 @@ -1,1372 +1,1365 @@
-/*	$NetBSD: xform_ah.c,v 1.37.6.3 2018/02/15 16:50:01 martin Exp $	*/
+/*	$NetBSD: xform_ah.c,v 1.37.6.4 2018/03/13 17:18:12 snj Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/xform_ah.c,v 1.1.4.1 2003/01/24 05:11:36 sam Exp $	*/
 /*	$OpenBSD: ip_ah.c,v 1.63 2001/06/26 06:18:58 angelos Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
+ *
  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  * and Niels Provos.
+ *
  * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist.
+ *
  * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
  * Angelos D. Keromytis and Niels Provos.
  * Copyright (c) 1999 Niklas Hallqvist.
  * Copyright (c) 2001 Angelos D. Keromytis.
+ *
  * Permission to use, copy, and modify this software with or without fee
  * is hereby granted, provided that this entire notice is included in
  * all copies of any software which is or includes a copy or
  * modification of this software.
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_ah.c,v 1.37.6.3 2018/02/15 16:50:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_ah.c,v 1.37.6.4 2018/03/13 17:18:12 snj Exp $");
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/syslog.h>
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
 #include <sys/socketvar.h> /* for softnet_lock */
 #include <net/if.h>
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/ip_ecn.h>
 #include <netinet/ip6.h>
 #include <net/route.h>
 #include <netipsec/ipsec.h>
 #include <netipsec/ipsec_private.h>
 #include <netipsec/ah.h>
 #include <netipsec/ah_var.h>
 #include <netipsec/xform.h>
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #include <netinet6/scope6_var.h>
 #include <netipsec/ipsec6.h>
 #  ifdef __FreeBSD__
 #  include <netinet6/ip6_ecn.h>
 #  endif
 #endif
 #include <netipsec/key.h>
 #include <netipsec/key_debug.h>
 #include <netipsec/ipsec_osdep.h>
 #include <opencrypto/cryptodev.h>
 /*
  * Return header size in bytes.  The old protocol did not support
  * the replay counter; the new protocol always includes the counter.
  */
 #define HDRSIZE(sav) \
 	(((sav)->flags & SADB_X_EXT_OLD) ? \
 		sizeof (struct ah) : sizeof (struct ah) + sizeof (u_int32_t))
 /*
  * Return authenticator size in bytes.  The old protocol is known
  * to use a fixed 16-byte authenticator.  The new algorithm gets
  * this size from the xform but is (currently) always 12.
  */
 #define	AUTHSIZE(sav) \
 	((sav->flags & SADB_X_EXT_OLD) ? 16 : (sav)->tdb_authalgxform->authsize)
 percpu_t *ahstat_percpu;
 int	ah_enable = 1;			/* control flow of packets with AH */
 int	ip4_ah_cleartos = 1;		/* clear ip_tos when doing AH calc */
 #ifdef __FreeBSD__
 SYSCTL_DECL(_net_inet_ah);
 SYSCTL_INT(_net_inet_ah, OID_AUTO,
 	ah_enable,	CTLFLAG_RW,	&ah_enable,	0, "");
 SYSCTL_INT(_net_inet_ah, OID_AUTO,
 	ah_cleartos,	CTLFLAG_RW,	&ip4_ah_cleartos,	0, "");
 SYSCTL_STRUCT(_net_inet_ah, IPSECCTL_STATS,
 	stats,		CTLFLAG_RD,	&ahstat,	ahstat, "");
 #endif /* __FreeBSD__ */
 static unsigned char ipseczeroes[256];	/* larger than an ip6 extension hdr */
 static int ah_input_cb(struct cryptop*);
 static int ah_output_cb(struct cryptop*);
 /*
  * NB: this is public for use by the PF_KEY support.
  */
 const struct auth_hash *
 ah_algorithm_lookup(int alg)
+{
 	if (alg >= AH_ALG_MAX)
 		return NULL;
 	switch (alg) {
 	case SADB_X_AALG_NULL:
 		return &auth_hash_null;
 	case SADB_AALG_MD5HMAC:
 		return &auth_hash_hmac_md5_96;
 	case SADB_AALG_SHA1HMAC:
 		return &auth_hash_hmac_sha1_96;
 	case SADB_X_AALG_RIPEMD160HMAC:
 		return &auth_hash_hmac_ripemd_160_96;
 	case SADB_X_AALG_MD5:
 		return &auth_hash_key_md5;
 	case SADB_X_AALG_SHA:
 		return &auth_hash_key_sha1;
 	case SADB_X_AALG_SHA2_256:
 		return &auth_hash_hmac_sha2_256;
 	case SADB_X_AALG_SHA2_384:
 		return &auth_hash_hmac_sha2_384;
 	case SADB_X_AALG_SHA2_512:
 		return &auth_hash_hmac_sha2_512;
 	case SADB_X_AALG_AES_XCBC_MAC:
 		return &auth_hash_aes_xcbc_mac_96;
+	}
 	return NULL;
+}
 size_t
 ah_hdrsiz(const struct secasvar *sav)
+{
 	size_t size;
 	if (sav != NULL) {
 		int authsize;
 		IPSEC_ASSERT(sav->tdb_authalgxform != NULL,
 			("ah_hdrsiz: null xform"));
 		/*XXX not right for null algorithm--does it matter??*/
 		authsize = AUTHSIZE(sav);
 		size = roundup(authsize, sizeof (u_int32_t)) + HDRSIZE(sav);
 	} else {
 		/* default guess */
 		size = sizeof (struct ah) + sizeof (u_int32_t) + 16;
+	}
 	return size;
+}
 /*
  * NB: public for use by esp_init.
  */
 int
 ah_init0(struct secasvar *sav, const struct xformsw *xsp,
 	 struct cryptoini *cria)
+{
 	const struct auth_hash *thash;
 	int keylen;
 	thash = ah_algorithm_lookup(sav->alg_auth);
 	if (thash == NULL) {
 		DPRINTF(("ah_init: unsupported authentication algorithm %u\n",
 			sav->alg_auth));
 		return EINVAL;
+	}
 	/*
 	 * Verify the replay state block allocation is consistent with
 	 * the protocol type.  We check here so we can make assumptions
 	 * later during protocol processing.
 	 */
 	/* NB: replay state is setup elsewhere (sigh) */
 	if (((sav->flags&SADB_X_EXT_OLD) == 0) ^ (sav->replay != NULL)) {
 		DPRINTF(("ah_init: replay state block inconsistency, "
 			"%s algorithm %s replay state\n",
 			(sav->flags & SADB_X_EXT_OLD) ? "old" : "new",
 			sav->replay == NULL ? "without" : "with"));
 		return EINVAL;
+	}
 	if (sav->key_auth == NULL) {
 		DPRINTF(("ah_init: no authentication key for %s "
 			"algorithm\n", thash->name));
 		return EINVAL;
+	}
 	keylen = _KEYLEN(sav->key_auth);
 	if (keylen != thash->keysize && thash->keysize != 0) {
 		DPRINTF(("ah_init: invalid keylength %d, algorithm "
 			 "%s requires keysize %d\n",
 			 keylen, thash->name, thash->keysize));
 		return EINVAL;
+	}
 	sav->tdb_xform = xsp;
 	sav->tdb_authalgxform = thash;
 	/* Initialize crypto session. */
 	memset(cria, 0, sizeof (*cria));
 	cria->cri_alg = sav->tdb_authalgxform->type;
 	cria->cri_klen = _KEYBITS(sav->key_auth);
 	cria->cri_key = _KEYBUF(sav->key_auth);
 	return 0;
+}
 /*
  * ah_init() is called when an SPI is being set up.
  */
 static int
 ah_init(struct secasvar *sav, const struct xformsw *xsp)
+{
 	struct cryptoini cria;
 	int error;
 	error = ah_init0(sav, xsp, &cria);
 	if (!error)
 		error = crypto_newsession(&sav->tdb_cryptoid,
 					   &cria, crypto_support);
 	return error;
+}
 /*
  * Paranoia.
+ *
  * NB: public for use by esp_zeroize (XXX).
  */
 int
 ah_zeroize(struct secasvar *sav)
+{
 	int err;
 	if (sav->key_auth)
 		memset(_KEYBUF(sav->key_auth), 0, _KEYLEN(sav->key_auth));
 	err = crypto_freesession(sav->tdb_cryptoid);
 	sav->tdb_cryptoid = 0;
 	sav->tdb_authalgxform = NULL;
 	sav->tdb_xform = NULL;
 	return err;
+}
 /*
  * Massage IPv4/IPv6 headers for AH processing.
  */
 static int
 ah_massage_headers(struct mbuf **m0, int proto, int skip, int alg, int out)
+{
 	struct mbuf *m = *m0;
 	unsigned char *ptr;
 	int off, count;
 #ifdef INET
 	struct ip *ip;
 #endif /* INET */
 #ifdef INET6
 	struct ip6_ext *ip6e;
 	struct ip6_hdr ip6;
 	int alloc, ad, nxt;
 #endif /* INET6 */
 	switch (proto) {
 #ifdef INET
 	case AF_INET:
 		/*
 		 * This is the least painful way of dealing with IPv4 header
 		 * and option processing -- just make sure they're in
 		 * contiguous memory.
 		 */
 		*m0 = m = m_pullup(m, skip);
 		if (m == NULL) {
 			DPRINTF(("ah_massage_headers: m_pullup failed\n"));
 			return ENOBUFS;
+		}
 		/* Fix the IP header */
 		ip = mtod(m, struct ip *);
 		if (ip4_ah_cleartos)
 			ip->ip_tos = 0;
 		ip->ip_ttl = 0;
 		ip->ip_sum = 0;
 		ip->ip_off = htons(ntohs(ip->ip_off) & ip4_ah_offsetmask);
 		/*
 		 * On FreeBSD, ip_off and ip_len assumed in host endian;
 		 * they are converted (if necessary) by ip_input().
 		 * On NetBSD, ip_off and ip_len are in network byte order.
 		 * They must be massaged back to network byte order
 		 * before verifying the  HMAC. Moreover, on FreeBSD,
 		 * we should add `skip' back into the massaged ip_len
 		 * (presumably ip_input() deducted it before we got here?)
 		 * whereas on NetBSD, we should not.
 		 */
 #ifdef __FreeBSD__
   #define TOHOST(x) (x)
 #else
   #define TOHOST(x) (ntohs(x))
 #endif
 		if (!out) {
 			u_int16_t inlen = TOHOST(ip->ip_len);
 #ifdef __FreeBSD__
 			ip->ip_len = htons(inlen + skip);
 #else  /*!__FreeBSD__ */
 			ip->ip_len = htons(inlen);
 #endif /*!__FreeBSD__ */
 			if (alg == CRYPTO_MD5_KPDK || alg == CRYPTO_SHA1_KPDK)
 				ip->ip_off  &= IP_OFF_CONVERT(IP_DF);
 			else
 				ip->ip_off = 0;
 		} else {
 			if (alg == CRYPTO_MD5_KPDK || alg == CRYPTO_SHA1_KPDK)
 				ip->ip_off &= IP_OFF_CONVERT(IP_DF);
 			else
 				ip->ip_off = 0;
+		}
 		ptr = mtod(m, unsigned char *);
 		/* IPv4 option processing */
 		for (off = sizeof(struct ip); off < skip;) {
 			if (ptr[off] == IPOPT_EOL || ptr[off] == IPOPT_NOP ||
 			    off + 1 < skip)
+				;
 			else {
 				DPRINTF(("ah_massage_headers: illegal IPv4 "
 				    "option length for option %d\n",
 				    ptr[off]));
 				m_freem(m);
 				return EINVAL;
+			}
 			switch (ptr[off]) {
 			case IPOPT_EOL:
 				off = skip;  /* End the loop. */
 				break;
 			case IPOPT_NOP:
 				off++;
 				break;
 			case IPOPT_SECURITY:	/* 0x82 */
 			case 0x85:	/* Extended security. */
 			case 0x86:	/* Commercial security. */
 			case 0x94:	/* Router alert */
 			case 0x95:	/* RFC1770 */
 				/* Sanity check for option length. */
 				if (ptr[off + 1] < 2) {
 					DPRINTF(("ah_massage_headers: "
 					    "illegal IPv4 option length for "
 					    "option %d\n", ptr[off]));
 					m_freem(m);
 					return EINVAL;
+				}
 				off += ptr[off + 1];
 				break;
 			case IPOPT_LSRR:
 			case IPOPT_SSRR:
 				/* Sanity check for option length. */
 				if (ptr[off + 1] < 2) {
 					DPRINTF(("ah_massage_headers: "
 					    "illegal IPv4 option length for "
 					    "option %d\n", ptr[off]));
 					m_freem(m);
 					return EINVAL;
+				}
 				/*
 				 * On output, if we have either of the
 				 * source routing options, we should
 				 * swap the destination address of the
 				 * IP header with the last address
 				 * specified in the option, as that is
 				 * what the destination's IP header
 				 * will look like.
 				 */
 				if (out)
 					bcopy(ptr + off + ptr[off + 1] -
 					    sizeof(struct in_addr),
 					    &(ip->ip_dst), sizeof(struct in_addr));
 				/* Fall through */
 			default:
 				/* Sanity check for option length. */
 				if (ptr[off + 1] < 2) {
 					DPRINTF(("ah_massage_headers: "
 					    "illegal IPv4 option length for "
 					    "option %d\n", ptr[off]));
 					m_freem(m);
 					return EINVAL;
+				}
 				/* Zeroize all other options. */
 				count = ptr[off + 1];
 				memcpy(ptr + off, ipseczeroes, count);
 				off += count;
 				break;
+			}
 			/* Sanity check. */
 			if (off > skip)	{
 				DPRINTF(("ah_massage_headers(): malformed "
 				    "IPv4 options header\n"));
 				m_freem(m);
 				return EINVAL;
+			}
+		}
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:  /* Ugly... */
 		/* Copy and "cook" the IPv6 header. */
 		m_copydata(m, 0, sizeof(ip6), &ip6);
 		/* We don't do IPv6 Jumbograms. */
 		if (ip6.ip6_plen == 0) {
 			DPRINTF(("ah_massage_headers: unsupported IPv6 jumbogram\n"));
 			m_freem(m);
 			return EMSGSIZE;
+		}
 		ip6.ip6_flow = 0;
 		ip6.ip6_hlim = 0;
 		ip6.ip6_vfc &= ~IPV6_VERSION_MASK;
 		ip6.ip6_vfc |= IPV6_VERSION;
 		/* Scoped address handling. */
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6.ip6_src))
 			ip6.ip6_src.s6_addr16[1] = 0;
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6.ip6_dst))
 			ip6.ip6_dst.s6_addr16[1] = 0;
 		/* Done with IPv6 header. */
 		m_copyback(m, 0, sizeof(struct ip6_hdr), &ip6);
 		/* Let's deal with the remaining headers (if any). */
 		if (skip - sizeof(struct ip6_hdr) > 0) {
 			if (m->m_len <= skip) {
 				ptr = (unsigned char *) malloc(
 				    skip - sizeof(struct ip6_hdr),
 				    M_XDATA, M_NOWAIT);
 				if (ptr == NULL) {
 					DPRINTF(("ah_massage_headers: failed "
 					    "to allocate memory for IPv6 "
 					    "headers\n"));
 					m_freem(m);
 					return ENOBUFS;
+				}
 				/*
 				 * Copy all the protocol headers after
 				 * the IPv6 header.
 				 */
 				m_copydata(m, sizeof(struct ip6_hdr),
 				    skip - sizeof(struct ip6_hdr), ptr);
 				alloc = 1;
 			} else {
 				/* No need to allocate memory. */
 				ptr = mtod(m, unsigned char *) +
 				    sizeof(struct ip6_hdr);
 				alloc = 0;
+			}
 		} else
 			break;
 		nxt = ip6.ip6_nxt & 0xff; /* Next header type. */
-		for (off = 0; off < skip - sizeof(struct ip6_hdr);)
+		for (off = 0; off < skip - sizeof(struct ip6_hdr);) {
 			int noff;
 			switch (nxt) {
 			case IPPROTO_HOPOPTS:
 			case IPPROTO_DSTOPTS:
-				ip6e = (struct ip6_ext *) (ptr + off);
+				ip6e = (struct ip6_ext *)(ptr + off);
 				noff = off + ((ip6e->ip6e_len + 1) << 3);
 				/* Sanity check. */
 				if (noff > skip - sizeof(struct ip6_hdr)) {
 					goto error6;
+				}
 				/*
-				 * Process the mutable/immutable
+				 * Zero out mutable options.
 				 * options -- borrows heavily from the
 				 * KAME code.
 				 */
 				for (count = off + sizeof(struct ip6_ext);
-				     count < off + ((ip6e->ip6e_len + 1) << 3);) {
+				     count < noff;) {
 					if (ptr[count] == IP6OPT_PAD1) {
 						count++;
-						continue; /* Skip padding. */
+						continue;
 					/* Sanity check. */
 					if (count > off +
 					    ((ip6e->ip6e_len + 1) << 3)) {
 						m_freem(m);
 						/* Free, if we allocated. */
 						if (alloc)
 							free(ptr, M_XDATA);
 						return EINVAL;
+					}
 					ad = ptr[count + 1] + 2;
-					/* If mutable option, zeroize. */
+					if (count + ad > noff) {
-					if (ptr[count] & IP6OPT_MUTABLE)
+						goto error6;
 						memcpy(ptr + count, ipseczeroes,
 						    ad);
 					if (ptr[count] & IP6OPT_MUTABLE) {
 						memset(ptr + count, 0, ad);
+					}
 					count += ad;
+				}
-					/* Sanity check. */
+				if (count != noff) {
-					if (count >
+					goto error6;
 					    skip - sizeof(struct ip6_hdr)) {
 						m_freem(m);
 						/* Free, if we allocated. */
 						if (alloc)
 							free(ptr, M_XDATA);
 						return EINVAL;
+				}
 				/* Advance. */
 				off += ((ip6e->ip6e_len + 1) << 3);
 				nxt = ip6e->ip6e_nxt;
 				break;
 			case IPPROTO_ROUTING:
 				/*
 				 * Always include routing headers in
 				 * computation.
 				 */
+				{
 					struct ip6_rthdr *rh;
 					ip6e = (struct ip6_ext *) (ptr + off);
 					rh = (struct ip6_rthdr *)(ptr + off);
 					/*
 					 * must adjust content to make it look like
 					 * its final form (as seen at the final
 					 * destination).
 					 * we only know how to massage type 0 routing
 					 * header.
 					 */
 					if (out && rh->ip6r_type == IPV6_RTHDR_TYPE_0) {
 						struct ip6_rthdr0 *rh0;
 						struct in6_addr *addr, finaldst;
 						int i;
 						rh0 = (struct ip6_rthdr0 *)rh;
 						addr = (struct in6_addr *)(rh0 + 1);
 						for (i = 0; i < rh0->ip6r0_segleft; i++)
 							in6_clearscope(&addr[i]);
 						finaldst = addr[rh0->ip6r0_segleft - 1];
 						memmove(&addr[1], &addr[0],
 							sizeof(struct in6_addr) *
 							(rh0->ip6r0_segleft - 1));
 						m_copydata(m, 0, sizeof(ip6), &ip6);
 						addr[0] = ip6.ip6_dst;
 						ip6.ip6_dst = finaldst;
 						m_copyback(m, 0, sizeof(ip6), &ip6);
 						rh0->ip6r0_segleft = 0;
+					}
 					/* advance */
 					off += ((ip6e->ip6e_len + 1) << 3);
 					nxt = ip6e->ip6e_nxt;
 					break;
+				}
 			default:
 				DPRINTF(("ah_massage_headers: unexpected "
 				    "IPv6 header type %d", off));
 error6:
 				if (alloc)
 					free(ptr, M_XDATA);
 				m_freem(m);
 				return EINVAL;
+			}
+		}
 		/* Copyback and free, if we allocated. */
 		if (alloc) {
 			m_copyback(m, sizeof(struct ip6_hdr),
 			    skip - sizeof(struct ip6_hdr), ptr);
 			free(ptr, M_XDATA);
+		}
 		break;
 #endif /* INET6 */
+	}
 	return 0;
+}
 /*
  * ah_input() gets called to verify that an input packet
  * passes authentication.
  */
 static int
 ah_input(struct mbuf *m, const struct secasvar *sav, int skip, int protoff)
+{
 	const struct auth_hash *ahx;
 	struct tdb_ident *tdbi;
 	struct tdb_crypto *tc;
 	struct m_tag *mtag;
 	struct newah *ah;
 	int hl, rplen, authsize, error;
 	uint8_t nxt;
 	struct cryptodesc *crda;
 	struct cryptop *crp;
 	IPSEC_SPLASSERT_SOFTNET("ah_input");
 	IPSEC_ASSERT(sav != NULL, ("ah_input: null SA"));
 	IPSEC_ASSERT(sav->key_auth != NULL,
 		("ah_input: null authentication key"));
 	IPSEC_ASSERT(sav->tdb_authalgxform != NULL,
 		("ah_input: null authentication xform"));
 	/* Figure out header size. */
 	rplen = HDRSIZE(sav);
 	/* XXX don't pullup, just copy header */
 	IP6_EXTHDR_GET(ah, struct newah *, m, skip, rplen);
 	if (ah == NULL) {
 		DPRINTF(("ah_input: cannot pullup header\n"));
 		AH_STATINC(AH_STAT_HDROPS);	/*XXX*/
 		m_freem(m);
 		return ENOBUFS;
+	}
 	nxt = ah->ah_nxt;
 	/* Check replay window, if applicable. */
 	if (sav->replay && !ipsec_chkreplay(ntohl(ah->ah_seq), sav)) {
 		AH_STATINC(AH_STAT_REPLAY);
 		DPRINTF(("ah_input: packet replay failure: %s\n",
 			  ipsec_logsastr(sav)));
 		m_freem(m);
 		return ENOBUFS;
+	}
 	/* Verify AH header length. */
 	hl = ah->ah_len * sizeof (u_int32_t);
 	ahx = sav->tdb_authalgxform;
 	authsize = AUTHSIZE(sav);
 	if (hl != authsize + rplen - sizeof (struct ah)) {
 		DPRINTF(("ah_input: bad authenticator length %u (expecting %lu)"
 			" for packet in SA %s/%08lx\n",
 			hl, (u_long) (authsize + rplen - sizeof (struct ah)),
 			ipsec_address(&sav->sah->saidx.dst),
 			(u_long) ntohl(sav->spi)));
 		AH_STATINC(AH_STAT_BADAUTHL);
 		m_freem(m);
 		return EACCES;
+	}
 	if (skip + authsize + rplen > m->m_pkthdr.len) {
 		DPRINTF(("%s: bad mbuf length %u (expecting >= %lu)"
 			" for packet in SA %s/%08lx\n", __func__,
 			m->m_pkthdr.len, (u_long)(skip + authsize + rplen),
 			ipsec_address(&sav->sah->saidx.dst),
 			(u_long) ntohl(sav->spi)));
 		AH_STATINC(AH_STAT_BADAUTHL);
 		m_freem(m);
 		return EACCES;
+	}
 	AH_STATADD(AH_STAT_IBYTES, m->m_pkthdr.len - skip - hl);
 	/* Get crypto descriptors. */
 	crp = crypto_getreq(1);
 	if (crp == NULL) {
 		DPRINTF(("ah_input: failed to acquire crypto descriptor\n"));
 		AH_STATINC(AH_STAT_CRYPTO);
 		m_freem(m);
 		return ENOBUFS;
+	}
 	crda = crp->crp_desc;
 	IPSEC_ASSERT(crda != NULL, ("ah_input: null crypto descriptor"));
 	crda->crd_skip = 0;
 	crda->crd_len = m->m_pkthdr.len;
 	crda->crd_inject = skip + rplen;
 	/* Authentication operation. */
 	crda->crd_alg = ahx->type;
 	crda->crd_key = _KEYBUF(sav->key_auth);
 	crda->crd_klen = _KEYBITS(sav->key_auth);
 	/* Find out if we've already done crypto. */
 	for (mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, NULL);
 	     mtag != NULL;
 	     mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, mtag)) {
 		tdbi = (struct tdb_ident *) (mtag + 1);
 		if (tdbi->proto == sav->sah->saidx.proto &&
 		    tdbi->spi == sav->spi &&
 		    !memcmp(&tdbi->dst, &sav->sah->saidx.dst,
 			  sizeof (union sockaddr_union)))
 			break;
+	}
 	/* Allocate IPsec-specific opaque crypto info. */
 	if (mtag == NULL) {
 		tc = (struct tdb_crypto *) malloc(sizeof (struct tdb_crypto) +
 			skip + rplen + authsize, M_XDATA, M_NOWAIT|M_ZERO);
 	} else {
 		/* Hash verification has already been done successfully. */
 		tc = (struct tdb_crypto *) malloc(sizeof (struct tdb_crypto),
 						    M_XDATA, M_NOWAIT|M_ZERO);
+	}
 	if (tc == NULL) {
 		DPRINTF(("ah_input: failed to allocate tdb_crypto\n"));
 		AH_STATINC(AH_STAT_CRYPTO);
 		crypto_freereq(crp);
 		m_freem(m);
 		return ENOBUFS;
+	}
 	error = m_makewritable(&m, 0, skip + rplen + authsize, M_NOWAIT);
 	if (error) {
 		m_freem(m);
 		DPRINTF(("ah_input: failed to copyback_cow\n"));
 		AH_STATINC(AH_STAT_HDROPS);
 		free(tc, M_XDATA);
 		crypto_freereq(crp);
 		return error;
+	}
 	/* Only save information if crypto processing is needed. */
 	if (mtag == NULL) {
 		/*
 		 * Save the authenticator, the skipped portion of the packet,
 		 * and the AH header.
 		 */
 		m_copydata(m, 0, skip + rplen + authsize, (tc + 1));
 		/* Zeroize the authenticator on the packet. */
 		m_copyback(m, skip + rplen, authsize, ipseczeroes);
 		/* "Massage" the packet headers for crypto processing. */
 		error = ah_massage_headers(&m, sav->sah->saidx.dst.sa.sa_family,
 		    skip, ahx->type, 0);
 		if (error != 0) {
 			/* NB: mbuf is free'd by ah_massage_headers */
 			AH_STATINC(AH_STAT_HDROPS);
 			free(tc, M_XDATA);
 			crypto_freereq(crp);
 			return error;
+		}
+	}
 	/* Crypto operation descriptor. */
 	crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */
 	crp->crp_flags = CRYPTO_F_IMBUF;
 	crp->crp_buf = m;
 	crp->crp_callback = ah_input_cb;
 	crp->crp_sid = sav->tdb_cryptoid;
 	crp->crp_opaque = tc;
 	/* These are passed as-is to the callback. */
 	tc->tc_spi = sav->spi;
 	tc->tc_dst = sav->sah->saidx.dst;
 	tc->tc_proto = sav->sah->saidx.proto;
 	tc->tc_nxt = nxt;
 	tc->tc_protoff = protoff;
 	tc->tc_skip = skip;
 	tc->tc_ptr = mtag; /* Save the mtag we've identified. */
 	DPRINTF(("ah: hash over %d bytes, skip %d: "
 		 "crda len %d skip %d inject %d\n",
 		 crp->crp_ilen, tc->tc_skip,
 		 crda->crd_len, crda->crd_skip, crda->crd_inject));
 	if (mtag == NULL)
 		return crypto_dispatch(crp);
 	else
 		return ah_input_cb(crp);
+}
 #ifdef INET6
 #define	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag) do {		     \
 	if (saidx->dst.sa.sa_family == AF_INET6) {			     \
 		error = ipsec6_common_input_cb(m, sav, skip, protoff, mtag); \
 	} else {							     \
 		error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag); \
 	}								     \
 } while (0)
 #else
 #define	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag)		     \
 	(error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag))
 #endif
 /*
  * AH input callback from the crypto driver.
  */
 static int
 ah_input_cb(struct cryptop *crp)
+{
 	int rplen, error, skip, protoff;
 	unsigned char calc[AH_ALEN_MAX];
 	struct mbuf *m;
 	struct cryptodesc *crd;
 	const struct auth_hash *ahx;
 	struct tdb_crypto *tc;
 	struct m_tag *mtag;
 	struct secasvar *sav;
 	struct secasindex *saidx;
 	u_int8_t nxt;
 	char *ptr;
 	int s, authsize;
 	u_int16_t dport = 0;
 	u_int16_t sport = 0;
 #ifdef IPSEC_NAT_T
 	struct m_tag * tag = NULL;
 #endif
 	crd = crp->crp_desc;
 	tc = (struct tdb_crypto *) crp->crp_opaque;
 	IPSEC_ASSERT(tc != NULL, ("ah_input_cb: null opaque crypto data area!"));
 	skip = tc->tc_skip;
 	nxt = tc->tc_nxt;
 	protoff = tc->tc_protoff;
 	mtag = (struct m_tag *) tc->tc_ptr;
 	m = (struct mbuf *) crp->crp_buf;
 #ifdef IPSEC_NAT_T
 	/* find the source port for NAT-T */
 	if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) {
 		sport = ((u_int16_t *)(tag + 1))[0];
 		dport = ((u_int16_t *)(tag + 1))[1];
+	}
 #endif
 	s = splsoftnet();
 	mutex_enter(softnet_lock);
 	sav = KEY_ALLOCSA(&tc->tc_dst, tc->tc_proto, tc->tc_spi, sport, dport);
 	if (sav == NULL) {
 		AH_STATINC(AH_STAT_NOTDB);
 		DPRINTF(("ah_input_cb: SA expired while in crypto\n"));
 		error = ENOBUFS;		/*XXX*/
 		goto bad;
+	}
 	saidx = &sav->sah->saidx;
 	IPSEC_ASSERT(saidx->dst.sa.sa_family == AF_INET ||
 		saidx->dst.sa.sa_family == AF_INET6,
 		("ah_input_cb: unexpected protocol family %u",
 		 saidx->dst.sa.sa_family));
 	ahx = sav->tdb_authalgxform;
 	/* Check for crypto errors. */
 	if (crp->crp_etype) {
 		if (sav->tdb_cryptoid != 0)
 			sav->tdb_cryptoid = crp->crp_sid;
 		if (crp->crp_etype == EAGAIN) {
 			mutex_exit(softnet_lock);
 			splx(s);
 			return crypto_dispatch(crp);
+		}
 		AH_STATINC(AH_STAT_NOXFORM);
 		DPRINTF(("ah_input_cb: crypto error %d\n", crp->crp_etype));
 		error = crp->crp_etype;
 		goto bad;
 	} else {
 		AH_STATINC(AH_STAT_HIST + sav->alg_auth);
 		crypto_freereq(crp);		/* No longer needed. */
 		crp = NULL;
+	}
 	/* Shouldn't happen... */
 	if (m == NULL) {
 		AH_STATINC(AH_STAT_CRYPTO);
 		DPRINTF(("ah_input_cb: bogus returned buffer from crypto\n"));
 		error = EINVAL;
 		goto bad;
+	}
 	/* Figure out header size. */
 	rplen = HDRSIZE(sav);
 	authsize = AUTHSIZE(sav);
 	if (ipsec_debug)
 	  memset(calc, 0, sizeof(calc));
 	/* Copy authenticator off the packet. */
 	m_copydata(m, skip + rplen, authsize, calc);
 	/*
 	 * If we have an mtag, we don't need to verify the authenticator --
 	 * it has been verified by an IPsec-aware NIC.
 	 */
 	if (mtag == NULL) {
 		ptr = (char *) (tc + 1);
 		/* Verify authenticator. */
 		if (memcmp(ptr + skip + rplen, calc, authsize)) {
 			u_int8_t *pppp = ptr + skip+rplen;
 			DPRINTF(("ah_input: authentication hash mismatch " \
 			    "over %d bytes " \
 			    "for packet in SA %s/%08lx:\n" \
 		    "%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x, " \
 		    "%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x\n",
 			    authsize,
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi),
 				 calc[0], calc[1], calc[2], calc[3],
 				 calc[4], calc[5], calc[6], calc[7],
 				 calc[8], calc[9], calc[10], calc[11],
 				 pppp[0], pppp[1], pppp[2], pppp[3],
 				 pppp[4], pppp[5], pppp[6], pppp[7],
 				 pppp[8], pppp[9], pppp[10], pppp[11]
 				 ));
 			AH_STATINC(AH_STAT_BADAUTH);
 			error = EACCES;
 			goto bad;
+		}
 		/* Fix the Next Protocol field. */
 		((u_int8_t *) ptr)[protoff] = nxt;
 		/* Copyback the saved (uncooked) network headers. */
 		m_copyback(m, 0, skip, ptr);
 	} else {
 		/* Fix the Next Protocol field. */
 		m_copyback(m, protoff, sizeof(u_int8_t), &nxt);
+	}
 	free(tc, M_XDATA), tc = NULL;			/* No longer needed */
 	/*
 	 * Header is now authenticated.
 	 */
 	m->m_flags |= M_AUTHIPHDR|M_AUTHIPDGM;
 	/*
 	 * Update replay sequence number, if appropriate.
 	 */
 	if (sav->replay) {
 		u_int32_t seq;
 		m_copydata(m, skip + offsetof(struct newah, ah_seq),
 			   sizeof (seq), &seq);
 		if (ipsec_updatereplay(ntohl(seq), sav)) {
 			AH_STATINC(AH_STAT_REPLAY);
 			error = ENOBUFS;			/*XXX as above*/
 			goto bad;
+		}
+	}
 	/*
 	 * Remove the AH header and authenticator from the mbuf.
 	 */
 	error = m_striphdr(m, skip, rplen + authsize);
 	if (error) {
 		DPRINTF(("ah_input_cb: mangled mbuf chain for SA %s/%08lx\n",
 		    ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi)));
 		AH_STATINC(AH_STAT_HDROPS);
 		goto bad;
+	}
 	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag);
 	KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	return error;
 bad:
 	if (sav)
 		KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	if (m != NULL)
 		m_freem(m);
 	if (tc != NULL)
 		free(tc, M_XDATA);
 	if (crp != NULL)
 		crypto_freereq(crp);
 	return error;
+}
 /*
  * AH output routine, called by ipsec[46]_process_packet().
  */
 static int
 ah_output(
     struct mbuf *m,
     struct ipsecrequest *isr,
     struct mbuf **mp,
     int skip,
     int protoff
+)
+{
 	const struct secasvar *sav;
 	const struct auth_hash *ahx;
 	struct cryptodesc *crda;
 	struct tdb_crypto *tc;
 	struct mbuf *mi;
 	struct cryptop *crp;
 	u_int16_t iplen;
 	int error, rplen, authsize, maxpacketsize, roff;
 	u_int8_t prot;
 	struct newah *ah;
 	IPSEC_SPLASSERT_SOFTNET("ah_output");
 	sav = isr->sav;
 	IPSEC_ASSERT(sav != NULL, ("ah_output: null SA"));
 	ahx = sav->tdb_authalgxform;
 	IPSEC_ASSERT(ahx != NULL, ("ah_output: null authentication xform"));
 	AH_STATINC(AH_STAT_OUTPUT);
 	/* Figure out header size. */
 	rplen = HDRSIZE(sav);
 	/* Check for maximum packet size violations. */
 	switch (sav->sah->saidx.dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		maxpacketsize = IP_MAXPACKET;
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		maxpacketsize = IPV6_MAXPACKET;
 		break;
 #endif /* INET6 */
 	default:
 		DPRINTF(("ah_output: unknown/unsupported protocol "
 		    "family %u, SA %s/%08lx\n",
 		    sav->sah->saidx.dst.sa.sa_family,
 		    ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi)));
 		AH_STATINC(AH_STAT_NOPF);
 		error = EPFNOSUPPORT;
 		goto bad;
+	}
 	authsize = AUTHSIZE(sav);
 	if (rplen + authsize + m->m_pkthdr.len > maxpacketsize) {
 		DPRINTF(("ah_output: packet in SA %s/%08lx got too big "
 		    "(len %u, max len %u)\n",
 		    ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi),
 		    rplen + authsize + m->m_pkthdr.len, maxpacketsize));
 		AH_STATINC(AH_STAT_TOOBIG);
 		error = EMSGSIZE;
 		goto bad;
+	}
 	/* Update the counters. */
 	AH_STATADD(AH_STAT_OBYTES, m->m_pkthdr.len - skip);
 	m = m_clone(m);
 	if (m == NULL) {
 		DPRINTF(("ah_output: cannot clone mbuf chain, SA %s/%08lx\n",
 		    ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi)));
 		AH_STATINC(AH_STAT_HDROPS);
 		error = ENOBUFS;
 		goto bad;
+	}
 	/* Inject AH header. */
 	mi = m_makespace(m, skip, rplen + authsize, &roff);
 	if (mi == NULL) {
 		DPRINTF(("ah_output: failed to inject %u byte AH header for SA "
 		    "%s/%08lx\n",
 		    rplen + authsize,
 		    ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi)));
 		AH_STATINC(AH_STAT_HDROPS);	/*XXX differs from openbsd */
 		error = ENOBUFS;
 		goto bad;
+	}
 	/*
 	 * The AH header is guaranteed by m_makespace() to be in
 	 * contiguous memory, at roff bytes offset into the returned mbuf.
 	 */
 	ah = (struct newah *)(mtod(mi, char *) + roff);
 	/* Initialize the AH header. */
 	m_copydata(m, protoff, sizeof(u_int8_t), &ah->ah_nxt);
 	ah->ah_len = (rplen + authsize - sizeof(struct ah)) / sizeof(u_int32_t);
 	ah->ah_reserve = 0;
 	ah->ah_spi = sav->spi;
 	/* Zeroize authenticator. */
 	m_copyback(m, skip + rplen, authsize, ipseczeroes);
 	/* Insert packet replay counter, as requested.  */
 	if (sav->replay) {
 		if (sav->replay->count == ~0 &&
 		    (sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
 			DPRINTF(("ah_output: replay counter wrapped for SA "
 				"%s/%08lx\n",
 				ipsec_address(&sav->sah->saidx.dst),
 				(u_long) ntohl(sav->spi)));
 			AH_STATINC(AH_STAT_WRAP);
 			error = EINVAL;
 			goto bad;
+		}
 #ifdef IPSEC_DEBUG
 		/* Emulate replay attack when ipsec_replay is TRUE. */
 		if (!ipsec_replay)
 #endif
 			sav->replay->count++;
 		ah->ah_seq = htonl(sav->replay->count);
+	}
 	/* Get crypto descriptors. */
 	crp = crypto_getreq(1);
 	if (crp == NULL) {
 		DPRINTF(("ah_output: failed to acquire crypto descriptors\n"));
 		AH_STATINC(AH_STAT_CRYPTO);
 		error = ENOBUFS;
 		goto bad;
+	}
 	crda = crp->crp_desc;
 	crda->crd_skip = 0;
 	crda->crd_inject = skip + rplen;
 	crda->crd_len = m->m_pkthdr.len;
 	/* Authentication operation. */
 	crda->crd_alg = ahx->type;
 	crda->crd_key = _KEYBUF(sav->key_auth);
 	crda->crd_klen = _KEYBITS(sav->key_auth);
 	/* Allocate IPsec-specific opaque crypto info. */
 	tc = (struct tdb_crypto *) malloc(
 		sizeof(struct tdb_crypto) + skip, M_XDATA, M_NOWAIT|M_ZERO);
 	if (tc == NULL) {
 		crypto_freereq(crp);
 		DPRINTF(("ah_output: failed to allocate tdb_crypto\n"));
 		AH_STATINC(AH_STAT_CRYPTO);
 		error = ENOBUFS;
 		goto bad;
+	}
 	/* Save the skipped portion of the packet. */
 	m_copydata(m, 0, skip, (tc + 1));
 	/*
 	 * Fix IP header length on the header used for
 	 * authentication. We don't need to fix the original
 	 * header length as it will be fixed by our caller.
 	 */
 	switch (sav->sah->saidx.dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		bcopy(((char *)(tc + 1)) +
 		    offsetof(struct ip, ip_len),
 		    &iplen, sizeof(u_int16_t));
 		iplen = htons(ntohs(iplen) + rplen + authsize);
 		m_copyback(m, offsetof(struct ip, ip_len),
 		    sizeof(u_int16_t), &iplen);
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		bcopy(((char *)(tc + 1)) +
 		    offsetof(struct ip6_hdr, ip6_plen),
 		    &iplen, sizeof(u_int16_t));
 		iplen = htons(ntohs(iplen) + rplen + authsize);
 		m_copyback(m, offsetof(struct ip6_hdr, ip6_plen),
 		    sizeof(u_int16_t), &iplen);
 		break;
 #endif /* INET6 */
+	}
 	/* Fix the Next Header field in saved header. */
 	((u_int8_t *) (tc + 1))[protoff] = IPPROTO_AH;
 	/* Update the Next Protocol field in the IP header. */
 	prot = IPPROTO_AH;
 	m_copyback(m, protoff, sizeof(u_int8_t), &prot);
 	/* "Massage" the packet headers for crypto processing. */
 	error = ah_massage_headers(&m, sav->sah->saidx.dst.sa.sa_family,
 			skip, ahx->type, 1);
 	if (error != 0) {
 		m = NULL;	/* mbuf was free'd by ah_massage_headers. */
 		free(tc, M_XDATA);
 		crypto_freereq(crp);
 		goto bad;
+	}
 	/* Crypto operation descriptor. */
 	crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */
 	crp->crp_flags = CRYPTO_F_IMBUF;
 	crp->crp_buf = m;
 	crp->crp_callback = ah_output_cb;
 	crp->crp_sid = sav->tdb_cryptoid;
 	crp->crp_opaque = tc;
 	/* These are passed as-is to the callback. */
 	tc->tc_isr = isr;
 	tc->tc_spi = sav->spi;
 	tc->tc_dst = sav->sah->saidx.dst;
 	tc->tc_proto = sav->sah->saidx.proto;
 	tc->tc_skip = skip;
 	tc->tc_protoff = protoff;
 	return crypto_dispatch(crp);
 bad:
 	if (m)
 		m_freem(m);
 	return (error);
+}
 /*
  * AH output callback from the crypto driver.
  */
 static int
 ah_output_cb(struct cryptop *crp)
+{
 	int skip, protoff, error;
 	struct tdb_crypto *tc;
 	struct ipsecrequest *isr;
 	struct secasvar *sav;
 	struct mbuf *m;
 	void *ptr;
 	int s, err;
 	tc = (struct tdb_crypto *) crp->crp_opaque;
 	IPSEC_ASSERT(tc != NULL, ("ah_output_cb: null opaque data area!"));
 	skip = tc->tc_skip;
 	protoff = tc->tc_protoff;
 	ptr = (tc + 1);
 	m = (struct mbuf *) crp->crp_buf;
 	s = splsoftnet();
 	mutex_enter(softnet_lock);
 	isr = tc->tc_isr;
 	sav = KEY_ALLOCSA(&tc->tc_dst, tc->tc_proto, tc->tc_spi, 0, 0);
 	if (sav == NULL) {
 		AH_STATINC(AH_STAT_NOTDB);
 		DPRINTF(("ah_output_cb: SA expired while in crypto\n"));
 		error = ENOBUFS;		/*XXX*/
 		goto bad;
+	}
 	IPSEC_ASSERT(isr->sav == sav, ("ah_output_cb: SA changed\n"));
 	/* Check for crypto errors. */
 	if (crp->crp_etype) {
 		if (sav->tdb_cryptoid != 0)
 			sav->tdb_cryptoid = crp->crp_sid;
 		if (crp->crp_etype == EAGAIN) {
 			KEY_FREESAV(&sav);
 			mutex_exit(softnet_lock);
 			splx(s);
 			return crypto_dispatch(crp);
+		}
 		AH_STATINC(AH_STAT_NOXFORM);
 		DPRINTF(("ah_output_cb: crypto error %d\n", crp->crp_etype));
 		error = crp->crp_etype;
 		goto bad;
+	}
 	/* Shouldn't happen... */
 	if (m == NULL) {
 		AH_STATINC(AH_STAT_CRYPTO);
 		DPRINTF(("ah_output_cb: bogus returned buffer from crypto\n"));
 		error = EINVAL;
 		goto bad;
+	}
 	AH_STATINC(AH_STAT_HIST + sav->alg_auth);
 	/*
 	 * Copy original headers (with the new protocol number) back
 	 * in place.
 	 */
 	m_copyback(m, 0, skip, ptr);
 	/* No longer needed. */
 	free(tc, M_XDATA);
 	crypto_freereq(crp);
 #ifdef IPSEC_DEBUG
 	/* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */
 	if (ipsec_integrity) {
 		int alen;
 		/*
 		 * Corrupt HMAC if we want to test integrity verification of
 		 * the other side.
 		 */
 		alen = AUTHSIZE(sav);
 		m_copyback(m, m->m_pkthdr.len - alen, alen, ipseczeroes);
+	}
 #endif
 	/* NB: m is reclaimed by ipsec_process_done. */
 	err = ipsec_process_done(m, isr);
 	KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	return err;
 bad:
 	if (sav)
 		KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	if (m)
 		m_freem(m);
 	free(tc, M_XDATA);
 	crypto_freereq(crp);
 	return error;
+}
 static struct xformsw ah_xformsw = {
 	XF_AH,		XFT_AUTH,	"IPsec AH",
 	ah_init,	ah_zeroize,	ah_input,	ah_output,
 	NULL,
 };
 INITFN void
 ah_attach(void)
+{
 	ahstat_percpu = percpu_alloc(sizeof(uint64_t) * AH_NSTATS);
 	xform_register(&ah_xformsw);
+}
 #ifdef __FreeBSD__
 SYSINIT(ah_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ah_attach, NULL);
 #endif

 @@ -1,1103 +1,1107 @@
-/*	$NetBSD: xform_esp.c,v 1.40 2012/01/25 20:31:23 drochner Exp $	*/
+/*	$NetBSD: xform_esp.c,v 1.40.6.1 2018/03/13 17:18:12 snj Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/xform_esp.c,v 1.2.2.1 2003/01/24 05:11:36 sam Exp $	*/
 /*	$OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
+ *
  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  * and Niels Provos.
+ *
  * Additional features in 1999 by Angelos D. Keromytis.
+ *
  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
  * Angelos D. Keromytis and Niels Provos.
  * Copyright (c) 2001 Angelos D. Keromytis.
+ *
  * Permission to use, copy, and modify this software with or without fee
  * is hereby granted, provided that this entire notice is included in
  * all copies of any software which is or includes a copy or
  * modification of this software.
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.40 2012/01/25 20:31:23 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.40.6.1 2018/03/13 17:18:12 snj Exp $");
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/syslog.h>
 #include <sys/kernel.h>
 /*#include <sys/random.h>*/
 #include <sys/sysctl.h>
 #include <sys/socketvar.h> /* for softnet_lock */
 #include <net/if.h>
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/ip_ecn.h>
 #include <netinet/ip6.h>
 #include <net/route.h>
 #include <netipsec/ipsec.h>
 #include <netipsec/ipsec_private.h>
 #include <netipsec/ah.h>
 #include <netipsec/ah_var.h>
 #include <netipsec/esp.h>
 #include <netipsec/esp_var.h>
 #include <netipsec/xform.h>
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #include <netipsec/ipsec6.h>
 #  ifdef __FreeBSD__
 #  include <netinet6/ip6_ecn.h>
 #  endif
 #endif
 #include <netipsec/key.h>
 #include <netipsec/key_debug.h>
 #include <netipsec/ipsec_osdep.h>
 #include <opencrypto/cryptodev.h>
 #include <opencrypto/xform.h>
 percpu_t *espstat_percpu;
 int	esp_enable = 1;
 #ifdef __FreeBSD__
 SYSCTL_DECL(_net_inet_esp);
 SYSCTL_INT(_net_inet_esp, OID_AUTO,
 	esp_enable,	CTLFLAG_RW,	&esp_enable,	0, "");
 SYSCTL_STRUCT(_net_inet_esp, IPSECCTL_STATS,
 	stats,		CTLFLAG_RD,	&espstat,	espstat, "");
 #endif /* __FreeBSD__ */
 static	int esp_max_ivlen;		/* max iv length over all algorithms */
 static int esp_input_cb(struct cryptop *op);
 static int esp_output_cb(struct cryptop *crp);
 /*
  * NB: this is public for use by the PF_KEY support.
  * NB: if you add support here; be sure to add code to esp_attach below!
  */
 const struct enc_xform *
 esp_algorithm_lookup(int alg)
+{
 	if (alg >= ESP_ALG_MAX)
 		return NULL;
 	switch (alg) {
 	case SADB_EALG_DESCBC:
 		return &enc_xform_des;
 	case SADB_EALG_3DESCBC:
 		return &enc_xform_3des;
 	case SADB_X_EALG_AES:
 		return &enc_xform_rijndael128;
 	case SADB_X_EALG_BLOWFISHCBC:
 		return &enc_xform_blf;
 	case SADB_X_EALG_CAST128CBC:
 		return &enc_xform_cast5;
 	case SADB_X_EALG_SKIPJACK:
 		return &enc_xform_skipjack;
 	case SADB_X_EALG_CAMELLIACBC:
 		return &enc_xform_camellia;
 	case SADB_X_EALG_AESCTR:
 		return &enc_xform_aes_ctr;
 	case SADB_X_EALG_AESGCM16:
 		return &enc_xform_aes_gcm;
 	case SADB_X_EALG_AESGMAC:
 		return &enc_xform_aes_gmac;
 	case SADB_EALG_NULL:
 		return &enc_xform_null;
+	}
 	return NULL;
+}
 size_t
 esp_hdrsiz(const struct secasvar *sav)
+{
 	size_t size;
 	if (sav != NULL) {
 		/*XXX not right for null algorithm--does it matter??*/
 		IPSEC_ASSERT(sav->tdb_encalgxform != NULL,
 			("esp_hdrsiz: SA with null xform"));
 		if (sav->flags & SADB_X_EXT_OLD)
 			size = sizeof (struct esp);
 		else
 			size = sizeof (struct newesp);
 		size += sav->tdb_encalgxform->ivsize + 9;
 		/*XXX need alg check???*/
 		if (sav->tdb_authalgxform != NULL && sav->replay)
 			size += ah_hdrsiz(sav);
 	} else {
 		/*
 		 *   base header size
 		 * + max iv length for CBC mode
 		 * + max pad length
 		 * + sizeof (pad length field)
 		 * + sizeof (next header field)
 		 * + max icv supported.
 		 */
 		size = sizeof (struct newesp) + esp_max_ivlen + 9 + 16;
+	}
 	return size;
+}
 /*
  * esp_init() is called when an SPI is being set up.
  */
 static int
 esp_init(struct secasvar *sav, const struct xformsw *xsp)
+{
 	const struct enc_xform *txform;
 	struct cryptoini cria, crie;
 	int keylen;
 	int error;
 	txform = esp_algorithm_lookup(sav->alg_enc);
 	if (txform == NULL) {
 		DPRINTF(("esp_init: unsupported encryption algorithm %d\n",
 			sav->alg_enc));
 		return EINVAL;
+	}
 	if (sav->key_enc == NULL) {
 		DPRINTF(("esp_init: no encoding key for %s algorithm\n",
 			 txform->name));
 		return EINVAL;
+	}
 	if ((sav->flags&(SADB_X_EXT_OLD|SADB_X_EXT_IV4B)) == SADB_X_EXT_IV4B) {
 		DPRINTF(("esp_init: 4-byte IV not supported with protocol\n"));
 		return EINVAL;
+	}
 	keylen = _KEYLEN(sav->key_enc);
 	if (txform->minkey > keylen || keylen > txform->maxkey) {
 		DPRINTF(("esp_init: invalid key length %u, must be in "
 			"the range [%u..%u] for algorithm %s\n",
 			keylen, txform->minkey, txform->maxkey,
 			txform->name));
 		return EINVAL;
+	}
 	sav->ivlen = txform->ivsize;
 	/*
 	 * Setup AH-related state.
 	 */
 	if (sav->alg_auth != 0) {
 		error = ah_init0(sav, xsp, &cria);
 		if (error)
 			return error;
+	}
 	/* NB: override anything set in ah_init0 */
 	sav->tdb_xform = xsp;
 	sav->tdb_encalgxform = txform;
 	if (sav->alg_enc == SADB_X_EALG_AESGCM16 ||
 	    sav->alg_enc == SADB_X_EALG_AESGMAC) {
 		switch (keylen) {
 		case 20:
 			sav->alg_auth = SADB_X_AALG_AES128GMAC;
 			sav->tdb_authalgxform = &auth_hash_gmac_aes_128;
 			break;
 		case 28:
 			sav->alg_auth = SADB_X_AALG_AES192GMAC;
 			sav->tdb_authalgxform = &auth_hash_gmac_aes_192;
 			break;
 		case 36:
 			sav->alg_auth = SADB_X_AALG_AES256GMAC;
 			sav->tdb_authalgxform = &auth_hash_gmac_aes_256;
 			break;
+		}
 		memset(&cria, 0, sizeof(cria));
 		cria.cri_alg = sav->tdb_authalgxform->type;
 		cria.cri_klen = _KEYBITS(sav->key_enc);
 		cria.cri_key = _KEYBUF(sav->key_enc);
+	}
 	/* Initialize crypto session. */
 	memset(&crie, 0, sizeof (crie));
 	crie.cri_alg = sav->tdb_encalgxform->type;
 	crie.cri_klen = _KEYBITS(sav->key_enc);
 	crie.cri_key = _KEYBUF(sav->key_enc);
 	/* XXX Rounds ? */
 	if (sav->tdb_authalgxform && sav->tdb_encalgxform) {
 		/* init both auth & enc */
 		crie.cri_next = &cria;
 		error = crypto_newsession(&sav->tdb_cryptoid,
 					  &crie, crypto_support);
 	} else if (sav->tdb_encalgxform) {
 		error = crypto_newsession(&sav->tdb_cryptoid,
 					  &crie, crypto_support);
 	} else if (sav->tdb_authalgxform) {
 		error = crypto_newsession(&sav->tdb_cryptoid,
 					  &cria, crypto_support);
 	} else {
 		/* XXX cannot happen? */
 		DPRINTF(("esp_init: no encoding OR authentication xform!\n"));
 		error = EINVAL;
+	}
 	return error;
+}
 /*
  * Paranoia.
  */
 static int
 esp_zeroize(struct secasvar *sav)
+{
 	/* NB: ah_zerorize free's the crypto session state */
 	int error = ah_zeroize(sav);
 	if (sav->key_enc)
 		memset(_KEYBUF(sav->key_enc), 0, _KEYLEN(sav->key_enc));
 	sav->tdb_encalgxform = NULL;
 	sav->tdb_xform = NULL;
 	return error;
+}
 /*
  * ESP input processing, called (eventually) through the protocol switch.
  */
 static int
 esp_input(struct mbuf *m, const struct secasvar *sav, int skip, int protoff)
+{
 	const struct auth_hash *esph;
 	const struct enc_xform *espx;
 	struct tdb_ident *tdbi;
 	struct tdb_crypto *tc;
 	int plen, alen, hlen, error;
 	struct m_tag *mtag;
 	struct newesp *esp;
 	struct cryptodesc *crde;
 	struct cryptop *crp;
 	IPSEC_SPLASSERT_SOFTNET("esp_input");
 	IPSEC_ASSERT(sav != NULL, ("esp_input: null SA"));
 	IPSEC_ASSERT(sav->tdb_encalgxform != NULL,
 		("esp_input: null encoding xform"));
 	IPSEC_ASSERT((skip&3) == 0 && (m->m_pkthdr.len&3) == 0,
 		("esp_input: misaligned packet, skip %u pkt len %u",
 			skip, m->m_pkthdr.len));
 	/* XXX don't pullup, just copy header */
 	IP6_EXTHDR_GET(esp, struct newesp *, m, skip, sizeof (struct newesp));
 	if (esp == NULL) {
 		/* m already freed */
 		return EINVAL;
+	}
 	esph = sav->tdb_authalgxform;
 	espx = sav->tdb_encalgxform;
 	/* Determine the ESP header length */
 	if (sav->flags & SADB_X_EXT_OLD)
 		hlen = sizeof (struct esp) + sav->ivlen;
 	else
 		hlen = sizeof (struct newesp) + sav->ivlen;
 	/* Authenticator hash size */
 	alen = esph ? esph->authsize : 0;
 	/*
 	 * Verify payload length is multiple of encryption algorithm
 	 * block size.
+	 *
 	 * NB: This works for the null algorithm because the blocksize
 	 *     is 4 and all packets must be 4-byte aligned regardless
 	 *     of the algorithm.
 	 */
 	plen = m->m_pkthdr.len - (skip + hlen + alen);
 	if ((plen & (espx->blocksize - 1)) || (plen <= 0)) {
 		DPRINTF(("esp_input: "
 		    "payload of %d octets not a multiple of %d octets,"
 		    "  SA %s/%08lx\n",
 		    plen, espx->blocksize,
 		    ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi)));
 		ESP_STATINC(ESP_STAT_BADILEN);
 		m_freem(m);
 		return EINVAL;
+	}
 	/*
 	 * Check sequence number.
 	 */
 	if (esph && sav->replay && !ipsec_chkreplay(ntohl(esp->esp_seq), sav)) {
 		DPRINTF(("esp_input: packet replay check for %s\n",
 		    ipsec_logsastr(sav)));	/*XXX*/
 		ESP_STATINC(ESP_STAT_REPLAY);
 		m_freem(m);
 		return ENOBUFS;		/*XXX*/
+	}
 	/* Update the counters */
 	ESP_STATADD(ESP_STAT_IBYTES, m->m_pkthdr.len - skip - hlen - alen);
 	/* Find out if we've already done crypto */
 	for (mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, NULL);
 	     mtag != NULL;
 	     mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_CRYPTO_DONE, mtag)) {
 		tdbi = (struct tdb_ident *) (mtag + 1);
 		if (tdbi->proto == sav->sah->saidx.proto &&
 		    tdbi->spi == sav->spi &&
 		    !memcmp(&tdbi->dst, &sav->sah->saidx.dst,
 			  sizeof(union sockaddr_union)))
 			break;
+	}
 	/* Get crypto descriptors */
 	crp = crypto_getreq(esph && espx ? 2 : 1);
 	if (crp == NULL) {
 		DPRINTF(("esp_input: failed to acquire crypto descriptors\n"));
 		ESP_STATINC(ESP_STAT_CRYPTO);
 		m_freem(m);
 		return ENOBUFS;
+	}
 	/* Get IPsec-specific opaque pointer */
 	if (esph == NULL || mtag != NULL)
 		tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto),
 		    M_XDATA, M_NOWAIT|M_ZERO);
 	else
 		tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto) + alen,
 		    M_XDATA, M_NOWAIT|M_ZERO);
 	if (tc == NULL) {
 		crypto_freereq(crp);
 		DPRINTF(("esp_input: failed to allocate tdb_crypto\n"));
 		ESP_STATINC(ESP_STAT_CRYPTO);
 		m_freem(m);
 		return ENOBUFS;
+	}
 	error = m_makewritable(&m, 0, m->m_pkthdr.len, M_NOWAIT);
 	if (error) {
 		m_freem(m);
 		free(tc, M_XDATA);
 		crypto_freereq(crp);
 		DPRINTF(("esp_input: m_makewritable failed\n"));
 		ESP_STATINC(ESP_STAT_CRYPTO);
 		return error;
+	}
 	tc->tc_ptr = mtag;
 	if (esph) {
 		struct cryptodesc *crda = crp->crp_desc;
 		IPSEC_ASSERT(crda != NULL, ("esp_input: null ah crypto descriptor"));
 		/* Authentication descriptor */
 		crda->crd_skip = skip;
 		if (espx && espx->type == CRYPTO_AES_GCM_16)
 			crda->crd_len = hlen - sav->ivlen;
 		else
 			crda->crd_len = m->m_pkthdr.len - (skip + alen);
 		crda->crd_inject = m->m_pkthdr.len - alen;
 		crda->crd_alg = esph->type;
 		if (espx && (espx->type == CRYPTO_AES_GCM_16 ||
 			     espx->type == CRYPTO_AES_GMAC)) {
 			crda->crd_key = _KEYBUF(sav->key_enc);
 			crda->crd_klen = _KEYBITS(sav->key_enc);
 		} else {
 			crda->crd_key = _KEYBUF(sav->key_auth);
 			crda->crd_klen = _KEYBITS(sav->key_auth);
+		}
 		/* Copy the authenticator */
 		if (mtag == NULL)
 			m_copydata(m, m->m_pkthdr.len - alen, alen,
 				      (tc + 1));
 		/* Chain authentication request */
 		crde = crda->crd_next;
 	} else {
 		crde = crp->crp_desc;
+	}
 	/* Crypto operation descriptor */
 	crp->crp_ilen = m->m_pkthdr.len; /* Total input length */
 	crp->crp_flags = CRYPTO_F_IMBUF;
 	crp->crp_buf = m;
 	crp->crp_callback = esp_input_cb;
 	crp->crp_sid = sav->tdb_cryptoid;
 	crp->crp_opaque = tc;
 	/* These are passed as-is to the callback */
 	tc->tc_spi = sav->spi;
 	tc->tc_dst = sav->sah->saidx.dst;
 	tc->tc_proto = sav->sah->saidx.proto;
 	tc->tc_protoff = protoff;
 	tc->tc_skip = skip;
 	/* Decryption descriptor */
 	if (espx) {
 		IPSEC_ASSERT(crde != NULL, ("esp_input: null esp crypto descriptor"));
 		crde->crd_skip = skip + hlen;
 		if (espx->type == CRYPTO_AES_GMAC)
 			crde->crd_len = 0;
 		else
 			crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen);
 		crde->crd_inject = skip + hlen - sav->ivlen;
 		crde->crd_alg = espx->type;
 		crde->crd_key = _KEYBUF(sav->key_enc);
 		crde->crd_klen = _KEYBITS(sav->key_enc);
 		/* XXX Rounds ? */
+	}
 	if (mtag == NULL)
 		return crypto_dispatch(crp);
 	else
 		return esp_input_cb(crp);
+}
 #ifdef INET6
 #define	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag) do {		     \
 	if (saidx->dst.sa.sa_family == AF_INET6) {			     \
 		error = ipsec6_common_input_cb(m, sav, skip, protoff, mtag); \
 	} else {							     \
 		error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag); \
 	}								     \
 } while (0)
 #else
 #define	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag)		     \
 	(error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag))
 #endif
 /*
  * ESP input callback from the crypto driver.
  */
 static int
 esp_input_cb(struct cryptop *crp)
+{
 	u_int8_t lastthree[3], aalg[AH_ALEN_MAX];
 	int s, hlen, skip, protoff, error;
 	struct mbuf *m;
 	struct cryptodesc *crd;
 	const struct auth_hash *esph;
 	const struct enc_xform *espx;
 	struct tdb_crypto *tc;
 	struct m_tag *mtag;
 	struct secasvar *sav;
 	struct secasindex *saidx;
 	void *ptr;
 	u_int16_t dport = 0;
 	u_int16_t sport = 0;
 #ifdef IPSEC_NAT_T
 	struct m_tag * tag = NULL;
 #endif
 	crd = crp->crp_desc;
 	IPSEC_ASSERT(crd != NULL, ("esp_input_cb: null crypto descriptor!"));
 	tc = (struct tdb_crypto *) crp->crp_opaque;
 	IPSEC_ASSERT(tc != NULL, ("esp_input_cb: null opaque crypto data area!"));
 	skip = tc->tc_skip;
 	protoff = tc->tc_protoff;
 	mtag = (struct m_tag *) tc->tc_ptr;
 	m = (struct mbuf *) crp->crp_buf;
 #ifdef IPSEC_NAT_T
 	/* find the source port for NAT-T */
 	if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL))) {
 		sport = ((u_int16_t *)(tag + 1))[0];
 		dport = ((u_int16_t *)(tag + 1))[1];
+	}
 #endif
 	s = splsoftnet();
 	mutex_enter(softnet_lock);
 	sav = KEY_ALLOCSA(&tc->tc_dst, tc->tc_proto, tc->tc_spi, sport, dport);
 	if (sav == NULL) {
 		ESP_STATINC(ESP_STAT_NOTDB);
 		DPRINTF(("esp_input_cb: SA expired while in crypto "
 		    "(SA %s/%08lx proto %u)\n", ipsec_address(&tc->tc_dst),
 		    (u_long) ntohl(tc->tc_spi), tc->tc_proto));
 		error = ENOBUFS;		/*XXX*/
 		goto bad;
+	}
 	saidx = &sav->sah->saidx;
 	IPSEC_ASSERT(saidx->dst.sa.sa_family == AF_INET ||
 		saidx->dst.sa.sa_family == AF_INET6,
 		("esp_input_cb: unexpected protocol family %u",
 		 saidx->dst.sa.sa_family));
 	esph = sav->tdb_authalgxform;
 	espx = sav->tdb_encalgxform;
 	/* Check for crypto errors */
 	if (crp->crp_etype) {
 		/* Reset the session ID */
 		if (sav->tdb_cryptoid != 0)
 			sav->tdb_cryptoid = crp->crp_sid;
 		if (crp->crp_etype == EAGAIN) {
 			KEY_FREESAV(&sav);
 			mutex_exit(softnet_lock);
 			splx(s);
 			return crypto_dispatch(crp);
+		}
 		ESP_STATINC(ESP_STAT_NOXFORM);
 		DPRINTF(("esp_input_cb: crypto error %d\n", crp->crp_etype));
 		error = crp->crp_etype;
 		goto bad;
+	}
 	/* Shouldn't happen... */
 	if (m == NULL) {
 		ESP_STATINC(ESP_STAT_CRYPTO);
 		DPRINTF(("esp_input_cb: bogus returned buffer from crypto\n"));
 		error = EINVAL;
 		goto bad;
+	}
 	ESP_STATINC(ESP_STAT_HIST + sav->alg_enc);
 	/* If authentication was performed, check now. */
 	if (esph != NULL) {
 		/*
 		 * If we have a tag, it means an IPsec-aware NIC did
 		 * the verification for us.  Otherwise we need to
 		 * check the authentication calculation.
 		 */
 		AH_STATINC(AH_STAT_HIST + sav->alg_auth);
 		if (mtag == NULL) {
 			/* Copy the authenticator from the packet */
 			m_copydata(m, m->m_pkthdr.len - esph->authsize,
 				esph->authsize, aalg);
 			ptr = (tc + 1);
 			/* Verify authenticator */
 			if (memcmp(ptr, aalg, esph->authsize) != 0) {
 				DPRINTF(("esp_input_cb: "
 		    "authentication hash mismatch for packet in SA %s/%08lx\n",
 				    ipsec_address(&saidx->dst),
 				    (u_long) ntohl(sav->spi)));
 				ESP_STATINC(ESP_STAT_BADAUTH);
 				error = EACCES;
 				goto bad;
+			}
+		}
 		/* Remove trailing authenticator */
 		m_adj(m, -(esph->authsize));
+	}
 	/* Release the crypto descriptors */
 	free(tc, M_XDATA), tc = NULL;
 	crypto_freereq(crp), crp = NULL;
 	/*
 	 * Packet is now decrypted.
 	 */
 	m->m_flags |= M_DECRYPTED;
 	/*
 	 * Update replay sequence number, if appropriate.
 	 */
 	if (sav->replay) {
 		u_int32_t seq;
 		m_copydata(m, skip + offsetof(struct newesp, esp_seq),
 		    sizeof (seq), &seq);
 		if (ipsec_updatereplay(ntohl(seq), sav)) {
 			DPRINTF(("%s: packet replay check for %s\n", __func__,
 			    ipsec_logsastr(sav)));
 			ESP_STATINC(ESP_STAT_REPLAY);
 			error = ENOBUFS;
 			goto bad;
+		}
+	}
 	/* Determine the ESP header length */
 	if (sav->flags & SADB_X_EXT_OLD)
 		hlen = sizeof (struct esp) + sav->ivlen;
 	else
 		hlen = sizeof (struct newesp) + sav->ivlen;
 	/* Remove the ESP header and IV from the mbuf. */
 	error = m_striphdr(m, skip, hlen);
 	if (error) {
 		ESP_STATINC(ESP_STAT_HDROPS);
 		DPRINTF(("esp_input_cb: bad mbuf chain, SA %s/%08lx\n",
 		    ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi)));
 		goto bad;
+	}
 	/* Save the last three bytes of decrypted data */
 	m_copydata(m, m->m_pkthdr.len - 3, 3, lastthree);
 	/* Verify pad length */
 	if (lastthree[1] + 2 > m->m_pkthdr.len - skip) {
 		ESP_STATINC(ESP_STAT_BADILEN);
 		DPRINTF(("esp_input_cb: invalid padding length %d "
 			 "for %u byte packet in SA %s/%08lx\n",
 			 lastthree[1], m->m_pkthdr.len - skip,
 			 ipsec_address(&sav->sah->saidx.dst),
 			 (u_long) ntohl(sav->spi)));
 		error = EINVAL;
 		goto bad;
+	}
 	/* Verify correct decryption by checking the last padding bytes */
 	if ((sav->flags & SADB_X_EXT_PMASK) != SADB_X_EXT_PRAND) {
 		if (lastthree[1] != lastthree[0] && lastthree[1] != 0) {
 			ESP_STATINC(ESP_STAT_BADENC);
 			DPRINTF(("esp_input_cb: decryption failed "
 				"for packet in SA %s/%08lx\n",
 				ipsec_address(&sav->sah->saidx.dst),
 				(u_long) ntohl(sav->spi)));
 DPRINTF(("esp_input_cb: %x %x\n", lastthree[0], lastthree[1]));
 			error = EINVAL;
 			goto bad;
+		}
+	}
 	/* Trim the mbuf chain to remove trailing authenticator and padding */
 	m_adj(m, -(lastthree[1] + 2));
 	/* Restore the Next Protocol field */
 	m_copyback(m, protoff, sizeof (u_int8_t), lastthree + 2);
 	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag);
 	KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	return error;
 bad:
 	if (sav)
 		KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	if (m != NULL)
 		m_freem(m);
 	if (tc != NULL)
 		free(tc, M_XDATA);
 	if (crp != NULL)
 		crypto_freereq(crp);
 	return error;
+}
 /*
  * ESP output routine, called by ipsec[46]_process_packet().
  */
 static int
 esp_output(
     struct mbuf *m,
     struct ipsecrequest *isr,
     struct mbuf **mp,
     int skip,
     int protoff
+)
+{
 	const struct enc_xform *espx;
 	const struct auth_hash *esph;
 	int hlen, rlen, plen, padding, blks, alen, i, roff;
 	struct mbuf *mo = NULL;
 	struct tdb_crypto *tc;
 	const struct secasvar *sav;
 	struct secasindex *saidx;
 	unsigned char *pad;
 	u_int8_t prot;
 	int error, maxpacketsize;
 	struct cryptodesc *crde = NULL, *crda = NULL;
 	struct cryptop *crp;
 	IPSEC_SPLASSERT_SOFTNET("esp_output");
 	sav = isr->sav;
 	IPSEC_ASSERT(sav != NULL, ("esp_output: null SA"));
 	esph = sav->tdb_authalgxform;
 	espx = sav->tdb_encalgxform;
 	IPSEC_ASSERT(espx != NULL, ("esp_output: null encoding xform"));
 	if (sav->flags & SADB_X_EXT_OLD)
 		hlen = sizeof (struct esp) + sav->ivlen;
 	else
 		hlen = sizeof (struct newesp) + sav->ivlen;
 	rlen = m->m_pkthdr.len - skip;	/* Raw payload length. */
 	/*
 	 * NB: The null encoding transform has a blocksize of 4
 	 *     so that headers are properly aligned.
 	 */
 	blks = espx->blocksize;		/* IV blocksize */
 	/* XXX clamp padding length a la KAME??? */
 	padding = ((blks - ((rlen + 2) % blks)) % blks) + 2;
 	plen = rlen + padding;		/* Padded payload length. */
 	if (esph)
 		alen = esph->authsize;
 	else
 		alen = 0;
 	ESP_STATINC(ESP_STAT_OUTPUT);
 	saidx = &sav->sah->saidx;
 	/* Check for maximum packet size violations. */
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		maxpacketsize = IP_MAXPACKET;
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		maxpacketsize = IPV6_MAXPACKET;
 		break;
 #endif /* INET6 */
 	default:
 		DPRINTF(("esp_output: unknown/unsupported protocol "
 		    "family %d, SA %s/%08lx\n",
 		    saidx->dst.sa.sa_family, ipsec_address(&saidx->dst),
 		    (u_long) ntohl(sav->spi)));
 		ESP_STATINC(ESP_STAT_NOPF);
 		error = EPFNOSUPPORT;
 		goto bad;
+	}
 	if (skip + hlen + rlen + padding + alen > maxpacketsize) {
 		DPRINTF(("esp_output: packet in SA %s/%08lx got too big "
 		    "(len %u, max len %u)\n",
 		    ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi),
 		    skip + hlen + rlen + padding + alen, maxpacketsize));
 		ESP_STATINC(ESP_STAT_TOOBIG);
 		error = EMSGSIZE;
 		goto bad;
+	}
 	/* Update the counters. */
 	ESP_STATADD(ESP_STAT_OBYTES, m->m_pkthdr.len - skip);
 	m = m_clone(m);
 	if (m == NULL) {
 		DPRINTF(("esp_output: cannot clone mbuf chain, SA %s/%08lx\n",
 		    ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi)));
 		ESP_STATINC(ESP_STAT_HDROPS);
 		error = ENOBUFS;
 		goto bad;
+	}
 	/* Inject ESP header. */
 	mo = m_makespace(m, skip, hlen, &roff);
 	if (mo == NULL) {
 		DPRINTF(("esp_output: failed to inject %u byte ESP hdr for SA "
 		    "%s/%08lx\n",
 		    hlen, ipsec_address(&saidx->dst),
 		    (u_long) ntohl(sav->spi)));
 		ESP_STATINC(ESP_STAT_HDROPS);	/* XXX diffs from openbsd */
 		error = ENOBUFS;
 		goto bad;
+	}
 	/* Initialize ESP header. */
 	memcpy(mtod(mo, char *) + roff, &sav->spi, sizeof(u_int32_t));
 	if (sav->replay) {
 		u_int32_t replay;
 #ifdef IPSEC_DEBUG
 		/* Emulate replay attack when ipsec_replay is TRUE. */
 		if (!ipsec_replay)
 #endif
 			sav->replay->count++;
 		replay = htonl(sav->replay->count);
 		bcopy(&replay,
 		    mtod(mo,char *) + roff + sizeof(u_int32_t),
 		    sizeof(u_int32_t));
+	}
 	/*
 	 * Add padding -- better to do it ourselves than use the crypto engine,
 	 * although if/when we support compression, we'd have to do that.
 	 */
 	pad = (u_char *) m_pad(m, padding + alen);
 	if (pad == NULL) {
 		DPRINTF(("esp_output: m_pad failed for SA %s/%08lx\n",
 		    ipsec_address(&saidx->dst), (u_long) ntohl(sav->spi)));
 		m = NULL;		/* NB: free'd by m_pad */
 		error = ENOBUFS;
 		goto bad;
+	}
 	/*
 	 * Add padding: random, zero, or self-describing.
 	 * XXX catch unexpected setting
 	 */
 	switch (sav->flags & SADB_X_EXT_PMASK) {
 	case SADB_X_EXT_PRAND:
 		(void) read_random(pad, padding - 2);
 		break;
 	case SADB_X_EXT_PZERO:
 		memset(pad, 0, padding - 2);
 		break;
 	case SADB_X_EXT_PSEQ:
 		for (i = 0; i < padding - 2; i++)
 			pad[i] = i+1;
 		break;
+	}
 	/* Fix padding length and Next Protocol in padding itself. */
 	pad[padding - 2] = padding - 2;
 	m_copydata(m, protoff, sizeof(u_int8_t), pad + padding - 1);
 	/* Fix Next Protocol in IPv4/IPv6 header. */
 	prot = IPPROTO_ESP;
 	m_copyback(m, protoff, sizeof(u_int8_t), (u_char *) &prot);
 	/* Get crypto descriptors. */
 	crp = crypto_getreq(esph && espx ? 2 : 1);
 	if (crp == NULL) {
 		DPRINTF(("esp_output: failed to acquire crypto descriptors\n"));
 		ESP_STATINC(ESP_STAT_CRYPTO);
 		error = ENOBUFS;
 		goto bad;
+	}
 	if (espx) {
 		crde = crp->crp_desc;
 		crda = crde->crd_next;
 		/* Encryption descriptor. */
 		crde->crd_skip = skip + hlen;
 		if (espx->type == CRYPTO_AES_GMAC)
 			crde->crd_len = 0;
 		else
 			crde->crd_len = m->m_pkthdr.len - (skip + hlen + alen);
 		crde->crd_flags = CRD_F_ENCRYPT;
 		crde->crd_inject = skip + hlen - sav->ivlen;
 		/* Encryption operation. */
 		crde->crd_alg = espx->type;
 		crde->crd_key = _KEYBUF(sav->key_enc);
 		crde->crd_klen = _KEYBITS(sav->key_enc);
 		/* XXX Rounds ? */
 	} else
 		crda = crp->crp_desc;
 	/* IPsec-specific opaque crypto info. */
 	tc = (struct tdb_crypto *) malloc(sizeof(struct tdb_crypto),
 		M_XDATA, M_NOWAIT|M_ZERO);
 	if (tc == NULL) {
 		crypto_freereq(crp);
 		DPRINTF(("esp_output: failed to allocate tdb_crypto\n"));
 		ESP_STATINC(ESP_STAT_CRYPTO);
 		error = ENOBUFS;
 		goto bad;
+	}
 	/* Callback parameters */
 	tc->tc_isr = isr;
 	tc->tc_spi = sav->spi;
 	tc->tc_dst = saidx->dst;
 	tc->tc_proto = saidx->proto;
 	/* Crypto operation descriptor. */
 	crp->crp_ilen = m->m_pkthdr.len; /* Total input length. */
 	crp->crp_flags = CRYPTO_F_IMBUF;
 	crp->crp_buf = m;
 	crp->crp_callback = esp_output_cb;
 	crp->crp_opaque = tc;
 	crp->crp_sid = sav->tdb_cryptoid;
 	if (esph) {
 		/* Authentication descriptor. */
 		crda->crd_skip = skip;
 		if (espx && espx->type == CRYPTO_AES_GCM_16)
 			crda->crd_len = hlen - sav->ivlen;
 		else
 			crda->crd_len = m->m_pkthdr.len - (skip + alen);
 		crda->crd_inject = m->m_pkthdr.len - alen;
 		/* Authentication operation. */
 		crda->crd_alg = esph->type;
 		if (espx && (espx->type == CRYPTO_AES_GCM_16 ||
 			     espx->type == CRYPTO_AES_GMAC)) {
 			crda->crd_key = _KEYBUF(sav->key_enc);
 			crda->crd_klen = _KEYBITS(sav->key_enc);
 		} else {
 			crda->crd_key = _KEYBUF(sav->key_auth);
 			crda->crd_klen = _KEYBITS(sav->key_auth);
+		}
+	}
 	return crypto_dispatch(crp);
 bad:
 	if (m)
 		m_freem(m);
 	return (error);
+}
 /*
  * ESP output callback from the crypto driver.
  */
 static int
 esp_output_cb(struct cryptop *crp)
+{
 	struct tdb_crypto *tc;
 	struct ipsecrequest *isr;
 	struct secasvar *sav;
 	struct mbuf *m;
 	int s, err, error;
 	tc = (struct tdb_crypto *) crp->crp_opaque;
 	IPSEC_ASSERT(tc != NULL, ("esp_output_cb: null opaque data area!"));
 	m = (struct mbuf *) crp->crp_buf;
 	s = splsoftnet();
 	mutex_enter(softnet_lock);
 	isr = tc->tc_isr;
 	sav = KEY_ALLOCSA(&tc->tc_dst, tc->tc_proto, tc->tc_spi, 0, 0);
 	if (sav == NULL) {
 		ESP_STATINC(ESP_STAT_NOTDB);
 		DPRINTF(("esp_output_cb: SA expired while in crypto "
 		    "(SA %s/%08lx proto %u)\n", ipsec_address(&tc->tc_dst),
 		    (u_long) ntohl(tc->tc_spi), tc->tc_proto));
 		error = ENOBUFS;		/*XXX*/
 		goto bad;
+	}
 	IPSEC_ASSERT(isr->sav == sav,
 		("esp_output_cb: SA changed was %p now %p\n", isr->sav, sav));
 	/* Check for crypto errors. */
 	if (crp->crp_etype) {
 		/* Reset session ID. */
 		if (sav->tdb_cryptoid != 0)
 			sav->tdb_cryptoid = crp->crp_sid;
 		if (crp->crp_etype == EAGAIN) {
 			KEY_FREESAV(&sav);
 			mutex_exit(softnet_lock);
 			splx(s);
 			return crypto_dispatch(crp);
+		}
 		ESP_STATINC(ESP_STAT_NOXFORM);
 		DPRINTF(("esp_output_cb: crypto error %d\n", crp->crp_etype));
 		error = crp->crp_etype;
 		goto bad;
+	}
 	/* Shouldn't happen... */
 	if (m == NULL) {
 		ESP_STATINC(ESP_STAT_CRYPTO);
 		DPRINTF(("esp_output_cb: bogus returned buffer from crypto\n"));
 		error = EINVAL;
 		goto bad;
+	}
 	ESP_STATINC(ESP_STAT_HIST + sav->alg_enc);
 	if (sav->tdb_authalgxform != NULL)
 		AH_STATINC(AH_STAT_HIST + sav->alg_auth);
 	/* Release crypto descriptors. */
 	free(tc, M_XDATA);
 	crypto_freereq(crp);
 #ifdef IPSEC_DEBUG
 	/* Emulate man-in-the-middle attack when ipsec_integrity is TRUE. */
 	if (ipsec_integrity) {
 		static unsigned char ipseczeroes[AH_ALEN_MAX];
 		const struct auth_hash *esph;
 		/*
 		 * Corrupt HMAC if we want to test integrity verification of
 		 * the other side.
 		 */
 		esph = sav->tdb_authalgxform;
 		if (esph !=  NULL) {
 			m_copyback(m, m->m_pkthdr.len - esph->authsize,
 			    esph->authsize, ipseczeroes);
+		}
+	}
 #endif
 	/* NB: m is reclaimed by ipsec_process_done. */
 	err = ipsec_process_done(m, isr);
 	KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	return err;
 bad:
 	if (sav)
 		KEY_FREESAV(&sav);
 	mutex_exit(softnet_lock);
 	splx(s);
 	if (m)
 		m_freem(m);
 	free(tc, M_XDATA);
 	crypto_freereq(crp);
 	return error;
+}
 static struct xformsw esp_xformsw = {
 	XF_ESP,		XFT_CONF|XFT_AUTH,	"IPsec ESP",
 	esp_init,	esp_zeroize,		esp_input,
 	esp_output,
 	NULL,
 };
 INITFN void
 esp_attach(void)
+{
 	espstat_percpu = percpu_alloc(sizeof(uint64_t) * ESP_NSTATS);
 #define	MAXIV(xform)					\
 	if (xform.ivsize > esp_max_ivlen)		\
 		esp_max_ivlen = xform.ivsize		\
 	esp_max_ivlen = 0;
 	MAXIV(enc_xform_des);		/* SADB_EALG_DESCBC */
 	MAXIV(enc_xform_3des);		/* SADB_EALG_3DESCBC */
 	MAXIV(enc_xform_rijndael128);	/* SADB_X_EALG_AES */
 	MAXIV(enc_xform_blf);		/* SADB_X_EALG_BLOWFISHCBC */
 	MAXIV(enc_xform_cast5);		/* SADB_X_EALG_CAST128CBC */
 	MAXIV(enc_xform_skipjack);	/* SADB_X_EALG_SKIPJACK */
 	MAXIV(enc_xform_camellia);	/* SADB_X_EALG_CAMELLIACBC */
 	MAXIV(enc_xform_aes_ctr);	/* SADB_X_EALG_AESCTR */
 	MAXIV(enc_xform_null);		/* SADB_EALG_NULL */
 	xform_register(&esp_xformsw);
 #undef MAXIV
+}
 #ifdef __FreeBSD__
 SYSINIT(esp_xform_init, SI_SUB_DRIVERS, SI_ORDER_FIRST, esp_attach, NULL)
 #else
 #endif

 @@ -1,779 +1,780 @@
-/*	$NetBSD: xform_ipip.c,v 1.28.14.1 2018/02/15 14:51:44 martin Exp $	*/
+/*	$NetBSD: xform_ipip.c,v 1.28.14.2 2018/03/13 17:18:12 snj Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $	*/
 /*	$OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
+ *
  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  * and Niels Provos.
+ *
  * Additional features in 1999 by Angelos D. Keromytis.
+ *
  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
  * Angelos D. Keromytis and Niels Provos.
  * Copyright (c) 2001, Angelos D. Keromytis.
+ *
  * Permission to use, copy, and modify this software with or without fee
  * is hereby granted, provided that this entire notice is included in
  * all copies of any software which is or includes a copy or
  * modification of this software.
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.28.14.1 2018/02/15 14:51:44 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.28.14.2 2018/03/13 17:18:12 snj Exp $");
 /*
  * IP-inside-IP processing
  */
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #include "opt_random_ip_id.h"
 #endif /* __FreeBSD__ */
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/kernel.h>
 #include <sys/protosw.h>
 #include <sys/sysctl.h>
 #include <net/if.h>
 #include <net/route.h>
 #include <net/netisr.h>
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/in_var.h>
 #include <netinet/ip.h>
 #include <netinet/ip_ecn.h>
 #include <netinet/ip_var.h>
 #include <netinet/ip_encap.h>
 #ifdef __FreeBSD__
 #include <netinet/ipprotosw.h>
 #endif
 #include <netipsec/ipsec.h>
 #include <netipsec/ipsec_private.h>
 #include <netipsec/xform.h>
 #include <netipsec/ipip_var.h>
 #ifdef MROUTING
 #include <netinet/ip_mroute.h>
 #endif
 #ifdef INET6
 #include <netinet/ip6.h>
 #include <netipsec/ipsec6.h>
 #  ifdef __FreeBSD__
 #  include <netinet6/ip6_ecn.h>
 #  endif
 #include <netinet6/in6_var.h>
 #include <netinet6/ip6protosw.h>
 #endif
 #include <netipsec/key.h>
 #include <netipsec/key_debug.h>
 #include <netipsec/ipsec_osdep.h>
 #ifdef __FreeBSD__
 typedef void	pr_in_input_t (struct mbuf *, int, int); /* XXX FIX THIS */
 #else
 typedef void	pr_in_input_t (struct mbuf *m, ...);
 #endif
 /*
  * We can control the acceptance of IP4 packets by altering the sysctl
  * net.inet.ipip.allow value.  Zero means drop them, all else is acceptance.
  */
 int	ipip_allow = 0;
 percpu_t *ipipstat_percpu;
 #ifdef SYSCTL_DECL
 SYSCTL_DECL(_net_inet_ipip);
 SYSCTL_INT(_net_inet_ipip, OID_AUTO,
 	ipip_allow,	CTLFLAG_RW,	&ipip_allow,	0, "");
 SYSCTL_STRUCT(_net_inet_ipip, IPSECCTL_STATS,
 	stats,		CTLFLAG_RD,	&ipipstat,	ipipstat, "");
 #endif
 #ifdef __FreeBSD__
 static
 #endif
 void ipe4_attach(void);
 /* XXX IPCOMP */
 #define	M_IPSEC	(M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp);
 #ifdef INET6
 /*
  * Really only a wrapper for ipip_input(), for use with IPv6.
  */
 int
 ip4_input6(struct mbuf **m, int *offp, int proto)
+{
 #if 0
 	/* If we do not accept IP-in-IP explicitly, drop.  */
 	if (!ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) {
 		DPRINTF(("ip4_input6: dropped due to policy\n"));
 		IPIP_STATINC(IPIP_STAT_PDROPS);
 		m_freem(*m);
 		return IPPROTO_DONE;
+	}
 #endif
 	_ipip_input(*m, *offp, NULL);
 	return IPPROTO_DONE;
+}
 #endif /* INET6 */
 #ifdef INET
 /*
  * Really only a wrapper for ipip_input(), for use with IPv4.
  */
 void
 ip4_input(struct mbuf *m, ...)
+{
 	va_list ap;
 	int iphlen;
 #if 0
 	/* If we do not accept IP-in-IP explicitly, drop.  */
 	if (!ipip_allow && (m->m_flags & M_IPSEC) == 0) {
 		DPRINTF(("ip4_input: dropped due to policy\n"));
 		IPIP_STATINC(IPIP_STAT_PDROPS);
 		m_freem(m);
 		return;
+	}
 #endif
 	va_start(ap, m);
 	iphlen = va_arg(ap, int);
 	va_end(ap);
 	_ipip_input(m, iphlen, NULL);
+}
 #endif /* INET */
 /*
  * ipip_input gets called when we receive an IP{46} encapsulated packet,
  * either because we got it at a real interface, or because AH or ESP
  * were being used in tunnel mode (in which case the rcvif element will
  * contain the address of the encX interface associated with the tunnel.
  */
 static void
 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
+{
 	register struct sockaddr_in *sin;
 	register struct ifnet *ifp;
 	register struct ifaddr *ifa;
 	struct ifqueue *ifq = NULL;
 	struct ip *ipo;
 #ifdef INET6
 	register struct sockaddr_in6 *sin6;
 	struct ip6_hdr *ip6 = NULL;
 	u_int8_t itos;
 #endif
 	int isr;
 	u_int8_t otos;
 	u_int8_t v;
 	int hlen;
 	IPIP_STATINC(IPIP_STAT_IPACKETS);
 	m_copydata(m, 0, 1, &v);
 	switch (v >> 4) {
 #ifdef INET
         case 4:
 		hlen = sizeof(struct ip);
 		break;
 #endif /* INET */
 #ifdef INET6
         case 6:
 		hlen = sizeof(struct ip6_hdr);
 		break;
 #endif
         default:
 		DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) "
 			"for outer header\n", v, v>>4));
 		IPIP_STATINC(IPIP_STAT_FAMILY);
 		m_freem(m);
 		return /* EAFNOSUPPORT */;
+	}
 	/* Bring the IP header in the first mbuf, if not there already */
 	if (m->m_len < hlen) {
 		if ((m = m_pullup(m, hlen)) == NULL) {
 			DPRINTF(("ipip_input: m_pullup (1) failed\n"));
 			IPIP_STATINC(IPIP_STAT_HDROPS);
 			return;
+		}
+	}
 	ipo = mtod(m, struct ip *);
 #ifdef MROUTING
 	if (ipo->ip_v == IPVERSION && ipo->ip_p == IPPROTO_IPV4) {
 		if (IN_MULTICAST(((struct ip *)((char *) ipo + iphlen))->ip_dst.s_addr)) {
 			ipip_mroute_input (m, iphlen);
 			return;
+		}
+	}
 #endif /* MROUTING */
 	/* Keep outer ecn field. */
 	switch (v >> 4) {
 #ifdef INET
 	case 4:
 		otos = ipo->ip_tos;
 		break;
 #endif /* INET */
 #ifdef INET6
 	case 6:
 		otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff;
 		break;
 #endif
 	default:
 		panic("ipip_input: unknown ip version %u (outer)", v>>4);
+	}
 	/* Remove outer IP header */
 	m_adj(m, iphlen);
 	/* Sanity check */
 	if (m->m_pkthdr.len < sizeof(struct ip))  {
 		IPIP_STATINC(IPIP_STAT_HDROPS);
 		m_freem(m);
 		return;
+	}
 	m_copydata(m, 0, 1, &v);
 	switch (v >> 4) {
 #ifdef INET
         case 4:
 		hlen = sizeof(struct ip);
 		break;
 #endif /* INET */
 #ifdef INET6
         case 6:
 		hlen = sizeof(struct ip6_hdr);
 		break;
 #endif
 	default:
 		DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) "
 			"for inner header\n", v, v>>4));
 		IPIP_STATINC(IPIP_STAT_FAMILY);
 		m_freem(m);
 		return; /* EAFNOSUPPORT */
+	}
 	/*
 	 * Bring the inner IP header in the first mbuf, if not there already.
 	 */
 	if (m->m_len < hlen) {
 		if ((m = m_pullup(m, hlen)) == NULL) {
 			DPRINTF(("ipip_input: m_pullup (2) failed\n"));
 			IPIP_STATINC(IPIP_STAT_HDROPS);
 			return;
+		}
+	}
 	/*
 	 * RFC 1853 specifies that the inner TTL should not be touched on
 	 * decapsulation. There's no reason this comment should be here, but
 	 * this is as good as any a position.
 	 */
 	/* Some sanity checks in the inner IP header */
 	switch (v >> 4) {
 #ifdef INET
     	case 4:
                 ipo = mtod(m, struct ip *);
 		ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos);
                 break;
 #endif /* INET */
 #ifdef INET6
     	case 6:
-                ip6 = (struct ip6_hdr *) ipo;
+		ipo = NULL;
 		ip6 = mtod(m, struct ip6_hdr *);
 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 		ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
 		ip6->ip6_flow &= ~htonl(0xff << 20);
 		ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
                 break;
 #endif
 	default:
 		panic("ipip_input: unknown ip version %u (inner)", v>>4);
+	}
 	/* Check for local address spoofing. */
 	if ((m->m_pkthdr.rcvif == NULL ||
 	    !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) &&
 	    ipip_allow != 2) {
 		IFNET_FOREACH(ifp) {
 			IFADDR_FOREACH(ifa, ifp) {
 #ifdef INET
 				if (ipo) {
 					if (ifa->ifa_addr->sa_family !=
 					    AF_INET)
 						continue;
 					sin = (struct sockaddr_in *) ifa->ifa_addr;
 					if (sin->sin_addr.s_addr ==
 					    ipo->ip_src.s_addr)	{
 						IPIP_STATINC(IPIP_STAT_SPOOF);
 						m_freem(m);
 						return;
+					}
+				}
 #endif /* INET */
 #ifdef INET6
 				if (ip6) {
 					if (ifa->ifa_addr->sa_family !=
 					    AF_INET6)
 						continue;
 					sin6 = (struct sockaddr_in6 *) ifa->ifa_addr;
 					if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) {
 						IPIP_STATINC(IPIP_STAT_SPOOF);
 						m_freem(m);
 						return;
+					}
+				}
 #endif /* INET6 */
+			}
+		}
+	}
 	/* Statistics */
 	IPIP_STATADD(IPIP_STAT_IBYTES, m->m_pkthdr.len - iphlen);
 	/*
 	 * Interface pointer stays the same; if no IPsec processing has
 	 * been done (or will be done), this will point to a normal
 	 * interface. Otherwise, it'll point to an enc interface, which
 	 * will allow a packet filter to distinguish between secure and
 	 * untrusted packets.
 	 */
 	switch (v >> 4) {
 #ifdef INET
 	case 4:
 		ifq = &ipintrq;
 		isr = NETISR_IP;
 		break;
 #endif
 #ifdef INET6
 	case 6:
 		ifq = &ip6intrq;
 		isr = NETISR_IPV6;
 		break;
 #endif
 	default:
 		panic("ipip_input: should never reach here");
+	}
 	if (!IF_HANDOFF(ifq, m, NULL)) {
 		IPIP_STATINC(IPIP_STAT_QFULL);
 		DPRINTF(("ipip_input: packet dropped because of full queue\n"));
 	} else {
 		schednetisr(isr);
+	}
+}
 int
 ipip_output(
     struct mbuf *m,
     struct ipsecrequest *isr,
     struct mbuf **mp,
     int skip,
     int protoff
+)
+{
 	const struct secasvar *sav;
 	u_int8_t tp, otos;
 	struct secasindex *saidx;
 	int error;
 #ifdef INET
 	u_int8_t itos;
 	struct ip *ipo;
 #endif /* INET */
 #ifdef INET6
 	struct ip6_hdr *ip6, *ip6o;
 #endif /* INET6 */
 	IPSEC_SPLASSERT_SOFTNET("ipip_output");
 	sav = isr->sav;
 	IPSEC_ASSERT(sav != NULL, ("ipip_output: null SA"));
 	IPSEC_ASSERT(sav->sah != NULL, ("ipip_output: null SAH"));
 	/* XXX Deal with empty TDB source/destination addresses. */
 	m_copydata(m, 0, 1, &tp);
 	tp = (tp >> 4) & 0xff;  /* Get the IP version number. */
 	saidx = &sav->sah->saidx;
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		if (saidx->src.sa.sa_family != AF_INET ||
 		    saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
 		    saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) {
 			DPRINTF(("ipip_output: unspecified tunnel endpoint "
 			    "address in SA %s/%08lx\n",
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			IPIP_STATINC(IPIP_STAT_UNSPEC);
 			error = EINVAL;
 			goto bad;
+		}
 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
 		if (m == 0) {
 			DPRINTF(("ipip_output: M_PREPEND failed\n"));
 			IPIP_STATINC(IPIP_STAT_HDROPS);
 			error = ENOBUFS;
 			goto bad;
+		}
 		ipo = mtod(m, struct ip *);
 		ipo->ip_v = IPVERSION;
 		ipo->ip_hl = 5;
 		ipo->ip_len = htons(m->m_pkthdr.len);
 		ipo->ip_ttl = ip_defttl;
 		ipo->ip_sum = 0;
 		ipo->ip_src = saidx->src.sin.sin_addr;
 		ipo->ip_dst = saidx->dst.sin.sin_addr;
 #if defined(__NetBSD__)
 		ipo->ip_id = ip_newid(NULL);
 #elif defined(RANDOM_IP_ID)
 		ipo->ip_id = ip_randomid();
 #else
 		ipo->ip_id = htons(ip_id++);
 #endif
 		/* If the inner protocol is IP... */
 		if (tp == IPVERSION) {
 			/* Save ECN notification */
 			m_copydata(m, sizeof(struct ip) +
 			    offsetof(struct ip, ip_tos),
 			    sizeof(u_int8_t), &itos);
 			ipo->ip_p = IPPROTO_IPIP;
 			/*
 			 * We should be keeping tunnel soft-state and
 			 * send back ICMPs if needed.
 			 */
 			m_copydata(m, sizeof(struct ip) +
 			    offsetof(struct ip, ip_off),
 			    sizeof(u_int16_t), &ipo->ip_off);
 			ipo->ip_off &= ~ IP_OFF_CONVERT(IP_DF | IP_MF | IP_OFFMASK);
+		}
 #ifdef INET6
 		else if (tp == (IPV6_VERSION >> 4)) {
 			u_int32_t itos32;
 			/* Save ECN notification. */
 			m_copydata(m, sizeof(struct ip) +
 			    offsetof(struct ip6_hdr, ip6_flow),
 			    sizeof(u_int32_t), &itos32);
 			itos = ntohl(itos32) >> 20;
 			ipo->ip_p = IPPROTO_IPV6;
 			ipo->ip_off = 0;
+		}
 #endif /* INET6 */
 		else {
 			goto nofamily;
+		}
 		otos = 0;
 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
 		ipo->ip_tos = otos;
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) ||
 		    saidx->src.sa.sa_family != AF_INET6 ||
 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) {
 			DPRINTF(("ipip_output: unspecified tunnel endpoint "
 			    "address in SA %s/%08lx\n",
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			IPIP_STATINC(IPIP_STAT_UNSPEC);
 			error = ENOBUFS;
 			goto bad;
+		}
 		if (tp == (IPV6_VERSION >> 4)) {
 			/* scoped address handling */
 			ip6 = mtod(m, struct ip6_hdr *);
 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
 				ip6->ip6_src.s6_addr16[1] = 0;
 			if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
 				ip6->ip6_dst.s6_addr16[1] = 0;
+		}
 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
 		if (m == 0) {
 			DPRINTF(("ipip_output: M_PREPEND failed\n"));
 			IPIP_STATINC(IPIP_STAT_HDROPS);
 			error = ENOBUFS;
 			goto bad;
+		}
 		/* Initialize IPv6 header */
 		ip6o = mtod(m, struct ip6_hdr *);
 		ip6o->ip6_flow = 0;
 		ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
 		ip6o->ip6_vfc |= IPV6_VERSION;
 		ip6o->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6o));
 		ip6o->ip6_hlim = ip_defttl;
 		ip6o->ip6_dst = saidx->dst.sin6.sin6_addr;
 		ip6o->ip6_src = saidx->src.sin6.sin6_addr;
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_dst))
 			ip6o->ip6_dst.s6_addr16[1] = htons(saidx->dst.sin6.sin6_scope_id);
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6o->ip6_src))
 			ip6o->ip6_src.s6_addr16[1] = htons(saidx->src.sin6.sin6_scope_id);
 #ifdef INET
 		if (tp == IPVERSION) {
 			/* Save ECN notification */
 			m_copydata(m, sizeof(struct ip6_hdr) +
 			    offsetof(struct ip, ip_tos), sizeof(u_int8_t),
 			    &itos);
 			/* This is really IPVERSION. */
 			ip6o->ip6_nxt = IPPROTO_IPIP;
 		} else
 #endif /* INET */
 			if (tp == (IPV6_VERSION >> 4)) {
 				u_int32_t itos32;
 				/* Save ECN notification. */
 				m_copydata(m, sizeof(struct ip6_hdr) +
 				    offsetof(struct ip6_hdr, ip6_flow),
 				    sizeof(u_int32_t), &itos32);
 				itos = ntohl(itos32) >> 20;
 				ip6o->ip6_nxt = IPPROTO_IPV6;
 			} else {
 				goto nofamily;
+			}
 		otos = 0;
 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
 		ip6o->ip6_flow |= htonl((u_int32_t) otos << 20);
 		break;
 #endif /* INET6 */
 	default:
 nofamily:
 		DPRINTF(("ipip_output: unsupported protocol family %u\n",
 		    saidx->dst.sa.sa_family));
 		IPIP_STATINC(IPIP_STAT_FAMILY);
 		error = EAFNOSUPPORT;		/* XXX diffs from openbsd */
 		goto bad;
+	}
 	IPIP_STATINC(IPIP_STAT_OPACKETS);
 	*mp = m;
 #ifdef INET
 	if (saidx->dst.sa.sa_family == AF_INET) {
 #if 0
 		if (sav->tdb_xform->xf_type == XF_IP4)
 			tdb->tdb_cur_bytes +=
 			    m->m_pkthdr.len - sizeof(struct ip);
 #endif
 		IPIP_STATADD(IPIP_STAT_OBYTES,
 			     m->m_pkthdr.len - sizeof(struct ip));
+	}
 #endif /* INET */
 #ifdef INET6
 	if (saidx->dst.sa.sa_family == AF_INET6) {
 #if 0
 		if (sav->tdb_xform->xf_type == XF_IP4)
 			tdb->tdb_cur_bytes +=
 			    m->m_pkthdr.len - sizeof(struct ip6_hdr);
 #endif
 		IPIP_STATADD(IPIP_STAT_OBYTES,
 		    m->m_pkthdr.len - sizeof(struct ip6_hdr));
+	}
 #endif /* INET6 */
 	return 0;
 bad:
 	if (m)
 		m_freem(m);
 	*mp = NULL;
 	return (error);
+}
 #ifdef FAST_IPSEC
 static int
 ipe4_init(struct secasvar *sav, const struct xformsw *xsp)
+{
 	sav->tdb_xform = xsp;
 	return 0;
+}
 static int
 ipe4_zeroize(struct secasvar *sav)
+{
 	sav->tdb_xform = NULL;
 	return 0;
+}
 static int
 ipe4_input(
     struct mbuf *m,
     const struct secasvar *sav,
     int skip,
     int protoff
+)
+{
 	/* This is a rather serious mistake, so no conditional printing. */
 	printf("ipe4_input: should never be called\n");
 	if (m)
 		m_freem(m);
 	return EOPNOTSUPP;
+}
 static struct xformsw ipe4_xformsw = {
 	XF_IP4,		0,		"IPv4 Simple Encapsulation",
 	ipe4_init,	ipe4_zeroize,	ipe4_input,	ipip_output,
 	NULL,
 };
 #ifdef INET
 PR_WRAP_CTLOUTPUT(rip_ctloutput)
 PR_WRAP_USRREQ(rip_usrreq)
 #define	rip_ctloutput	rip_ctloutput_wrapper
 #define	rip_usrreq	rip_usrreq_wrapper
 extern struct domain inetdomain;
 static struct ipprotosw ipe4_protosw = {
  .pr_type = SOCK_RAW,
  .pr_domain = &inetdomain,
  .pr_protocol = IPPROTO_IPV4,
  .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
  .pr_input = ip4_input,
  .pr_output = 0,
  .pr_ctlinput = 0,
  .pr_ctloutput = rip_ctloutput,
  .pr_usrreq = rip_usrreq,
  .pr_init = 0,
  .pr_fasttimo = 0,
  .pr_slowtimo =	0,
  .pr_drain = 0,
 };
 #endif
 #ifdef INET6
 PR_WRAP_CTLOUTPUT(rip6_ctloutput)
 PR_WRAP_USRREQ(rip6_usrreq)
 #define	rip6_ctloutput	rip6_ctloutput_wrapper
 #define	rip6_usrreq	rip6_usrreq_wrapper
 extern struct domain inet6domain;
 static struct ip6protosw ipe4_protosw6 = {
  .pr_type = SOCK_RAW,
  .pr_domain = &inet6domain,
  .pr_protocol = IPPROTO_IPV6,
  .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
  .pr_input = ip4_input6,
  .pr_output = 0,
  .pr_ctlinput = 0,
  .pr_ctloutput = rip6_ctloutput,
  .pr_usrreq = rip6_usrreq,
  .pr_init = 0,
  .pr_fasttimo = 0,
  .pr_slowtimo = 0,
  .pr_drain = 0,
 };
 #endif
 #endif /* FAST_IPSEC */
 /*
  * Check the encapsulated packet to see if we want it
  */
 static int
 ipe4_encapcheck(struct mbuf *m,
     int off,
     int proto,
     void *arg
+)
+{
 	/*
 	 * Only take packets coming from IPSEC tunnels; the rest
 	 * must be handled by the gif tunnel code.  Note that we
 	 * also return a minimum priority when we want the packet
 	 * so any explicit gif tunnels take precedence.
 	 */
 	return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0);
+}
 INITFN void
 ipe4_attach(void)
+{
 	ipipstat_percpu = percpu_alloc(sizeof(uint64_t) * IPIP_NSTATS);
 	xform_register(&ipe4_xformsw);
 	/* attach to encapsulation framework */
 	/* XXX save return cookie for detach on module remove */
 #ifdef INET
 	(void) encap_attach_func(AF_INET, -1,
 		ipe4_encapcheck, (struct protosw*) &ipe4_protosw, NULL);
 #endif
 #ifdef INET6
 	(void) encap_attach_func(AF_INET6, -1,
 		ipe4_encapcheck, (struct protosw*) &ipe4_protosw6, NULL);
 #endif
+}
 #ifdef SYSINIT
 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL);
 #endif