| 674 | |
| 675 | #ifdef INET6 |
| 676 | static void |
| 677 | ipsec6_get_ulp(const struct mbuf *m, struct secpolicyindex *spidx, |
| 678 | int needport) |
| 679 | { |
| 680 | struct tcphdr th; |
| 681 | struct udphdr uh; |
| 682 | struct icmp6_hdr ih; |
| 683 | int off, nxt; |
| 684 | |
| 685 | IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip6_hdr), |
| 686 | ("packet too short")); |
| 687 | |
| 688 | /* Set default. */ |
| 689 | spidx->ul_proto = IPSEC_ULPROTO_ANY; |
| 690 | spidx->src.sin6.sin6_port = IPSEC_PORT_ANY; |
| 691 | spidx->dst.sin6.sin6_port = IPSEC_PORT_ANY; |
| 692 | |
| 693 | nxt = -1; |
| 694 | off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt); |
| 695 | if (off < 0 || m->m_pkthdr.len < off) |
| 696 | return; |
| 697 | |
| 698 | switch (nxt) { |
| 699 | case IPPROTO_TCP: |
| 700 | spidx->ul_proto = nxt; |
| 701 | if (!needport) |
| 702 | break; |
| 703 | if (off + sizeof(struct tcphdr) > m->m_pkthdr.len) |
| 704 | break; |
| 705 | m_copydata(m, off, sizeof(th), (caddr_t)&th); |
| 706 | spidx->src.sin6.sin6_port = th.th_sport; |
| 707 | spidx->dst.sin6.sin6_port = th.th_dport; |
| 708 | break; |
| 709 | case IPPROTO_UDP: |
| 710 | spidx->ul_proto = nxt; |
| 711 | if (!needport) |
| 712 | break; |
| 713 | if (off + sizeof(struct udphdr) > m->m_pkthdr.len) |
| 714 | break; |
| 715 | m_copydata(m, off, sizeof(uh), (caddr_t)&uh); |
| 716 | spidx->src.sin6.sin6_port = uh.uh_sport; |
| 717 | spidx->dst.sin6.sin6_port = uh.uh_dport; |
| 718 | break; |
| 719 | case IPPROTO_ICMPV6: |
| 720 | spidx->ul_proto = nxt; |
| 721 | if (off + sizeof(struct icmp6_hdr) > m->m_pkthdr.len) |
| 722 | break; |
| 723 | m_copydata(m, off, sizeof(ih), (caddr_t)&ih); |
| 724 | spidx->src.sin6.sin6_port = htons((uint16_t)ih.icmp6_type); |
| 725 | spidx->dst.sin6.sin6_port = htons((uint16_t)ih.icmp6_code); |
| 726 | break; |
| 727 | default: |
| 728 | /* XXX Intermediate headers??? */ |
| 729 | spidx->ul_proto = nxt; |
| 730 | break; |
| 731 | } |
| 732 | KEYDBG(IPSEC_DUMP, |
| 733 | printf("%s: ", __func__); kdebug_secpolicyindex(spidx, NULL)); |
no test coverage detected