xref: /netbsd-src/sys/netipsec/xform_ipcomp.c (revision c9496f6b604074a9451a67df576a5b423068e71e)
1 /*	$NetBSD: xform_ipcomp.c,v 1.53 2017/10/03 08:56:52 ozaki-r Exp $	*/
2 /*	$FreeBSD: src/sys/netipsec/xform_ipcomp.c,v 1.1.4.1 2003/01/24 05:11:36 sam Exp $	*/
3 /* $OpenBSD: ip_ipcomp.c,v 1.1 2001/07/05 12:08:52 jjbg Exp $ */
4 
5 /*
6  * Copyright (c) 2001 Jean-Jacques Bernard-Gundol (jj@wabbitt.org)
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *   notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *   notice, this list of conditions and the following disclaimer in the
16  *   documentation and/or other materials provided with the distribution.
17  * 3. The name of the author may not be used to endorse or promote products
18  *   derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 #include <sys/cdefs.h>
33 __KERNEL_RCSID(0, "$NetBSD: xform_ipcomp.c,v 1.53 2017/10/03 08:56:52 ozaki-r Exp $");
34 
35 /* IP payload compression protocol (IPComp), see RFC 2393 */
36 #if defined(_KERNEL_OPT)
37 #include "opt_inet.h"
38 #endif
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/socket.h>
44 #include <sys/kernel.h>
45 #include <sys/protosw.h>
46 #include <sys/sysctl.h>
47 #include <sys/pool.h>
48 #include <sys/pserialize.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 
55 #include <net/route.h>
56 #include <netipsec/ipsec.h>
57 #include <netipsec/ipsec_private.h>
58 #include <netipsec/xform.h>
59 
60 #ifdef INET6
61 #include <netinet/ip6.h>
62 #include <netipsec/ipsec6.h>
63 #endif
64 
65 #include <netipsec/ipcomp.h>
66 #include <netipsec/ipcomp_var.h>
67 
68 #include <netipsec/key.h>
69 #include <netipsec/key_debug.h>
70 
71 #include <opencrypto/cryptodev.h>
72 #include <opencrypto/deflate.h>
73 #include <opencrypto/xform.h>
74 
75 percpu_t *ipcompstat_percpu;
76 
77 int	ipcomp_enable = 1;
78 
79 #ifdef __FreeBSD__
80 SYSCTL_DECL(_net_inet_ipcomp);
81 SYSCTL_INT(_net_inet_ipcomp, OID_AUTO,
82 	ipcomp_enable,	CTLFLAG_RW,	&ipcomp_enable,	0, "");
83 SYSCTL_STRUCT(_net_inet_ipcomp, IPSECCTL_STATS,
84 	stats,		CTLFLAG_RD,	&ipcompstat,	ipcompstat, "");
85 #endif /* __FreeBSD__ */
86 
87 static int ipcomp_input_cb(struct cryptop *crp);
88 static int ipcomp_output_cb(struct cryptop *crp);
89 
90 const uint8_t ipcomp_stats[256] = { SADB_CALG_STATS_INIT };
91 
92 static pool_cache_t ipcomp_tdb_crypto_pool_cache;
93 
94 const struct comp_algo *
95 ipcomp_algorithm_lookup(int alg)
96 {
97 	switch (alg) {
98 	case SADB_X_CALG_DEFLATE:
99 		return &comp_algo_deflate_nogrow;
100 	}
101 	return NULL;
102 }
103 
104 /*
105  * ipcomp_init() is called when an CPI is being set up.
106  */
107 static int
108 ipcomp_init(struct secasvar *sav, const struct xformsw *xsp)
109 {
110 	const struct comp_algo *tcomp;
111 	struct cryptoini cric;
112 	int ses;
113 
114 	/* NB: algorithm really comes in alg_enc and not alg_comp! */
115 	tcomp = ipcomp_algorithm_lookup(sav->alg_enc);
116 	if (tcomp == NULL) {
117 		DPRINTF(("%s: unsupported compression algorithm %d\n",
118 		    __func__, sav->alg_comp));
119 		return EINVAL;
120 	}
121 	sav->alg_comp = sav->alg_enc;		/* set for doing histogram */
122 	sav->tdb_xform = xsp;
123 	sav->tdb_compalgxform = tcomp;
124 
125 	/* Initialize crypto session */
126 	memset(&cric, 0, sizeof(cric));
127 	cric.cri_alg = sav->tdb_compalgxform->type;
128 
129 	ses = crypto_newsession(&sav->tdb_cryptoid, &cric, crypto_support);
130 	return ses;
131 }
132 
133 /*
134  * ipcomp_zeroize() used when IPCA is deleted
135  */
136 static int
137 ipcomp_zeroize(struct secasvar *sav)
138 {
139 	int err;
140 
141 	err = crypto_freesession(sav->tdb_cryptoid);
142 	sav->tdb_cryptoid = 0;
143 	return err;
144 }
145 
146 /*
147  * ipcomp_input() gets called to uncompress an input packet
148  */
149 static int
150 ipcomp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
151 {
152 	struct tdb_crypto *tc;
153 	struct cryptodesc *crdc;
154 	struct cryptop *crp;
155 	int error, hlen = IPCOMP_HLENGTH;
156 
157 	IPSEC_SPLASSERT_SOFTNET(__func__);
158 
159 	/* Get crypto descriptors */
160 	crp = crypto_getreq(1);
161 	if (crp == NULL) {
162 		m_freem(m);
163 		DPRINTF(("%s: no crypto descriptors\n", __func__));
164 		IPCOMP_STATINC(IPCOMP_STAT_CRYPTO);
165 		return ENOBUFS;
166 	}
167 	/* Get IPsec-specific opaque pointer */
168 	tc = pool_cache_get(ipcomp_tdb_crypto_pool_cache, PR_NOWAIT);
169 	if (tc == NULL) {
170 		m_freem(m);
171 		crypto_freereq(crp);
172 		DPRINTF(("%s: cannot allocate tdb_crypto\n", __func__));
173 		IPCOMP_STATINC(IPCOMP_STAT_CRYPTO);
174 		return ENOBUFS;
175 	}
176 
177 	error = m_makewritable(&m, 0, m->m_pkthdr.len, M_NOWAIT);
178 	if (error) {
179 		DPRINTF(("%s: m_makewritable failed\n", __func__));
180 		m_freem(m);
181 		pool_cache_put(ipcomp_tdb_crypto_pool_cache, tc);
182 		crypto_freereq(crp);
183 		IPCOMP_STATINC(IPCOMP_STAT_CRYPTO);
184 		return error;
185 	}
186 
187     {
188 	int s = pserialize_read_enter();
189 
190 	/*
191 	 * Take another reference to the SA for opencrypto callback.
192 	 */
193 	if (__predict_false(sav->state == SADB_SASTATE_DEAD)) {
194 		pserialize_read_exit(s);
195 		pool_cache_put(ipcomp_tdb_crypto_pool_cache, tc);
196 		crypto_freereq(crp);
197 		IPCOMP_STATINC(IPCOMP_STAT_NOTDB);
198 		return ENOENT;
199 	}
200 	KEY_SA_REF(sav);
201 	pserialize_read_exit(s);
202     }
203 
204 	crdc = crp->crp_desc;
205 
206 	crdc->crd_skip = skip + hlen;
207 	crdc->crd_len = m->m_pkthdr.len - (skip + hlen);
208 	crdc->crd_inject = 0; /* unused */
209 
210 	/* Decompression operation */
211 	crdc->crd_alg = sav->tdb_compalgxform->type;
212 
213 	/* Crypto operation descriptor */
214 	crp->crp_ilen = m->m_pkthdr.len - (skip + hlen);
215 	crp->crp_olen = MCLBYTES; /* hint to decompression code */
216 	crp->crp_flags = CRYPTO_F_IMBUF;
217 	crp->crp_buf = m;
218 	crp->crp_callback = ipcomp_input_cb;
219 	crp->crp_sid = sav->tdb_cryptoid;
220 	crp->crp_opaque = tc;
221 
222 	/* These are passed as-is to the callback */
223 	tc->tc_spi = sav->spi;
224 	tc->tc_dst = sav->sah->saidx.dst;
225 	tc->tc_proto = sav->sah->saidx.proto;
226 	tc->tc_protoff = protoff;
227 	tc->tc_skip = skip;
228 	tc->tc_sav = sav;
229 
230 	return crypto_dispatch(crp);
231 }
232 
233 #ifdef INET6
234 #define	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff) do {		     \
235 	if (saidx->dst.sa.sa_family == AF_INET6) {			     \
236 		error = ipsec6_common_input_cb(m, sav, skip, protoff);	     \
237 	} else {							     \
238 		error = ipsec4_common_input_cb(m, sav, skip, protoff);       \
239 	}								     \
240 } while (0)
241 #else
242 #define	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff)			     \
243 	(error = ipsec4_common_input_cb(m, sav, skip, protoff))
244 #endif
245 
246 /*
247  * IPComp input callback from the crypto driver.
248  */
249 static int
250 ipcomp_input_cb(struct cryptop *crp)
251 {
252 	char buf[IPSEC_ADDRSTRLEN];
253 	struct tdb_crypto *tc;
254 	int skip, protoff;
255 	struct mbuf *m;
256 	struct secasvar *sav;
257 	struct secasindex *saidx __diagused;
258 	int hlen = IPCOMP_HLENGTH, error, clen;
259 	uint8_t nproto;
260 	void *addr;
261 	uint16_t dport;
262 	uint16_t sport;
263 	IPSEC_DECLARE_LOCK_VARIABLE;
264 
265 	KASSERT(crp->crp_opaque != NULL);
266 	tc = crp->crp_opaque;
267 	skip = tc->tc_skip;
268 	protoff = tc->tc_protoff;
269 	m = crp->crp_buf;
270 
271 	/* find the source port for NAT-T */
272 	nat_t_ports_get(m, &dport, &sport);
273 
274 	IPSEC_ACQUIRE_GLOBAL_LOCKS();
275 
276 	sav = tc->tc_sav;
277 	if (__predict_false(!SADB_SASTATE_USABLE_P(sav))) {
278 		KEY_SA_UNREF(&sav);
279 		sav = KEY_LOOKUP_SA(&tc->tc_dst, tc->tc_proto, tc->tc_spi,
280 		    sport, dport);
281 		if (sav == NULL) {
282 			IPCOMP_STATINC(IPCOMP_STAT_NOTDB);
283 			DPRINTF(("%s: SA expired while in crypto\n", __func__));
284 			error = ENOBUFS;		/*XXX*/
285 			goto bad;
286 		}
287 	}
288 
289 	saidx = &sav->sah->saidx;
290 	KASSERTMSG(saidx->dst.sa.sa_family == AF_INET ||
291 	    saidx->dst.sa.sa_family == AF_INET6,
292 	    "unexpected protocol family %u", saidx->dst.sa.sa_family);
293 
294 	/* Check for crypto errors */
295 	if (crp->crp_etype) {
296 		/* Reset the session ID */
297 		if (sav->tdb_cryptoid != 0)
298 			sav->tdb_cryptoid = crp->crp_sid;
299 
300 		if (crp->crp_etype == EAGAIN) {
301 			KEY_SA_UNREF(&sav);
302 			IPSEC_RELEASE_GLOBAL_LOCKS();
303 			return crypto_dispatch(crp);
304 		}
305 
306 		IPCOMP_STATINC(IPCOMP_STAT_NOXFORM);
307 		DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype));
308 		error = crp->crp_etype;
309 		goto bad;
310 	}
311 
312 	IPCOMP_STATINC(IPCOMP_STAT_HIST + ipcomp_stats[sav->alg_comp]);
313 
314 	/* Update the counters */
315 	IPCOMP_STATADD(IPCOMP_STAT_IBYTES, m->m_pkthdr.len - skip - hlen);
316 
317 
318 	clen = crp->crp_olen;		/* Length of data after processing */
319 
320 	/* Release the crypto descriptors */
321 	pool_cache_put(ipcomp_tdb_crypto_pool_cache, tc);
322 	tc = NULL;
323 	crypto_freereq(crp), crp = NULL;
324 
325 	/* In case it's not done already, adjust the size of the mbuf chain */
326 	m->m_pkthdr.len = clen + hlen + skip;
327 
328 	if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == 0) {
329 		IPCOMP_STATINC(IPCOMP_STAT_HDROPS);	/*XXX*/
330 		DPRINTF(("%s: m_pullup failed\n", __func__));
331 		error = EINVAL;				/*XXX*/
332 		goto bad;
333 	}
334 
335 	/* Keep the next protocol field */
336 	addr = (uint8_t*) mtod(m, struct ip *) + skip;
337 	nproto = ((struct ipcomp *) addr)->comp_nxt;
338 	switch (nproto) {
339 	case IPPROTO_IPCOMP:
340 	case IPPROTO_AH:
341 	case IPPROTO_ESP:
342 		IPCOMP_STATINC(IPCOMP_STAT_HDROPS);
343 		DPRINTF(("%s: nested ipcomp, IPCA %s/%08lx\n", __func__,
344 		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
345 		    (u_long) ntohl(sav->spi)));
346 		error = EINVAL;
347 		goto bad;
348 	default:
349 		break;
350 	}
351 
352 	/* Remove the IPCOMP header */
353 	error = m_striphdr(m, skip, hlen);
354 	if (error) {
355 		IPCOMP_STATINC(IPCOMP_STAT_HDROPS);
356 		DPRINTF(("%s: bad mbuf chain, IPCA %s/%08lx\n", __func__,
357 		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
358 		    (u_long) ntohl(sav->spi)));
359 		goto bad;
360 	}
361 
362 	/* Restore the Next Protocol field */
363 	m_copyback(m, protoff, sizeof(uint8_t), (uint8_t *) &nproto);
364 
365 	IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff);
366 
367 	KEY_SA_UNREF(&sav);
368 	IPSEC_RELEASE_GLOBAL_LOCKS();
369 	return error;
370 bad:
371 	if (sav)
372 		KEY_SA_UNREF(&sav);
373 	IPSEC_RELEASE_GLOBAL_LOCKS();
374 	if (m)
375 		m_freem(m);
376 	if (tc != NULL)
377 		pool_cache_put(ipcomp_tdb_crypto_pool_cache, tc);
378 	if (crp)
379 		crypto_freereq(crp);
380 	return error;
381 }
382 
383 /*
384  * IPComp output routine, called by ipsec[46]_process_packet()
385  */
386 static int
387 ipcomp_output(
388     struct mbuf *m,
389     const struct ipsecrequest *isr,
390     struct secasvar *sav,
391     struct mbuf **mp,
392     int skip,
393     int protoff
394 )
395 {
396 	char buf[IPSEC_ADDRSTRLEN];
397 	const struct comp_algo *ipcompx;
398 	int error, ralen, hlen, maxpacketsize;
399 	struct cryptodesc *crdc;
400 	struct cryptop *crp;
401 	struct tdb_crypto *tc;
402 
403 	IPSEC_SPLASSERT_SOFTNET(__func__);
404 	KASSERT(sav != NULL);
405 	KASSERT(sav->tdb_compalgxform != NULL);
406 	ipcompx = sav->tdb_compalgxform;
407 
408 	ralen = m->m_pkthdr.len - skip;	/* Raw payload length before comp. */
409 
410     /* Don't process the packet if it is too short */
411 	if (ralen < ipcompx->minlen) {
412 		IPCOMP_STATINC(IPCOMP_STAT_MINLEN);
413 		return ipsec_process_done(m, isr, sav);
414 	}
415 
416 	hlen = IPCOMP_HLENGTH;
417 
418 	IPCOMP_STATINC(IPCOMP_STAT_OUTPUT);
419 
420 	/* Check for maximum packet size violations. */
421 	switch (sav->sah->saidx.dst.sa.sa_family) {
422 #ifdef INET
423 	case AF_INET:
424 		maxpacketsize =  IP_MAXPACKET;
425 		break;
426 #endif /* INET */
427 #ifdef INET6
428 	case AF_INET6:
429 		maxpacketsize =  IPV6_MAXPACKET;
430 		break;
431 #endif /* INET6 */
432 	default:
433 		IPCOMP_STATINC(IPCOMP_STAT_NOPF);
434 		DPRINTF(("%s: unknown/unsupported protocol family %d"
435 		    ", IPCA %s/%08lx\n", __func__,
436 		    sav->sah->saidx.dst.sa.sa_family,
437 		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
438 		    (u_long) ntohl(sav->spi)));
439 		error = EPFNOSUPPORT;
440 		goto bad;
441 	}
442 	if (skip + hlen + ralen > maxpacketsize) {
443 		IPCOMP_STATINC(IPCOMP_STAT_TOOBIG);
444 		DPRINTF(("%s: packet in IPCA %s/%08lx got too big "
445 		    "(len %u, max len %u)\n", __func__,
446 		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
447 		    (u_long) ntohl(sav->spi),
448 		    skip + hlen + ralen, maxpacketsize));
449 		error = EMSGSIZE;
450 		goto bad;
451 	}
452 
453 	/* Update the counters */
454 	IPCOMP_STATADD(IPCOMP_STAT_OBYTES, m->m_pkthdr.len - skip);
455 
456 	m = m_clone(m);
457 	if (m == NULL) {
458 		IPCOMP_STATINC(IPCOMP_STAT_HDROPS);
459 		DPRINTF(("%s: cannot clone mbuf chain, IPCA %s/%08lx\n",
460 		    __func__,
461 		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
462 		    (u_long) ntohl(sav->spi)));
463 		error = ENOBUFS;
464 		goto bad;
465 	}
466 
467 	/* Ok now, we can pass to the crypto processing */
468 
469 	/* Get crypto descriptors */
470 	crp = crypto_getreq(1);
471 	if (crp == NULL) {
472 		IPCOMP_STATINC(IPCOMP_STAT_CRYPTO);
473 		DPRINTF(("%s: failed to acquire crypto descriptor\n",
474 		    __func__));
475 		error = ENOBUFS;
476 		goto bad;
477 	}
478 	crdc = crp->crp_desc;
479 
480 	/* Compression descriptor */
481 	crdc->crd_skip = skip;
482 	crdc->crd_len = m->m_pkthdr.len - skip;
483 	crdc->crd_flags = CRD_F_COMP;
484 	crdc->crd_inject = skip;
485 
486 	/* Compression operation */
487 	crdc->crd_alg = ipcompx->type;
488 
489 	/* IPsec-specific opaque crypto info */
490 	tc = pool_cache_get(ipcomp_tdb_crypto_pool_cache, PR_NOWAIT);
491 	if (tc == NULL) {
492 		IPCOMP_STATINC(IPCOMP_STAT_CRYPTO);
493 		DPRINTF(("%s: failed to allocate tdb_crypto\n", __func__));
494 		crypto_freereq(crp);
495 		error = ENOBUFS;
496 		goto bad;
497 	}
498 
499     {
500 	int s = pserialize_read_enter();
501 
502 	/*
503 	 * Take another reference to the SP and the SA for opencrypto callback.
504 	 */
505 	if (__predict_false(isr->sp->state == IPSEC_SPSTATE_DEAD ||
506 	    sav->state == SADB_SASTATE_DEAD)) {
507 		pserialize_read_exit(s);
508 		pool_cache_put(ipcomp_tdb_crypto_pool_cache, tc);
509 		crypto_freereq(crp);
510 		IPCOMP_STATINC(IPCOMP_STAT_NOTDB);
511 		error = ENOENT;
512 		goto bad;
513 	}
514 	KEY_SP_REF(isr->sp);
515 	KEY_SA_REF(sav);
516 	pserialize_read_exit(s);
517     }
518 
519 	tc->tc_isr = isr;
520 	tc->tc_spi = sav->spi;
521 	tc->tc_dst = sav->sah->saidx.dst;
522 	tc->tc_proto = sav->sah->saidx.proto;
523 	tc->tc_skip = skip;
524 	tc->tc_protoff = protoff;
525 	tc->tc_sav = sav;
526 
527 	/* Crypto operation descriptor */
528 	crp->crp_ilen = m->m_pkthdr.len;	/* Total input length */
529 	crp->crp_flags = CRYPTO_F_IMBUF;
530 	crp->crp_buf = m;
531 	crp->crp_callback = ipcomp_output_cb;
532 	crp->crp_opaque = tc;
533 	crp->crp_sid = sav->tdb_cryptoid;
534 
535 	return crypto_dispatch(crp);
536 bad:
537 	if (m)
538 		m_freem(m);
539 	return (error);
540 }
541 
542 /*
543  * IPComp output callback from the crypto driver.
544  */
545 static int
546 ipcomp_output_cb(struct cryptop *crp)
547 {
548 	char buf[IPSEC_ADDRSTRLEN];
549 	struct tdb_crypto *tc;
550 	const struct ipsecrequest *isr;
551 	struct secasvar *sav;
552 	struct mbuf *m, *mo;
553 	int error, skip, rlen, roff;
554 	uint8_t prot;
555 	uint16_t cpi;
556 	struct ipcomp * ipcomp;
557 	IPSEC_DECLARE_LOCK_VARIABLE;
558 
559 	KASSERT(crp->crp_opaque != NULL);
560 	tc = crp->crp_opaque;
561 	m = crp->crp_buf;
562 	skip = tc->tc_skip;
563 	rlen = crp->crp_ilen - skip;
564 
565 	IPSEC_ACQUIRE_GLOBAL_LOCKS();
566 
567 	isr = tc->tc_isr;
568 	sav = tc->tc_sav;
569 	if (__predict_false(isr->sp->state == IPSEC_SPSTATE_DEAD)) {
570 		IPCOMP_STATINC(IPCOMP_STAT_NOTDB);
571 		IPSECLOG(LOG_DEBUG,
572 		    "SP is being destroyed while in crypto (id=%u)\n",
573 		    isr->sp->id);
574 		error = ENOENT;
575 		goto bad;
576 	}
577 	if (__predict_false(!SADB_SASTATE_USABLE_P(sav))) {
578 		KEY_SA_UNREF(&sav);
579 		sav = KEY_LOOKUP_SA(&tc->tc_dst, tc->tc_proto, tc->tc_spi, 0, 0);
580 		if (sav == NULL) {
581 			IPCOMP_STATINC(IPCOMP_STAT_NOTDB);
582 			DPRINTF(("%s: SA expired while in crypto\n", __func__));
583 			error = ENOBUFS;		/*XXX*/
584 			goto bad;
585 		}
586 	}
587 
588 	/* Check for crypto errors */
589 	if (crp->crp_etype) {
590 		/* Reset session ID */
591 		if (sav->tdb_cryptoid != 0)
592 			sav->tdb_cryptoid = crp->crp_sid;
593 
594 		if (crp->crp_etype == EAGAIN) {
595 			IPSEC_RELEASE_GLOBAL_LOCKS();
596 			return crypto_dispatch(crp);
597 		}
598 		IPCOMP_STATINC(IPCOMP_STAT_NOXFORM);
599 		DPRINTF(("%s: crypto error %d\n", __func__, crp->crp_etype));
600 		error = crp->crp_etype;
601 		goto bad;
602 	}
603 
604 	IPCOMP_STATINC(IPCOMP_STAT_HIST + ipcomp_stats[sav->alg_comp]);
605 
606 	if (rlen > crp->crp_olen) {
607 		/* Inject IPCOMP header */
608 		mo = m_makespace(m, skip, IPCOMP_HLENGTH, &roff);
609 		if (mo == NULL) {
610 			IPCOMP_STATINC(IPCOMP_STAT_WRAP);
611 			DPRINTF(("%s: failed to inject IPCOMP header for "
612 			    "IPCA %s/%08lx\n", __func__,
613 			    ipsec_address(&sav->sah->saidx.dst, buf,
614 			    sizeof(buf)), (u_long) ntohl(sav->spi)));
615 			error = ENOBUFS;
616 			goto bad;
617 		}
618 		ipcomp = (struct ipcomp *)(mtod(mo, char *) + roff);
619 
620 		/* Initialize the IPCOMP header */
621 		/* XXX alignment always correct? */
622 		switch (sav->sah->saidx.dst.sa.sa_family) {
623 #ifdef INET
624 		case AF_INET:
625 			ipcomp->comp_nxt = mtod(m, struct ip *)->ip_p;
626 			 break;
627 #endif /* INET */
628 #ifdef INET6
629 		case AF_INET6:
630 			ipcomp->comp_nxt = mtod(m, struct ip6_hdr *)->ip6_nxt;
631 		break;
632 #endif
633 		}
634 		ipcomp->comp_flags = 0;
635 
636 		if ((sav->flags & SADB_X_EXT_RAWCPI) == 0)
637 			 cpi = sav->alg_enc;
638 		else
639 			cpi = ntohl(sav->spi) & 0xffff;
640 		ipcomp->comp_cpi = htons(cpi);
641 
642 		/* Fix Next Protocol in IPv4/IPv6 header */
643 		prot = IPPROTO_IPCOMP;
644 		m_copyback(m, tc->tc_protoff, sizeof(uint8_t), (u_char *)&prot);
645 
646 		/* Adjust the length in the IP header */
647 		switch (sav->sah->saidx.dst.sa.sa_family) {
648 #ifdef INET
649 		case AF_INET:
650 			mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
651 			break;
652 #endif /* INET */
653 #ifdef INET6
654 		case AF_INET6:
655 			mtod(m, struct ip6_hdr *)->ip6_plen =
656 				htons(m->m_pkthdr.len) - sizeof(struct ip6_hdr);
657 			break;
658 #endif /* INET6 */
659 		default:
660 			IPCOMP_STATINC(IPCOMP_STAT_NOPF);
661 			DPRINTF(("ipcomp_output: unknown/unsupported protocol "
662 			    "family %d, IPCA %s/%08lx\n",
663 			    sav->sah->saidx.dst.sa.sa_family,
664 			    ipsec_address(&sav->sah->saidx.dst, buf,
665 			    sizeof(buf)), (u_long) ntohl(sav->spi)));
666 			error = EPFNOSUPPORT;
667 			goto bad;
668 		}
669 	} else {
670 		/* compression was useless, we have lost time */
671 		IPCOMP_STATINC(IPCOMP_STAT_USELESS);
672 		DPRINTF(("ipcomp_output_cb: compression was useless : initial size was %d"
673 				   	"and compressed size is %d\n", rlen, crp->crp_olen));
674 	}
675 
676 
677 	/* Release the crypto descriptor */
678 	pool_cache_put(ipcomp_tdb_crypto_pool_cache, tc);
679 	crypto_freereq(crp);
680 
681 	/* NB: m is reclaimed by ipsec_process_done. */
682 	error = ipsec_process_done(m, isr, sav);
683 	KEY_SA_UNREF(&sav);
684 	KEY_SP_UNREF(&isr->sp);
685 	IPSEC_RELEASE_GLOBAL_LOCKS();
686 	return error;
687 bad:
688 	if (sav)
689 		KEY_SA_UNREF(&sav);
690 	KEY_SP_UNREF(&isr->sp);
691 	IPSEC_RELEASE_GLOBAL_LOCKS();
692 	if (m)
693 		m_freem(m);
694 	pool_cache_put(ipcomp_tdb_crypto_pool_cache, tc);
695 	crypto_freereq(crp);
696 	return error;
697 }
698 
699 static struct xformsw ipcomp_xformsw = {
700 	.xf_type	= XF_IPCOMP,
701 	.xf_flags	= XFT_COMP,
702 	.xf_name	= "IPcomp",
703 	.xf_init	= ipcomp_init,
704 	.xf_zeroize	= ipcomp_zeroize,
705 	.xf_input	= ipcomp_input,
706 	.xf_output	= ipcomp_output,
707 	.xf_next	= NULL,
708 };
709 
710 void
711 ipcomp_attach(void)
712 {
713 	ipcompstat_percpu = percpu_alloc(sizeof(uint64_t) * IPCOMP_NSTATS);
714 	ipcomp_tdb_crypto_pool_cache = pool_cache_init(sizeof(struct tdb_crypto),
715 	    coherency_unit, 0, 0, "ipcomp_tdb_crypto", NULL, IPL_SOFTNET,
716 	    NULL, NULL, NULL);
717 	xform_register(&ipcomp_xformsw);
718 }
719