![[BACK]](/icons/back.gif){kind=icon}
Return to ip_ipsp.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / netinet|
Return to ip_ipsp.c CVS log | Up to [local] / sys / netinet |
1.1 nbrk 1: /* $OpenBSD: ip_ipsp.c,v 1.168 2007/02/14 00:53:48 jsg Exp $ */
2: /*
3: * The authors of this code are John Ioannidis (ji@tla.org),
4: * Angelos D. Keromytis (kermit@csd.uch.gr),
5: * Niels Provos (provos@physnet.uni-hamburg.de) and
6: * Niklas Hallqvist (niklas@appli.se).
7: *
8: * The original version of this code was written by John Ioannidis
9: * for BSD/OS in Athens, Greece, in November 1995.
10: *
11: * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
12: * by Angelos D. Keromytis.
13: *
14: * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
15: * and Niels Provos.
16: *
17: * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist.
18: *
19: * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
20: * Angelos D. Keromytis and Niels Provos.
21: * Copyright (c) 1999 Niklas Hallqvist.
22: * Copyright (c) 2001, Angelos D. Keromytis.
23: *
24: * Permission to use, copy, and modify this software with or without fee
25: * is hereby granted, provided that this entire notice is included in
26: * all copies of any software which is or includes a copy or
27: * modification of this software.
28: * You may use this code under the GNU public license if you so wish. Please
29: * contribute changes back to the authors under this freer than GPL license
30: * so that we may further the use of strong encryption without limitations to
31: * all.
32: *
33: * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
34: * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
35: * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
36: * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
37: * PURPOSE.
38: */
39:
40: #include "pf.h"
41:
42: #include <sys/param.h>
43: #include <sys/mbuf.h>
44: #include <sys/socket.h>
45: #include <sys/kernel.h>
46: #include <sys/sysctl.h>
47:
48: #include <net/if.h>
49: #include <net/route.h>
50:
51: #if NPF > 0
52: #include <net/pfvar.h>
53: #endif
54:
55: #ifdef INET
56: #include <netinet/in.h>
57: #include <netinet/in_systm.h>
58: #include <netinet/ip.h>
59: #include <netinet/in_pcb.h>
60: #endif /* INET */
61:
62: #ifdef INET6
63: #ifndef INET
64: #include <netinet/in.h>
65: #endif
66: #include <netinet6/in6_var.h>
67: #endif /* INET6 */
68:
69: #include <netinet/ip_ipsp.h>
70: #include <net/pfkeyv2.h>
71: #include <crypto/xform.h>
72: #include <dev/rndvar.h>
73:
74: #ifdef DDB
75: #include <ddb/db_output.h>
76: void tdb_hashstats(void);
77: #endif
78:
79: #ifdef ENCDEBUG
80: #define DPRINTF(x) if (encdebug) printf x
81: #else
82: #define DPRINTF(x)
83: #endif
84:
85: int ipsp_kern(int, char **, int);
86: u_int8_t get_sa_require(struct inpcb *);
87: void tdb_rehash(void);
88: void tdb_timeout(void *v);
89: void tdb_firstuse(void *v);
90: void tdb_soft_timeout(void *v);
91: void tdb_soft_firstuse(void *v);
92:
93: extern int ipsec_auth_default_level;
94: extern int ipsec_esp_trans_default_level;
95: extern int ipsec_esp_network_default_level;
96: extern int ipsec_ipcomp_default_level;
97:
98: extern int encdebug;
99: int ipsec_in_use = 0;
100: u_int64_t ipsec_last_added = 0;
101:
102: struct ipsec_policy_head ipsec_policy_head =
103: TAILQ_HEAD_INITIALIZER(ipsec_policy_head);
104: struct ipsec_acquire_head ipsec_acquire_head =
105: TAILQ_HEAD_INITIALIZER(ipsec_acquire_head);
106:
107: /*
108: * This is the proper place to define the various encapsulation transforms.
109: */
110:
111: struct xformsw xformsw[] = {
112: #ifdef IPSEC
113: { XF_IP4, 0, "IPv4 Simple Encapsulation",
114: ipe4_attach, ipe4_init, ipe4_zeroize,
115: (int (*)(struct mbuf *, struct tdb *, int, int))ipe4_input,
116: ipip_output, },
117: { XF_AH, XFT_AUTH, "IPsec AH",
118: ah_attach, ah_init, ah_zeroize,
119: ah_input, ah_output, },
120: { XF_ESP, XFT_CONF|XFT_AUTH, "IPsec ESP",
121: esp_attach, esp_init, esp_zeroize,
122: esp_input, esp_output, },
123: { XF_IPCOMP, XFT_COMP, "IPcomp",
124: ipcomp_attach, ipcomp_init, ipcomp_zeroize,
125: ipcomp_input, ipcomp_output, },
126: #endif /* IPSEC */
127: #ifdef TCP_SIGNATURE
128: { XF_TCPSIGNATURE, XFT_AUTH, "TCP MD5 Signature Option, RFC 2385",
129: tcp_signature_tdb_attach, tcp_signature_tdb_init,
130: tcp_signature_tdb_zeroize, tcp_signature_tdb_input,
131: tcp_signature_tdb_output, }
132: #endif /* TCP_SIGNATURE */
133: };
134:
135: struct xformsw *xformswNXFORMSW = &xformsw[sizeof(xformsw)/sizeof(xformsw[0])];
136:
137: unsigned char ipseczeroes[IPSEC_ZEROES_SIZE]; /* zeroes! */
138:
139: #define TDB_HASHSIZE_INIT 32
140:
141: static struct tdb **tdbh = NULL;
142: static struct tdb **tdbaddr = NULL;
143: static struct tdb **tdbsrc = NULL;
144: static u_int tdb_hashmask = TDB_HASHSIZE_INIT - 1;
145: static int tdb_count;
146:
147: /*
148: * Our hashing function needs to stir things with a non-zero random multiplier
149: * so we cannot be DoS-attacked via choosing of the data to hash.
150: */
151: int
152: tdb_hash(u_int32_t spi, union sockaddr_union *dst, u_int8_t proto)
153: {
154: static u_int32_t mult1 = 0, mult2 = 0;
155: u_int8_t *ptr = (u_int8_t *) dst;
156: int i, shift;
157: u_int64_t hash;
158: int val32 = 0;
159:
160: while (mult1 == 0)
161: mult1 = arc4random();
162: while (mult2 == 0)
163: mult2 = arc4random();
164:
165: hash = (spi ^ proto) * mult1;
166: for (i = 0; i < SA_LEN(&dst->sa); i++) {
167: val32 = (val32 << 8) | ptr[i];
168: if (i % 4 == 3) {
169: hash ^= val32 * mult2;
170: val32 = 0;
171: }
172: }
173:
174: if (i % 4 != 0)
175: hash ^= val32 * mult2;
176:
177: shift = ffs(tdb_hashmask + 1);
178: while ((hash & ~tdb_hashmask) != 0)
179: hash = (hash >> shift) ^ (hash & tdb_hashmask);
180:
181: return hash;
182: }
183:
184: /*
185: * Reserve an SPI; the SA is not valid yet though. We use 0 as
186: * an error return value.
187: */
188: u_int32_t
189: reserve_spi(u_int32_t sspi, u_int32_t tspi, union sockaddr_union *src,
190: union sockaddr_union *dst, u_int8_t sproto, int *errval)
191: {
192: struct tdb *tdbp;
193: u_int32_t spi;
194: int nums, s;
195:
196: /* Don't accept ranges only encompassing reserved SPIs. */
197: if (sproto != IPPROTO_IPCOMP &&
198: (tspi < sspi || tspi <= SPI_RESERVED_MAX)) {
199: (*errval) = EINVAL;
200: return 0;
201: }
202: if (sproto == IPPROTO_IPCOMP && (tspi < sspi ||
203: tspi <= CPI_RESERVED_MAX ||
204: tspi >= CPI_PRIVATE_MIN)) {
205: (*errval) = EINVAL;
206: return 0;
207: }
208:
209: /* Limit the range to not include reserved areas. */
210: if (sspi <= SPI_RESERVED_MAX)
211: sspi = SPI_RESERVED_MAX + 1;
212:
213: /* For IPCOMP the CPI is only 16 bits long, what a good idea.... */
214:
215: if (sproto == IPPROTO_IPCOMP) {
216: u_int32_t t;
217: if (sspi >= 0x10000)
218: sspi = 0xffff;
219: if (tspi >= 0x10000)
220: tspi = 0xffff;
221: if (sspi > tspi) {
222: t = sspi; sspi = tspi; tspi = t;
223: }
224: }
225:
226: if (sspi == tspi) /* Asking for a specific SPI. */
227: nums = 1;
228: else
229: nums = 100; /* Arbitrarily chosen */
230:
231: while (nums--) {
232: if (sspi == tspi) /* Specific SPI asked. */
233: spi = tspi;
234: else /* Range specified */
235: spi = sspi + (arc4random() % (tspi - sspi));
236:
237: /* Don't allocate reserved SPIs. */
238: if (spi >= SPI_RESERVED_MIN && spi <= SPI_RESERVED_MAX)
239: continue;
240: else
241: spi = htonl(spi);
242:
243: /* Check whether we're using this SPI already. */
244: s = spltdb();
245: tdbp = gettdb(spi, dst, sproto);
246: splx(s);
247:
248: if (tdbp != (struct tdb *) NULL)
249: continue;
250:
251: tdbp = tdb_alloc();
252:
253: tdbp->tdb_spi = spi;
254: bcopy(&dst->sa, &tdbp->tdb_dst.sa, SA_LEN(&dst->sa));
255: bcopy(&src->sa, &tdbp->tdb_src.sa, SA_LEN(&src->sa));
256: tdbp->tdb_sproto = sproto;
257: tdbp->tdb_flags |= TDBF_INVALID; /* Mark SA invalid for now. */
258: tdbp->tdb_satype = SADB_SATYPE_UNSPEC;
259: puttdb(tdbp);
260:
261: /* Setup a "silent" expiration (since TDBF_INVALID's set). */
262: if (ipsec_keep_invalid > 0) {
263: tdbp->tdb_flags |= TDBF_TIMER;
264: tdbp->tdb_exp_timeout = ipsec_keep_invalid;
265: timeout_add(&tdbp->tdb_timer_tmo,
266: hz * ipsec_keep_invalid);
267: }
268:
269: return spi;
270: }
271:
272: (*errval) = EEXIST;
273: return 0;
274: }
275:
276: /*
277: * An IPSP SAID is really the concatenation of the SPI found in the
278: * packet, the destination address of the packet and the IPsec protocol.
279: * When we receive an IPSP packet, we need to look up its tunnel descriptor
280: * block, based on the SPI in the packet and the destination address (which
281: * is really one of our addresses if we received the packet!
282: *
283: * Caller is responsible for setting at least spltdb().
284: */
285: struct tdb *
286: gettdb(u_int32_t spi, union sockaddr_union *dst, u_int8_t proto)
287: {
288: u_int32_t hashval;
289: struct tdb *tdbp;
290:
291: if (tdbh == NULL)
292: return (struct tdb *) NULL;
293:
294: hashval = tdb_hash(spi, dst, proto);
295:
296: for (tdbp = tdbh[hashval]; tdbp != NULL; tdbp = tdbp->tdb_hnext)
297: if ((tdbp->tdb_spi == spi) && (tdbp->tdb_sproto == proto) &&
298: !bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa)))
299: break;
300:
301: return tdbp;
302: }
303:
304: /*
305: * Same as gettdb() but compare SRC as well, so we
306: * use the tdbsrc[] hash table. Setting spi to 0
307: * matches all SPIs.
308: */
309: struct tdb *
310: gettdbbysrcdst(u_int32_t spi, union sockaddr_union *src,
311: union sockaddr_union *dst, u_int8_t proto)
312: {
313: u_int32_t hashval;
314: struct tdb *tdbp;
315: union sockaddr_union su_null;
316:
317: if (tdbsrc == NULL)
318: return (struct tdb *) NULL;
319:
320: hashval = tdb_hash(0, src, proto);
321:
322: for (tdbp = tdbsrc[hashval]; tdbp != NULL; tdbp = tdbp->tdb_snext)
323: if (tdbp->tdb_sproto == proto &&
324: (spi == 0 || tdbp->tdb_spi == spi) &&
325: ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
326: (tdbp->tdb_dst.sa.sa_family == AF_UNSPEC ||
327: !bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa))) &&
328: !bcmp(&tdbp->tdb_src, src, SA_LEN(&src->sa)))
329: break;
330:
331: if (tdbp != NULL)
332: return (tdbp);
333:
334: bzero(&su_null, sizeof(su_null));
335: su_null.sa.sa_len = sizeof(struct sockaddr);
336: hashval = tdb_hash(0, &su_null, proto);
337:
338: for (tdbp = tdbsrc[hashval]; tdbp != NULL; tdbp = tdbp->tdb_snext)
339: if (tdbp->tdb_sproto == proto &&
340: (spi == 0 || tdbp->tdb_spi == spi) &&
341: ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
342: (tdbp->tdb_dst.sa.sa_family == AF_UNSPEC ||
343: !bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa))) &&
344: tdbp->tdb_src.sa.sa_family == AF_UNSPEC)
345: break;
346:
347: return (tdbp);
348: }
349:
350: /*
351: * Check that credentials and IDs match. Return true if so. The t*
352: * range of arguments contains information from TDBs; the p*
353: * range of arguments contains information from policies or
354: * already established TDBs.
355: */
356: int
357: ipsp_aux_match(struct tdb *tdb,
358: struct ipsec_ref *psrcid,
359: struct ipsec_ref *pdstid,
360: struct ipsec_ref *plcred,
361: struct ipsec_ref *prcred,
362: struct sockaddr_encap *pfilter,
363: struct sockaddr_encap *pfiltermask)
364: {
365: if (psrcid != NULL)
366: if (tdb->tdb_srcid == NULL ||
367: !ipsp_ref_match(tdb->tdb_srcid, psrcid))
368: return 0;
369:
370: if (pdstid != NULL)
371: if (tdb->tdb_dstid == NULL ||
372: !ipsp_ref_match(tdb->tdb_dstid, pdstid))
373: return 0;
374:
375: if (plcred != NULL)
376: if (tdb->tdb_local_cred == NULL ||
377: !ipsp_ref_match(tdb->tdb_local_cred, plcred))
378: return 0;
379:
380: if (prcred != NULL)
381: if (tdb->tdb_remote_cred == NULL ||
382: !ipsp_ref_match(tdb->tdb_remote_cred, prcred))
383: return 0;
384:
385: /* Check for filter matches. */
386: if (tdb->tdb_filter.sen_type) {
387: /*
388: * XXX We should really be doing a subnet-check (see
389: * whether the TDB-associated filter is a subset
390: * of the policy's. For now, an exact match will solve
391: * most problems (all this will do is make every
392: * policy get its own SAs).
393: */
394: if (bcmp(&tdb->tdb_filter, pfilter,
395: sizeof(struct sockaddr_encap)) ||
396: bcmp(&tdb->tdb_filtermask, pfiltermask,
397: sizeof(struct sockaddr_encap)))
398: return 0;
399: }
400:
401: return 1;
402: }
403:
404: /*
405: * Get an SA given the remote address, the security protocol type, and
406: * the desired IDs.
407: */
408: struct tdb *
409: gettdbbyaddr(union sockaddr_union *dst, u_int8_t sproto,
410: struct ipsec_ref *srcid, struct ipsec_ref *dstid,
411: struct ipsec_ref *local_cred, struct mbuf *m, int af,
412: struct sockaddr_encap *filter, struct sockaddr_encap *filtermask)
413: {
414: u_int32_t hashval;
415: struct tdb *tdbp;
416:
417: if (tdbaddr == NULL)
418: return (struct tdb *) NULL;
419:
420: hashval = tdb_hash(0, dst, sproto);
421:
422: for (tdbp = tdbaddr[hashval]; tdbp != NULL; tdbp = tdbp->tdb_anext)
423: if ((tdbp->tdb_sproto == sproto) &&
424: ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
425: (!bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa)))) {
426: /* Do IDs and local credentials match ? */
427: if (!ipsp_aux_match(tdbp, srcid, dstid,
428: local_cred, NULL, filter, filtermask))
429: continue;
430: break;
431: }
432:
433: return tdbp;
434: }
435:
436: /*
437: * Get an SA given the source address, the security protocol type, and
438: * the desired IDs.
439: */
440: struct tdb *
441: gettdbbysrc(union sockaddr_union *src, u_int8_t sproto,
442: struct ipsec_ref *srcid, struct ipsec_ref *dstid,
443: struct mbuf *m, int af, struct sockaddr_encap *filter,
444: struct sockaddr_encap *filtermask)
445: {
446: u_int32_t hashval;
447: struct tdb *tdbp;
448:
449: if (tdbsrc == NULL)
450: return (struct tdb *) NULL;
451:
452: hashval = tdb_hash(0, src, sproto);
453:
454: for (tdbp = tdbsrc[hashval]; tdbp != NULL; tdbp = tdbp->tdb_snext)
455: if ((tdbp->tdb_sproto == sproto) &&
456: ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
457: (!bcmp(&tdbp->tdb_src, src, SA_LEN(&src->sa)))) {
458: /* Check whether IDs match */
459: if (!ipsp_aux_match(tdbp, dstid, srcid, NULL, NULL,
460: filter, filtermask))
461: continue;
462: break;
463: }
464:
465: return tdbp;
466: }
467:
468: #if DDB
469: void
470: tdb_hashstats(void)
471: {
472: int i, cnt, buckets[16];
473: struct tdb *tdbp;
474:
475: if (tdbh == NULL) {
476: db_printf("no tdb hash table\n");
477: return;
478: }
479:
480: bzero (buckets, sizeof(buckets));
481: for (i = 0; i <= tdb_hashmask; i++) {
482: cnt = 0;
483: for (tdbp = tdbh[i]; cnt < 16 && tdbp != NULL;
484: tdbp = tdbp->tdb_hnext)
485: cnt++;
486: buckets[cnt]++;
487: }
488:
489: db_printf("tdb cnt\t\tbucket cnt\n");
490: for (i = 0; i < 16; i++)
491: if (buckets[i] > 0)
492: db_printf("%d%c\t\t%d\n", i, i == 15 ? "+" : "",
493: buckets[i]);
494: }
495: #endif /* DDB */
496:
497: /*
498: * Caller is responsible for setting at least spltdb().
499: */
500: int
501: tdb_walk(int (*walker)(struct tdb *, void *, int), void *arg)
502: {
503: int i, rval = 0;
504: struct tdb *tdbp, *next;
505:
506: if (tdbh == NULL)
507: return ENOENT;
508:
509: for (i = 0; i <= tdb_hashmask; i++)
510: for (tdbp = tdbh[i]; rval == 0 && tdbp != NULL; tdbp = next) {
511: next = tdbp->tdb_hnext;
512: if (i == tdb_hashmask && next == NULL)
513: rval = walker(tdbp, (void *)arg, 1);
514: else
515: rval = walker(tdbp, (void *)arg, 0);
516: }
517:
518: return rval;
519: }
520:
521: /*
522: * Called at splsoftclock().
523: */
524: void
525: tdb_timeout(void *v)
526: {
527: struct tdb *tdb = v;
528:
529: if (!(tdb->tdb_flags & TDBF_TIMER))
530: return;
531:
532: /* If it's an "invalid" TDB do a silent expiration. */
533: if (!(tdb->tdb_flags & TDBF_INVALID))
534: pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_HARD);
535: tdb_delete(tdb);
536: }
537:
538: void
539: tdb_firstuse(void *v)
540: {
541: struct tdb *tdb = v;
542:
543: if (!(tdb->tdb_flags & TDBF_SOFT_FIRSTUSE))
544: return;
545:
546: /* If the TDB hasn't been used, don't renew it. */
547: if (tdb->tdb_first_use != 0)
548: pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_HARD);
549: tdb_delete(tdb);
550: }
551:
552: void
553: tdb_soft_timeout(void *v)
554: {
555: struct tdb *tdb = v;
556:
557: if (!(tdb->tdb_flags & TDBF_SOFT_TIMER))
558: return;
559:
560: /* Soft expirations. */
561: pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_SOFT);
562: tdb->tdb_flags &= ~TDBF_SOFT_TIMER;
563: }
564:
565: void
566: tdb_soft_firstuse(void *v)
567: {
568: struct tdb *tdb = v;
569:
570: if (!(tdb->tdb_flags & TDBF_SOFT_FIRSTUSE))
571: return;
572:
573: /* If the TDB hasn't been used, don't renew it. */
574: if (tdb->tdb_first_use != 0)
575: pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_SOFT);
576: tdb->tdb_flags &= ~TDBF_SOFT_FIRSTUSE;
577: }
578:
579: /*
580: * Caller is responsible for spltdb().
581: */
582: void
583: tdb_rehash(void)
584: {
585: struct tdb **new_tdbh, **new_tdbaddr, **new_srcaddr, *tdbp, *tdbnp;
586: u_int i, old_hashmask = tdb_hashmask;
587: u_int32_t hashval;
588:
589: tdb_hashmask = (tdb_hashmask << 1) | 1;
590:
591: MALLOC(new_tdbh, struct tdb **,
592: sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB, M_WAITOK);
593: MALLOC(new_tdbaddr, struct tdb **,
594: sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB, M_WAITOK);
595: MALLOC(new_srcaddr, struct tdb **,
596: sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB, M_WAITOK);
597:
598: bzero(new_tdbh, sizeof(struct tdb *) * (tdb_hashmask + 1));
599: bzero(new_tdbaddr, sizeof(struct tdb *) * (tdb_hashmask + 1));
600: bzero(new_srcaddr, sizeof(struct tdb *) * (tdb_hashmask + 1));
601:
602: for (i = 0; i <= old_hashmask; i++) {
603: for (tdbp = tdbh[i]; tdbp != NULL; tdbp = tdbnp) {
604: tdbnp = tdbp->tdb_hnext;
605: hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst,
606: tdbp->tdb_sproto);
607: tdbp->tdb_hnext = new_tdbh[hashval];
608: new_tdbh[hashval] = tdbp;
609: }
610:
611: for (tdbp = tdbaddr[i]; tdbp != NULL; tdbp = tdbnp) {
612: tdbnp = tdbp->tdb_anext;
613: hashval = tdb_hash(0, &tdbp->tdb_dst,
614: tdbp->tdb_sproto);
615: tdbp->tdb_anext = new_tdbaddr[hashval];
616: new_tdbaddr[hashval] = tdbp;
617: }
618:
619: for (tdbp = tdbsrc[i]; tdbp != NULL; tdbp = tdbnp) {
620: tdbnp = tdbp->tdb_snext;
621: hashval = tdb_hash(0, &tdbp->tdb_src,
622: tdbp->tdb_sproto);
623: tdbp->tdb_snext = new_srcaddr[hashval];
624: new_srcaddr[hashval] = tdbp;
625: }
626: }
627:
628: FREE(tdbh, M_TDB);
629: tdbh = new_tdbh;
630:
631: FREE(tdbaddr, M_TDB);
632: tdbaddr = new_tdbaddr;
633:
634: FREE(tdbsrc, M_TDB);
635: tdbsrc = new_srcaddr;
636: }
637:
638: /*
639: * Add TDB in the hash table.
640: */
641: void
642: puttdb(struct tdb *tdbp)
643: {
644: u_int32_t hashval;
645: int s = spltdb();
646:
647: if (tdbh == NULL) {
648: MALLOC(tdbh, struct tdb **,
649: sizeof(struct tdb *) * (tdb_hashmask + 1),
650: M_TDB, M_WAITOK);
651: MALLOC(tdbaddr, struct tdb **,
652: sizeof(struct tdb *) * (tdb_hashmask + 1),
653: M_TDB, M_WAITOK);
654: MALLOC(tdbsrc, struct tdb **,
655: sizeof(struct tdb *) * (tdb_hashmask + 1),
656: M_TDB, M_WAITOK);
657:
658: bzero(tdbh, sizeof(struct tdb *) * (tdb_hashmask + 1));
659: bzero(tdbaddr, sizeof(struct tdb *) * (tdb_hashmask + 1));
660: bzero(tdbsrc, sizeof(struct tdb *) * (tdb_hashmask + 1));
661: }
662:
663: hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst, tdbp->tdb_sproto);
664:
665: /*
666: * Rehash if this tdb would cause a bucket to have more than
667: * two items and if the number of tdbs exceed 10% of the
668: * bucket count. This number is arbitratily chosen and is
669: * just a measure to not keep rehashing when adding and
670: * removing tdbs which happens to always end up in the same
671: * bucket, which is not uncommon when doing manual keying.
672: */
673: if (tdbh[hashval] != NULL && tdbh[hashval]->tdb_hnext != NULL &&
674: tdb_count * 10 > tdb_hashmask + 1) {
675: tdb_rehash();
676: hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst,
677: tdbp->tdb_sproto);
678: }
679:
680: tdbp->tdb_hnext = tdbh[hashval];
681: tdbh[hashval] = tdbp;
682:
683: hashval = tdb_hash(0, &tdbp->tdb_dst, tdbp->tdb_sproto);
684: tdbp->tdb_anext = tdbaddr[hashval];
685: tdbaddr[hashval] = tdbp;
686:
687: hashval = tdb_hash(0, &tdbp->tdb_src, tdbp->tdb_sproto);
688: tdbp->tdb_snext = tdbsrc[hashval];
689: tdbsrc[hashval] = tdbp;
690:
691: tdb_count++;
692:
693: ipsec_last_added = time_second;
694:
695: splx(s);
696: }
697:
698: /*
699: * Caller is responsible to set at least spltdb().
700: */
701: void
702: tdb_delete(struct tdb *tdbp)
703: {
704: struct tdb *tdbpp;
705: u_int32_t hashval;
706: int s;
707:
708: if (tdbh == NULL)
709: return;
710:
711: hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst, tdbp->tdb_sproto);
712:
713: s = spltdb();
714: if (tdbh[hashval] == tdbp) {
715: tdbpp = tdbp;
716: tdbh[hashval] = tdbp->tdb_hnext;
717: } else {
718: for (tdbpp = tdbh[hashval]; tdbpp != NULL;
719: tdbpp = tdbpp->tdb_hnext) {
720: if (tdbpp->tdb_hnext == tdbp) {
721: tdbpp->tdb_hnext = tdbp->tdb_hnext;
722: tdbpp = tdbp;
723: break;
724: }
725: }
726: }
727:
728: tdbp->tdb_hnext = NULL;
729:
730: hashval = tdb_hash(0, &tdbp->tdb_dst, tdbp->tdb_sproto);
731:
732: if (tdbaddr[hashval] == tdbp) {
733: tdbpp = tdbp;
734: tdbaddr[hashval] = tdbp->tdb_anext;
735: } else {
736: for (tdbpp = tdbaddr[hashval]; tdbpp != NULL;
737: tdbpp = tdbpp->tdb_anext) {
738: if (tdbpp->tdb_anext == tdbp) {
739: tdbpp->tdb_anext = tdbp->tdb_anext;
740: tdbpp = tdbp;
741: break;
742: }
743: }
744: }
745:
746: hashval = tdb_hash(0, &tdbp->tdb_src, tdbp->tdb_sproto);
747:
748: if (tdbsrc[hashval] == tdbp) {
749: tdbpp = tdbp;
750: tdbsrc[hashval] = tdbp->tdb_snext;
751: }
752: else {
753: for (tdbpp = tdbsrc[hashval]; tdbpp != NULL;
754: tdbpp = tdbpp->tdb_snext) {
755: if (tdbpp->tdb_snext == tdbp) {
756: tdbpp->tdb_snext = tdbp->tdb_snext;
757: tdbpp = tdbp;
758: break;
759: }
760: }
761: }
762:
763: tdbp->tdb_snext = NULL;
764: tdb_free(tdbp);
765: tdb_count--;
766:
767: splx(s);
768: }
769:
770: /*
771: * Allocate a TDB and initialize a few basic fields.
772: */
773: struct tdb *
774: tdb_alloc(void)
775: {
776: struct tdb *tdbp;
777:
778: MALLOC(tdbp, struct tdb *, sizeof(struct tdb), M_TDB, M_WAITOK);
779: bzero((caddr_t) tdbp, sizeof(struct tdb));
780:
781: /* Init Incoming SA-Binding Queues. */
782: TAILQ_INIT(&tdbp->tdb_inp_out);
783: TAILQ_INIT(&tdbp->tdb_inp_in);
784:
785: TAILQ_INIT(&tdbp->tdb_policy_head);
786:
787: /* Record establishment time. */
788: tdbp->tdb_established = time_second;
789:
790: /* Initialize timeouts. */
791: timeout_set(&tdbp->tdb_timer_tmo, tdb_timeout, tdbp);
792: timeout_set(&tdbp->tdb_first_tmo, tdb_firstuse, tdbp);
793: timeout_set(&tdbp->tdb_stimer_tmo, tdb_soft_timeout, tdbp);
794: timeout_set(&tdbp->tdb_sfirst_tmo, tdb_soft_firstuse, tdbp);
795:
796: return tdbp;
797: }
798:
799: void
800: tdb_free(struct tdb *tdbp)
801: {
802: struct ipsec_policy *ipo;
803: struct inpcb *inp;
804:
805: if (tdbp->tdb_xform) {
806: (*(tdbp->tdb_xform->xf_zeroize))(tdbp);
807: tdbp->tdb_xform = NULL;
808: }
809:
810: /* Cleanup inp references. */
811: for (inp = TAILQ_FIRST(&tdbp->tdb_inp_in); inp;
812: inp = TAILQ_FIRST(&tdbp->tdb_inp_in)) {
813: TAILQ_REMOVE(&tdbp->tdb_inp_in, inp, inp_tdb_in_next);
814: inp->inp_tdb_in = NULL;
815: }
816:
817: for (inp = TAILQ_FIRST(&tdbp->tdb_inp_out); inp;
818: inp = TAILQ_FIRST(&tdbp->tdb_inp_out)) {
819: TAILQ_REMOVE(&tdbp->tdb_inp_out, inp, inp_tdb_out_next);
820: inp->inp_tdb_out = NULL;
821: }
822:
823: /* Cleanup SPD references. */
824: for (ipo = TAILQ_FIRST(&tdbp->tdb_policy_head); ipo;
825: ipo = TAILQ_FIRST(&tdbp->tdb_policy_head)) {
826: TAILQ_REMOVE(&tdbp->tdb_policy_head, ipo, ipo_tdb_next);
827: ipo->ipo_tdb = NULL;
828: ipo->ipo_last_searched = 0; /* Force a re-search. */
829: }
830:
831: /* Remove expiration timeouts. */
832: tdbp->tdb_flags &= ~(TDBF_FIRSTUSE | TDBF_SOFT_FIRSTUSE | TDBF_TIMER |
833: TDBF_SOFT_TIMER);
834: timeout_del(&tdbp->tdb_timer_tmo);
835: timeout_del(&tdbp->tdb_first_tmo);
836: timeout_del(&tdbp->tdb_stimer_tmo);
837: timeout_del(&tdbp->tdb_sfirst_tmo);
838:
839: if (tdbp->tdb_local_auth) {
840: ipsp_reffree(tdbp->tdb_local_auth);
841: tdbp->tdb_local_auth = NULL;
842: }
843:
844: if (tdbp->tdb_remote_auth) {
845: ipsp_reffree(tdbp->tdb_remote_auth);
846: tdbp->tdb_remote_auth = NULL;
847: }
848:
849: if (tdbp->tdb_srcid) {
850: ipsp_reffree(tdbp->tdb_srcid);
851: tdbp->tdb_srcid = NULL;
852: }
853:
854: if (tdbp->tdb_dstid) {
855: ipsp_reffree(tdbp->tdb_dstid);
856: tdbp->tdb_dstid = NULL;
857: }
858:
859: if (tdbp->tdb_local_cred) {
860: ipsp_reffree(tdbp->tdb_local_cred);
861: tdbp->tdb_local_cred = NULL;
862: }
863:
864: if (tdbp->tdb_remote_cred) {
865: ipsp_reffree(tdbp->tdb_remote_cred);
866: tdbp->tdb_remote_cred = NULL;
867: }
868:
869: #if NPF > 0
870: if (tdbp->tdb_tag) {
871: pf_tag_unref(tdbp->tdb_tag);
872: tdbp->tdb_tag = 0;
873: }
874: #endif
875:
876: if ((tdbp->tdb_onext) && (tdbp->tdb_onext->tdb_inext == tdbp))
877: tdbp->tdb_onext->tdb_inext = NULL;
878:
879: if ((tdbp->tdb_inext) && (tdbp->tdb_inext->tdb_onext == tdbp))
880: tdbp->tdb_inext->tdb_onext = NULL;
881:
882: FREE(tdbp, M_TDB);
883: }
884:
885: /*
886: * Do further initializations of a TDB.
887: */
888: int
889: tdb_init(struct tdb *tdbp, u_int16_t alg, struct ipsecinit *ii)
890: {
891: struct xformsw *xsp;
892: int err;
893:
894: for (xsp = xformsw; xsp < xformswNXFORMSW; xsp++) {
895: if (xsp->xf_type == alg) {
896: err = (*(xsp->xf_init))(tdbp, xsp, ii);
897: return err;
898: }
899: }
900:
901: DPRINTF(("tdb_init(): no alg %d for spi %08x, addr %s, proto %d\n",
902: alg, ntohl(tdbp->tdb_spi), ipsp_address(tdbp->tdb_dst),
903: tdbp->tdb_sproto));
904:
905: return EINVAL;
906: }
907:
908: /*
909: * Check which transformations are required.
910: */
911: u_int8_t
912: get_sa_require(struct inpcb *inp)
913: {
914: u_int8_t sareq = 0;
915:
916: if (inp != NULL) {
917: sareq |= inp->inp_seclevel[SL_AUTH] >= IPSEC_LEVEL_USE ?
918: NOTIFY_SATYPE_AUTH : 0;
919: sareq |= inp->inp_seclevel[SL_ESP_TRANS] >= IPSEC_LEVEL_USE ?
920: NOTIFY_SATYPE_CONF : 0;
921: sareq |= inp->inp_seclevel[SL_ESP_NETWORK] >= IPSEC_LEVEL_USE ?
922: NOTIFY_SATYPE_TUNNEL : 0;
923: } else {
924: sareq |= ipsec_auth_default_level >= IPSEC_LEVEL_USE ?
925: NOTIFY_SATYPE_AUTH : 0;
926: sareq |= ipsec_esp_trans_default_level >= IPSEC_LEVEL_USE ?
927: NOTIFY_SATYPE_CONF : 0;
928: sareq |= ipsec_esp_network_default_level >= IPSEC_LEVEL_USE ?
929: NOTIFY_SATYPE_TUNNEL : 0;
930: }
931:
932: return (sareq);
933: }
934:
935: /*
936: * Add an inpcb to the list of inpcb which reference this tdb directly.
937: */
938: void
939: tdb_add_inp(struct tdb *tdb, struct inpcb *inp, int inout)
940: {
941: if (inout) {
942: if (inp->inp_tdb_in) {
943: if (inp->inp_tdb_in == tdb)
944: return;
945:
946: TAILQ_REMOVE(&inp->inp_tdb_in->tdb_inp_in, inp,
947: inp_tdb_in_next);
948: }
949:
950: inp->inp_tdb_in = tdb;
951: TAILQ_INSERT_TAIL(&tdb->tdb_inp_in, inp, inp_tdb_in_next);
952: } else {
953: if (inp->inp_tdb_out) {
954: if (inp->inp_tdb_out == tdb)
955: return;
956:
957: TAILQ_REMOVE(&inp->inp_tdb_out->tdb_inp_out, inp,
958: inp_tdb_out_next);
959: }
960:
961: inp->inp_tdb_out = tdb;
962: TAILQ_INSERT_TAIL(&tdb->tdb_inp_out, inp, inp_tdb_out_next);
963: }
964: }
965:
966: /* Return a printable string for the IPv4 address. */
967: char *
968: inet_ntoa4(struct in_addr ina)
969: {
970: static char buf[4][4 * sizeof "123" + 4];
971: unsigned char *ucp = (unsigned char *) &ina;
972: static int i = 3;
973:
974: i = (i + 1) % 4;
975: snprintf(buf[i], sizeof buf[0], "%d.%d.%d.%d",
976: ucp[0] & 0xff, ucp[1] & 0xff,
977: ucp[2] & 0xff, ucp[3] & 0xff);
978: return (buf[i]);
979: }
980:
981: /* Return a printable string for the address. */
982: char *
983: ipsp_address(union sockaddr_union sa)
984: {
985: switch (sa.sa.sa_family) {
986: #if INET
987: case AF_INET:
988: return inet_ntoa4(sa.sin.sin_addr);
989: #endif /* INET */
990:
991: #if INET6
992: case AF_INET6:
993: return ip6_sprintf(&sa.sin6.sin6_addr);
994: #endif /* INET6 */
995:
996: default:
997: return "(unknown address family)";
998: }
999: }
1000:
1001: /* Check whether an IP{4,6} address is unspecified. */
1002: int
1003: ipsp_is_unspecified(union sockaddr_union addr)
1004: {
1005: switch (addr.sa.sa_family) {
1006: #ifdef INET
1007: case AF_INET:
1008: if (addr.sin.sin_addr.s_addr == INADDR_ANY)
1009: return 1;
1010: else
1011: return 0;
1012: #endif /* INET */
1013:
1014: #ifdef INET6
1015: case AF_INET6:
1016: if (IN6_IS_ADDR_UNSPECIFIED(&addr.sin6.sin6_addr))
1017: return 1;
1018: else
1019: return 0;
1020: #endif /* INET6 */
1021:
1022: case 0: /* No family set. */
1023: default:
1024: return 1;
1025: }
1026: }
1027:
1028: /* Free reference-counted structure. */
1029: void
1030: ipsp_reffree(struct ipsec_ref *ipr)
1031: {
1032: #ifdef DIAGNOSTIC
1033: if (ipr->ref_count <= 0)
1034: printf("ipsp_reffree: illegal reference count %d for "
1035: "object %p (len = %d, malloctype = %d)\n",
1036: ipr->ref_count, ipr, ipr->ref_len, ipr->ref_malloctype);
1037: #endif
1038: if (--ipr->ref_count <= 0)
1039: FREE(ipr, ipr->ref_malloctype);
1040: }
1041:
1042: /* Mark a TDB as TDBF_SKIPCRYPTO. */
1043: void
1044: ipsp_skipcrypto_mark(struct tdb_ident *tdbi)
1045: {
1046: struct tdb *tdb;
1047: int s = spltdb();
1048:
1049: tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
1050: if (tdb != NULL) {
1051: tdb->tdb_flags |= TDBF_SKIPCRYPTO;
1052: tdb->tdb_last_marked = time_second;
1053: }
1054: splx(s);
1055: }
1056:
1057: /* Unmark a TDB as TDBF_SKIPCRYPTO. */
1058: void
1059: ipsp_skipcrypto_unmark(struct tdb_ident *tdbi)
1060: {
1061: struct tdb *tdb;
1062: int s = spltdb();
1063:
1064: tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
1065: if (tdb != NULL) {
1066: tdb->tdb_flags &= ~TDBF_SKIPCRYPTO;
1067: tdb->tdb_last_marked = time_second;
1068: }
1069: splx(s);
1070: }
1071:
1072: /* Return true if the two structures match. */
1073: int
1074: ipsp_ref_match(struct ipsec_ref *ref1, struct ipsec_ref *ref2)
1075: {
1076: if (ref1->ref_type != ref2->ref_type ||
1077: ref1->ref_len != ref2->ref_len ||
1078: bcmp(ref1 + 1, ref2 + 1, ref1->ref_len))
1079: return 0;
1080:
1081: return 1;
1082: }
1083:
1084: #ifdef notyet
1085: /*
1086: * Go down a chain of IPv4/IPv6/ESP/AH/IPiP chains creating an tag for each
1087: * IPsec header encountered. The offset where the first header, as well
1088: * as its type are given to us.
1089: */
1090: struct m_tag *
1091: ipsp_parse_headers(struct mbuf *m, int off, u_int8_t proto)
1092: {
1093: int ipv4sa = 0, s, esphlen = 0, trail = 0, i;
1094: SLIST_HEAD(packet_tags, m_tag) tags;
1095: unsigned char lasteight[8];
1096: struct tdb_ident *tdbi;
1097: struct m_tag *mtag;
1098: struct tdb *tdb;
1099:
1100: #ifdef INET
1101: struct ip iph;
1102: #endif /* INET */
1103:
1104: #ifdef INET6
1105: struct in6_addr ip6_dst;
1106: #endif /* INET6 */
1107:
1108: /* We have to start with a known network protocol. */
1109: if (proto != IPPROTO_IPV4 && proto != IPPROTO_IPV6)
1110: return NULL;
1111:
1112: SLIST_INIT(&tags);
1113:
1114: while (1) {
1115: switch (proto) {
1116: #ifdef INET
1117: case IPPROTO_IPV4: /* Also IPPROTO_IPIP */
1118: {
1119: /*
1120: * Save the IP header (we need both the
1121: * address and ip_hl).
1122: */
1123: m_copydata(m, off, sizeof(struct ip), (caddr_t) &iph);
1124: ipv4sa = 1;
1125: proto = iph.ip_p;
1126: off += iph.ip_hl << 2;
1127: break;
1128: }
1129: #endif /* INET */
1130:
1131: #ifdef INET6
1132: case IPPROTO_IPV6:
1133: {
1134: int nxtp, l;
1135:
1136: /* Copy the IPv6 address. */
1137: m_copydata(m, off + offsetof(struct ip6_hdr, ip6_dst),
1138: sizeof(struct ip6_hdr), (caddr_t) &ip6_dst);
1139: ipv4sa = 0;
1140:
1141: /*
1142: * Go down the chain of headers until we encounter a
1143: * non-option.
1144: */
1145: for (l = ip6_nexthdr(m, off, proto, &nxtp); l != -1;
1146: l = ip6_nexthdr(m, off, proto, &nxtp)) {
1147: off += l;
1148: proto = nxtp;
1149:
1150: /* Construct a tag. */
1151: if (nxtp == IPPROTO_AH) {
1152: mtag = m_tag_get(PACKET_TAG_IPSEC_IN_CRYPTO_DONE,
1153: sizeof(struct tdb_ident),
1154: M_NOWAIT);
1155:
1156: if (mtag == NULL)
1157: return SLIST_FIRST(&tags);
1158:
1159: tdbi = (struct tdb_ident *) (mtag + 1);
1160: bzero(tdbi, sizeof(struct tdb_ident));
1161:
1162: m_copydata(m, off + sizeof(u_int32_t),
1163: sizeof(u_int32_t),
1164: (caddr_t) &tdbi->spi);
1165:
1166: tdbi->proto = IPPROTO_AH;
1167: tdbi->dst.sin6.sin6_family = AF_INET6;
1168: tdbi->dst.sin6.sin6_len =
1169: sizeof(struct sockaddr_in6);
1170: tdbi->dst.sin6.sin6_addr = ip6_dst;
1171: SLIST_INSERT_HEAD(&tags,
1172: mtag, m_tag_link);
1173: }
1174: else
1175: if (nxtp == IPPROTO_IPV6)
1176: m_copydata(m, off +
1177: offsetof(struct ip6_hdr,
1178: ip6_dst),
1179: sizeof(struct ip6_hdr),
1180: (caddr_t) &ip6_dst);
1181: }
1182: break;
1183: }
1184: #endif /* INET6 */
1185:
1186: case IPPROTO_ESP:
1187: /* Verify that this has been decrypted. */
1188: {
1189: union sockaddr_union su;
1190: u_int32_t spi;
1191:
1192: m_copydata(m, off, sizeof(u_int32_t), (caddr_t) &spi);
1193: bzero(&su, sizeof(union sockaddr_union));
1194:
1195: s = spltdb();
1196:
1197: #ifdef INET
1198: if (ipv4sa) {
1199: su.sin.sin_family = AF_INET;
1200: su.sin.sin_len = sizeof(struct sockaddr_in);
1201: su.sin.sin_addr = iph.ip_dst;
1202: }
1203: #endif /* INET */
1204:
1205: #ifdef INET6
1206: if (!ipv4sa) {
1207: su.sin6.sin6_family = AF_INET6;
1208: su.sin6.sin6_len = sizeof(struct sockaddr_in6);
1209: su.sin6.sin6_addr = ip6_dst;
1210: }
1211: #endif /* INET6 */
1212:
1213: tdb = gettdb(spi, &su, IPPROTO_ESP);
1214: if (tdb == NULL) {
1215: splx(s);
1216: return SLIST_FIRST(&tags);
1217: }
1218:
1219: /* How large is the ESP header ? We use this later. */
1220: if (tdb->tdb_flags & TDBF_NOREPLAY)
1221: esphlen = sizeof(u_int32_t) + tdb->tdb_ivlen;
1222: else
1223: esphlen = 2 * sizeof(u_int32_t) +
1224: tdb->tdb_ivlen;
1225:
1226: /*
1227: * Verify decryption. If the SA is using
1228: * random padding (as the "old" ESP SAs were
1229: * bound to do, there's nothing we can do to
1230: * see if the payload has been decrypted.
1231: */
1232: if (tdb->tdb_flags & TDBF_RANDOMPADDING) {
1233: splx(s);
1234: return SLIST_FIRST(&tags);
1235: }
1236:
1237: /* Update the length of trailing ESP authenticators. */
1238: if (tdb->tdb_authalgxform)
1239: trail += AH_HMAC_HASHLEN;
1240:
1241: splx(s);
1242:
1243: /* Copy the last 10 bytes. */
1244: m_copydata(m, m->m_pkthdr.len - trail - 8, 8,
1245: lasteight);
1246:
1247: /* Verify the self-describing padding values. */
1248: if (lasteight[6] != 0) {
1249: if (lasteight[6] != lasteight[5])
1250: return SLIST_FIRST(&tags);
1251:
1252: for (i = 4; lasteight[i + 1] != 1 && i >= 0;
1253: i--)
1254: if (lasteight[i + 1] !=
1255: lasteight[i] + 1)
1256: return SLIST_FIRST(&tags);
1257: }
1258: }
1259: /* FALLTHROUGH */
1260: case IPPROTO_AH:
1261: mtag = m_tag_get(PACKET_TAG_IPSEC_IN_CRYPTO_DONE,
1262: sizeof(struct tdb_ident), M_NOWAIT);
1263: if (mtag == NULL)
1264: return SLIST_FIRST(&tags);
1265:
1266: tdbi = (struct tdb_ident *) (mtag + 1);
1267: bzero(tdbi, sizeof(struct tdb_ident));
1268:
1269: /* Get SPI off the relevant header. */
1270: if (proto == IPPROTO_AH)
1271: m_copydata(m, off + sizeof(u_int32_t),
1272: sizeof(u_int32_t), (caddr_t) &tdbi->spi);
1273: else /* IPPROTO_ESP */
1274: m_copydata(m, off, sizeof(u_int32_t),
1275: (caddr_t) &tdbi->spi);
1276:
1277: tdbi->proto = proto; /* AH or ESP */
1278:
1279: #ifdef INET
1280: /* Last network header was IPv4. */
1281: if (ipv4sa) {
1282: tdbi->dst.sin.sin_family = AF_INET;
1283: tdbi->dst.sin.sin_len =
1284: sizeof(struct sockaddr_in);
1285: tdbi->dst.sin.sin_addr = iph.ip_dst;
1286: }
1287: #endif /* INET */
1288:
1289: #ifdef INET6
1290: /* Last network header was IPv6. */
1291: if (!ipv4sa) {
1292: tdbi->dst.sin6.sin6_family = AF_INET6;
1293: tdbi->dst.sin6.sin6_len =
1294: sizeof(struct sockaddr_in6);
1295: tdbi->dst.sin6.sin6_addr = ip6_dst;
1296: }
1297: #endif /* INET6 */
1298:
1299: SLIST_INSERT_HEAD(&tags, mtag, m_tag_link);
1300:
1301: /* Update next protocol/header and header offset. */
1302: if (proto == IPPROTO_AH) {
1303: u_int8_t foo[2];
1304:
1305: m_copydata(m, off, 2 * sizeof(u_int8_t), foo);
1306: proto = foo[0];
1307: off += (foo[1] + 2) << 2;
1308: } else {/* IPPROTO_ESP */
1309: /* Initialized in IPPROTO_ESP case. */
1310: off += esphlen;
1311: proto = lasteight[7];
1312: }
1313: break;
1314:
1315: default:
1316: return SLIST_FIRST(&tags); /* We're done. */
1317: }
1318: }
1319: }
1320: #endif /* notyet */