if (*error != 0)
169fcf59617SAndrey V. Elsukov 			return (NULL);
170fcf59617SAndrey V. Elsukov 		if (ipsec_get_reqlevel(sp, *pidx) != IPSEC_LEVEL_REQUIRE) {
171fcf59617SAndrey V. Elsukov 			/*
172fcf59617SAndrey V. Elsukov 			 * We have no SA and policy that doesn't require
173fcf59617SAndrey V. Elsukov 			 * this IPsec transform, thus we can continue w/o
174fcf59617SAndrey V. Elsukov 			 * IPsec processing, i.e. return EJUSTRETURN.
175fcf59617SAndrey V. Elsukov 			 * But first check if there is some bundled transform.
176fcf59617SAndrey V. Elsukov 			 */
177fcf59617SAndrey V. Elsukov 			if (sp->tcount > ++(*pidx))
178fcf59617SAndrey V. Elsukov 				goto next;
179fcf59617SAndrey V. Elsukov 			*error = EJUSTRETURN;
180fcf59617SAndrey V. Elsukov 		}
181fcf59617SAndrey V. Elsukov 		return (NULL);
182fcf59617SAndrey V. Elsukov 	}
183fcf59617SAndrey V. Elsukov 	IPSEC_ASSERT(sav->tdb_xform != NULL, ("SA with NULL tdb_xform"));
184fcf59617SAndrey V. Elsukov 	return (sav);
185fcf59617SAndrey V. Elsukov }
186fcf59617SAndrey V. Elsukov 
187fcf59617SAndrey V. Elsukov /*
188fcf59617SAndrey V. Elsukov  * IPsec output logic for IPv4.
189fcf59617SAndrey V. Elsukov  */
190fcf59617SAndrey V. Elsukov static int
1911a01e0e7SAndrey V. Elsukov ipsec4_perform_request(struct mbuf *m, struct secpolicy *sp,
1921a01e0e7SAndrey V. Elsukov     struct inpcb *inp, u_int idx)
193fcf59617SAndrey V. Elsukov {
194fcf59617SAndrey V. Elsukov 	struct ipsec_ctx_data ctx;
195fcf59617SAndrey V. Elsukov 	union sockaddr_union *dst;
196fcf59617SAndrey V. Elsukov 	struct secasvar *sav;
197fcf59617SAndrey V. Elsukov 	struct ip *ip;
198fcf59617SAndrey V. Elsukov 	int error, i, off;
199fcf59617SAndrey V. Elsukov 
200fcf59617SAndrey V. Elsukov 	IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
201fcf59617SAndrey V. Elsukov 
202fcf59617SAndrey V. Elsukov 	/*
203fcf59617SAndrey V. Elsukov 	 * We hold the reference to SP. Content of SP couldn't be changed.
204fcf59617SAndrey V. Elsukov 	 * Craft secasindex and do lookup for suitable SA.
205fcf59617SAndrey V. Elsukov 	 * Then do encapsulation if needed and call xform's output.
206fcf59617SAndrey V. Elsukov 	 * We need to store SP in the xform callback parameters.
207fcf59617SAndrey V. Elsukov 	 * In xform callback we will extract SP and it can be used to
208fcf59617SAndrey V. Elsukov 	 * determine next transform. At the end of transform we can
209fcf59617SAndrey V. Elsukov 	 * release reference to SP.
210fcf59617SAndrey V. Elsukov 	 */
211fcf59617SAndrey V. Elsukov 	sav = ipsec4_allocsa(m, sp, &idx, &error);
212fcf59617SAndrey V. Elsukov 	if (sav == NULL) {
213fcf59617SAndrey V. Elsukov 		if (error == EJUSTRETURN) { /* No IPsec required */
214fcf59617SAndrey V. Elsukov 			key_freesp(&sp);
215fcf59617SAndrey V. Elsukov 			return (error);
216fcf59617SAndrey V. Elsukov 		}
217fcf59617SAndrey V. Elsukov 		goto bad;
218fcf59617SAndrey V. Elsukov 	}
219fcf59617SAndrey V. Elsukov 	/*
220fcf59617SAndrey V. Elsukov 	 * XXXAE: most likely ip_sum at this point is wrong.
221fcf59617SAndrey V. Elsukov 	 */
2221a01e0e7SAndrey V. Elsukov 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, AF_INET, IPSEC_ENC_BEFORE);
223fcf59617SAndrey V. Elsukov 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
224fcf59617SAndrey V. Elsukov 		goto bad;
225fcf59617SAndrey V. Elsukov 
226fcf59617SAndrey V. Elsukov 	ip = mtod(m, struct ip *);
227fcf59617SAndrey V. Elsukov 	dst = &sav->sah->saidx.dst;
228fcf59617SAndrey V. Elsukov 	/* Do the appropriate encapsulation, if necessary */
229fcf59617SAndrey V. Elsukov 	if (sp->req[idx]->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
230fcf59617SAndrey V. Elsukov 	    dst->sa.sa_family != AF_INET ||	    /* PF mismatch */
231fcf59617SAndrey V. Elsukov 	    (dst->sa.sa_family == AF_INET &&	    /* Proxy */
232fcf59617SAndrey V. Elsukov 	     dst->sin.sin_addr.s_addr != INADDR_ANY &&
233fcf59617SAndrey V. Elsukov 	     dst->sin.sin_addr.s_addr != ip->ip_dst.s_addr)) {
234fcf59617SAndrey V. Elsukov 		/* Fix IPv4 header checksum and length */
235fcf59617SAndrey V. Elsukov 		ip->ip_len = htons(m->m_pkthdr.len);
236fcf59617SAndrey V. Elsukov 		ip->ip_sum = 0;
237fcf59617SAndrey V. Elsukov 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
238fcf59617SAndrey V. Elsukov 		error = ipsec_encap(&m, &sav->sah->saidx);
239fcf59617SAndrey V. Elsukov 		if (error != 0) {
2407f1f6591SAndrey V. Elsukov 			DPRINTF(("%s: encapsulation for SPI 0x%08x failed "
2417f1f6591SAndrey V. Elsukov 			    "with error %d\n", __func__, ntohl(sav->spi),
2427f1f6591SAndrey V. Elsukov 			    error));
243fcf59617SAndrey V. Elsukov 			/* XXXAE: IPSEC_OSTAT_INC(tunnel); */
244fcf59617SAndrey V. Elsukov 			goto bad;
245fcf59617SAndrey V. Elsukov 		}
2461a01e0e7SAndrey V. Elsukov 		inp = NULL;
247fcf59617SAndrey V. Elsukov 	}
248fcf59617SAndrey V. Elsukov 
2491a01e0e7SAndrey V. Elsukov 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
250fcf59617SAndrey V. Elsukov 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
251fcf59617SAndrey V. Elsukov 		goto bad;
252fcf59617SAndrey V. Elsukov 
253fcf59617SAndrey V. Elsukov 	/*
254fcf59617SAndrey V. Elsukov 	 * Dispatch to the appropriate IPsec transform logic.  The
255fcf59617SAndrey V. Elsukov 	 * packet will be returned for transmission after crypto
256fcf59617SAndrey V. Elsukov 	 * processing, etc. are completed.
257fcf59617SAndrey V. Elsukov 	 *
258fcf59617SAndrey V. Elsukov 	 * NB: m & sav are ``passed to caller'' who's responsible for
259fcf59617SAndrey V. Elsukov 	 *     reclaiming their resources.
260fcf59617SAndrey V. Elsukov 	 */
261fcf59617SAndrey V. Elsukov 	switch(dst->sa.sa_family) {
262fcf59617SAndrey V. Elsukov 	case AF_INET:
263fcf59617SAndrey V. Elsukov 		ip = mtod(m, struct ip *);
264fcf59617SAndrey V. Elsukov 		i = ip->ip_hl << 2;
265fcf59617SAndrey V. Elsukov 		off = offsetof(struct ip, ip_p);
266fcf59617SAndrey V. Elsukov 		break;
267fcf59617SAndrey V. Elsukov #ifdef INET6
268fcf59617SAndrey V. Elsukov 	case AF_INET6:
269fcf59617SAndrey V. Elsukov 		i = sizeof(struct ip6_hdr);
270fcf59617SAndrey V. Elsukov 		off = offsetof(struct ip6_hdr, ip6_nxt);
271fcf59617SAndrey V. Elsukov 		break;
272fcf59617SAndrey V. Elsukov #endif /* INET6 */
273fcf59617SAndrey V. Elsukov 	default:
274fcf59617SAndrey V. Elsukov 		DPRINTF(("%s: unsupported protocol family %u\n",
275fcf59617SAndrey V. Elsukov 		    __func__, dst->sa.sa_family));
276fcf59617SAndrey V. Elsukov 		error = EPFNOSUPPORT;
277fcf59617SAndrey V. Elsukov 		IPSEC_OSTAT_INC(sav->sah->saidx.proto, nopf);
278fcf59617SAndrey V. Elsukov 		goto bad;
279fcf59617SAndrey V. Elsukov 	}
280fcf59617SAndrey V. Elsukov 	error = (*sav->tdb_xform->xf_output)(m, sp, sav, idx, i, off);
281fcf59617SAndrey V. Elsukov 	return (error);
282fcf59617SAndrey V. Elsukov bad:
283fcf59617SAndrey V. Elsukov 	IPSECSTAT_INC(ips_out_inval);
284fcf59617SAndrey V. Elsukov 	if (m != NULL)
285fcf59617SAndrey V. Elsukov 		m_freem(m);
286fcf59617SAndrey V. Elsukov 	if (sav != NULL)
287fcf59617SAndrey V. Elsukov 		key_freesav(&sav);
288fcf59617SAndrey V. Elsukov 	key_freesp(&sp);
289fcf59617SAndrey V. Elsukov 	return (error);
290fcf59617SAndrey V. Elsukov }
2917b495c44SVANHULLEBUS Yvan 
29288768458SSam Leffler int
293fcf59617SAndrey V. Elsukov ipsec4_process_packet(struct mbuf *m, struct secpolicy *sp,
294fcf59617SAndrey V. Elsukov     struct inpcb *inp)
29588768458SSam Leffler {
296fcf59617SAndrey V. Elsukov 
2971a01e0e7SAndrey V. Elsukov 	return (ipsec4_perform_request(m, sp, inp, 0));
298fcf59617SAndrey V. Elsukov }
299fcf59617SAndrey V. Elsukov 
3006b66194bSKornel Duleba int
3016b66194bSKornel Duleba ipsec4_check_pmtu(struct mbuf *m, struct secpolicy *sp, int forwarding)
3026b66194bSKornel Duleba {
3036b66194bSKornel Duleba 	struct secasvar *sav;
3046b66194bSKornel Duleba 	struct ip *ip;
3056b66194bSKornel Duleba 	size_t hlen, pmtu;
3066b66194bSKornel Duleba 	uint32_t idx;
3076b66194bSKornel Duleba 	int error;
3086b66194bSKornel Duleba 
3096b66194bSKornel Duleba 	/* Don't check PMTU if the frame won't have DF bit set. */
3106b66194bSKornel Duleba 	if (!V_ip4_ipsec_dfbit)
3116b66194bSKornel Duleba 		return (0);
3126b66194bSKornel Duleba 	if (V_ip4_ipsec_dfbit == 1)
3136b66194bSKornel Duleba 		goto setdf;
3146b66194bSKornel Duleba 
3156b66194bSKornel Duleba 	/* V_ip4_ipsec_dfbit > 1 - we will copy it from inner header. */
3166b66194bSKornel Duleba 	ip = mtod(m, struct ip *);
3176b66194bSKornel Duleba 	if (!(ip->ip_off & htons(IP_DF)))
3186b66194bSKornel Duleba 		return (0);
3196b66194bSKornel Duleba 
3206b66194bSKornel Duleba setdf:
3216b66194bSKornel Duleba 	idx = sp->tcount - 1;
3226b66194bSKornel Duleba 	sav = ipsec4_allocsa(m, sp, &idx, &error);
3236b66194bSKornel Duleba 	if (sav == NULL) {
3246b66194bSKornel Duleba 		key_freesp(&sp);
325a16771deSKornel Duleba 		/*
326a16771deSKornel Duleba 		 * No matching SA was found and SADB_ACQUIRE message was generated.
327a16771deSKornel Duleba 		 * Since we have matched a SP to this packet drop it silently.
328a16771deSKornel Duleba 		 */
329a16771deSKornel Duleba 		if (error == 0)
330a16771deSKornel Duleba 			error = EINPROGRESS;
3316b66194bSKornel Duleba 		if (error != EJUSTRETURN)
3326b66194bSKornel Duleba 			m_freem(m);
3336b66194bSKornel Duleba 
3346b66194bSKornel Duleba 		return (error);
3356b66194bSKornel Duleba 	}
3366b66194bSKornel Duleba 
3379dfc8606SBartlomiej Grzesik 	pmtu = ipsec_get_pmtu(sav);
338b4220bf3SBartlomiej Grzesik 	if (pmtu == 0) {
3399dfc8606SBartlomiej Grzesik 		key_freesav(&sav);
3406b66194bSKornel Duleba 		return (0);
341b4220bf3SBartlomiej Grzesik 	}
342b4220bf3SBartlomiej Grzesik 
3436b66194bSKornel Duleba 	hlen = ipsec_hdrsiz_internal(sp);
3449dfc8606SBartlomiej Grzesik 	key_freesav(&sav);
3459dfc8606SBartlomiej Grzesik 
3466b66194bSKornel Duleba 	if (m_length(m, NULL) + hlen > pmtu) {
3476b66194bSKornel Duleba 		/*
3486b66194bSKornel Duleba 		 * If we're forwarding generate ICMP message here,
3498deba29cSWojciech Macek 		 * so that it contains pmtu subtracted by header size.
3506b66194bSKornel Duleba 		 * Set error to EINPROGRESS, in order for the frame
3516b66194bSKornel Duleba 		 * to be dropped silently.
3526b66194bSKornel Duleba 		 */
3536b66194bSKornel Duleba 		if (forwarding) {
3546b66194bSKornel Duleba 			if (pmtu > hlen)
3556b66194bSKornel Duleba 				icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
3566b66194bSKornel Duleba 				    0, pmtu - hlen);
3576b66194bSKornel Duleba 			else
3586b66194bSKornel Duleba 				m_freem(m);
3596b66194bSKornel Duleba 
3606b66194bSKornel Duleba 			key_freesp(&sp);
3616b66194bSKornel Duleba 			return (EINPROGRESS); /* Pretend that we consumed it. */
3626b66194bSKornel Duleba 		} else {
3636b66194bSKornel Duleba 			m_freem(m);
3646b66194bSKornel Duleba 			key_freesp(&sp);
3656b66194bSKornel Duleba 			return (EMSGSIZE);
3666b66194bSKornel Duleba 		}
3676b66194bSKornel Duleba 	}
3686b66194bSKornel Duleba 
3696b66194bSKornel Duleba 	return (0);
3706b66194bSKornel Duleba }
3716b66194bSKornel Duleba 
372fcf59617SAndrey V. Elsukov static int
373fcf59617SAndrey V. Elsukov ipsec4_common_output(struct mbuf *m, struct inpcb *inp, int forwarding)
374fcf59617SAndrey V. Elsukov {
375fcf59617SAndrey V. Elsukov 	struct secpolicy *sp;
37688768458SSam Leffler 	int error;
37788768458SSam Leffler 
378fcf59617SAndrey V. Elsukov 	/* Lookup for the corresponding outbound security policy */
37922bbefb2SAndrey V. Elsukov 	sp = ipsec4_checkpolicy(m, inp, &error, !forwarding);
380fcf59617SAndrey V. Elsukov 	if (sp == NULL) {
381fcf59617SAndrey V. Elsukov 		if (error == -EINVAL) {
382fcf59617SAndrey V. Elsukov 			/* Discarded by policy. */
383fcf59617SAndrey V. Elsukov 			m_freem(m);
384fcf59617SAndrey V. Elsukov 			return (EACCES);
385fcf59617SAndrey V. Elsukov 		}
386fcf59617SAndrey V. Elsukov 		return (0); /* No IPsec required. */
387fcf59617SAndrey V. Elsukov 	}
388fcf59617SAndrey V. Elsukov 
389fcf59617SAndrey V. Elsukov 	/*
390fcf59617SAndrey V. Elsukov 	 * Usually we have to have tunnel mode IPsec security policy
391fcf59617SAndrey V. Elsukov 	 * when we are forwarding a packet. Otherwise we could not handle
392fcf59617SAndrey V. Elsukov 	 * encrypted replies, because they are not destined for us. But
393fcf59617SAndrey V. Elsukov 	 * some users are doing source address translation for forwarded
394fcf59617SAndrey V. Elsukov 	 * packets, and thus, even if they are forwarded, the replies will
395fcf59617SAndrey V. Elsukov 	 * return back to us.
396fcf59617SAndrey V. Elsukov 	 */
397fcf59617SAndrey V. Elsukov 	if (!forwarding) {
398fcf59617SAndrey V. Elsukov 		/*
399fcf59617SAndrey V. Elsukov 		 * Do delayed checksums now because we send before
400fcf59617SAndrey V. Elsukov 		 * this is done in the normal processing path.
401fcf59617SAndrey V. Elsukov 		 */
402fcf59617SAndrey V. Elsukov 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
403fcf59617SAndrey V. Elsukov 			in_delayed_cksum(m);
404fcf59617SAndrey V. Elsukov 			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
405fcf59617SAndrey V. Elsukov 		}
40695033af9SMark Johnston #if defined(SCTP) || defined(SCTP_SUPPORT)
407fcf59617SAndrey V. Elsukov 		if (m->m_pkthdr.csum_flags & CSUM_SCTP) {
4088e9313caSJohn Baldwin 			struct ip *ip;
409fcf59617SAndrey V. Elsukov 
4108e9313caSJohn Baldwin 			ip = mtod(m, struct ip *);
411fcf59617SAndrey V. Elsukov 			sctp_delayed_cksum(m, (uint32_t)(ip->ip_hl << 2));
412fcf59617SAndrey V. Elsukov 			m->m_pkthdr.csum_flags &= ~CSUM_SCTP;
413fcf59617SAndrey V. Elsukov 		}
414fcf59617SAndrey V. Elsukov #endif
415fcf59617SAndrey V. Elsukov 	}
416fcf59617SAndrey V. Elsukov 	/* NB: callee frees mbuf and releases reference to SP */
4176b66194bSKornel Duleba 	error = ipsec4_check_pmtu(m, sp, forwarding);
4186b66194bSKornel Duleba 	if (error != 0) {
4196b66194bSKornel Duleba 		if (error == EJUSTRETURN)
4206b66194bSKornel Duleba 			return (0);
4216b66194bSKornel Duleba 
4226b66194bSKornel Duleba 		return (error);
4236b66194bSKornel Duleba 	}
4246b66194bSKornel Duleba 
425fcf59617SAndrey V. Elsukov 	error = ipsec4_process_packet(m, sp, inp);
426fcf59617SAndrey V. Elsukov 	if (error == EJUSTRETURN) {
427fcf59617SAndrey V. Elsukov 		/*
428fcf59617SAndrey V. Elsukov 		 * We had a SP with a level of 'use' and no SA. We
429fcf59617SAndrey V. Elsukov 		 * will just continue to process the packet without
430fcf59617SAndrey V. Elsukov 		 * IPsec processing and return without error.
431fcf59617SAndrey V. Elsukov 		 */
432fcf59617SAndrey V. Elsukov 		return (0);
433fcf59617SAndrey V. Elsukov 	}
434fcf59617SAndrey V. Elsukov 	if (error == 0)
435fcf59617SAndrey V. Elsukov 		return (EINPROGRESS); /* consumed by IPsec */
436fcf59617SAndrey V. Elsukov 	return (error);
437fcf59617SAndrey V. Elsukov }
438fcf59617SAndrey V. Elsukov 
439fcf59617SAndrey V. Elsukov /*
440fcf59617SAndrey V. Elsukov  * IPSEC_OUTPUT() method implementation for IPv4.
441fcf59617SAndrey V. Elsukov  * 0 - no IPsec handling needed
442fcf59617SAndrey V. Elsukov  * other values - mbuf consumed by IPsec.
443fcf59617SAndrey V. Elsukov  */
444fcf59617SAndrey V. Elsukov int
445fcf59617SAndrey V. Elsukov ipsec4_output(struct mbuf *m, struct inpcb *inp)
446fcf59617SAndrey V. Elsukov {
447fcf59617SAndrey V. Elsukov 
448fcf59617SAndrey V. Elsukov 	/*
449fcf59617SAndrey V. Elsukov 	 * If the packet is resubmitted to ip_output (e.g. after
450fcf59617SAndrey V. Elsukov 	 * AH, ESP, etc. processing), there will be a tag to bypass
451fcf59617SAndrey V. Elsukov 	 * the lookup and related policy checking.
452fcf59617SAndrey V. Elsukov 	 */
453fcf59617SAndrey V. Elsukov 	if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL)
454fcf59617SAndrey V. Elsukov 		return (0);
455fcf59617SAndrey V. Elsukov 
456fcf59617SAndrey V. Elsukov 	return (ipsec4_common_output(m, inp, 0));
457fcf59617SAndrey V. Elsukov }
458fcf59617SAndrey V. Elsukov 
459fcf59617SAndrey V. Elsukov /*
460fcf59617SAndrey V. Elsukov  * IPSEC_FORWARD() method implementation for IPv4.
461fcf59617SAndrey V. Elsukov  * 0 - no IPsec handling needed
462fcf59617SAndrey V. Elsukov  * other values - mbuf consumed by IPsec.
463fcf59617SAndrey V. Elsukov  */
464fcf59617SAndrey V. Elsukov int
465fcf59617SAndrey V. Elsukov ipsec4_forward(struct mbuf *m)
466fcf59617SAndrey V. Elsukov {
467fcf59617SAndrey V. Elsukov 
468fcf59617SAndrey V. Elsukov 	/*
469fcf59617SAndrey V. Elsukov 	 * Check if this packet has an active inbound SP and needs to be
470fcf59617SAndrey V. Elsukov 	 * dropped instead of forwarded.
471fcf59617SAndrey V. Elsukov 	 */
472fcf59617SAndrey V. Elsukov 	if (ipsec4_in_reject(m, NULL) != 0) {
473fcf59617SAndrey V. Elsukov 		m_freem(m);
474fcf59617SAndrey V. Elsukov 		return (EACCES);
475fcf59617SAndrey V. Elsukov 	}
476fcf59617SAndrey V. Elsukov 	return (ipsec4_common_output(m, NULL, 1));
477fcf59617SAndrey V. Elsukov }
478fcf59617SAndrey V. Elsukov #endif
479fcf59617SAndrey V. Elsukov 
480fcf59617SAndrey V. Elsukov #ifdef INET6
481fcf59617SAndrey V. Elsukov static int
482fcf59617SAndrey V. Elsukov in6_sa_equal_addrwithscope(const struct sockaddr_in6 *sa,
483fcf59617SAndrey V. Elsukov     const struct in6_addr *ia)
484fcf59617SAndrey V. Elsukov {
485fcf59617SAndrey V. Elsukov 	struct in6_addr ia2;
486fcf59617SAndrey V. Elsukov 
487fcf59617SAndrey V. Elsukov 	if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6_addr)) {
488fcf59617SAndrey V. Elsukov 		memcpy(&ia2, &sa->sin6_addr, sizeof(ia2));
489fcf59617SAndrey V. Elsukov 		ia2.s6_addr16[1] = htons(sa->sin6_scope_id);
490fcf59617SAndrey V. Elsukov 		return (IN6_ARE_ADDR_EQUAL(ia, &ia2));
491fcf59617SAndrey V. Elsukov 	}
492fcf59617SAndrey V. Elsukov 	return (IN6_ARE_ADDR_EQUAL(&sa->sin6_addr, ia));
493fcf59617SAndrey V. Elsukov }
494fcf59617SAndrey V. Elsukov 
495fcf59617SAndrey V. Elsukov static struct secasvar *
496fcf59617SAndrey V. Elsukov ipsec6_allocsa(struct mbuf *m, struct secpolicy *sp, u_int *pidx, int *error)
497fcf59617SAndrey V. Elsukov {
498fcf59617SAndrey V. Elsukov 	struct secasindex *saidx, tmpsaidx;
499fcf59617SAndrey V. Elsukov 	struct ipsecrequest *isr;
500fcf59617SAndrey V. Elsukov 	struct sockaddr_in6 *sin6;
501fcf59617SAndrey V. Elsukov 	struct secasvar *sav;
502fcf59617SAndrey V. Elsukov 	struct ip6_hdr *ip6;
503fcf59617SAndrey V. Elsukov 
504fcf59617SAndrey V. Elsukov 	/*
505fcf59617SAndrey V. Elsukov 	 * Check system global policy controls.
506fcf59617SAndrey V. Elsukov 	 */
507fcf59617SAndrey V. Elsukov next:
508fcf59617SAndrey V. Elsukov 	isr = sp->req[*pidx];
509fcf59617SAndrey V. Elsukov 	if ((isr->saidx.proto == IPPROTO_ESP && !V_esp_enable) ||
510fcf59617SAndrey V. Elsukov 	    (isr->saidx.proto == IPPROTO_AH && !V_ah_enable) ||
511fcf59617SAndrey V. Elsukov 	    (isr->saidx.proto == IPPROTO_IPCOMP && !V_ipcomp_enable)) {
512fcf59617SAndrey V. Elsukov 		DPRINTF(("%s: IPsec outbound packet dropped due"
513fcf59617SAndrey V. Elsukov 			" to policy (check your sysctls)\n", __func__));
514fcf59617SAndrey V. Elsukov 		IPSEC_OSTAT_INC(isr->saidx.proto, pdrops);
515fcf59617SAndrey V. Elsukov 		*error = EHOSTUNREACH;
516fcf59617SAndrey V. Elsukov 		return (NULL);
517fcf59617SAndrey V. Elsukov 	}
518fcf59617SAndrey V. Elsukov 	/*
519fcf59617SAndrey V. Elsukov 	 * Craft SA index to search for proper SA.  Note that
520fcf59617SAndrey V. Elsukov 	 * we only fillin unspecified SA peers for transport
521fcf59617SAndrey V. Elsukov 	 * mode; for tunnel mode they must already be filled in.
522fcf59617SAndrey V. Elsukov 	 */
523fcf59617SAndrey V. Elsukov 	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
524fcf59617SAndrey V. Elsukov 		saidx = &tmpsaidx;
525fcf59617SAndrey V. Elsukov 		*saidx = isr->saidx;
526fcf59617SAndrey V. Elsukov 		ip6 = mtod(m, struct ip6_hdr *);
527fcf59617SAndrey V. Elsukov 		if (saidx->src.sin6.sin6_len == 0) {
528fcf59617SAndrey V. Elsukov 			sin6 = (struct sockaddr_in6 *)&saidx->src;
529fcf59617SAndrey V. Elsukov 			sin6->sin6_len = sizeof(*sin6);
530fcf59617SAndrey V. Elsukov 			sin6->sin6_family = AF_INET6;
531fcf59617SAndrey V. Elsukov 			sin6->sin6_port = IPSEC_PORT_ANY;
532fcf59617SAndrey V. Elsukov 			sin6->sin6_addr = ip6->ip6_src;
533fcf59617SAndrey V. Elsukov 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
534fcf59617SAndrey V. Elsukov 				/* fix scope id for comparing SPD */
535fcf59617SAndrey V. Elsukov 				sin6->sin6_addr.s6_addr16[1] = 0;
536fcf59617SAndrey V. Elsukov 				sin6->sin6_scope_id =
537fcf59617SAndrey V. Elsukov 				    ntohs(ip6->ip6_src.s6_addr16[1]);
538fcf59617SAndrey V. Elsukov 			}
539fcf59617SAndrey V. Elsukov 		}
540fcf59617SAndrey V. Elsukov 		if (saidx->dst.sin6.sin6_len == 0) {
541fcf59617SAndrey V. Elsukov 			sin6 = (struct sockaddr_in6 *)&saidx->dst;
542fcf59617SAndrey V. Elsukov 			sin6->sin6_len = sizeof(*sin6);
543fcf59617SAndrey V. Elsukov 			sin6->sin6_family = AF_INET6;
544fcf59617SAndrey V. Elsukov 			sin6->sin6_port = IPSEC_PORT_ANY;
545fcf59617SAndrey V. Elsukov 			sin6->sin6_addr = ip6->ip6_dst;
546fcf59617SAndrey V. Elsukov 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
547fcf59617SAndrey V. Elsukov 				/* fix scope id for comparing SPD */
548fcf59617SAndrey V. Elsukov 				sin6->sin6_addr.s6_addr16[1] = 0;
549fcf59617SAndrey V. Elsukov 				sin6->sin6_scope_id =
550fcf59617SAndrey V. Elsukov 				    ntohs(ip6->ip6_dst.s6_addr16[1]);
551fcf59617SAndrey V. Elsukov 			}
552fcf59617SAndrey V. Elsukov 		}
553fcf59617SAndrey V. Elsukov 	} else
554fcf59617SAndrey V. Elsukov 		saidx = &sp->req[*pidx]->saidx;
555fcf59617SAndrey V. Elsukov 	/*
556fcf59617SAndrey V. Elsukov 	 * Lookup SA and validate it.
557fcf59617SAndrey V. Elsukov 	 */
558fcf59617SAndrey V. Elsukov 	sav = key_allocsa_policy(sp, saidx, error);
559fcf59617SAndrey V. Elsukov 	if (sav == NULL) {
560fcf59617SAndrey V. Elsukov 		IPSEC6STAT_INC(ips_out_nosa);
561fcf59617SAndrey V. Elsukov 		if (*error != 0)
562fcf59617SAndrey V. Elsukov 			return (NULL);
563fcf59617SAndrey V. Elsukov 		if (ipsec_get_reqlevel(sp, *pidx) != IPSEC_LEVEL_REQUIRE) {
564fcf59617SAndrey V. Elsukov 			/*
565fcf59617SAndrey V. Elsukov 			 * We have no SA and policy that doesn't require
566fcf59617SAndrey V. Elsukov 			 * this IPsec transform, thus we can continue w/o
567fcf59617SAndrey V. Elsukov 			 * IPsec processing, i.e. return EJUSTRETURN.
568fcf59617SAndrey V. Elsukov 			 * But first check if there is some bundled transform.
569fcf59617SAndrey V. Elsukov 			 */
570fcf59617SAndrey V. Elsukov 			if (sp->tcount > ++(*pidx))
571fcf59617SAndrey V. Elsukov 				goto next;
572fcf59617SAndrey V. Elsukov 			*error = EJUSTRETURN;
573fcf59617SAndrey V. Elsukov 		}
574fcf59617SAndrey V. Elsukov 		return (NULL);
575fcf59617SAndrey V. Elsukov 	}
576fcf59617SAndrey V. Elsukov 	IPSEC_ASSERT(sav->tdb_xform != NULL, ("SA with NULL tdb_xform"));
577fcf59617SAndrey V. Elsukov 	return (sav);
578fcf59617SAndrey V. Elsukov }
579fcf59617SAndrey V. Elsukov 
580fcf59617SAndrey V. Elsukov /*
581fcf59617SAndrey V. Elsukov  * IPsec output logic for IPv6.
582fcf59617SAndrey V. Elsukov  */
583fcf59617SAndrey V. Elsukov static int
5841a01e0e7SAndrey V. Elsukov ipsec6_perform_request(struct mbuf *m, struct secpolicy *sp,
5851a01e0e7SAndrey V. Elsukov     struct inpcb *inp, u_int idx)
586fcf59617SAndrey V. Elsukov {
587fcf59617SAndrey V. Elsukov 	struct ipsec_ctx_data ctx;
588fcf59617SAndrey V. Elsukov 	union sockaddr_union *dst;
589fcf59617SAndrey V. Elsukov 	struct secasvar *sav;
590fcf59617SAndrey V. Elsukov 	struct ip6_hdr *ip6;
591fcf59617SAndrey V. Elsukov 	int error, i, off;
592fcf59617SAndrey V. Elsukov 
593fcf59617SAndrey V. Elsukov 	IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx));
594fcf59617SAndrey V. Elsukov 
595fcf59617SAndrey V. Elsukov 	sav = ipsec6_allocsa(m, sp, &idx, &error);
596fcf59617SAndrey V. Elsukov 	if (sav == NULL) {
597fcf59617SAndrey V. Elsukov 		if (error == EJUSTRETURN) { /* No IPsec required */
598fcf59617SAndrey V. Elsukov 			key_freesp(&sp);
599fcf59617SAndrey V. Elsukov 			return (error);
600fcf59617SAndrey V. Elsukov 		}
601fcf59617SAndrey V. Elsukov 		goto bad;
602fcf59617SAndrey V. Elsukov 	}
603fcf59617SAndrey V. Elsukov 
604fcf59617SAndrey V. Elsukov 	/* Fix IP length in case if it is not set yet. */
605fcf59617SAndrey V. Elsukov 	ip6 = mtod(m, struct ip6_hdr *);
606fcf59617SAndrey V. Elsukov 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
607fcf59617SAndrey V. Elsukov 
6081a01e0e7SAndrey V. Elsukov 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, AF_INET6, IPSEC_ENC_BEFORE);
609fcf59617SAndrey V. Elsukov 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
610fcf59617SAndrey V. Elsukov 		goto bad;
611fcf59617SAndrey V. Elsukov 
612fcf59617SAndrey V. Elsukov 	ip6 = mtod(m, struct ip6_hdr *); /* pfil can change mbuf */
613fcf59617SAndrey V. Elsukov 	dst = &sav->sah->saidx.dst;
614fcf59617SAndrey V. Elsukov 
615fcf59617SAndrey V. Elsukov 	/* Do the appropriate encapsulation, if necessary */
616fcf59617SAndrey V. Elsukov 	if (sp->req[idx]->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
617fcf59617SAndrey V. Elsukov 	    dst->sa.sa_family != AF_INET6 ||        /* PF mismatch */
618fcf59617SAndrey V. Elsukov 	    ((dst->sa.sa_family == AF_INET6) &&
619fcf59617SAndrey V. Elsukov 	     (!IN6_IS_ADDR_UNSPECIFIED(&dst->sin6.sin6_addr)) &&
620fcf59617SAndrey V. Elsukov 	     (!in6_sa_equal_addrwithscope(&dst->sin6, &ip6->ip6_dst)))) {
621fcf59617SAndrey V. Elsukov 		if (m->m_pkthdr.len - sizeof(*ip6) > IPV6_MAXPACKET) {
622fcf59617SAndrey V. Elsukov 			/* No jumbogram support. */
623fcf59617SAndrey V. Elsukov 			error = ENXIO;   /*XXX*/
624fcf59617SAndrey V. Elsukov 			goto bad;
625fcf59617SAndrey V. Elsukov 		}
626fcf59617SAndrey V. Elsukov 		error = ipsec_encap(&m, &sav->sah->saidx);
627fcf59617SAndrey V. Elsukov 		if (error != 0) {
6287f1f6591SAndrey V. Elsukov 			DPRINTF(("%s: encapsulation for SPI 0x%08x failed "
6297f1f6591SAndrey V. Elsukov 			    "with error %d\n", __func__, ntohl(sav->spi),
6307f1f6591SAndrey V. Elsukov 			    error));
631fcf59617SAndrey V. Elsukov 			/* XXXAE: IPSEC_OSTAT_INC(tunnel); */
632fcf59617SAndrey V. Elsukov 			goto bad;
633fcf59617SAndrey V. Elsukov 		}
6341a01e0e7SAndrey V. Elsukov 		inp = NULL;
635fcf59617SAndrey V. Elsukov 	}
636fcf59617SAndrey V. Elsukov 
6371a01e0e7SAndrey V. Elsukov 	IPSEC_INIT_CTX(&ctx, &m, inp, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
638fcf59617SAndrey V. Elsukov 	if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
639fcf59617SAndrey V. Elsukov 		goto bad;
640fcf59617SAndrey V. Elsukov 
641fcf59617SAndrey V. Elsukov 	switch(dst->sa.sa_family) {
642fcf59617SAndrey V. Elsukov #ifdef INET
643fcf59617SAndrey V. Elsukov 	case AF_INET:
644fcf59617SAndrey V. Elsukov 		{
645fcf59617SAndrey V. Elsukov 		struct ip *ip;
646fcf59617SAndrey V. Elsukov 		ip = mtod(m, struct ip *);
647fcf59617SAndrey V. Elsukov 		i = ip->ip_hl << 2;
648fcf59617SAndrey V. Elsukov 		off = offsetof(struct ip, ip_p);
649fcf59617SAndrey V. Elsukov 		}
650fcf59617SAndrey V. Elsukov 		break;
651fcf59617SAndrey V. Elsukov #endif /* AF_INET */
652fcf59617SAndrey V. Elsukov 	case AF_INET6:
653fcf59617SAndrey V. Elsukov 		i = sizeof(struct ip6_hdr);
654fcf59617SAndrey V. Elsukov 		off = offsetof(struct ip6_hdr, ip6_nxt);
655fcf59617SAndrey V. Elsukov 		break;
656fcf59617SAndrey V. Elsukov 	default:
657fcf59617SAndrey V. Elsukov 		DPRINTF(("%s: unsupported protocol family %u\n",
658fcf59617SAndrey V. Elsukov 				 __func__, dst->sa.sa_family));
659fcf59617SAndrey V. Elsukov 		error = EPFNOSUPPORT;
660fcf59617SAndrey V. Elsukov 		IPSEC_OSTAT_INC(sav->sah->saidx.proto, nopf);
661fcf59617SAndrey V. Elsukov 		goto bad;
662fcf59617SAndrey V. Elsukov 	}
663fcf59617SAndrey V. Elsukov 	error = (*sav->tdb_xform->xf_output)(m, sp, sav, idx, i, off);
664fcf59617SAndrey V. Elsukov 	return (error);
665fcf59617SAndrey V. Elsukov bad:
666fcf59617SAndrey V. Elsukov 	IPSEC6STAT_INC(ips_out_inval);
667fcf59617SAndrey V. Elsukov 	if (m != NULL)
668fcf59617SAndrey V. Elsukov 		m_freem(m);
669fcf59617SAndrey V. Elsukov 	if (sav != NULL)
670fcf59617SAndrey V. Elsukov 		key_freesav(&sav);
671fcf59617SAndrey V. Elsukov 	key_freesp(&sp);
672fcf59617SAndrey V. Elsukov 	return (error);
673fcf59617SAndrey V. Elsukov }
674fcf59617SAndrey V. Elsukov 
675fcf59617SAndrey V. Elsukov int
676fcf59617SAndrey V. Elsukov ipsec6_process_packet(struct mbuf *m, struct secpolicy *sp,
677fcf59617SAndrey V. Elsukov     struct inpcb *inp)
678fcf59617SAndrey V. Elsukov {
679fcf59617SAndrey V. Elsukov 
6801a01e0e7SAndrey V. Elsukov 	return (ipsec6_perform_request(m, sp, inp, 0));
681fcf59617SAndrey V. Elsukov }
682fcf59617SAndrey V. Elsukov 
6839dfc8606SBartlomiej Grzesik /*
6849dfc8606SBartlomiej Grzesik  * IPv6 implementation is based on IPv4 implementation.
6859dfc8606SBartlomiej Grzesik  */
6869dfc8606SBartlomiej Grzesik int
6879dfc8606SBartlomiej Grzesik ipsec6_check_pmtu(struct mbuf *m, struct secpolicy *sp, int forwarding)
6889dfc8606SBartlomiej Grzesik {
6899dfc8606SBartlomiej Grzesik 	struct secasvar *sav;
6909dfc8606SBartlomiej Grzesik 	size_t hlen, pmtu;
6919dfc8606SBartlomiej Grzesik 	uint32_t idx;
6929dfc8606SBartlomiej Grzesik 	int error;
6939dfc8606SBartlomiej Grzesik 
6949dfc8606SBartlomiej Grzesik 	/*
6959dfc8606SBartlomiej Grzesik 	 * According to RFC8200 L3 fragmentation is supposed to be done only on
6969dfc8606SBartlomiej Grzesik 	 * locally generated packets. During L3 forwarding packets that are too
6979dfc8606SBartlomiej Grzesik 	 * big are always supposed to be dropped, with an ICMPv6 packet being
6989dfc8606SBartlomiej Grzesik 	 * sent back.
6999dfc8606SBartlomiej Grzesik 	 */
7009dfc8606SBartlomiej Grzesik 	if (!forwarding)
7019dfc8606SBartlomiej Grzesik 		return (0);
7029dfc8606SBartlomiej Grzesik 
7039dfc8606SBartlomiej Grzesik 	idx = sp->tcount - 1;
7049dfc8606SBartlomiej Grzesik 	sav = ipsec6_allocsa(m, sp, &idx, &error);
7059dfc8606SBartlomiej Grzesik 	if (sav == NULL) {
7069dfc8606SBartlomiej Grzesik 		key_freesp(&sp);
7079dfc8606SBartlomiej Grzesik 		/*
7089dfc8606SBartlomiej Grzesik 		 * No matching SA was found and SADB_ACQUIRE message was generated.
7099dfc8606SBartlomiej Grzesik 		 * Since we have matched a SP to this packet drop it silently.
7109dfc8606SBartlomiej Grzesik 		 */
7119dfc8606SBartlomiej Grzesik 		if (error == 0)
7129dfc8606SBartlomiej Grzesik 			error = EINPROGRESS;
7139dfc8606SBartlomiej Grzesik 		if (error != EJUSTRETURN)
7149dfc8606SBartlomiej Grzesik 			m_freem(m);
7159dfc8606SBartlomiej Grzesik 
7169dfc8606SBartlomiej Grzesik 		return (error);
7179dfc8606SBartlomiej Grzesik 	}
7189dfc8606SBartlomiej Grzesik 
7199dfc8606SBartlomiej Grzesik 	pmtu = ipsec_get_pmtu(sav);
7209dfc8606SBartlomiej Grzesik 	if (pmtu == 0) {
7219dfc8606SBartlomiej Grzesik 		key_freesav(&sav);
7229dfc8606SBartlomiej Grzesik 		return (0);
7239dfc8606SBartlomiej Grzesik 	}
7249dfc8606SBartlomiej Grzesik 
7259dfc8606SBartlomiej Grzesik 	hlen = ipsec_hdrsiz_internal(sp);
7269dfc8606SBartlomiej Grzesik 	key_freesav(&sav);
7279dfc8606SBartlomiej Grzesik 
7289dfc8606SBartlomiej Grzesik 	if (m_length(m, NULL) + hlen > pmtu) {
7299dfc8606SBartlomiej Grzesik 		/*
7309dfc8606SBartlomiej Grzesik 		 * If we're forwarding generate ICMPv6 message here,
731c27214f0SWojciech Macek 		 * so that it contains pmtu subtracted by header size.
7329dfc8606SBartlomiej Grzesik 		 * Set error to EINPROGRESS, in order for the frame
7339dfc8606SBartlomiej Grzesik 		 * to be dropped silently.
7349dfc8606SBartlomiej Grzesik 		 */
7359dfc8606SBartlomiej Grzesik 		if (forwarding) {
7369dfc8606SBartlomiej Grzesik 			if (pmtu > hlen)
7379dfc8606SBartlomiej Grzesik 				icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, pmtu - hlen);
7389dfc8606SBartlomiej Grzesik 			else
7399dfc8606SBartlomiej Grzesik 				m_freem(m);
7409dfc8606SBartlomiej Grzesik 
7419dfc8606SBartlomiej Grzesik 			key_freesp(&sp);
7429dfc8606SBartlomiej Grzesik 			return (EINPROGRESS); /* Pretend that we consumed it. */
7439dfc8606SBartlomiej Grzesik 		}
7449dfc8606SBartlomiej Grzesik 	}
7459dfc8606SBartlomiej Grzesik 
7469dfc8606SBartlomiej Grzesik 	return (0);
7479dfc8606SBartlomiej Grzesik }
7489dfc8606SBartlomiej Grzesik 
749fcf59617SAndrey V. Elsukov static int
750fcf59617SAndrey V. Elsukov ipsec6_common_output(struct mbuf *m, struct inpcb *inp, int forwarding)
751fcf59617SAndrey V. Elsukov {
752fcf59617SAndrey V. Elsukov 	struct secpolicy *sp;
753fcf59617SAndrey V. Elsukov 	int error;
754fcf59617SAndrey V. Elsukov 
755fcf59617SAndrey V. Elsukov 	/* Lookup for the corresponding outbound security policy */
75622bbefb2SAndrey V. Elsukov 	sp = ipsec6_checkpolicy(m, inp, &error, !forwarding);
757fcf59617SAndrey V. Elsukov 	if (sp == NULL) {
758fcf59617SAndrey V. Elsukov 		if (error == -EINVAL) {
759fcf59617SAndrey V. Elsukov 			/* Discarded by policy. */
760fcf59617SAndrey V. Elsukov 			m_freem(m);
761fcf59617SAndrey V. Elsukov 			return (EACCES);
762fcf59617SAndrey V. Elsukov 		}
763fcf59617SAndrey V. Elsukov 		return (0); /* No IPsec required. */
764fcf59617SAndrey V. Elsukov 	}
765fcf59617SAndrey V. Elsukov 
766fcf59617SAndrey V. Elsukov 	if (!forwarding) {
767fcf59617SAndrey V. Elsukov 		/*
768fcf59617SAndrey V. Elsukov 		 * Do delayed checksums now because we send before
769fcf59617SAndrey V. Elsukov 		 * this is done in the normal processing path.
770fcf59617SAndrey V. Elsukov 		 */
771fcf59617SAndrey V. Elsukov 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) {
772fcf59617SAndrey V. Elsukov 			in6_delayed_cksum(m, m->m_pkthdr.len -
773fcf59617SAndrey V. Elsukov 			    sizeof(struct ip6_hdr), sizeof(struct ip6_hdr));
774fcf59617SAndrey V. Elsukov 			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
775fcf59617SAndrey V. Elsukov 		}
77695033af9SMark Johnston #if defined(SCTP) || defined(SCTP_SUPPORT)
777fcf59617SAndrey V. Elsukov 		if (m->m_pkthdr.csum_flags & CSUM_SCTP_IPV6) {
778fcf59617SAndrey V. Elsukov 			sctp_delayed_cksum(m, sizeof(struct ip6_hdr));
779fcf59617SAndrey V. Elsukov 			m->m_pkthdr.csum_flags &= ~CSUM_SCTP_IPV6;
780fcf59617SAndrey V. Elsukov 		}
781fcf59617SAndrey V. Elsukov #endif
782fcf59617SAndrey V. Elsukov 	}
7839dfc8606SBartlomiej Grzesik 
7849dfc8606SBartlomiej Grzesik 	error = ipsec6_check_pmtu(m, sp, forwarding);
7859dfc8606SBartlomiej Grzesik 	if (error != 0) {
7869dfc8606SBartlomiej Grzesik 		if (error == EJUSTRETURN)
7879dfc8606SBartlomiej Grzesik 			return (0);
7889dfc8606SBartlomiej Grzesik 
7899dfc8606SBartlomiej Grzesik 		return (error);
7909dfc8606SBartlomiej Grzesik 	}
7919dfc8606SBartlomiej Grzesik 
792fcf59617SAndrey V. Elsukov 	/* NB: callee frees mbuf and releases reference to SP */
793fcf59617SAndrey V. Elsukov 	error = ipsec6_process_packet(m, sp, inp);
794fcf59617SAndrey V. Elsukov 	if (error == EJUSTRETURN) {
795fcf59617SAndrey V. Elsukov 		/*
796fcf59617SAndrey V. Elsukov 		 * We had a SP with a level of 'use' and no SA. We
797fcf59617SAndrey V. Elsukov 		 * will just continue to process the packet without
798fcf59617SAndrey V. Elsukov 		 * IPsec processing and return without error.
799fcf59617SAndrey V. Elsukov 		 */
800fcf59617SAndrey V. Elsukov 		return (0);
801fcf59617SAndrey V. Elsukov 	}
802fcf59617SAndrey V. Elsukov 	if (error == 0)
803fcf59617SAndrey V. Elsukov 		return (EINPROGRESS); /* consumed by IPsec */
804fcf59617SAndrey V. Elsukov 	return (error);
805fcf59617SAndrey V. Elsukov }
806fcf59617SAndrey V. Elsukov 
807fcf59617SAndrey V. Elsukov /*
808fcf59617SAndrey V. Elsukov  * IPSEC_OUTPUT() method implementation for IPv6.
809fcf59617SAndrey V. Elsukov  * 0 - no IPsec handling needed
810fcf59617SAndrey V. Elsukov  * other values - mbuf consumed by IPsec.
811fcf59617SAndrey V. Elsukov  */
812fcf59617SAndrey V. Elsukov int
813fcf59617SAndrey V. Elsukov ipsec6_output(struct mbuf *m, struct inpcb *inp)
814fcf59617SAndrey V. Elsukov {
815fcf59617SAndrey V. Elsukov 
816fcf59617SAndrey V. Elsukov 	/*
817fcf59617SAndrey V. Elsukov 	 * If the packet is resubmitted to ip_output (e.g. after
818fcf59617SAndrey V. Elsukov 	 * AH, ESP, etc. processing), there will be a tag to bypass
819fcf59617SAndrey V. Elsukov 	 * the lookup and related policy checking.
820fcf59617SAndrey V. Elsukov 	 */
821fcf59617SAndrey V. Elsukov 	if (m_tag_find(m, PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL)
822fcf59617SAndrey V. Elsukov 		return (0);
823fcf59617SAndrey V. Elsukov 
824fcf59617SAndrey V. Elsukov 	return (ipsec6_common_output(m, inp, 0));
825fcf59617SAndrey V. Elsukov }
826fcf59617SAndrey V. Elsukov 
827fcf59617SAndrey V. Elsukov /*
828fcf59617SAndrey V. Elsukov  * IPSEC_FORWARD() method implementation for IPv6.
829fcf59617SAndrey V. Elsukov  * 0 - no IPsec handling needed
830fcf59617SAndrey V. Elsukov  * other values - mbuf consumed by IPsec.
831fcf59617SAndrey V. Elsukov  */
832fcf59617SAndrey V. Elsukov int
833fcf59617SAndrey V. Elsukov ipsec6_forward(struct mbuf *m)
834fcf59617SAndrey V. Elsukov {
835fcf59617SAndrey V. Elsukov 
836fcf59617SAndrey V. Elsukov 	/*
837fcf59617SAndrey V. Elsukov 	 * Check if this packet has an active inbound SP and needs to be
838fcf59617SAndrey V. Elsukov 	 * dropped instead of forwarded.
839fcf59617SAndrey V. Elsukov 	 */
840fcf59617SAndrey V. Elsukov 	if (ipsec6_in_reject(m, NULL) != 0) {
841fcf59617SAndrey V. Elsukov 		m_freem(m);
842fcf59617SAndrey V. Elsukov 		return (EACCES);
843fcf59617SAndrey V. Elsukov 	}
844fcf59617SAndrey V. Elsukov 	return (ipsec6_common_output(m, NULL, 1));
845fcf59617SAndrey V. Elsukov }
846fcf59617SAndrey V. Elsukov #endif /* INET6 */
847fcf59617SAndrey V. Elsukov 
848fcf59617SAndrey V. Elsukov int
849fcf59617SAndrey V. Elsukov ipsec_process_done(struct mbuf *m, struct secpolicy *sp, struct secasvar *sav,
850fcf59617SAndrey V. Elsukov     u_int idx)
851fcf59617SAndrey V. Elsukov {
852f82eb2a6SJohn Baldwin 	struct epoch_tracker et;
853fcf59617SAndrey V. Elsukov 	struct xform_history *xh;
854fcf59617SAndrey V. Elsukov 	struct secasindex *saidx;
855fcf59617SAndrey V. Elsukov 	struct m_tag *mtag;
856fcf59617SAndrey V. Elsukov 	int error;
85788768458SSam Leffler 
85888768458SSam Leffler 	saidx = &sav->sah->saidx;
85988768458SSam Leffler 	switch (saidx->dst.sa.sa_family) {
86088768458SSam Leffler #ifdef INET
86188768458SSam Leffler 	case AF_INET:
86288768458SSam Leffler 		/* Fix the header length, for AH processing. */
86388768458SSam Leffler 		mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
86488768458SSam Leffler 		break;
86588768458SSam Leffler #endif /* INET */
86688768458SSam Leffler #ifdef INET6
86788768458SSam Leffler 	case AF_INET6:
86888768458SSam Leffler 		/* Fix the header length, for AH processing. */
86988768458SSam Leffler 		if (m->m_pkthdr.len < sizeof (struct ip6_hdr)) {
87088768458SSam Leffler 			error = ENXIO;
87188768458SSam Leffler 			goto bad;
87288768458SSam Leffler 		}
87388768458SSam Leffler 		if (m->m_pkthdr.len - sizeof (struct ip6_hdr) > IPV6_MAXPACKET) {
87488768458SSam Leffler 			/* No jumbogram support. */
87588768458SSam Leffler 			error = ENXIO;	/*?*/
87688768458SSam Leffler 			goto bad;
87788768458SSam Leffler 		}
87888768458SSam Leffler 		mtod(m, struct ip6_hdr *)->ip6_plen =
87988768458SSam Leffler 			htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
88088768458SSam Leffler 		break;
88188768458SSam Leffler #endif /* INET6 */
88288768458SSam Leffler 	default:
8839ffa9677SSam Leffler 		DPRINTF(("%s: unknown protocol family %u\n", __func__,
88488768458SSam Leffler 		    saidx->dst.sa.sa_family));
88588768458SSam Leffler 		error = ENXIO;
88688768458SSam Leffler 		goto bad;
88788768458SSam Leffler 	}
88888768458SSam Leffler 
88988768458SSam Leffler 	/*
890fcf59617SAndrey V. Elsukov 	 * Add a record of what we've done to the packet.
89188768458SSam Leffler 	 */
892fcf59617SAndrey V. Elsukov 	mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE, sizeof(*xh), M_NOWAIT);
89388768458SSam Leffler 	if (mtag == NULL) {
8949ffa9677SSam Leffler 		DPRINTF(("%s: could not get packet tag\n", __func__));
89588768458SSam Leffler 		error = ENOMEM;
89688768458SSam Leffler 		goto bad;
89788768458SSam Leffler 	}
89888768458SSam Leffler 
899fcf59617SAndrey V. Elsukov 	xh = (struct xform_history *)(mtag + 1);
900fcf59617SAndrey V. Elsukov 	xh->dst = saidx->dst;
901fcf59617SAndrey V. Elsukov 	xh->proto = saidx->proto;
902fcf59617SAndrey V. Elsukov 	xh->mode = saidx->mode;
903fcf59617SAndrey V. Elsukov 	xh->spi = sav->spi;
90488768458SSam Leffler 	m_tag_prepend(m, mtag);
90588768458SSam Leffler 
90659959de5SErmal Luçi 	key_sa_recordxfer(sav, m);		/* record data transfer */
90759959de5SErmal Luçi 
90888768458SSam Leffler 	/*
90988768458SSam Leffler 	 * If there's another (bundled) SA to apply, do so.
91088768458SSam Leffler 	 * Note that this puts a burden on the kernel stack size.
91188768458SSam Leffler 	 * If this is a problem we'll need to introduce a queue
91288768458SSam Leffler 	 * to set the packet on so we can unwind the stack before
91388768458SSam Leffler 	 * doing further processing.
91488768458SSam Leffler 	 */
915fcf59617SAndrey V. Elsukov 	if (++idx < sp->tcount) {
916db178eb8SBjoern A. Zeeb 		switch (saidx->dst.sa.sa_family) {
917db178eb8SBjoern A. Zeeb #ifdef INET
918db178eb8SBjoern A. Zeeb 		case AF_INET:
919fcf59617SAndrey V. Elsukov 			key_freesav(&sav);
920f9d8f665SAndrey V. Elsukov 			IPSECSTAT_INC(ips_out_bundlesa);
9211a01e0e7SAndrey V. Elsukov 			return (ipsec4_perform_request(m, sp, NULL, idx));
922db178eb8SBjoern A. Zeeb 			/* NOTREACHED */
923db178eb8SBjoern A. Zeeb #endif
924db178eb8SBjoern A. Zeeb #ifdef INET6
925db178eb8SBjoern A. Zeeb 		case AF_INET6:
926fcf59617SAndrey V. Elsukov 			key_freesav(&sav);
927f9d8f665SAndrey V. Elsukov 			IPSEC6STAT_INC(ips_out_bundlesa);
9281a01e0e7SAndrey V. Elsukov 			return (ipsec6_perform_request(m, sp, NULL, idx));
929db178eb8SBjoern A. Zeeb 			/* NOTREACHED */
930db178eb8SBjoern A. Zeeb #endif /* INET6 */
931db178eb8SBjoern A. Zeeb 		default:
932db178eb8SBjoern A. Zeeb 			DPRINTF(("%s: unknown protocol family %u\n", __func__,
933db178eb8SBjoern A. Zeeb 			    saidx->dst.sa.sa_family));
934fcf59617SAndrey V. Elsukov 			error = EPFNOSUPPORT;
935db178eb8SBjoern A. Zeeb 			goto bad;
936db178eb8SBjoern A. Zeeb 		}
93788768458SSam Leffler 	}
93888768458SSam Leffler 
939fcf59617SAndrey V. Elsukov 	key_freesp(&sp), sp = NULL;	/* Release reference to SP */
940fcf59617SAndrey V. Elsukov #ifdef INET
941fcf59617SAndrey V. Elsukov 	/*
942fcf59617SAndrey V. Elsukov 	 * Do UDP encapsulation if SA requires it.
943fcf59617SAndrey V. Elsukov 	 */
944fcf59617SAndrey V. Elsukov 	if (sav->natt != NULL) {
945fcf59617SAndrey V. Elsukov 		error = udp_ipsec_output(m, sav);
946fcf59617SAndrey V. Elsukov 		if (error != 0)
947fcf59617SAndrey V. Elsukov 			goto bad;
948fcf59617SAndrey V. Elsukov 	}
949fcf59617SAndrey V. Elsukov #endif /* INET */
95088768458SSam Leffler 	/*
95188768458SSam Leffler 	 * We're done with IPsec processing, transmit the packet using the
9526508929bSAndrey V. Elsukov 	 * appropriate network protocol (IP or IPv6).
95388768458SSam Leffler 	 */
954f82eb2a6SJohn Baldwin 	NET_EPOCH_ENTER(et);
95588768458SSam Leffler 	switch (saidx->dst.sa.sa_family) {
95688768458SSam Leffler #ifdef INET
95788768458SSam Leffler 	case AF_INET:
958fcf59617SAndrey V. Elsukov 		key_freesav(&sav);
959f82eb2a6SJohn Baldwin 		error = ip_output(m, NULL, NULL, IP_RAWOUTPUT, NULL, NULL);
960f82eb2a6SJohn Baldwin 		break;
96188768458SSam Leffler #endif /* INET */
96288768458SSam Leffler #ifdef INET6
96388768458SSam Leffler 	case AF_INET6:
964fcf59617SAndrey V. Elsukov 		key_freesav(&sav);
965f82eb2a6SJohn Baldwin 		error = ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
966f82eb2a6SJohn Baldwin 		break;
96788768458SSam Leffler #endif /* INET6 */
968f82eb2a6SJohn Baldwin 	default:
96988768458SSam Leffler 		panic("ipsec_process_done");
970f82eb2a6SJohn Baldwin 	}
971f82eb2a6SJohn Baldwin 	NET_EPOCH_EXIT(et);
972f82eb2a6SJohn Baldwin 	return (error);
97388768458SSam Leffler bad:
97488768458SSam Leffler 	m_freem(m);
975fcf59617SAndrey V. Elsukov 	key_freesav(&sav);
976fcf59617SAndrey V. Elsukov 	if (sp != NULL)
977fcf59617SAndrey V. Elsukov 		key_freesp(&sp);
97888768458SSam Leffler 	return (error);
97988768458SSam Leffler }
98088768458SSam Leffler 
981fcf59617SAndrey V. Elsukov /*
982fcf59617SAndrey V. Elsukov  * ipsec_prepend() is optimized version of M_PREPEND().
983fcf59617SAndrey V. Elsukov  * ipsec_encap() is called by IPsec output routine for tunnel mode SA.
984fcf59617SAndrey V. Elsukov  * It is expected that after IP encapsulation some IPsec transform will
985fcf59617SAndrey V. Elsukov  * be performed. Each IPsec transform inserts its variable length header
986fcf59617SAndrey V. Elsukov  * just after outer IP header using m_makespace(). If given mbuf has not
987fcf59617SAndrey V. Elsukov  * enough free space at the beginning, we allocate new mbuf and reserve
988fcf59617SAndrey V. Elsukov  * some space at the beginning and at the end.
989fcf59617SAndrey V. Elsukov  * This helps avoid allocating of new mbuf and data copying in m_makespace(),
990fcf59617SAndrey V. Elsukov  * we place outer header in the middle of mbuf's data with reserved leading
991fcf59617SAndrey V. Elsukov  * and trailing space:
992fcf59617SAndrey V. Elsukov  *	[ LEADINGSPACE ][ Outer IP header ][ TRAILINGSPACE ]
993fcf59617SAndrey V. Elsukov  * LEADINGSPACE will be used to add ethernet header, TRAILINGSPACE will
994fcf59617SAndrey V. Elsukov  * be used to inject AH/ESP/IPCOMP header.
995fcf59617SAndrey V. Elsukov  */
996fcf59617SAndrey V. Elsukov #define	IPSEC_TRAILINGSPACE	(sizeof(struct udphdr) +/* NAT-T */	\
997fcf59617SAndrey V. Elsukov     max(sizeof(struct newesp) + EALG_MAX_BLOCK_LEN,	/* ESP + IV */	\
998fcf59617SAndrey V. Elsukov 	sizeof(struct newah) + HASH_MAX_LEN		/* AH + ICV */))
999fcf59617SAndrey V. Elsukov static struct mbuf *
1000fcf59617SAndrey V. Elsukov ipsec_prepend(struct mbuf *m, int len, int how)
100188768458SSam Leffler {
1002fcf59617SAndrey V. Elsukov 	struct mbuf *n;
100388768458SSam Leffler 
1004fcf59617SAndrey V. Elsukov 	M_ASSERTPKTHDR(m);
1005fcf59617SAndrey V. Elsukov 	IPSEC_ASSERT(len < MHLEN, ("wrong length"));
1006fcf59617SAndrey V. Elsukov 	if (M_LEADINGSPACE(m) >= len) {
1007fcf59617SAndrey V. Elsukov 		/* No need to allocate new mbuf. */
1008fcf59617SAndrey V. Elsukov 		m->m_data -= len;
1009fcf59617SAndrey V. Elsukov 		m->m_len += len;
1010fcf59617SAndrey V. Elsukov 		m->m_pkthdr.len += len;
1011fcf59617SAndrey V. Elsukov 		return (m);
101288768458SSam Leffler 	}
1013fcf59617SAndrey V. Elsukov 	n = m_gethdr(how, m->m_type);
1014fcf59617SAndrey V. Elsukov 	if (n == NULL) {
1015fcf59617SAndrey V. Elsukov 		m_freem(m);
1016fcf59617SAndrey V. Elsukov 		return (NULL);
101788768458SSam Leffler 	}
1018fcf59617SAndrey V. Elsukov 	m_move_pkthdr(n, m);
1019fcf59617SAndrey V. Elsukov 	n->m_next = m;
1020fcf59617SAndrey V. Elsukov 	if (len + IPSEC_TRAILINGSPACE < M_SIZE(n))
1021fcf59617SAndrey V. Elsukov 		m_align(n, len + IPSEC_TRAILINGSPACE);
1022fcf59617SAndrey V. Elsukov 	n->m_len = len;
1023fcf59617SAndrey V. Elsukov 	n->m_pkthdr.len += len;
1024fcf59617SAndrey V. Elsukov 	return (n);
102588768458SSam Leffler }
102688768458SSam Leffler 
10279dfc8606SBartlomiej Grzesik static size_t
10289dfc8606SBartlomiej Grzesik ipsec_get_pmtu(struct secasvar *sav)
10299dfc8606SBartlomiej Grzesik {
10309dfc8606SBartlomiej Grzesik 	union sockaddr_union *dst;
10319dfc8606SBartlomiej Grzesik 	struct in_conninfo inc;
10329dfc8606SBartlomiej Grzesik 	size_t pmtu;
10339dfc8606SBartlomiej Grzesik 
10349dfc8606SBartlomiej Grzesik 	dst = &sav->sah->saidx.dst;
10359dfc8606SBartlomiej Grzesik 	memset(&inc, 0, sizeof(inc));
10369dfc8606SBartlomiej Grzesik 
10379dfc8606SBartlomiej Grzesik 	switch (dst->sa.sa_family) {
10389dfc8606SBartlomiej Grzesik #ifdef INET
10399dfc8606SBartlomiej Grzesik 	case AF_INET:
10409dfc8606SBartlomiej Grzesik 		inc.inc_faddr = satosin(&dst->sa)->sin_addr;
10419dfc8606SBartlomiej Grzesik 		break;
10429dfc8606SBartlomiej Grzesik #endif
10439dfc8606SBartlomiej Grzesik #ifdef INET6
10449dfc8606SBartlomiej Grzesik 	case AF_INET6:
10459dfc8606SBartlomiej Grzesik 		inc.inc6_faddr = satosin6(&dst->sa)->sin6_addr;
10469dfc8606SBartlomiej Grzesik 		inc.inc_flags |= INC_ISIPV6;
10479dfc8606SBartlomiej Grzesik 		break;
10489dfc8606SBartlomiej Grzesik #endif
10499dfc8606SBartlomiej Grzesik 	default:
10509dfc8606SBartlomiej Grzesik 		return (0);
10519dfc8606SBartlomiej Grzesik 	}
10529dfc8606SBartlomiej Grzesik 
10539dfc8606SBartlomiej Grzesik 	pmtu = tcp_hc_getmtu(&inc);
10549dfc8606SBartlomiej Grzesik 	if (pmtu != 0)
10559dfc8606SBartlomiej Grzesik 		return (pmtu);
10569dfc8606SBartlomiej Grzesik 
10579dfc8606SBartlomiej Grzesik 	/* No entry in hostcache. Assume that PMTU is equal to link's MTU */
10589dfc8606SBartlomiej Grzesik 	switch (dst->sa.sa_family) {
10599dfc8606SBartlomiej Grzesik #ifdef INET
10609dfc8606SBartlomiej Grzesik 	case AF_INET:
10619dfc8606SBartlomiej Grzesik 		pmtu = tcp_maxmtu(&inc, NULL);
10629dfc8606SBartlomiej Grzesik 		break;
10639dfc8606SBartlomiej Grzesik #endif
10649dfc8606SBartlomiej Grzesik #ifdef INET6
10659dfc8606SBartlomiej Grzesik 	case AF_INET6:
10669dfc8606SBartlomiej Grzesik 		pmtu = tcp_maxmtu6(&inc, NULL);
10679dfc8606SBartlomiej Grzesik 		break;
10689dfc8606SBartlomiej Grzesik #endif
10699dfc8606SBartlomiej Grzesik 	default:
10709dfc8606SBartlomiej Grzesik 		return (0);
10719dfc8606SBartlomiej Grzesik 	}
10729dfc8606SBartlomiej Grzesik 	if (pmtu == 0)
10739dfc8606SBartlomiej Grzesik 		return (0);
10749dfc8606SBartlomiej Grzesik 
10759dfc8606SBartlomiej Grzesik 	tcp_hc_updatemtu(&inc, pmtu);
10769dfc8606SBartlomiej Grzesik 
10779dfc8606SBartlomiej Grzesik 	return (pmtu);
10789dfc8606SBartlomiej Grzesik }
10799dfc8606SBartlomiej Grzesik 
108061f37615SAndrey V. Elsukov static int
108161f37615SAndrey V. Elsukov ipsec_encap(struct mbuf **mp, struct secasindex *saidx)
108261f37615SAndrey V. Elsukov {
108361f37615SAndrey V. Elsukov #ifdef INET6
108461f37615SAndrey V. Elsukov 	struct ip6_hdr *ip6;
108561f37615SAndrey V. Elsukov #endif
108661f37615SAndrey V. Elsukov 	struct ip *ip;
108740461785SJohn Baldwin #ifdef INET
108861f37615SAndrey V. Elsukov 	int setdf;
108940461785SJohn Baldwin #endif
109061f37615SAndrey V. Elsukov 	uint8_t itos, proto;
109161f37615SAndrey V. Elsukov 
109261f37615SAndrey V. Elsukov 	ip = mtod(*mp, struct ip *);
109361f37615SAndrey V. Elsukov 	switch (ip->ip_v) {
109461f37615SAndrey V. Elsukov #ifdef INET
109561f37615SAndrey V. Elsukov 	case IPVERSION:
109661f37615SAndrey V. Elsukov 		proto = IPPROTO_IPIP;
109761f37615SAndrey V. Elsukov 		/*
109861f37615SAndrey V. Elsukov 		 * Collect IP_DF state from the inner header
109961f37615SAndrey V. Elsukov 		 * and honor system-wide control of how to handle it.
110061f37615SAndrey V. Elsukov 		 */
110161f37615SAndrey V. Elsukov 		switch (V_ip4_ipsec_dfbit) {
110261f37615SAndrey V. Elsukov 		case 0:	/* clear in outer header */
110361f37615SAndrey V. Elsukov 		case 1:	/* set in outer header */
110461f37615SAndrey V. Elsukov 			setdf = V_ip4_ipsec_dfbit;
110561f37615SAndrey V. Elsukov 			break;
110661f37615SAndrey V. Elsukov 		default:/* propagate to outer header */
11076f814d0eSAndrey V. Elsukov 			setdf = (ip->ip_off & htons(IP_DF)) != 0;
110861f37615SAndrey V. Elsukov 		}
110961f37615SAndrey V. Elsukov 		itos = ip->ip_tos;
111061f37615SAndrey V. Elsukov 		break;
111161f37615SAndrey V. Elsukov #endif
111261f37615SAndrey V. Elsukov #ifdef INET6
111361f37615SAndrey V. Elsukov 	case (IPV6_VERSION >> 4):
111461f37615SAndrey V. Elsukov 		proto = IPPROTO_IPV6;
111561f37615SAndrey V. Elsukov 		ip6 = mtod(*mp, struct ip6_hdr *);
111661f37615SAndrey V. Elsukov 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
111761f37615SAndrey V. Elsukov 		/* scoped address handling */
111861f37615SAndrey V. Elsukov 		in6_clearscope(&ip6->ip6_src);
111961f37615SAndrey V. Elsukov 		in6_clearscope(&ip6->ip6_dst);
112061f37615SAndrey V. Elsukov 		break;
112161f37615SAndrey V. Elsukov #endif
112261f37615SAndrey V. Elsukov 	default:
112361f37615SAndrey V. Elsukov 		return (EAFNOSUPPORT);
112461f37615SAndrey V. Elsukov 	}
112561f37615SAndrey V. Elsukov 	switch (saidx->dst.sa.sa_family) {
112661f37615SAndrey V. Elsukov #ifdef INET
112761f37615SAndrey V. Elsukov 	case AF_INET:
112861f37615SAndrey V. Elsukov 		if (saidx->src.sa.sa_family != AF_INET ||
112961f37615SAndrey V. Elsukov 		    saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
113061f37615SAndrey V. Elsukov 		    saidx->dst.sin.sin_addr.s_addr == INADDR_ANY)
113161f37615SAndrey V. Elsukov 			return (EINVAL);
1132fcf59617SAndrey V. Elsukov 		*mp = ipsec_prepend(*mp, sizeof(struct ip), M_NOWAIT);
113361f37615SAndrey V. Elsukov 		if (*mp == NULL)
113461f37615SAndrey V. Elsukov 			return (ENOBUFS);
113561f37615SAndrey V. Elsukov 		ip = mtod(*mp, struct ip *);
113661f37615SAndrey V. Elsukov 		ip->ip_v = IPVERSION;
113761f37615SAndrey V. Elsukov 		ip->ip_hl = sizeof(struct ip) >> 2;
113861f37615SAndrey V. Elsukov 		ip->ip_p = proto;
113961f37615SAndrey V. Elsukov 		ip->ip_len = htons((*mp)->m_pkthdr.len);
114061f37615SAndrey V. Elsukov 		ip->ip_ttl = V_ip_defttl;
114161f37615SAndrey V. Elsukov 		ip->ip_sum = 0;
114261f37615SAndrey V. Elsukov 		ip->ip_off = setdf ? htons(IP_DF): 0;
114361f37615SAndrey V. Elsukov 		ip->ip_src = saidx->src.sin.sin_addr;
114461f37615SAndrey V. Elsukov 		ip->ip_dst = saidx->dst.sin.sin_addr;
114561f37615SAndrey V. Elsukov 		ip_ecn_ingress(V_ip4_ipsec_ecn, &ip->ip_tos, &itos);
114661f37615SAndrey V. Elsukov 		ip_fillid(ip);
114761f37615SAndrey V. Elsukov 		break;
114861f37615SAndrey V. Elsukov #endif /* INET */
114961f37615SAndrey V. Elsukov #ifdef INET6
115061f37615SAndrey V. Elsukov 	case AF_INET6:
115161f37615SAndrey V. Elsukov 		if (saidx->src.sa.sa_family != AF_INET6 ||
115261f37615SAndrey V. Elsukov 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr) ||
115361f37615SAndrey V. Elsukov 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr))
115461f37615SAndrey V. Elsukov 			return (EINVAL);
1155fcf59617SAndrey V. Elsukov 		*mp = ipsec_prepend(*mp, sizeof(struct ip6_hdr), M_NOWAIT);
115661f37615SAndrey V. Elsukov 		if (*mp == NULL)
115761f37615SAndrey V. Elsukov 			return (ENOBUFS);
115861f37615SAndrey V. Elsukov 		ip6 = mtod(*mp, struct ip6_hdr *);
115961f37615SAndrey V. Elsukov 		ip6->ip6_flow = 0;
116061f37615SAndrey V. Elsukov 		ip6->ip6_vfc = IPV6_VERSION;
116161f37615SAndrey V. Elsukov 		ip6->ip6_hlim = V_ip6_defhlim;
116261f37615SAndrey V. Elsukov 		ip6->ip6_nxt = proto;
116361f37615SAndrey V. Elsukov 		ip6->ip6_dst = saidx->dst.sin6.sin6_addr;
11641ae800e7SAndrey V. Elsukov 		/* For link-local address embed scope zone id */
11651ae800e7SAndrey V. Elsukov 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
11661ae800e7SAndrey V. Elsukov 			ip6->ip6_dst.s6_addr16[1] =
11671ae800e7SAndrey V. Elsukov 			    htons(saidx->dst.sin6.sin6_scope_id & 0xffff);
116861f37615SAndrey V. Elsukov 		ip6->ip6_src = saidx->src.sin6.sin6_addr;
11691ae800e7SAndrey V. Elsukov 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
11701ae800e7SAndrey V. Elsukov 			ip6->ip6_src.s6_addr16[1] =
11711ae800e7SAndrey V. Elsukov 			    htons(saidx->src.sin6.sin6_scope_id & 0xffff);
117261f37615SAndrey V. Elsukov 		ip6->ip6_plen = htons((*mp)->m_pkthdr.len - sizeof(*ip6));
117361f37615SAndrey V. Elsukov 		ip_ecn_ingress(V_ip6_ipsec_ecn, &proto, &itos);
117461f37615SAndrey V. Elsukov 		ip6->ip6_flow |= htonl((uint32_t)proto << 20);
117561f37615SAndrey V. Elsukov 		break;
117661f37615SAndrey V. Elsukov #endif /* INET6 */
117761f37615SAndrey V. Elsukov 	default:
117861f37615SAndrey V. Elsukov 		return (EAFNOSUPPORT);
117961f37615SAndrey V. Elsukov 	}
1180fcf59617SAndrey V. Elsukov 	(*mp)->m_flags &= ~(M_BCAST | M_MCAST);
118161f37615SAndrey V. Elsukov 	return (0);
118261f37615SAndrey V. Elsukov }
1183