 @@ -1,14 +1,14 @@
-/*	$NetBSD: ipsec_input.c,v 1.29 2012/01/25 21:58:10 drochner Exp $	*/
+/*	$NetBSD: ipsec_input.c,v 1.29.16.1 2018/03/13 17:47:12 snj Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $	*/
 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
  * in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
 @@ -29,27 +29,27 @@
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.29 2012/01/25 21:58:10 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.29.16.1 2018/03/13 17:47:12 snj Exp $");
 /*
  * IPsec input processing.
  */
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include "opt_ipsec.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 @@ -322,34 +322,35 @@ ipsec4_common_input_cb(struct mbuf *m, s
 		    "for SA %s/%08lx\n",
 		    ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi)));
 		IPSEC_ISTAT(sproto, ESP_STAT_HDROPS, AH_STAT_HDROPS,
 		    IPCOMP_STAT_HDROPS);
 		error = ENOBUFS;
 		goto bad;
+	}
 	ip = mtod(m, struct ip *);
 	ip->ip_len = htons(m->m_pkthdr.len);
 	prot = ip->ip_p;
 #ifdef notyet
 	/* IP-in-IP encapsulation */
 	if (prot == IPPROTO_IPIP) {
 		struct ip ipn;
 		/* ipn will now contain the inner IPv4 header */
 		/* XXX: check m_pkthdr.len */
 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), &ipn);
 #ifdef notyet
 		/* XXX PROXY address isn't recorded in SAH */
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET &&
 		    saidx->proxy.sin.sin_addr.s_addr !=
 		    INADDR_ANY &&
 		    ipn.ip_src.s_addr !=
 		    saidx->proxy.sin.sin_addr.s_addr) ||
 		    (saidx->proxy.sa.sa_family != AF_INET &&
 			saidx->proxy.sa.sa_family != 0)) {
 @@ -357,65 +358,64 @@ ipsec4_common_input_cb(struct mbuf *m, s
 			    "source address %s doesn't correspond to "
 			    "expected proxy source %s, SA %s/%08lx\n",
 			    inet_ntoa4(ipn.ip_src),
 			    ipsp_address(saidx->proxy),
 			    ipsp_address(saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 			    AH_STAT_PDROPS,
 			    IPCOMP_STAT_PDROPS);
 			error = EACCES;
 			goto bad;
+		}
 #endif /*XXX*/
+	}
 #if INET6
 	/* IPv6-in-IP encapsulation. */
 	if (prot == IPPROTO_IPV6) {
 		struct ip6_hdr ip6n;
 		/* ip6n will now contain the inner IPv6 header. */
 		/* XXX: check m_pkthdr.len */
 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), &ip6n);
 #ifdef notyet
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
 			&saidx->proxy.sin6.sin6_addr)) ||
 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
 			saidx->proxy.sa.sa_family != 0)) {
 			DPRINTF(("ipsec4_common_input_cb: inner "
 			    "source address %s doesn't correspond to "
 			    "expected proxy source %s, SA %s/%08lx\n",
 			    ip6_sprintf(&ip6n.ip6_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 			    AH_STAT_PDROPS,
 			    IPCOMP_STAT_PDROPS);
 			error = EACCES;
 			goto bad;
+		}
 #endif /*XXX*/
+	}
 #endif /* INET6 */
 #endif /* notyet */
 	/*
 	 * Record what we've done to the packet (under what SA it was
 	 * processed). If we've been passed an mtag, it means the packet
 	 * was already processed by an ethernet/crypto combo card and
 	 * thus has a tag attached with all the right information, but
 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
 	 */
 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 		    sizeof(struct tdb_ident), M_NOWAIT);
 		if (mtag == NULL) {
 @@ -641,96 +641,95 @@ ipsec6_common_input_cb(struct mbuf *m, s
 		IPSEC_ISTAT(sproto, ESP_STAT_HDROPS, AH_STAT_HDROPS,
 		    IPCOMP_STAT_HDROPS);
 		error = EACCES;
 		goto bad;
+	}
 	ip6 = mtod(m, struct ip6_hdr *);
 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 	/* Save protocol */
 	m_copydata(m, protoff, 1, &prot);
 #ifdef notyet
 #ifdef INET
 	/* IP-in-IP encapsulation */
 	if (prot == IPPROTO_IPIP) {
 		struct ip ipn;
 		/* ipn will now contain the inner IPv4 header */
 		/* XXX: check m_pkthdr.len */
 		m_copydata(m, skip, sizeof(struct ip), &ipn);
 #ifdef notyet
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET &&
 		    saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
 		    ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
 		    (saidx->proxy.sa.sa_family != AF_INET &&
 			saidx->proxy.sa.sa_family != 0)) {
 			DPRINTF(("ipsec6_common_input_cb: inner "
 			    "source address %s doesn't correspond to "
 			    "expected proxy source %s, SA %s/%08lx\n",
 			    inet_ntoa4(ipn.ip_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 			    AH_STAT_PDROPS, IPCOMP_STAT_PDROPS);
 			error = EACCES;
 			goto bad;
+		}
 #endif /*XXX*/
+	}
 #endif /* INET */
 	/* IPv6-in-IP encapsulation */
 	if (prot == IPPROTO_IPV6) {
 		struct ip6_hdr ip6n;
 		/* ip6n will now contain the inner IPv6 header. */
 		/* XXX: check m_pkthdr.len */
 		m_copydata(m, skip, sizeof(struct ip6_hdr), &ip6n);
 #ifdef notyet
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
 			&saidx->proxy.sin6.sin6_addr)) ||
 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
 			saidx->proxy.sa.sa_family != 0)) {
 			DPRINTF(("ipsec6_common_input_cb: inner "
 			    "source address %s doesn't correspond to "
 			    "expected proxy source %s, SA %s/%08lx\n",
 			    ip6_sprintf(&ip6n.ip6_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			IPSEC_ISTAT(sproto, ESP_STAT_PDROPS,
 			    AH_STAT_PDROPS, IPCOMP_STAT_PDROPS);
 			error = EACCES;
 			goto bad;
+		}
 #endif /*XXX*/
+	}
 #endif /* notyet */
 	/*
 	 * Record what we've done to the packet (under what SA it was
 	 * processed). If we've been passed an mtag, it means the packet
 	 * was already processed by an ethernet/crypto combo card and
 	 * thus has a tag attached with all the right information, but
 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
 	 */
 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 		    sizeof(struct tdb_ident), M_NOWAIT);
 		if (mtag == NULL) {