root/netinet/ip_ipsp.c

DEFINITIONS

1. tdb_hash
2. reserve_spi
3. gettdb
4. gettdbbysrcdst
5. ipsp_aux_match
6. gettdbbyaddr
7. gettdbbysrc
8. tdb_hashstats
9. tdb_walk
10. tdb_timeout
11. tdb_firstuse
12. tdb_soft_timeout
13. tdb_soft_firstuse
14. tdb_rehash
15. puttdb
16. tdb_delete
17. tdb_alloc
18. tdb_free
19. tdb_init
20. get_sa_require
21. tdb_add_inp
22. inet_ntoa4
23. ipsp_address
24. ipsp_is_unspecified
25. ipsp_reffree
26. ipsp_skipcrypto_mark
27. ipsp_skipcrypto_unmark
28. ipsp_ref_match
29. ipsp_parse_headers

    1 /*      $OpenBSD: ip_ipsp.c,v 1.168 2007/02/14 00:53:48 jsg Exp $       */
    2 /*
    3  * The authors of this code are John Ioannidis (ji@tla.org),
    4  * Angelos D. Keromytis (kermit@csd.uch.gr),
    5  * Niels Provos (provos@physnet.uni-hamburg.de) and
    6  * Niklas Hallqvist (niklas@appli.se).
    7  *
    8  * The original version of this code was written by John Ioannidis
    9  * for BSD/OS in Athens, Greece, in November 1995.
   10  *
   11  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
   12  * by Angelos D. Keromytis.
   13  *
   14  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
   15  * and Niels Provos.
   16  *
   17  * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist.
   18  *
   19  * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
   20  * Angelos D. Keromytis and Niels Provos.
   21  * Copyright (c) 1999 Niklas Hallqvist.
   22  * Copyright (c) 2001, Angelos D. Keromytis.
   23  *
   24  * Permission to use, copy, and modify this software with or without fee
   25  * is hereby granted, provided that this entire notice is included in
   26  * all copies of any software which is or includes a copy or
   27  * modification of this software.
   28  * You may use this code under the GNU public license if you so wish. Please
   29  * contribute changes back to the authors under this freer than GPL license
   30  * so that we may further the use of strong encryption without limitations to
   31  * all.
   32  *
   33  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
   34  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
   35  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
   36  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
   37  * PURPOSE.
   38  */
   40 #include "pf.h"
   42 #include <sys/param.h>
   43 #include <sys/mbuf.h>
   44 #include <sys/socket.h>
   45 #include <sys/kernel.h>
   46 #include <sys/sysctl.h>
   48 #include <net/if.h>
   49 #include <net/route.h>
   51 #if NPF > 0
   52 #include <net/pfvar.h>
   53 #endif
   55 #ifdef INET
   56 #include <netinet/in.h>
   57 #include <netinet/in_systm.h>
   58 #include <netinet/ip.h>
   59 #include <netinet/in_pcb.h>
   60 #endif /* INET */
   62 #ifdef INET6
   63 #ifndef INET
   64 #include <netinet/in.h>
   65 #endif
   66 #include <netinet6/in6_var.h>
   67 #endif /* INET6 */
   69 #include <netinet/ip_ipsp.h>
   70 #include <net/pfkeyv2.h>
   71 #include <crypto/xform.h>
   72 #include <dev/rndvar.h>
   74 #ifdef DDB
   75 #include <ddb/db_output.h>
   76 void tdb_hashstats(void);
   77 #endif
   79 #ifdef ENCDEBUG
   80 #define DPRINTF(x)      if (encdebug) printf x
   81 #else
   82 #define DPRINTF(x)
   83 #endif
   85 int             ipsp_kern(int, char **, int);
u_int8_t        get_sa_require(struct inpcb *);
   87 void            tdb_rehash(void);
   88 void            tdb_timeout(void *v);
   89 void            tdb_firstuse(void *v);
   90 void            tdb_soft_timeout(void *v);
   91 void            tdb_soft_firstuse(void *v);
   93 extern int      ipsec_auth_default_level;
   94 extern int      ipsec_esp_trans_default_level;
   95 extern int      ipsec_esp_network_default_level;
   96 extern int      ipsec_ipcomp_default_level;
   98 extern int encdebug;
   99 int ipsec_in_use = 0;
u_int64_t ipsec_last_added = 0;
  102 struct ipsec_policy_head ipsec_policy_head =
TAILQ_HEAD_INITIALIZER(ipsec_policy_head);
  104 struct ipsec_acquire_head ipsec_acquire_head =
TAILQ_HEAD_INITIALIZER(ipsec_acquire_head);
  107 /*
  108  * This is the proper place to define the various encapsulation transforms.
  109  */
  111 struct xformsw xformsw[] = {
  112 #ifdef IPSEC
  113         { XF_IP4,            0,               "IPv4 Simple Encapsulation",
ipe4_attach,       ipe4_init,       ipe4_zeroize,
  115           (int (*)(struct mbuf *, struct tdb *, int, int))ipe4_input,
ipip_output, },
  117         { XF_AH,         XFT_AUTH,          "IPsec AH",
ah_attach,    ah_init,   ah_zeroize,
ah_input,             ah_output, },
  120         { XF_ESP,        XFT_CONF|XFT_AUTH, "IPsec ESP",
esp_attach,   esp_init,  esp_zeroize,
esp_input,    esp_output, },
  123         { XF_IPCOMP,    XFT_COMP, "IPcomp",
ipcomp_attach,    ipcomp_init, ipcomp_zeroize,
ipcomp_input,     ipcomp_output, },
  126 #endif /* IPSEC */
  127 #ifdef TCP_SIGNATURE
  128         { XF_TCPSIGNATURE,       XFT_AUTH, "TCP MD5 Signature Option, RFC 2385",
tcp_signature_tdb_attach,     tcp_signature_tdb_init,
tcp_signature_tdb_zeroize,    tcp_signature_tdb_input,
tcp_signature_tdb_output, }
  132 #endif /* TCP_SIGNATURE */
  133 };
  135 struct xformsw *xformswNXFORMSW = &xformsw[sizeof(xformsw)/sizeof(xformsw[0])];
  137 unsigned char ipseczeroes[IPSEC_ZEROES_SIZE]; /* zeroes! */
  139 #define TDB_HASHSIZE_INIT       32
  141 static struct tdb **tdbh = NULL;
  142 static struct tdb **tdbaddr = NULL;
  143 static struct tdb **tdbsrc = NULL;
  144 static u_int tdb_hashmask = TDB_HASHSIZE_INIT - 1;
  145 static int tdb_count;
  147 /*
  148  * Our hashing function needs to stir things with a non-zero random multiplier
  149  * so we cannot be DoS-attacked via choosing of the data to hash.
  150  */
  151 int
tdb_hash(u_int32_t spi, union sockaddr_union *dst, u_int8_t proto)
  153 {
  154         static u_int32_t mult1 = 0, mult2 = 0;
u_int8_t *ptr = (u_int8_t *) dst;
  156         int i, shift;
u_int64_t hash;
  158         int val32 = 0;
  160         while (mult1 == 0)
mult1 = arc4random();
  162         while (mult2 == 0)
mult2 = arc4random();
hash = (spi ^ proto) * mult1;
  166         for (i = 0; i < SA_LEN(&dst->sa); i++) {
val32 = (val32 << 8) | ptr[i];
  168                 if (i % 4 == 3) {
hash ^= val32 * mult2;
val32 = 0;
  171                 }
  172         }
  174         if (i % 4 != 0)
hash ^= val32 * mult2;
shift = ffs(tdb_hashmask + 1);
  178         while ((hash & ~tdb_hashmask) != 0)
hash = (hash >> shift) ^ (hash & tdb_hashmask);
  181         return hash;
  182 }
  184 /*
  185  * Reserve an SPI; the SA is not valid yet though.  We use 0 as
  186  * an error return value.
  187  */
u_int32_t
reserve_spi(u_int32_t sspi, u_int32_t tspi, union sockaddr_union *src,
  190     union sockaddr_union *dst, u_int8_t sproto, int *errval)
  191 {
  192         struct tdb *tdbp;
u_int32_t spi;
  194         int nums, s;
  196         /* Don't accept ranges only encompassing reserved SPIs. */
  197         if (sproto != IPPROTO_IPCOMP &&
  198             (tspi < sspi || tspi <= SPI_RESERVED_MAX)) {
  199                 (*errval) = EINVAL;
  200                 return 0;
  201         }
  202         if (sproto == IPPROTO_IPCOMP && (tspi < sspi ||
tspi <= CPI_RESERVED_MAX ||
tspi >= CPI_PRIVATE_MIN)) {
  205                 (*errval) = EINVAL;
  206                 return 0;
  207         }
  209         /* Limit the range to not include reserved areas. */
  210         if (sspi <= SPI_RESERVED_MAX)
sspi = SPI_RESERVED_MAX + 1;
  213         /* For IPCOMP the CPI is only 16 bits long, what a good idea.... */
  215         if (sproto == IPPROTO_IPCOMP) {
u_int32_t t;
  217                 if (sspi >= 0x10000)
sspi = 0xffff;
  219                 if (tspi >= 0x10000)
tspi = 0xffff;
  221                 if (sspi > tspi) {
t = sspi; sspi = tspi; tspi = t;
  223                 }
  224         }
  226         if (sspi == tspi)   /* Asking for a specific SPI. */
nums = 1;
  228         else
nums = 100;  /* Arbitrarily chosen */
  231         while (nums--) {
  232                 if (sspi == tspi)  /* Specific SPI asked. */
spi = tspi;
  234                 else    /* Range specified */
spi = sspi + (arc4random() % (tspi - sspi));
  237                 /* Don't allocate reserved SPIs.  */
  238                 if (spi >= SPI_RESERVED_MIN && spi <= SPI_RESERVED_MAX)
  239                         continue;
  240                 else
spi = htonl(spi);
  243                 /* Check whether we're using this SPI already. */
s = spltdb();
tdbp = gettdb(spi, dst, sproto);
splx(s);
  248                 if (tdbp != (struct tdb *) NULL)
  249                         continue;
tdbp = tdb_alloc();
tdbp->tdb_spi = spi;
bcopy(&dst->sa, &tdbp->tdb_dst.sa, SA_LEN(&dst->sa));
bcopy(&src->sa, &tdbp->tdb_src.sa, SA_LEN(&src->sa));
tdbp->tdb_sproto = sproto;
tdbp->tdb_flags |= TDBF_INVALID; /* Mark SA invalid for now. */
tdbp->tdb_satype = SADB_SATYPE_UNSPEC;
puttdb(tdbp);
  261                 /* Setup a "silent" expiration (since TDBF_INVALID's set). */
  262                 if (ipsec_keep_invalid > 0) {
tdbp->tdb_flags |= TDBF_TIMER;
tdbp->tdb_exp_timeout = ipsec_keep_invalid;
timeout_add(&tdbp->tdb_timer_tmo,
hz * ipsec_keep_invalid);
  267                 }
  269                 return spi;
  270         }
  272         (*errval) = EEXIST;
  273         return 0;
  274 }
  276 /*
  277  * An IPSP SAID is really the concatenation of the SPI found in the
  278  * packet, the destination address of the packet and the IPsec protocol.
  279  * When we receive an IPSP packet, we need to look up its tunnel descriptor
  280  * block, based on the SPI in the packet and the destination address (which
  281  * is really one of our addresses if we received the packet!
  282  *
  283  * Caller is responsible for setting at least spltdb().
  284  */
  285 struct tdb *
gettdb(u_int32_t spi, union sockaddr_union *dst, u_int8_t proto)
  287 {
u_int32_t hashval;
  289         struct tdb *tdbp;
  291         if (tdbh == NULL)
  292                 return (struct tdb *) NULL;
hashval = tdb_hash(spi, dst, proto);
  296         for (tdbp = tdbh[hashval]; tdbp != NULL; tdbp = tdbp->tdb_hnext)
  297                 if ((tdbp->tdb_spi == spi) && (tdbp->tdb_sproto == proto) &&
  298                     !bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa)))
  299                         break;
  301         return tdbp;
  302 }
  304 /*
  305  * Same as gettdb() but compare SRC as well, so we
  306  * use the tdbsrc[] hash table.  Setting spi to 0
  307  * matches all SPIs.
  308  */
  309 struct tdb *
gettdbbysrcdst(u_int32_t spi, union sockaddr_union *src,
  311     union sockaddr_union *dst, u_int8_t proto)
  312 {
u_int32_t hashval;
  314         struct tdb *tdbp;
  315         union sockaddr_union su_null;
  317         if (tdbsrc == NULL)
  318                 return (struct tdb *) NULL;
hashval = tdb_hash(0, src, proto);
  322         for (tdbp = tdbsrc[hashval]; tdbp != NULL; tdbp = tdbp->tdb_snext)
  323                 if (tdbp->tdb_sproto == proto &&
  324                     (spi == 0 || tdbp->tdb_spi == spi) &&
  325                     ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
  326                     (tdbp->tdb_dst.sa.sa_family == AF_UNSPEC ||
  327                     !bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa))) &&
  328                     !bcmp(&tdbp->tdb_src, src, SA_LEN(&src->sa)))
  329                         break;
  331         if (tdbp != NULL)
  332                 return (tdbp);
bzero(&su_null, sizeof(su_null));
su_null.sa.sa_len = sizeof(struct sockaddr);
hashval = tdb_hash(0, &su_null, proto);
  338         for (tdbp = tdbsrc[hashval]; tdbp != NULL; tdbp = tdbp->tdb_snext)
  339                 if (tdbp->tdb_sproto == proto &&
  340                     (spi == 0 || tdbp->tdb_spi == spi) &&
  341                     ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
  342                     (tdbp->tdb_dst.sa.sa_family == AF_UNSPEC ||
  343                     !bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa))) &&
tdbp->tdb_src.sa.sa_family == AF_UNSPEC)
  345                         break;
  347         return (tdbp);
  348 }
  350 /*
  351  * Check that credentials and IDs match. Return true if so. The t*
  352  * range of arguments contains information from TDBs; the p*
  353  * range of arguments contains information from policies or
  354  * already established TDBs.
  355  */
  356 int
ipsp_aux_match(struct tdb *tdb,
  358     struct ipsec_ref *psrcid,
  359     struct ipsec_ref *pdstid,
  360     struct ipsec_ref *plcred,
  361     struct ipsec_ref *prcred,
  362     struct sockaddr_encap *pfilter,
  363     struct sockaddr_encap *pfiltermask)
  364 {
  365         if (psrcid != NULL)
  366                 if (tdb->tdb_srcid == NULL ||
  367                     !ipsp_ref_match(tdb->tdb_srcid, psrcid))
  368                         return 0;
  370         if (pdstid != NULL)
  371                 if (tdb->tdb_dstid == NULL ||
  372                     !ipsp_ref_match(tdb->tdb_dstid, pdstid))
  373                         return 0;
  375         if (plcred != NULL)
  376                 if (tdb->tdb_local_cred == NULL ||
  377                    !ipsp_ref_match(tdb->tdb_local_cred, plcred))
  378                         return 0;
  380         if (prcred != NULL)
  381                 if (tdb->tdb_remote_cred == NULL ||
  382                     !ipsp_ref_match(tdb->tdb_remote_cred, prcred))
  383                         return 0;
  385         /* Check for filter matches. */
  386         if (tdb->tdb_filter.sen_type) {
  387                 /*
  388                  * XXX We should really be doing a subnet-check (see
  389                  * whether the TDB-associated filter is a subset
  390                  * of the policy's. For now, an exact match will solve
  391                  * most problems (all this will do is make every
  392                  * policy get its own SAs).
  393                  */
  394                 if (bcmp(&tdb->tdb_filter, pfilter,
  395                     sizeof(struct sockaddr_encap)) ||
bcmp(&tdb->tdb_filtermask, pfiltermask,
  397                     sizeof(struct sockaddr_encap)))
  398                         return 0;
  399         }
  401         return 1;
  402 }
  404 /*
  405  * Get an SA given the remote address, the security protocol type, and
  406  * the desired IDs.
  407  */
  408 struct tdb *
gettdbbyaddr(union sockaddr_union *dst, u_int8_t sproto,
  410     struct ipsec_ref *srcid, struct ipsec_ref *dstid,
  411     struct ipsec_ref *local_cred, struct mbuf *m, int af,
  412     struct sockaddr_encap *filter, struct sockaddr_encap *filtermask)
  413 {
u_int32_t hashval;
  415         struct tdb *tdbp;
  417         if (tdbaddr == NULL)
  418                 return (struct tdb *) NULL;
hashval = tdb_hash(0, dst, sproto);
  422         for (tdbp = tdbaddr[hashval]; tdbp != NULL; tdbp = tdbp->tdb_anext)
  423                 if ((tdbp->tdb_sproto == sproto) &&
  424                     ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
  425                     (!bcmp(&tdbp->tdb_dst, dst, SA_LEN(&dst->sa)))) {
  426                         /* Do IDs and local credentials match ? */
  427                         if (!ipsp_aux_match(tdbp, srcid, dstid,
local_cred, NULL, filter, filtermask))
  429                                 continue;
  430                         break;
  431                 }
  433         return tdbp;
  434 }
  436 /*
  437  * Get an SA given the source address, the security protocol type, and
  438  * the desired IDs.
  439  */
  440 struct tdb *
gettdbbysrc(union sockaddr_union *src, u_int8_t sproto,
  442     struct ipsec_ref *srcid, struct ipsec_ref *dstid,
  443     struct mbuf *m, int af, struct sockaddr_encap *filter,
  444     struct sockaddr_encap *filtermask)
  445 {
u_int32_t hashval;
  447         struct tdb *tdbp;
  449         if (tdbsrc == NULL)
  450                 return (struct tdb *) NULL;
hashval = tdb_hash(0, src, sproto);
  454         for (tdbp = tdbsrc[hashval]; tdbp != NULL; tdbp = tdbp->tdb_snext)
  455                 if ((tdbp->tdb_sproto == sproto) &&
  456                     ((tdbp->tdb_flags & TDBF_INVALID) == 0) &&
  457                     (!bcmp(&tdbp->tdb_src, src, SA_LEN(&src->sa)))) {
  458                         /* Check whether IDs match */
  459                         if (!ipsp_aux_match(tdbp, dstid, srcid, NULL, NULL,
filter, filtermask))
  461                                 continue;
  462                         break;
  463                 }
  465         return tdbp;
  466 }
  468 #if DDB
  469 void
tdb_hashstats(void)
  471 {
  472         int i, cnt, buckets[16];
  473         struct tdb *tdbp;
  475         if (tdbh == NULL) {
db_printf("no tdb hash table\n");
  477                 return;
  478         }
bzero (buckets, sizeof(buckets));
  481         for (i = 0; i <= tdb_hashmask; i++) {
cnt = 0;
  483                 for (tdbp = tdbh[i]; cnt < 16 && tdbp != NULL;
tdbp = tdbp->tdb_hnext)
cnt++;
buckets[cnt]++;
  487         }
db_printf("tdb cnt\t\tbucket cnt\n");
  490         for (i = 0; i < 16; i++)
  491                 if (buckets[i] > 0)
db_printf("%d%c\t\t%d\n", i, i == 15 ? "+" : "",
buckets[i]);
  494 }
  495 #endif  /* DDB */
  497 /*
  498  * Caller is responsible for setting at least spltdb().
  499  */
  500 int
tdb_walk(int (*walker)(struct tdb *, void *, int), void *arg)
  502 {
  503         int i, rval = 0;
  504         struct tdb *tdbp, *next;
  506         if (tdbh == NULL)
  507                 return ENOENT;
  509         for (i = 0; i <= tdb_hashmask; i++)
  510                 for (tdbp = tdbh[i]; rval == 0 && tdbp != NULL; tdbp = next) {
next = tdbp->tdb_hnext;
  512                         if (i == tdb_hashmask && next == NULL)
rval = walker(tdbp, (void *)arg, 1);
  514                         else
rval = walker(tdbp, (void *)arg, 0);
  516                 }
  518         return rval;
  519 }
  521 /*
  522  * Called at splsoftclock().
  523  */
  524 void
tdb_timeout(void *v)
  526 {
  527         struct tdb *tdb = v;
  529         if (!(tdb->tdb_flags & TDBF_TIMER))
  530                 return;
  532         /* If it's an "invalid" TDB do a silent expiration. */
  533         if (!(tdb->tdb_flags & TDBF_INVALID))
pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_HARD);
tdb_delete(tdb);
  536 }
  538 void
tdb_firstuse(void *v)
  540 {
  541         struct tdb *tdb = v;
  543         if (!(tdb->tdb_flags & TDBF_SOFT_FIRSTUSE))
  544                 return;
  546         /* If the TDB hasn't been used, don't renew it. */
  547         if (tdb->tdb_first_use != 0)
pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_HARD);
tdb_delete(tdb);
  550 }
  552 void
tdb_soft_timeout(void *v)
  554 {
  555         struct tdb *tdb = v;
  557         if (!(tdb->tdb_flags & TDBF_SOFT_TIMER))
  558                 return;
  560         /* Soft expirations. */
pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_SOFT);
tdb->tdb_flags &= ~TDBF_SOFT_TIMER;
  563 }
  565 void
tdb_soft_firstuse(void *v)
  567 {
  568         struct tdb *tdb = v;
  570         if (!(tdb->tdb_flags & TDBF_SOFT_FIRSTUSE))
  571                 return;
  573         /* If the TDB hasn't been used, don't renew it. */
  574         if (tdb->tdb_first_use != 0)
pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_SOFT);
tdb->tdb_flags &= ~TDBF_SOFT_FIRSTUSE;
  577 }
  579 /*
  580  * Caller is responsible for spltdb().
  581  */
  582 void
tdb_rehash(void)
  584 {
  585         struct tdb **new_tdbh, **new_tdbaddr, **new_srcaddr, *tdbp, *tdbnp;
u_int i, old_hashmask = tdb_hashmask;
u_int32_t hashval;
tdb_hashmask = (tdb_hashmask << 1) | 1;
MALLOC(new_tdbh, struct tdb **,
  592             sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB, M_WAITOK);
MALLOC(new_tdbaddr, struct tdb **,
  594             sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB, M_WAITOK);
MALLOC(new_srcaddr, struct tdb **,
  596             sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB, M_WAITOK);
bzero(new_tdbh, sizeof(struct tdb *) * (tdb_hashmask + 1));
bzero(new_tdbaddr, sizeof(struct tdb *) * (tdb_hashmask + 1));
bzero(new_srcaddr, sizeof(struct tdb *) * (tdb_hashmask + 1));
  602         for (i = 0; i <= old_hashmask; i++) {
  603                 for (tdbp = tdbh[i]; tdbp != NULL; tdbp = tdbnp) {
tdbnp = tdbp->tdb_hnext;
hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst,
tdbp->tdb_sproto);
tdbp->tdb_hnext = new_tdbh[hashval];
new_tdbh[hashval] = tdbp;
  609                 }
  611                 for (tdbp = tdbaddr[i]; tdbp != NULL; tdbp = tdbnp) {
tdbnp = tdbp->tdb_anext;
hashval = tdb_hash(0, &tdbp->tdb_dst,
tdbp->tdb_sproto);
tdbp->tdb_anext = new_tdbaddr[hashval];
new_tdbaddr[hashval] = tdbp;
  617                 }
  619                 for (tdbp = tdbsrc[i]; tdbp != NULL; tdbp = tdbnp) {
tdbnp = tdbp->tdb_snext;
hashval = tdb_hash(0, &tdbp->tdb_src,
tdbp->tdb_sproto);
tdbp->tdb_snext = new_srcaddr[hashval];
new_srcaddr[hashval] = tdbp;
  625                 }
  626         }
FREE(tdbh, M_TDB);
tdbh = new_tdbh;
FREE(tdbaddr, M_TDB);
tdbaddr = new_tdbaddr;
FREE(tdbsrc, M_TDB);
tdbsrc = new_srcaddr;
  636 }
  638 /*
  639  * Add TDB in the hash table.
  640  */
  641 void
puttdb(struct tdb *tdbp)
  643 {
u_int32_t hashval;
  645         int s = spltdb();
  647         if (tdbh == NULL) {
MALLOC(tdbh, struct tdb **,
  649                     sizeof(struct tdb *) * (tdb_hashmask + 1),
M_TDB, M_WAITOK);
MALLOC(tdbaddr, struct tdb **,
  652                     sizeof(struct tdb *) * (tdb_hashmask + 1),
M_TDB, M_WAITOK);
MALLOC(tdbsrc, struct tdb **,
  655                     sizeof(struct tdb *) * (tdb_hashmask + 1),
M_TDB, M_WAITOK);
bzero(tdbh, sizeof(struct tdb *) * (tdb_hashmask + 1));
bzero(tdbaddr, sizeof(struct tdb *) * (tdb_hashmask + 1));
bzero(tdbsrc, sizeof(struct tdb *) * (tdb_hashmask + 1));
  661         }
hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst, tdbp->tdb_sproto);
  665         /*
  666          * Rehash if this tdb would cause a bucket to have more than
  667          * two items and if the number of tdbs exceed 10% of the
  668          * bucket count.  This number is arbitratily chosen and is
  669          * just a measure to not keep rehashing when adding and
  670          * removing tdbs which happens to always end up in the same
  671          * bucket, which is not uncommon when doing manual keying.
  672          */
  673         if (tdbh[hashval] != NULL && tdbh[hashval]->tdb_hnext != NULL &&
tdb_count * 10 > tdb_hashmask + 1) {
tdb_rehash();
hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst,
tdbp->tdb_sproto);
  678         }
tdbp->tdb_hnext = tdbh[hashval];
tdbh[hashval] = tdbp;
hashval = tdb_hash(0, &tdbp->tdb_dst, tdbp->tdb_sproto);
tdbp->tdb_anext = tdbaddr[hashval];
tdbaddr[hashval] = tdbp;
hashval = tdb_hash(0, &tdbp->tdb_src, tdbp->tdb_sproto);
tdbp->tdb_snext = tdbsrc[hashval];
tdbsrc[hashval] = tdbp;
tdb_count++;
ipsec_last_added = time_second;
splx(s);
  696 }
  698 /*
  699  * Caller is responsible to set at least spltdb().
  700  */
  701 void
tdb_delete(struct tdb *tdbp)
  703 {
  704         struct tdb *tdbpp;
u_int32_t hashval;
  706         int s;
  708         if (tdbh == NULL)
  709                 return;
hashval = tdb_hash(tdbp->tdb_spi, &tdbp->tdb_dst, tdbp->tdb_sproto);
s = spltdb();
  714         if (tdbh[hashval] == tdbp) {
tdbpp = tdbp;
tdbh[hashval] = tdbp->tdb_hnext;
  717         } else {
  718                 for (tdbpp = tdbh[hashval]; tdbpp != NULL;
tdbpp = tdbpp->tdb_hnext) {
  720                         if (tdbpp->tdb_hnext == tdbp) {
tdbpp->tdb_hnext = tdbp->tdb_hnext;
tdbpp = tdbp;
  723                                 break;
  724                         }
  725                 }
  726         }
tdbp->tdb_hnext = NULL;
hashval = tdb_hash(0, &tdbp->tdb_dst, tdbp->tdb_sproto);
  732         if (tdbaddr[hashval] == tdbp) {
tdbpp = tdbp;
tdbaddr[hashval] = tdbp->tdb_anext;
  735         } else {
  736                 for (tdbpp = tdbaddr[hashval]; tdbpp != NULL;
tdbpp = tdbpp->tdb_anext) {
  738                         if (tdbpp->tdb_anext == tdbp) {
tdbpp->tdb_anext = tdbp->tdb_anext;
tdbpp = tdbp;
  741                                 break;
  742                         }
  743                 }
  744         }
hashval = tdb_hash(0, &tdbp->tdb_src, tdbp->tdb_sproto);
  748         if (tdbsrc[hashval] == tdbp) {
tdbpp = tdbp;
tdbsrc[hashval] = tdbp->tdb_snext;
  751         }
  752         else {
  753                 for (tdbpp = tdbsrc[hashval]; tdbpp != NULL;
tdbpp = tdbpp->tdb_snext) {
  755                         if (tdbpp->tdb_snext == tdbp) {
tdbpp->tdb_snext = tdbp->tdb_snext;
tdbpp = tdbp;
  758                                 break;
  759                         }
  760                 }
  761         }
tdbp->tdb_snext = NULL;
tdb_free(tdbp);
tdb_count--;
splx(s);
  768 }
  770 /*
  771  * Allocate a TDB and initialize a few basic fields.
  772  */
  773 struct tdb *
tdb_alloc(void)
  775 {
  776         struct tdb *tdbp;
MALLOC(tdbp, struct tdb *, sizeof(struct tdb), M_TDB, M_WAITOK);
bzero((caddr_t) tdbp, sizeof(struct tdb));
  781         /* Init Incoming SA-Binding Queues. */
TAILQ_INIT(&tdbp->tdb_inp_out);
TAILQ_INIT(&tdbp->tdb_inp_in);
TAILQ_INIT(&tdbp->tdb_policy_head);
  787         /* Record establishment time. */
tdbp->tdb_established = time_second;
  790         /* Initialize timeouts. */
timeout_set(&tdbp->tdb_timer_tmo, tdb_timeout, tdbp);
timeout_set(&tdbp->tdb_first_tmo, tdb_firstuse, tdbp);
timeout_set(&tdbp->tdb_stimer_tmo, tdb_soft_timeout, tdbp);
timeout_set(&tdbp->tdb_sfirst_tmo, tdb_soft_firstuse, tdbp);
  796         return tdbp;
  797 }
  799 void
tdb_free(struct tdb *tdbp)
  801 {
  802         struct ipsec_policy *ipo;
  803         struct inpcb *inp;
  805         if (tdbp->tdb_xform) {
  806                 (*(tdbp->tdb_xform->xf_zeroize))(tdbp);
tdbp->tdb_xform = NULL;
  808         }
  810         /* Cleanup inp references. */
  811         for (inp = TAILQ_FIRST(&tdbp->tdb_inp_in); inp;
inp = TAILQ_FIRST(&tdbp->tdb_inp_in)) {
TAILQ_REMOVE(&tdbp->tdb_inp_in, inp, inp_tdb_in_next);
inp->inp_tdb_in = NULL;
  815         }
  817         for (inp = TAILQ_FIRST(&tdbp->tdb_inp_out); inp;
inp = TAILQ_FIRST(&tdbp->tdb_inp_out)) {
TAILQ_REMOVE(&tdbp->tdb_inp_out, inp, inp_tdb_out_next);
inp->inp_tdb_out = NULL;
  821         }
  823         /* Cleanup SPD references. */
  824         for (ipo = TAILQ_FIRST(&tdbp->tdb_policy_head); ipo;
ipo = TAILQ_FIRST(&tdbp->tdb_policy_head))  {
TAILQ_REMOVE(&tdbp->tdb_policy_head, ipo, ipo_tdb_next);
ipo->ipo_tdb = NULL;
ipo->ipo_last_searched = 0; /* Force a re-search. */
  829         }
  831         /* Remove expiration timeouts. */
tdbp->tdb_flags &= ~(TDBF_FIRSTUSE | TDBF_SOFT_FIRSTUSE | TDBF_TIMER |
TDBF_SOFT_TIMER);
timeout_del(&tdbp->tdb_timer_tmo);
timeout_del(&tdbp->tdb_first_tmo);
timeout_del(&tdbp->tdb_stimer_tmo);
timeout_del(&tdbp->tdb_sfirst_tmo);
  839         if (tdbp->tdb_local_auth) {
ipsp_reffree(tdbp->tdb_local_auth);
tdbp->tdb_local_auth = NULL;
  842         }
  844         if (tdbp->tdb_remote_auth) {
ipsp_reffree(tdbp->tdb_remote_auth);
tdbp->tdb_remote_auth = NULL;
  847         }
  849         if (tdbp->tdb_srcid) {
ipsp_reffree(tdbp->tdb_srcid);
tdbp->tdb_srcid = NULL;
  852         }
  854         if (tdbp->tdb_dstid) {
ipsp_reffree(tdbp->tdb_dstid);
tdbp->tdb_dstid = NULL;
  857         }
  859         if (tdbp->tdb_local_cred) {
ipsp_reffree(tdbp->tdb_local_cred);
tdbp->tdb_local_cred = NULL;
  862         }
  864         if (tdbp->tdb_remote_cred) {
ipsp_reffree(tdbp->tdb_remote_cred);
tdbp->tdb_remote_cred = NULL;
  867         }
  869 #if NPF > 0
  870         if (tdbp->tdb_tag) {
pf_tag_unref(tdbp->tdb_tag);
tdbp->tdb_tag = 0;
  873         }
  874 #endif
  876         if ((tdbp->tdb_onext) && (tdbp->tdb_onext->tdb_inext == tdbp))
tdbp->tdb_onext->tdb_inext = NULL;
  879         if ((tdbp->tdb_inext) && (tdbp->tdb_inext->tdb_onext == tdbp))
tdbp->tdb_inext->tdb_onext = NULL;
FREE(tdbp, M_TDB);
  883 }
  885 /*
  886  * Do further initializations of a TDB.
  887  */
  888 int
tdb_init(struct tdb *tdbp, u_int16_t alg, struct ipsecinit *ii)
  890 {
  891         struct xformsw *xsp;
  892         int err;
  894         for (xsp = xformsw; xsp < xformswNXFORMSW; xsp++) {
  895                 if (xsp->xf_type == alg) {
err = (*(xsp->xf_init))(tdbp, xsp, ii);
  897                         return err;
  898                 }
  899         }
DPRINTF(("tdb_init(): no alg %d for spi %08x, addr %s, proto %d\n",
alg, ntohl(tdbp->tdb_spi), ipsp_address(tdbp->tdb_dst),
tdbp->tdb_sproto));
  905         return EINVAL;
  906 }
  908 /*
  909  * Check which transformations are required.
  910  */
u_int8_t
get_sa_require(struct inpcb *inp)
  913 {
u_int8_t sareq = 0;
  916         if (inp != NULL) {
sareq |= inp->inp_seclevel[SL_AUTH] >= IPSEC_LEVEL_USE ?
NOTIFY_SATYPE_AUTH : 0;
sareq |= inp->inp_seclevel[SL_ESP_TRANS] >= IPSEC_LEVEL_USE ?
NOTIFY_SATYPE_CONF : 0;
sareq |= inp->inp_seclevel[SL_ESP_NETWORK] >= IPSEC_LEVEL_USE ?
NOTIFY_SATYPE_TUNNEL : 0;
  923         } else {
sareq |= ipsec_auth_default_level >= IPSEC_LEVEL_USE ?
NOTIFY_SATYPE_AUTH : 0;
sareq |= ipsec_esp_trans_default_level >= IPSEC_LEVEL_USE ?
NOTIFY_SATYPE_CONF : 0;
sareq |= ipsec_esp_network_default_level >= IPSEC_LEVEL_USE ?
NOTIFY_SATYPE_TUNNEL : 0;
  930         }
  932         return (sareq);
  933 }
  935 /*
  936  * Add an inpcb to the list of inpcb which reference this tdb directly.
  937  */
  938 void
tdb_add_inp(struct tdb *tdb, struct inpcb *inp, int inout)
  940 {
  941         if (inout) {
  942                 if (inp->inp_tdb_in) {
  943                         if (inp->inp_tdb_in == tdb)
  944                                 return;
TAILQ_REMOVE(&inp->inp_tdb_in->tdb_inp_in, inp,
inp_tdb_in_next);
  948                 }
inp->inp_tdb_in = tdb;
TAILQ_INSERT_TAIL(&tdb->tdb_inp_in, inp, inp_tdb_in_next);
  952         } else {
  953                 if (inp->inp_tdb_out) {
  954                         if (inp->inp_tdb_out == tdb)
  955                                 return;
TAILQ_REMOVE(&inp->inp_tdb_out->tdb_inp_out, inp,
inp_tdb_out_next);
  959                 }
inp->inp_tdb_out = tdb;
TAILQ_INSERT_TAIL(&tdb->tdb_inp_out, inp, inp_tdb_out_next);
  963         }
  964 }
  966 /* Return a printable string for the IPv4 address. */
  967 char *
inet_ntoa4(struct in_addr ina)
  969 {
  970         static char buf[4][4 * sizeof "123" + 4];
  971         unsigned char *ucp = (unsigned char *) &ina;
  972         static int i = 3;
i = (i + 1) % 4;
snprintf(buf[i], sizeof buf[0], "%d.%d.%d.%d",
ucp[0] & 0xff, ucp[1] & 0xff,
ucp[2] & 0xff, ucp[3] & 0xff);
  978         return (buf[i]);
  979 }
  981 /* Return a printable string for the address. */
  982 char *
ipsp_address(union sockaddr_union sa)
  984 {
  985         switch (sa.sa.sa_family) {
  986 #if INET
  987         case AF_INET:
  988                 return inet_ntoa4(sa.sin.sin_addr);
  989 #endif /* INET */
  991 #if INET6
  992         case AF_INET6:
  993                 return ip6_sprintf(&sa.sin6.sin6_addr);
  994 #endif /* INET6 */
  996         default:
  997                 return "(unknown address family)";
  998         }
  999 }
 1001 /* Check whether an IP{4,6} address is unspecified. */
 1002 int
ipsp_is_unspecified(union sockaddr_union addr)
 1004 {
 1005         switch (addr.sa.sa_family) {
 1006 #ifdef INET
 1007         case AF_INET:
 1008                 if (addr.sin.sin_addr.s_addr == INADDR_ANY)
 1009                         return 1;
 1010                 else
 1011                         return 0;
 1012 #endif /* INET */
 1014 #ifdef INET6
 1015         case AF_INET6:
 1016                 if (IN6_IS_ADDR_UNSPECIFIED(&addr.sin6.sin6_addr))
 1017                         return 1;
 1018                 else
 1019                         return 0;
 1020 #endif /* INET6 */
 1022         case 0: /* No family set. */
 1023         default:
 1024                 return 1;
 1025         }
 1026 }
 1028 /* Free reference-counted structure. */
 1029 void
ipsp_reffree(struct ipsec_ref *ipr)
 1031 {
 1032 #ifdef DIAGNOSTIC
 1033         if (ipr->ref_count <= 0)
printf("ipsp_reffree: illegal reference count %d for "
 1035                     "object %p (len = %d, malloctype = %d)\n",
ipr->ref_count, ipr, ipr->ref_len, ipr->ref_malloctype);
 1037 #endif
 1038         if (--ipr->ref_count <= 0)
FREE(ipr, ipr->ref_malloctype);
 1040 }
 1042 /* Mark a TDB as TDBF_SKIPCRYPTO. */
 1043 void
ipsp_skipcrypto_mark(struct tdb_ident *tdbi)
 1045 {
 1046         struct tdb *tdb;
 1047         int s = spltdb();
tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
 1050         if (tdb != NULL) {
tdb->tdb_flags |= TDBF_SKIPCRYPTO;
tdb->tdb_last_marked = time_second;
 1053         }
splx(s);
 1055 }
 1057 /* Unmark a TDB as TDBF_SKIPCRYPTO. */
 1058 void
ipsp_skipcrypto_unmark(struct tdb_ident *tdbi)
 1060 {
 1061         struct tdb *tdb;
 1062         int s = spltdb();
tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
 1065         if (tdb != NULL) {
tdb->tdb_flags &= ~TDBF_SKIPCRYPTO;
tdb->tdb_last_marked = time_second;
 1068         }
splx(s);
 1070 }
 1072 /* Return true if the two structures match. */
 1073 int
ipsp_ref_match(struct ipsec_ref *ref1, struct ipsec_ref *ref2)
 1075 {
 1076         if (ref1->ref_type != ref2->ref_type ||
ref1->ref_len != ref2->ref_len ||
bcmp(ref1 + 1, ref2 + 1, ref1->ref_len))
 1079                 return 0;
 1081         return 1;
 1082 }
 1084 #ifdef notyet
 1085 /*
 1086  * Go down a chain of IPv4/IPv6/ESP/AH/IPiP chains creating an tag for each
 1087  * IPsec header encountered. The offset where the first header, as well
 1088  * as its type are given to us.
 1089  */
 1090 struct m_tag *
ipsp_parse_headers(struct mbuf *m, int off, u_int8_t proto)
 1092 {
 1093         int ipv4sa = 0, s, esphlen = 0, trail = 0, i;
SLIST_HEAD(packet_tags, m_tag) tags;
 1095         unsigned char lasteight[8];
 1096         struct tdb_ident *tdbi;
 1097         struct m_tag *mtag;
 1098         struct tdb *tdb;
 1100 #ifdef INET
 1101         struct ip iph;
 1102 #endif /* INET */
 1104 #ifdef INET6
 1105         struct in6_addr ip6_dst;
 1106 #endif /* INET6 */
 1108         /* We have to start with a known network protocol. */
 1109         if (proto != IPPROTO_IPV4 && proto != IPPROTO_IPV6)
 1110                 return NULL;
SLIST_INIT(&tags);
 1114         while (1) {
 1115                 switch (proto) {
 1116 #ifdef INET
 1117                 case IPPROTO_IPV4: /* Also IPPROTO_IPIP */
 1118                 {
 1119                         /*
 1120                          * Save the IP header (we need both the
 1121                          * address and ip_hl).
 1122                          */
m_copydata(m, off, sizeof(struct ip), (caddr_t) &iph);
ipv4sa = 1;
proto = iph.ip_p;
off += iph.ip_hl << 2;
 1127                         break;
 1128                 }
 1129 #endif /* INET */
 1131 #ifdef INET6
 1132                 case IPPROTO_IPV6:
 1133                 {
 1134                         int nxtp, l;
 1136                         /* Copy the IPv6 address. */
m_copydata(m, off + offsetof(struct ip6_hdr, ip6_dst),
 1138                             sizeof(struct ip6_hdr), (caddr_t) &ip6_dst);
ipv4sa = 0;
 1141                         /*
 1142                          * Go down the chain of headers until we encounter a
 1143                          * non-option.
 1144                          */
 1145                         for (l = ip6_nexthdr(m, off, proto, &nxtp); l != -1;
l = ip6_nexthdr(m, off, proto, &nxtp)) {
off += l;
proto = nxtp;
 1150                                 /* Construct a tag. */
 1151                                 if (nxtp == IPPROTO_AH) {
mtag = m_tag_get(PACKET_TAG_IPSEC_IN_CRYPTO_DONE,
 1153                                             sizeof(struct tdb_ident),
M_NOWAIT);
 1156                                         if (mtag == NULL)
 1157                                                 return SLIST_FIRST(&tags);
tdbi = (struct tdb_ident *) (mtag + 1);
bzero(tdbi, sizeof(struct tdb_ident));
m_copydata(m, off + sizeof(u_int32_t),
 1163                                             sizeof(u_int32_t),
 1164                                             (caddr_t) &tdbi->spi);
tdbi->proto = IPPROTO_AH;
tdbi->dst.sin6.sin6_family = AF_INET6;
tdbi->dst.sin6.sin6_len =
 1169                                             sizeof(struct sockaddr_in6);
tdbi->dst.sin6.sin6_addr = ip6_dst;
SLIST_INSERT_HEAD(&tags,
mtag, m_tag_link);
 1173                                 }
 1174                                 else
 1175                                         if (nxtp == IPPROTO_IPV6)
m_copydata(m, off +
offsetof(struct ip6_hdr,
ip6_dst),
 1179                                                     sizeof(struct ip6_hdr),
 1180                                                     (caddr_t) &ip6_dst);
 1181                         }
 1182                         break;
 1183                 }
 1184 #endif /* INET6 */
 1186                 case IPPROTO_ESP:
 1187                 /* Verify that this has been decrypted. */
 1188                 {
 1189                         union sockaddr_union su;
u_int32_t spi;
m_copydata(m, off, sizeof(u_int32_t), (caddr_t) &spi);
bzero(&su, sizeof(union sockaddr_union));
s = spltdb();
 1197 #ifdef INET
 1198                         if (ipv4sa) {
su.sin.sin_family = AF_INET;
su.sin.sin_len = sizeof(struct sockaddr_in);
su.sin.sin_addr = iph.ip_dst;
 1202                         }
 1203 #endif /* INET */
 1205 #ifdef INET6
 1206                         if (!ipv4sa) {
su.sin6.sin6_family = AF_INET6;
su.sin6.sin6_len = sizeof(struct sockaddr_in6);
su.sin6.sin6_addr = ip6_dst;
 1210                         }
 1211 #endif /* INET6 */
tdb = gettdb(spi, &su, IPPROTO_ESP);
 1214                         if (tdb == NULL) {
splx(s);
 1216                                 return SLIST_FIRST(&tags);
 1217                         }
 1219                         /* How large is the ESP header ? We use this later. */
 1220                         if (tdb->tdb_flags & TDBF_NOREPLAY)
esphlen = sizeof(u_int32_t) + tdb->tdb_ivlen;
 1222                         else
esphlen = 2 * sizeof(u_int32_t) +
tdb->tdb_ivlen;
 1226                         /*
 1227                          * Verify decryption. If the SA is using
 1228                          * random padding (as the "old" ESP SAs were
 1229                          * bound to do, there's nothing we can do to
 1230                          * see if the payload has been decrypted.
 1231                          */
 1232                         if (tdb->tdb_flags & TDBF_RANDOMPADDING) {
splx(s);
 1234                                 return SLIST_FIRST(&tags);
 1235                         }
 1237                         /* Update the length of trailing ESP authenticators. */
 1238                         if (tdb->tdb_authalgxform)
trail += AH_HMAC_HASHLEN;
splx(s);
 1243                         /* Copy the last 10 bytes. */
m_copydata(m, m->m_pkthdr.len - trail - 8, 8,
lasteight);
 1247                         /* Verify the self-describing padding values. */
 1248                         if (lasteight[6] != 0) {
 1249                                 if (lasteight[6] != lasteight[5])
 1250                                         return SLIST_FIRST(&tags);
 1252                                 for (i = 4; lasteight[i + 1] != 1 && i >= 0;
i--)
 1254                                         if (lasteight[i + 1] !=
lasteight[i] + 1)
 1256                                                 return SLIST_FIRST(&tags);
 1257                         }
 1258                 }
 1259                 /* FALLTHROUGH */
 1260                 case IPPROTO_AH:
mtag = m_tag_get(PACKET_TAG_IPSEC_IN_CRYPTO_DONE,
 1262                             sizeof(struct tdb_ident), M_NOWAIT);
 1263                         if (mtag == NULL)
 1264                                 return SLIST_FIRST(&tags);
tdbi = (struct tdb_ident *) (mtag + 1);
bzero(tdbi, sizeof(struct tdb_ident));
 1269                         /* Get SPI off the relevant header. */
 1270                         if (proto == IPPROTO_AH)
m_copydata(m, off + sizeof(u_int32_t),
 1272                                     sizeof(u_int32_t), (caddr_t) &tdbi->spi);
 1273                         else /* IPPROTO_ESP */
m_copydata(m, off, sizeof(u_int32_t),
 1275                                     (caddr_t) &tdbi->spi);
tdbi->proto = proto; /* AH or ESP */
 1279 #ifdef INET
 1280                         /* Last network header was IPv4. */
 1281                         if (ipv4sa) {
tdbi->dst.sin.sin_family = AF_INET;
tdbi->dst.sin.sin_len =
 1284                                     sizeof(struct sockaddr_in);
tdbi->dst.sin.sin_addr = iph.ip_dst;
 1286                         }
 1287 #endif /* INET */
 1289 #ifdef INET6
 1290                         /* Last network header was IPv6. */
 1291                         if (!ipv4sa) {
tdbi->dst.sin6.sin6_family = AF_INET6;
tdbi->dst.sin6.sin6_len =
 1294                                     sizeof(struct sockaddr_in6);
tdbi->dst.sin6.sin6_addr = ip6_dst;
 1296                         }
 1297 #endif /* INET6 */
SLIST_INSERT_HEAD(&tags, mtag, m_tag_link);
 1301                         /* Update next protocol/header and header offset. */
 1302                         if (proto == IPPROTO_AH) {
u_int8_t foo[2];
m_copydata(m, off, 2 * sizeof(u_int8_t), foo);
proto = foo[0];
off += (foo[1] + 2) << 2;
 1308                         } else {/* IPPROTO_ESP */
 1309                                 /* Initialized in IPPROTO_ESP case. */
off += esphlen;
proto = lasteight[7];
 1312                         }
 1313                         break;
 1315                 default:
 1316                         return SLIST_FIRST(&tags); /* We're done. */
 1317                 }
 1318         }
 1319 }
 1320 #endif /* notyet */