 @@ -1,14 +1,14 @@
-/*	$NetBSD: ipsec_output.c,v 1.32 2011/02/18 16:12:26 drochner Exp $	*/
+/*	$NetBSD: ipsec_output.c,v 1.33 2011/06/06 16:48:35 drochner Exp $	*/
 /*-
  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -19,27 +19,27 @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  * $FreeBSD: /repoman/r/ncvs/src/sys/netipsec/ipsec_output.c,v 1.3.2.2 2003/03/28 20:32:53 sam Exp $
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.32 2011/02/18 16:12:26 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.33 2011/06/06 16:48:35 drochner Exp $");
 /*
  * IPsec output processing.
  */
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include "opt_ipsec.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 @@ -598,29 +598,35 @@ ipsec4_process_packet(
+	}
 	/*
 	 * Dispatch to the appropriate IPsec transform logic.  The
 	 * packet will be returned for transmission after crypto
 	 * processing, etc. are completed.  For encapsulation we
 	 * bypass this call because of the explicit call done above
 	 * (necessary to deal with IP_DF handling for IPv4).
+	 *
 	 * NB: m & sav are ``passed to caller'' who's reponsible for
 	 *     for reclaiming their resources.
 	 */
 	if (sav->tdb_xform->xf_type != XF_IP4) {
-		ip = mtod(m, struct ip *);
+		union sockaddr_union *dst = &sav->sah->saidx.dst;
-		i = ip->ip_hl << 2;
+		if (dst->sa.sa_family == AF_INET) {
-		off = offsetof(struct ip, ip_p);
+			ip = mtod(m, struct ip *);
 			i = ip->ip_hl << 2;
 			off = offsetof(struct ip, ip_p);
 		} else {
 			i = sizeof(struct ip6_hdr);
 			off = offsetof(struct ip6_hdr, ip6_nxt);
+		}
 		error = (*sav->tdb_xform->xf_output)(m, isr, NULL, i, off);
 	} else {
 		error = ipsec_process_done(m, isr);
+	}
 	splx(s);
 	return error;
 bad:
 	splx(s);
 	if (m)
 		m_freem(m);
 	return error;
+}
 #endif

 @@ -1,14 +1,14 @@
-/*	$NetBSD: key.c,v 1.71 2011/05/23 15:17:25 drochner Exp $	*/
+/*	$NetBSD: key.c,v 1.72 2011/06/06 16:48:35 drochner Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/key.c,v 1.3.2.3 2004/02/14 22:23:23 bms Exp $	*/
 /*	$KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -22,27 +22,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.71 2011/05/23 15:17:25 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.72 2011/06/06 16:48:35 drochner Exp $");
 /*
  * This code is referd to RFC 2367
  */
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include "opt_ipsec.h"
 #ifdef __NetBSD__
 #include "opt_gateway.h"
 #endif
 @@ -1932,44 +1932,26 @@ key_spdadd(struct socket *so, struct mbu
 	                &newsp->spidx);
 	/* sanity check on addr pair */
 	if (((struct sockaddr *)(src0 + 1))->sa_family !=
 			((struct sockaddr *)(dst0+ 1))->sa_family) {
 		KFREE(newsp);
 		return key_senderror(so, m, EINVAL);
+	}
 	if (((struct sockaddr *)(src0 + 1))->sa_len !=
 			((struct sockaddr *)(dst0+ 1))->sa_len) {
 		KFREE(newsp);
 		return key_senderror(so, m, EINVAL);
+	}
 #if 1
 	if (newsp->req && newsp->req->saidx.src.sa.sa_family) {
 		struct sockaddr *sa;
 		sa = (struct sockaddr *)(src0 + 1);
 		if (sa->sa_family != newsp->req->saidx.src.sa.sa_family) {
 			KFREE(newsp);
 			return key_senderror(so, m, EINVAL);
 	if (newsp->req && newsp->req->saidx.dst.sa.sa_family) {
 		struct sockaddr *sa;
 		sa = (struct sockaddr *)(dst0 + 1);
 		if (sa->sa_family != newsp->req->saidx.dst.sa.sa_family) {
 			KFREE(newsp);
 			return key_senderror(so, m, EINVAL);
 #endif
 	newsp->created = time_uptime;
 	newsp->lastused = newsp->created;
 	newsp->lifetime = lft ? lft->sadb_lifetime_addtime : 0;
 	newsp->validtime = lft ? lft->sadb_lifetime_usetime : 0;
 	newsp->refcnt = 1;	/* do not reclaim until I say I do */
 	newsp->state = IPSEC_SPSTATE_ALIVE;
 	LIST_INSERT_TAIL(&sptree[newsp->spidx.dir], newsp, secpolicy, chain);
 	/* delete the entry in spacqtree */
 	if (mhp->msg->sadb_msg_type == SADB_X_SPDUPDATE) {
 		struct secspacq *spacq;

 @@ -1,14 +1,14 @@
-/*	$NetBSD: xform_ipip.c,v 1.26 2011/02/18 20:40:58 drochner Exp $	*/
+/*	$NetBSD: xform_ipip.c,v 1.27 2011/06/06 16:48:35 drochner Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $	*/
 /*	$OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
 @@ -29,27 +29,27 @@
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.26 2011/02/18 20:40:58 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.27 2011/06/06 16:48:35 drochner Exp $");
 /*
  * IP-inside-IP processing
  */
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #include "opt_random_ip_id.h"
 #endif /* __FreeBSD__ */
 #include <sys/param.h>
 #include <sys/systm.h>
 @@ -193,27 +193,26 @@ ip4_input(struct mbuf *m, ...)
 static void
 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
+{
 	register struct sockaddr_in *sin;
 	register struct ifnet *ifp;
 	register struct ifaddr *ifa;
 	struct ifqueue *ifq = NULL;
 	struct ip *ipo;
 #ifdef INET6
 	register struct sockaddr_in6 *sin6;
 	struct ip6_hdr *ip6 = NULL;
 	u_int8_t itos;
 #endif
 	u_int8_t nxt;
 	int isr;
 	u_int8_t otos;
 	u_int8_t v;
 	int hlen;
 	IPIP_STATINC(IPIP_STAT_IPACKETS);
 	m_copydata(m, 0, 1, &v);
 	switch (v >> 4) {
 #ifdef INET
         case 4:
 		hlen = sizeof(struct ip);
 @@ -312,34 +311,32 @@ _ipip_input(struct mbuf *m, int iphlen,
+	}
 	/*
 	 * RFC 1853 specifies that the inner TTL should not be touched on
 	 * decapsulation. There's no reason this comment should be here, but
 	 * this is as good as any a position.
 	 */
 	/* Some sanity checks in the inner IP header */
 	switch (v >> 4) {
 #ifdef INET
     	case 4:
                 ipo = mtod(m, struct ip *);
                 nxt = ipo->ip_p;
 		ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos);
                 break;
 #endif /* INET */
 #ifdef INET6
     	case 6:
                 ip6 = (struct ip6_hdr *) ipo;
                 nxt = ip6->ip6_nxt;
 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 		ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
 		ip6->ip6_flow &= ~htonl(0xff << 20);
 		ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
                 break;
 #endif
 	default:
 		panic("ipip_input: unknown ip version %u (inner)", v>>4);
+	}
 	/* Check for local address spoofing. */
 	if ((m->m_pkthdr.rcvif == NULL ||
 	    !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) &&
 @@ -539,50 +536,56 @@ ipip_output(
 	case AF_INET6:
 		if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) ||
 		    saidx->src.sa.sa_family != AF_INET6 ||
 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) {
 			DPRINTF(("ipip_output: unspecified tunnel endpoint "
 			    "address in SA %s/%08lx\n",
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			IPIP_STATINC(IPIP_STAT_UNSPEC);
 			error = ENOBUFS;
 			goto bad;
+		}
-		/* scoped address handling */
+		if (tp == (IPV6_VERSION >> 4)) {
-		ip6 = mtod(m, struct ip6_hdr *);
+			/* scoped address handling */
-		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
+			ip6 = mtod(m, struct ip6_hdr *);
-			ip6->ip6_src.s6_addr16[1] = 0;
+			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
-		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
+				ip6->ip6_src.s6_addr16[1] = 0;
-			ip6->ip6_dst.s6_addr16[1] = 0;
+			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
 				ip6->ip6_dst.s6_addr16[1] = 0;
+		}
 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
 		if (m == 0) {
 			DPRINTF(("ipip_output: M_PREPEND failed\n"));
 			IPIP_STATINC(IPIP_STAT_HDROPS);
 			error = ENOBUFS;
 			goto bad;
+		}
 		/* Initialize IPv6 header */
 		ip6o = mtod(m, struct ip6_hdr *);
 		ip6o->ip6_flow = 0;
 		ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
 		ip6o->ip6_vfc |= IPV6_VERSION;
 		ip6o->ip6_plen = htons(m->m_pkthdr.len);
 		ip6o->ip6_hlim = ip_defttl;
 		ip6o->ip6_dst = saidx->dst.sin6.sin6_addr;
 		ip6o->ip6_src = saidx->src.sin6.sin6_addr;
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_dst))
 			ip6o->ip6_dst.s6_addr16[1] = htons(saidx->dst.sin6.sin6_scope_id);
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_src))
 			ip6o->ip6_src.s6_addr16[1] = htons(saidx->src.sin6.sin6_scope_id);
 #ifdef INET
 		if (tp == IPVERSION) {
 			/* Save ECN notification */
 			m_copydata(m, sizeof(struct ip6_hdr) +
 			    offsetof(struct ip, ip_tos), sizeof(u_int8_t),
 			    &itos);
 			/* This is really IPVERSION. */
 			ip6o->ip6_nxt = IPPROTO_IPIP;
 		} else
 #endif /* INET */
 			if (tp == (IPV6_VERSION >> 4)) {
 @@ -626,27 +629,27 @@ nofamily:
 #endif
 		IPIP_STATADD(IPIP_STAT_OBYTES,
 			     m->m_pkthdr.len - sizeof(struct ip));
+	}
 #endif /* INET */
 #ifdef INET6
 	if (saidx->dst.sa.sa_family == AF_INET6) {
 #if 0
 		if (sav->tdb_xform->xf_type == XF_IP4)
 			tdb->tdb_cur_bytes +=
 			    m->m_pkthdr.len - sizeof(struct ip6_hdr);
 #endif
-		IPIP_STATADD(IPIP_STAT_IBYTES,
+		IPIP_STATADD(IPIP_STAT_OBYTES,
 		    m->m_pkthdr.len - sizeof(struct ip6_hdr));
+	}
 #endif /* INET6 */
 	return 0;
 bad:
 	if (m)
 		m_freem(m);
 	*mp = NULL;
 	return (error);
+}
 #ifdef FAST_IPSEC