ipcomp_output.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*      $NetBSD: ipcomp_output.c,v 1.28 2008/05/05 13:41:30 ad Exp $    */
    2 /*      $KAME: ipcomp_output.c,v 1.24 2001/07/26 06:53:18 jinmei Exp $  */
    3 
    4 /*
    5  * Copyright (C) 1999 WIDE Project.
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the project nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  */
   32 
   33 /*
   34  * RFC2393 IP payload compression protocol (IPComp).
   35  */
   36 
   37 #include <sys/cdefs.h>
   38 __KERNEL_RCSID(0, "$NetBSD: ipcomp_output.c,v 1.28 2008/05/05 13:41:30 ad Exp $");
   39 
   40 #include "opt_inet.h"
   41 
   42 #include <sys/param.h>
   43 #include <sys/systm.h>
   44 #include <sys/malloc.h>
   45 #include <sys/mbuf.h>
   46 #include <sys/domain.h>
   47 #include <sys/protosw.h>
   48 #include <sys/socket.h>
   49 #include <sys/errno.h>
   50 #include <sys/time.h>
   51 #include <sys/kernel.h>
   52 #include <sys/syslog.h>
   53 
   54 #include <net/if.h>
   55 #include <net/route.h>
   56 #include <net/netisr.h>
   57 #include <net/zlib.h>
   58 #include <sys/cpu.h>
   59 
   60 #include <netinet/in.h>
   61 #include <netinet/in_systm.h>
   62 #include <netinet/in_var.h>
   63 #include <netinet/ip.h>
   64 #include <netinet/ip_var.h>
   65 #include <netinet/ip_ecn.h>
   66 
   67 #ifdef INET6
   68 #include <netinet/ip6.h>
   69 #include <netinet6/ip6_var.h>
   70 #endif
   71 #include <netinet6/ipcomp.h>
   72 
   73 #include <netinet6/ipsec.h>
   74 #include <netinet6/ipsec_private.h>
   75 #include <netkey/key.h>
   76 #include <netkey/keydb.h>
   77 
   78 #include <machine/stdarg.h>
   79 
   80 #include <net/net_osdep.h>
   81 
   82 static int ipcomp_output(struct mbuf *, u_char *, struct mbuf *,
   83         struct ipsecrequest *, int);
   84 
   85 /*
   86  * Modify the packet so that the payload is compressed.
   87  * The mbuf (m) must start with IPv4 or IPv6 header.
   88  * On failure, free the given mbuf and return non-zero.
   89  *
   90  * on invocation:
   91  *      m   nexthdrp md
   92  *      v   v        v
   93  *      IP ......... payload
   94  * during the encryption:
   95  *      m   nexthdrp mprev md
   96  *      v   v        v     v
   97  *      IP ............... ipcomp payload
   98  *                         <-----><----->
   99  *                         complen  plen
  100  *      <-> hlen
  101  *      <-----------------> compoff
  102  */
  103 static int
  104 ipcomp_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md, 
  105         struct ipsecrequest *isr, int af)
  106 {
  107         struct mbuf *n;
  108         struct mbuf *md0;
  109         struct mbuf *mcopy;
  110         struct mbuf *mprev;
  111         struct ipcomp *ipcomp;
  112         struct secasvar *sav = isr->sav;
  113         const struct ipcomp_algorithm *algo;
  114         u_int16_t cpi;          /* host order */
  115         size_t plen0, plen;     /* payload length to be compressed */
  116         size_t compoff;
  117         int afnumber;
  118         int error = 0;
  119         percpu_t *stat;
  120 
  121         switch (af) {
  122 #ifdef INET
  123         case AF_INET:
  124                 afnumber = 4;
  125                 stat = ipsecstat_percpu;
  126                 break;
  127 #endif
  128 #ifdef INET6
  129         case AF_INET6:
  130                 afnumber = 6;
  131                 stat = ipsec6stat_percpu;
  132                 break;
  133 #endif
  134         default:
  135                 ipseclog((LOG_ERR, "ipcomp_output: unsupported af %d\n", af));
  136                 return 0;       /* no change at all */
  137         }
  138 
  139         /* grab parameters */
  140         algo = ipcomp_algorithm_lookup(sav->alg_enc);
  141         if ((ntohl(sav->spi) & ~0xffff) != 0 || !algo) {
  142                 _NET_STATINC(stat, IPSEC_STAT_OUT_INVAL);
  143                 error = EINVAL;
  144                 goto fail1;
  145         }
  146         if ((sav->flags & SADB_X_EXT_RAWCPI) == 0)
  147                 cpi = sav->alg_enc;
  148         else
  149                 cpi = ntohl(sav->spi) & 0xffff;
  150 
  151         /* compute original payload length */
  152         plen = 0;
  153         for (n = md; n; n = n->m_next)
  154                 plen += n->m_len;
  155 
  156         /* if the payload is short enough, we don't need to compress */
  157         if (plen < algo->minplen)
  158                 return 0;
  159 
  160         /*
  161          * retain the original packet for two purposes:
  162          * (1) we need to backout our changes when compression is not necessary.
  163          * (2) byte lifetime computation should use the original packet.
  164          *     see RFC2401 page 23.
  165          * compromise two m_copym().  we will be going through every byte of
  166          * the payload during compression process anyways.
  167          */
  168         mcopy = m_copym(m, 0, M_COPYALL, M_NOWAIT);
  169         if (mcopy == NULL) {
  170                 error = ENOBUFS;
  171                 goto fail1;
  172         }
  173         md0 = m_copym(md, 0, M_COPYALL, M_NOWAIT);
  174         if (md0 == NULL) {
  175                 error = ENOBUFS;
  176                 goto fail2;
  177         }
  178         plen0 = plen;
  179 
  180         /* make the packet over-writable */
  181         for (mprev = m; mprev && mprev->m_next != md; mprev = mprev->m_next)
  182                 ;
  183         if (mprev == NULL || mprev->m_next != md) {
  184                 ipseclog((LOG_DEBUG, "ipcomp%d_output: md is not in chain\n",
  185                     afnumber));
  186                 _NET_STATINC(stat, IPSEC_STAT_OUT_INVAL);
  187                 error = EINVAL;
  188                 goto fail3;
  189         }
  190         mprev->m_next = NULL;
  191         if ((md = ipsec_copypkt(md)) == NULL) {
  192                 error = ENOBUFS;
  193                 goto fail3;
  194         }
  195         mprev->m_next = md;
  196 
  197         /* compress data part */
  198         if ((*algo->compress)(m, md, &plen) || mprev->m_next == NULL) {
  199                 ipseclog((LOG_ERR, "packet compression failure\n"));
  200                 m = NULL;
  201                 _NET_STATINC(stat, IPSEC_STAT_OUT_INVAL);
  202                 error = EINVAL;
  203                 goto fail3;
  204         }
  205         _NET_STATINC(stat, IPSEC_STAT_OUT_COMPHIST + sav->alg_enc);
  206         md = mprev->m_next;
  207 
  208         /*
  209          * if the packet became bigger, meaningless to use IPComp.
  210          * we've only wasted our CPU time.
  211          */
  212         if (plen0 < plen) {
  213                 m_freem(md);
  214                 m_freem(mcopy);
  215                 mprev->m_next = md0;
  216                 return 0;
  217         }
  218 
  219         /*
  220          * no need to backout change beyond here.
  221          */
  222         m_freem(md0);
  223         md0 = NULL;
  224 
  225         m->m_pkthdr.len -= plen0;
  226         m->m_pkthdr.len += plen;
  227 
  228     {
  229         /*
  230          * insert IPComp header.
  231          */
  232 #ifdef INET
  233         struct ip *ip = NULL;
  234 #endif
  235 #ifdef INET6
  236         struct ip6_hdr *ip6 = NULL;
  237 #endif
  238         size_t hlen = 0;        /* ip header len */
  239         size_t complen = sizeof(struct ipcomp);
  240 
  241         switch (af) {
  242 #ifdef INET
  243         case AF_INET:
  244                 ip = mtod(m, struct ip *);
  245                 hlen = ip->ip_hl << 2;
  246                 break;
  247 #endif
  248 #ifdef INET6
  249         case AF_INET6:
  250                 ip6 = mtod(m, struct ip6_hdr *);
  251                 hlen = sizeof(*ip6);
  252                 break;
  253 #endif
  254         }
  255 
  256         compoff = m->m_pkthdr.len - plen;
  257 
  258         /*
  259          * grow the mbuf to accommodate ipcomp header.
  260          * before: IP ... payload
  261          * after:  IP ... ipcomp payload
  262          */
  263         if (M_LEADINGSPACE(md) < complen) {
  264                 MGET(n, M_DONTWAIT, MT_DATA);
  265                 if (!n) {
  266                         error = ENOBUFS;
  267                         goto fail2;
  268                 }
  269                 n->m_len = complen;
  270                 mprev->m_next = n;
  271                 n->m_next = md;
  272                 m->m_pkthdr.len += complen;
  273                 ipcomp = mtod(n, struct ipcomp *);
  274         } else {
  275                 md->m_len += complen;
  276                 md->m_data -= complen;
  277                 m->m_pkthdr.len += complen;
  278                 ipcomp = mtod(md, struct ipcomp *);
  279         }
  280 
  281         bzero(ipcomp, sizeof(*ipcomp));
  282         ipcomp->comp_nxt = *nexthdrp;
  283         *nexthdrp = IPPROTO_IPCOMP;
  284         ipcomp->comp_cpi = htons(cpi);
  285         switch (af) {
  286 #ifdef INET
  287         case AF_INET:
  288                 if (compoff + complen + plen < IP_MAXPACKET)
  289                         ip->ip_len = htons(compoff + complen + plen);
  290                 else {
  291                         ipseclog((LOG_ERR,
  292                             "IPv4 ESP output: size exceeds limit\n"));
  293                         IPSEC_STATINC(IPSEC_STAT_OUT_INVAL);
  294                         error = EMSGSIZE;
  295                         goto fail2;
  296                 }
  297                 break;
  298 #endif
  299 #ifdef INET6
  300         case AF_INET6:
  301                 /* total packet length will be computed in ip6_output() */
  302                 break;
  303 #endif
  304         }
  305     }
  306 
  307         if (!m) {
  308                 ipseclog((LOG_DEBUG,
  309                     "NULL mbuf after compression in ipcomp%d_output",
  310                     afnumber));
  311                 _NET_STATINC(stat, IPSEC_STAT_OUT_INVAL);
  312         }
  313                 _NET_STATINC(stat, IPSEC_STAT_OUT_SUCCESS);
  314 
  315         /* compute byte lifetime against original packet */
  316         key_sa_recordxfer(sav, mcopy);
  317         m_freem(mcopy);
  318 
  319         return 0;
  320 
  321 fail3:
  322         m_freem(md0);
  323 fail2:
  324         m_freem(mcopy);
  325 fail1:
  326         m_freem(m);
  327 #if 1
  328         return error;
  329 #else
  330         panic("something bad in ipcomp_output");
  331 #endif
  332 }
  333 
  334 #ifdef INET
  335 int
  336 ipcomp4_output(struct mbuf *m, struct ipsecrequest *isr)
  337 {
  338         struct ip *ip;
  339         if (m->m_len < sizeof(struct ip)) {
  340                 ipseclog((LOG_DEBUG, "ipcomp4_output: first mbuf too short\n"));
  341                 IPSEC_STATINC(IPSEC_STAT_OUT_INVAL);
  342                 m_freem(m);
  343                 return EINVAL;
  344         }
  345         ip = mtod(m, struct ip *);
  346         /* XXX assumes that m->m_next points to payload */
  347         return ipcomp_output(m, &ip->ip_p, m->m_next, isr, AF_INET);
  348 }
  349 #endif /* INET */
  350 
  351 #ifdef INET6
  352 int
  353 ipcomp6_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md, 
  354         struct ipsecrequest *isr)
  355 {
  356         if (m->m_len < sizeof(struct ip6_hdr)) {
  357                 ipseclog((LOG_DEBUG, "ipcomp6_output: first mbuf too short\n"));
  358                 IPSEC6_STATINC(IPSEC_STAT_OUT_INVAL);
  359                 m_freem(m);
  360                 return EINVAL;
  361         }
  362         return ipcomp_output(m, nexthdrp, md, isr, AF_INET6);
  363 }
  364 #endif /* INET6 */
Cache object: 91534ab6e17de56dcc5b5510e24e20fe
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netinet6/ipcomp_output.c

FreeBSD/Linux Kernel Cross Reference
sys/netinet6/ipcomp_output.c
