 @@ -1,14 +1,14 @@
-/*	$NetBSD: if_ipsec.c,v 1.19 2018/12/07 05:09:39 knakahara Exp $  */
+/*	$NetBSD: if_ipsec.c,v 1.20 2018/12/26 08:55:14 knakahara Exp $  */
 /*
  * Copyright (c) 2017 Internet Initiative Japan Inc.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -17,27 +17,27 @@
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ipsec.c,v 1.19 2018/12/07 05:09:39 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ipsec.c,v 1.20 2018/12/26 08:55:14 knakahara Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/sockio.h>
 #include <sys/errno.h>
 #include <sys/ioctl.h>
 @@ -1585,34 +1585,27 @@ if_ipsec_add_sp0(struct sockaddr *src, i
 	if_ipsec_add_pad(m, padlen);
 	if_ipsec_add_mbuf(m, &xdst, sizeof(xdst));
 	/* ditto */
 	if_ipsec_add_mbuf_addr_port(m, dst, 0, true);
 	padlen = PFKEY_UNUNIT64(xdst.sadb_address_len)
 		- (sizeof(xdst) + PFKEY_ALIGN8(dst->sa_len));
 	if_ipsec_add_pad(m, padlen);
 	if_ipsec_add_mbuf(m, &xpl, sizeof(xpl));
 	padlen = PFKEY_UNUNIT64(xpl.sadb_x_policy_len) - sizeof(xpl);
 	if (policy == IPSEC_POLICY_IPSEC) {
 		if_ipsec_add_mbuf(m, &xisr, sizeof(xisr));
 		/*
 		 * secpolicy.req->saidx.{src, dst} must be set port number,
 		 * when it is used for NAT-T.
 		 */
 		if_ipsec_add_mbuf_addr_port(m, src, sport, false);
 		if_ipsec_add_mbuf_addr_port(m, dst, dport, false);
 		padlen -= PFKEY_ALIGN8(sizeof(xisr));
 		padlen -= PFKEY_ALIGN8(src->sa_len + dst->sa_len);
+	}
 	if_ipsec_add_pad(m, padlen);
 	/* key_kpi_spdadd() has already done KEY_SP_REF(). */
 	return key_kpi_spdadd(m);
+}
 static int
 if_ipsec_add_sp(struct ipsec_variant *var,
     struct sockaddr *src, in_port_t sport,
     struct sockaddr *dst, in_port_t dport)
+{
 	struct ipsec_softc *sc = var->iv_softc;

 @@ -1,14 +1,14 @@
-/*	$NetBSD: key.c,v 1.258 2018/12/22 14:28:57 maxv Exp $	*/
+/*	$NetBSD: key.c,v 1.259 2018/12/26 08:55:14 knakahara Exp $	*/
 /*	$FreeBSD: key.c,v 1.3.2.3 2004/02/14 22:23:23 bms Exp $	*/
 /*	$KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -22,27 +22,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.258 2018/12/22 14:28:57 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.259 2018/12/26 08:55:14 knakahara Exp $");
 /*
  * This code is referred to RFC 2367
  */
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
 #include "opt_ipsec.h"
 #include "opt_gateway.h"
 #include "opt_net_mpsafe.h"
 #endif
 #include <sys/types.h>
 @@ -1962,26 +1962,40 @@ _key_msg2sp(const struct sadb_x_policy *
 				(*p_isr)->saidx.reqid = xisr_reqid;
+			}
 			break;
 		default:
 			IPSECLOG(LOG_DEBUG, "invalid level=%u\n",
 			    xisr->sadb_x_ipsecrequest_level);
 			*error = EINVAL;
 			goto free_exit;
+		}
 		(*p_isr)->level = xisr->sadb_x_ipsecrequest_level;
 		/* set IP addresses if there */
 		/*
 		 * NOTE:
 		 * MOBIKE Extensions for PF_KEY draft says:
 		 *     If tunnel mode is specified, the sadb_x_ipsecrequest
 		 *     structure is followed by two sockaddr structures that
 		 *     define the tunnel endpoint addresses.  In the case that
 		 *     transport mode is used, no additional addresses are
 		 *     specified.
 		 * see: https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01
+		 *
 		 * And then, the IP addresses will be set by
 		 * ipsec_fill_saidx_bymbuf() from packet in transport mode.
 		 * This behavior is used by NAT-T enabled ipsecif(4).
 		 */
 		if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
 			const struct sockaddr *paddr;
 			paddr = (const struct sockaddr *)(xisr + 1);
 			/* validity check */
 			if (paddr->sa_len > sizeof((*p_isr)->saidx.src)) {
 				IPSECLOG(LOG_DEBUG, "invalid request "
 				    "address length.\n");
 				*error = EINVAL;
 				goto free_exit;
+			}
 			memcpy(&(*p_isr)->saidx.src, paddr, paddr->sa_len);