* IPsec output logic for IPv6. */
| 508 | * IPsec output logic for IPv6. |
| 509 | */ |
| 510 | static int |
| 511 | ipsec6_perform_request(struct mbuf *m, struct secpolicy *sp, |
| 512 | struct inpcb *inp, u_int idx) |
| 513 | { |
| 514 | struct ipsec_ctx_data ctx; |
| 515 | union sockaddr_union *dst; |
| 516 | struct secasvar *sav; |
| 517 | struct ip6_hdr *ip6; |
| 518 | int error, i, off; |
| 519 | |
| 520 | IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx)); |
| 521 | |
| 522 | sav = ipsec6_allocsa(m, sp, &idx, &error); |
| 523 | if (sav == NULL) { |
| 524 | if (error == EJUSTRETURN) { /* No IPsec required */ |
| 525 | key_freesp(&sp); |
| 526 | return (error); |
| 527 | } |
| 528 | goto bad; |
| 529 | } |
| 530 | |
| 531 | /* Fix IP length in case if it is not set yet. */ |
| 532 | ip6 = mtod(m, struct ip6_hdr *); |
| 533 | ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6)); |
| 534 | |
| 535 | IPSEC_INIT_CTX(&ctx, &m, inp, sav, AF_INET6, IPSEC_ENC_BEFORE); |
| 536 | if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0) |
| 537 | goto bad; |
| 538 | |
| 539 | ip6 = mtod(m, struct ip6_hdr *); /* pfil can change mbuf */ |
| 540 | dst = &sav->sah->saidx.dst; |
| 541 | |
| 542 | /* Do the appropriate encapsulation, if necessary */ |
| 543 | if (sp->req[idx]->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */ |
| 544 | dst->sa.sa_family != AF_INET6 || /* PF mismatch */ |
| 545 | ((dst->sa.sa_family == AF_INET6) && |
| 546 | (!IN6_IS_ADDR_UNSPECIFIED(&dst->sin6.sin6_addr)) && |
| 547 | (!in6_sa_equal_addrwithscope(&dst->sin6, &ip6->ip6_dst)))) { |
| 548 | if (m->m_pkthdr.len - sizeof(*ip6) > IPV6_MAXPACKET) { |
| 549 | /* No jumbogram support. */ |
| 550 | error = ENXIO; /*XXX*/ |
| 551 | goto bad; |
| 552 | } |
| 553 | error = ipsec_encap(&m, &sav->sah->saidx); |
| 554 | if (error != 0) { |
| 555 | DPRINTF(("%s: encapsulation for SPI 0x%08x failed " |
| 556 | "with error %d\n", __func__, ntohl(sav->spi), |
| 557 | error)); |
| 558 | /* XXXAE: IPSEC_OSTAT_INC(tunnel); */ |
| 559 | goto bad; |
| 560 | } |
| 561 | inp = NULL; |
| 562 | } |
| 563 | |
| 564 | IPSEC_INIT_CTX(&ctx, &m, inp, sav, dst->sa.sa_family, IPSEC_ENC_AFTER); |
| 565 | if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0) |
| 566 | goto bad; |
| 567 |
no test coverage detected