[apple/xnu.git] / bsd / netinet6 / ipcomp_output.c

/*
 * Copyright (c) 2016 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

/*	$FreeBSD: src/sys/netinet6/ipcomp_output.c,v 1.1.2.2 2001/07/03 11:01:54 ume Exp $	*/
/*	$KAME: ipcomp_output.c,v 1.23 2001/01/23 08:59:37 itojun Exp $	*/

/*
 * Copyright (C) 1999 WIDE Project.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * RFC2393 IP payload compression protocol (IPComp).
 */


#include <sys/param.h>
#include <sys/systm.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/domain.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <sys/kernel.h>
#include <sys/syslog.h>

#include <net/if.h>
#include <net/route.h>
#include <libkern/zlib.h>
#include <kern/cpu_number.h>
#include <kern/locks.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/in_var.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/ip_ecn.h>

#if INET6
#include <netinet/ip6.h>
#include <netinet6/ip6_var.h>
#endif
#include <netinet6/ipcomp.h>
#if INET6
#include <netinet6/ipcomp6.h>
#endif

#include <netinet6/ipsec.h>
#if INET6
#include <netinet6/ipsec6.h>
#endif
#include <netkey/key.h>
#include <netkey/keydb.h>

#include <net/net_osdep.h>


static int ipcomp_output(struct mbuf *, u_char *, struct mbuf *,
	int, struct secasvar *sav);

/*
 * Modify the packet so that the payload is compressed.
 * The mbuf (m) must start with IPv4 or IPv6 header.
 * On failure, free the given mbuf and return non-zero.
 *
 * on invocation:
 *	m   nexthdrp md
 *	v   v        v
 *	IP ......... payload
 * during the encryption:
 *	m   nexthdrp mprev md
 *	v   v        v     v
 *	IP ............... ipcomp payload
 *	                   <-----><----->
 *	                   complen  plen
 *	<-> hlen
 *	<-----------------> compoff
 */
static int
ipcomp_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md, int af, struct secasvar *sav)
{
	struct mbuf *n;
	struct mbuf *md0;
	struct mbuf *mcopy;
	struct mbuf *mprev;
	struct ipcomp *ipcomp;
	const struct ipcomp_algorithm *algo;
	u_int16_t cpi;		/* host order */
	size_t plen0, plen;	/*payload length to be compressed*/
	size_t compoff;
	int afnumber;
	int error = 0;
	struct ipsecstat *stat;

	switch (af) {
#if INET
	case AF_INET:
		afnumber = 4;
		stat = &ipsecstat;
		break;
#endif
#if INET6
	case AF_INET6:
		afnumber = 6;
		stat = &ipsec6stat;
		break;
#endif
	default:
		ipseclog((LOG_ERR, "ipcomp_output: unsupported af %d\n", af));
		return 0;	/* no change at all */
	}

	/* grab parameters */
	algo = ipcomp_algorithm_lookup(sav->alg_enc);
	if ((ntohl(sav->spi) & ~0xffff) != 0 || !algo) {
		IPSEC_STAT_INCREMENT(stat->out_inval);
		m_freem(m);
		return EINVAL;
	}
	if ((sav->flags & SADB_X_EXT_RAWCPI) == 0)
		cpi = sav->alg_enc;
	else
		cpi = ntohl(sav->spi) & 0xffff;

	/* compute original payload length */
	plen = 0;
	for (n = md; n; n = n->m_next)
		plen += n->m_len;

	/* if the payload is short enough, we don't need to compress */
	if (plen < algo->minplen)
		return 0;

	/*
	 * retain the original packet for two purposes:
	 * (1) we need to backout our changes when compression is not necessary.
	 * (2) byte lifetime computation should use the original packet.
	 *     see RFC2401 page 23.
	 * compromise two m_copym().  we will be going through every byte of
	 * the payload during compression process anyways.
	 */
	mcopy = m_copym(m, 0, M_COPYALL, M_NOWAIT);
	if (mcopy == NULL) {
		error = ENOBUFS;
		return 0;
	}
	md0 = m_copym(md, 0, M_COPYALL, M_NOWAIT);
	if (md0 == NULL) {
		m_freem(mcopy);
		error = ENOBUFS;
		return 0;
	}
	plen0 = plen;

	/* make the packet over-writable */
	for (mprev = m; mprev && mprev->m_next != md; mprev = mprev->m_next)
		;
	if (mprev == NULL || mprev->m_next != md) {
		ipseclog((LOG_DEBUG, "ipcomp%d_output: md is not in chain\n",
		    afnumber));
		IPSEC_STAT_INCREMENT(stat->out_inval);
		m_freem(m);
		m_freem(md0);
		m_freem(mcopy);
		return EINVAL;
	}
	mprev->m_next = NULL;
	if ((md = ipsec_copypkt(md)) == NULL) {
		m_freem(m);
		m_freem(md0);
		m_freem(mcopy);
		error = ENOBUFS;
		goto fail;
	}
	mprev->m_next = md;

	/* compress data part */
	if ((*algo->compress)(m, md, &plen) || mprev->m_next == NULL) {
		ipseclog((LOG_ERR, "packet compression failure\n"));
		m = NULL;
		m_freem(md0);
		m_freem(mcopy);
		IPSEC_STAT_INCREMENT(stat->out_inval);
		error = EINVAL;
		goto fail;
	}
	IPSEC_STAT_INCREMENT(stat->out_comphist[sav->alg_enc]);
	md = mprev->m_next;

	/*
	 * if the packet became bigger, meaningless to use IPComp.
	 * we've only wasted our cpu time.
	 */
	if (plen0 < plen) {
		m_freem(md);
		m_freem(mcopy);
		mprev->m_next = md0;
		return 0;
	}

	/*
	 * no need to backout change beyond here.
	 */
	m_freem(md0);
	md0 = NULL;

	m->m_pkthdr.len -= plen0;
	m->m_pkthdr.len += plen;

    {
	/*
	 * insert IPComp header.
	 */
#if INET
	struct ip *ip = NULL;
#endif
#if INET6
	struct ip6_hdr *ip6 = NULL;
#endif
	size_t hlen = 0;	/*ip header len*/
	size_t complen = sizeof(struct ipcomp);

	switch (af) {
#if INET
	case AF_INET:
		ip = mtod(m, struct ip *);
#ifdef _IP_VHL
		hlen = IP_VHL_HL(ip->ip_vhl) << 2;
#else
		hlen = ip->ip_hl << 2;
#endif
		break;
#endif
#if INET6
	case AF_INET6:
		ip6 = mtod(m, struct ip6_hdr *);
		hlen = sizeof(*ip6);
		break;
#endif
	}

	compoff = m->m_pkthdr.len - plen;

	/*
	 * grow the mbuf to accomodate ipcomp header.
	 * before: IP ... payload
	 * after:  IP ... ipcomp payload
	 */
	if (M_LEADINGSPACE(md) < complen) {
		MGET(n, M_DONTWAIT, MT_DATA);
		if (!n) {
			m_freem(m);
			error = ENOBUFS;
			goto fail;
		}
		n->m_len = complen;
		mprev->m_next = n;
		n->m_next = md;
		m->m_pkthdr.len += complen;
		ipcomp = mtod(n, struct ipcomp *);
	} else {
		md->m_len += complen;
		md->m_data -= complen;
		m->m_pkthdr.len += complen;
		ipcomp = mtod(md, struct ipcomp *);
	}
	
	bzero(ipcomp, sizeof(*ipcomp));
	ipcomp->comp_nxt = *nexthdrp;
	*nexthdrp = IPPROTO_IPCOMP;
	ipcomp->comp_cpi = htons(cpi);
	switch (af) {
#if INET
	case AF_INET:
		if (compoff + complen + plen < IP_MAXPACKET)
			ip->ip_len = htons(compoff + complen + plen);
		else {
			ipseclog((LOG_ERR,
			    "IPv4 ESP output: size exceeds limit\n"));
			IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
			m_freem(m);
			error = EMSGSIZE;
			goto fail;
		}
		break;
#endif
#if INET6
	case AF_INET6:
		/* total packet length will be computed in ip6_output() */
		break;
#endif
	}
    }

	if (!m) {
		ipseclog((LOG_DEBUG,
		    "NULL mbuf after compression in ipcomp%d_output",
		    afnumber));
		IPSEC_STAT_INCREMENT(stat->out_inval);
	}
		IPSEC_STAT_INCREMENT(stat->out_success);

	/* compute byte lifetime against original packet */
	key_sa_recordxfer(sav, mcopy);
	m_freem(mcopy);

	return 0;

fail:
#if 1
	return error;
#else
	panic("something bad in ipcomp_output");
#endif
}

#if INET
int
ipcomp4_output(struct mbuf *m, struct secasvar *sav)
{
	struct ip *ip;
	if (m->m_len < sizeof(struct ip)) {
		ipseclog((LOG_DEBUG, "ipcomp4_output: first mbuf too short\n"));
		IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
		m_freem(m);
		return 0;
	}
	ip = mtod(m, struct ip *);
	/* XXX assumes that m->m_next points to payload */
	return ipcomp_output(m, &ip->ip_p, m->m_next, AF_INET, sav);
}
#endif /*INET*/

#if INET6
int
ipcomp6_output(
	struct mbuf *m,
	u_char *nexthdrp,
	struct mbuf *md,
	struct secasvar *sav)
{
	if (m->m_len < sizeof(struct ip6_hdr)) {
		ipseclog((LOG_DEBUG, "ipcomp6_output: first mbuf too short\n"));
		IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
		m_freem(m);
		return 0;
	}
	return ipcomp_output(m, nexthdrp, md, AF_INET6, sav);
}
#endif /*INET6*/
Commit	Line	Data
39037602 A	1	/*
	2	* Copyright (c) 2016 Apple Inc. All rights reserved.
	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28
9bccf70c A	29	/* $FreeBSD: src/sys/netinet6/ipcomp_output.c,v 1.1.2.2 2001/07/03 11:01:54 ume Exp $ */
9bccf70c A	30	/* $KAME: ipcomp_output.c,v 1.23 2001/01/23 08:59:37 itojun Exp $ */
1c79356b A	31
	32	/*
	33	* Copyright (C) 1999 WIDE Project.
	34	* All rights reserved.
	35	*
	36	* Redistribution and use in source and binary forms, with or without
	37	* modification, are permitted provided that the following conditions
	38	* are met:
	39	* 1. Redistributions of source code must retain the above copyright
	40	* notice, this list of conditions and the following disclaimer.
	41	* 2. Redistributions in binary form must reproduce the above copyright
	42	* notice, this list of conditions and the following disclaimer in the
	43	* documentation and/or other materials provided with the distribution.
	44	* 3. Neither the name of the project nor the names of its contributors
	45	* may be used to endorse or promote products derived from this software
	46	* without specific prior written permission.
	47	*
	48	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	49	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	50	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	51	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	52	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	53	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	54	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	55	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	56	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	57	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	58	* SUCH DAMAGE.
	59	*/
	60
	61	/*
	62	* RFC2393 IP payload compression protocol (IPComp).
	63	*/
	64
1c79356b A	65
	66	#include <sys/param.h>
	67	#include <sys/systm.h>
	68	#include <sys/malloc.h>
	69	#include <sys/mbuf.h>
	70	#include <sys/domain.h>
	71	#include <sys/protosw.h>
	72	#include <sys/socket.h>
	73	#include <sys/errno.h>
	74	#include <sys/time.h>
	75	#include <sys/kernel.h>
	76	#include <sys/syslog.h>
	77
	78	#include <net/if.h>
	79	#include <net/route.h>
2d21ac55	80	#include <libkern/zlib.h>
1c79356b	81	#include <kern/cpu_number.h>
91447636	82	#include <kern/locks.h>
1c79356b A	83
	84	#include <netinet/in.h>
	85	#include <netinet/in_systm.h>
	86	#include <netinet/in_var.h>
	87	#include <netinet/ip.h>
	88	#include <netinet/ip_var.h>
	89	#include <netinet/ip_ecn.h>
	90
	91	#if INET6
	92	#include <netinet/ip6.h>
	93	#include <netinet6/ip6_var.h>
	94	#endif
	95	#include <netinet6/ipcomp.h>
9bccf70c A	96	#if INET6
	97	#include <netinet6/ipcomp6.h>
	98	#endif
1c79356b A	99
1c79356b A	100	#include <netinet6/ipsec.h>
9bccf70c A	101	#if INET6
	102	#include <netinet6/ipsec6.h>
	103	#endif
1c79356b A	104	#include <netkey/key.h>
1c79356b A	105	#include <netkey/keydb.h>
1c79356b A	106
	107	#include <net/net_osdep.h>
	108
91447636 A	109
91447636 A	110	static int ipcomp_output(struct mbuf , u_char , struct mbuf *,
2d21ac55	111	int, struct secasvar *sav);
1c79356b A	112
	113	/*
	114	* Modify the packet so that the payload is compressed.
	115	* The mbuf (m) must start with IPv4 or IPv6 header.
9bccf70c	116	* On failure, free the given mbuf and return non-zero.
1c79356b A	117	*
	118	* on invocation:
	119	* m nexthdrp md
	120	* v v v
	121	* IP ......... payload
	122	* during the encryption:
	123	* m nexthdrp mprev md
	124	* v v v v
	125	* IP ............... ipcomp payload
	126	* <-----><----->
	127	* complen plen
	128	* <-> hlen
	129	* <-----------------> compoff
	130	*/
	131	static int
39037602	132	ipcomp_output(struct mbuf m, u_char nexthdrp, struct mbuf md, int af, struct secasvar sav)
1c79356b A	133	{
	134	struct mbuf *n;
	135	struct mbuf *md0;
9bccf70c	136	struct mbuf *mcopy;
1c79356b A	137	struct mbuf *mprev;
1c79356b A	138	struct ipcomp *ipcomp;
9bccf70c	139	const struct ipcomp_algorithm *algo;
1c79356b A	140	u_int16_t cpi; /* host order */
	141	size_t plen0, plen; /payload length to be compressed/
	142	size_t compoff;
	143	int afnumber;
	144	int error = 0;
9bccf70c	145	struct ipsecstat *stat;
1c79356b A	146
	147	switch (af) {
	148	#if INET
	149	case AF_INET:
	150	afnumber = 4;
9bccf70c	151	stat = &ipsecstat;
1c79356b A	152	break;
	153	#endif
	154	#if INET6
	155	case AF_INET6:
	156	afnumber = 6;
9bccf70c	157	stat = &ipsec6stat;
1c79356b A	158	break;
	159	#endif
	160	default:
	161	ipseclog((LOG_ERR, "ipcomp_output: unsupported af %d\n", af));
	162	return 0; /* no change at all */
	163	}
	164
	165	/* grab parameters */
9bccf70c A	166	algo = ipcomp_algorithm_lookup(sav->alg_enc);
9bccf70c A	167	if ((ntohl(sav->spi) & ~0xffff) != 0 \|\| !algo) {
2d21ac55	168	IPSEC_STAT_INCREMENT(stat->out_inval);
1c79356b A	169	m_freem(m);
	170	return EINVAL;
	171	}
	172	if ((sav->flags & SADB_X_EXT_RAWCPI) == 0)
	173	cpi = sav->alg_enc;
	174	else
	175	cpi = ntohl(sav->spi) & 0xffff;
1c79356b A	176
	177	/* compute original payload length */
	178	plen = 0;
	179	for (n = md; n; n = n->m_next)
	180	plen += n->m_len;
	181
	182	/* if the payload is short enough, we don't need to compress */
	183	if (plen < algo->minplen)
	184	return 0;
	185
	186	/*
9bccf70c A	187	* retain the original packet for two purposes:
	188	* (1) we need to backout our changes when compression is not necessary.
	189	* (2) byte lifetime computation should use the original packet.
	190	* see RFC2401 page 23.
	191	* compromise two m_copym(). we will be going through every byte of
	192	* the payload during compression process anyways.
1c79356b	193	*/
9bccf70c A	194	mcopy = m_copym(m, 0, M_COPYALL, M_NOWAIT);
	195	if (mcopy == NULL) {
	196	error = ENOBUFS;
	197	return 0;
	198	}
1c79356b A	199	md0 = m_copym(md, 0, M_COPYALL, M_NOWAIT);
1c79356b A	200	if (md0 == NULL) {
9bccf70c	201	m_freem(mcopy);
1c79356b A	202	error = ENOBUFS;
	203	return 0;
	204	}
	205	plen0 = plen;
	206
	207	/* make the packet over-writable */
	208	for (mprev = m; mprev && mprev->m_next != md; mprev = mprev->m_next)
	209	;
	210	if (mprev == NULL \|\| mprev->m_next != md) {
	211	ipseclog((LOG_DEBUG, "ipcomp%d_output: md is not in chain\n",
	212	afnumber));
2d21ac55	213	IPSEC_STAT_INCREMENT(stat->out_inval);
1c79356b A	214	m_freem(m);
1c79356b A	215	m_freem(md0);
9bccf70c	216	m_freem(mcopy);
1c79356b A	217	return EINVAL;
	218	}
	219	mprev->m_next = NULL;
	220	if ((md = ipsec_copypkt(md)) == NULL) {
	221	m_freem(m);
	222	m_freem(md0);
9bccf70c	223	m_freem(mcopy);
1c79356b A	224	error = ENOBUFS;
	225	goto fail;
	226	}
	227	mprev->m_next = md;
	228
	229	/* compress data part */
	230	if ((*algo->compress)(m, md, &plen) \|\| mprev->m_next == NULL) {
	231	ipseclog((LOG_ERR, "packet compression failure\n"));
	232	m = NULL;
	233	m_freem(md0);
9bccf70c	234	m_freem(mcopy);
2d21ac55	235	IPSEC_STAT_INCREMENT(stat->out_inval);
1c79356b A	236	error = EINVAL;
	237	goto fail;
	238	}
2d21ac55	239	IPSEC_STAT_INCREMENT(stat->out_comphist[sav->alg_enc]);
1c79356b A	240	md = mprev->m_next;
	241
	242	/*
	243	* if the packet became bigger, meaningless to use IPComp.
	244	* we've only wasted our cpu time.
	245	*/
	246	if (plen0 < plen) {
	247	m_freem(md);
9bccf70c	248	m_freem(mcopy);
1c79356b A	249	mprev->m_next = md0;
	250	return 0;
	251	}
	252
9bccf70c A	253	/*
	254	* no need to backout change beyond here.
	255	*/
1c79356b A	256	m_freem(md0);
1c79356b A	257	md0 = NULL;
9bccf70c	258
1c79356b A	259	m->m_pkthdr.len -= plen0;
	260	m->m_pkthdr.len += plen;
	261
	262	{
	263	/*
	264	* insert IPComp header.
	265	*/
	266	#if INET
	267	struct ip *ip = NULL;
	268	#endif
	269	#if INET6
	270	struct ip6_hdr *ip6 = NULL;
	271	#endif
	272	size_t hlen = 0; /ip header len/
	273	size_t complen = sizeof(struct ipcomp);
	274
	275	switch (af) {
	276	#if INET
	277	case AF_INET:
	278	ip = mtod(m, struct ip *);
	279	#ifdef _IP_VHL
	280	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
	281	#else
	282	hlen = ip->ip_hl << 2;
	283	#endif
	284	break;
	285	#endif
	286	#if INET6
	287	case AF_INET6:
	288	ip6 = mtod(m, struct ip6_hdr *);
	289	hlen = sizeof(*ip6);
	290	break;
	291	#endif
	292	}
	293
	294	compoff = m->m_pkthdr.len - plen;
	295
	296	/*
	297	* grow the mbuf to accomodate ipcomp header.
	298	* before: IP ... payload
	299	* after: IP ... ipcomp payload
	300	*/
	301	if (M_LEADINGSPACE(md) < complen) {
	302	MGET(n, M_DONTWAIT, MT_DATA);
	303	if (!n) {
	304	m_freem(m);
	305	error = ENOBUFS;
	306	goto fail;
	307	}
	308	n->m_len = complen;
	309	mprev->m_next = n;
	310	n->m_next = md;
	311	m->m_pkthdr.len += complen;
	312	ipcomp = mtod(n, struct ipcomp *);
	313	} else {
	314	md->m_len += complen;
	315	md->m_data -= complen;
	316	m->m_pkthdr.len += complen;
	317	ipcomp = mtod(md, struct ipcomp *);
	318	}
	319
	320	bzero(ipcomp, sizeof(*ipcomp));
	321	ipcomp->comp_nxt = *nexthdrp;
	322	*nexthdrp = IPPROTO_IPCOMP;
323	ipcomp->comp_cpi = htons(cpi);
324	switch (af) {
325	#if INET
326	case AF_INET:
327	if (compoff + complen + plen < IP_MAXPACKET)
328	ip->ip_len = htons(compoff + complen + plen);
329	else {
330	ipseclog((LOG_ERR,
331	"IPv4 ESP output: size exceeds limit\n"));
2d21ac55	332	IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
1c79356b A	333	m_freem(m);
	334	error = EMSGSIZE;
	335	goto fail;
	336	}
	337	break;
	338	#endif
	339	#if INET6
	340	case AF_INET6:
	341	/* total packet length will be computed in ip6_output() */
	342	break;
	343	#endif
	344	}
	345	}
	346
	347	if (!m) {
	348	ipseclog((LOG_DEBUG,
	349	"NULL mbuf after compression in ipcomp%d_output",
	350	afnumber));
2d21ac55	351	IPSEC_STAT_INCREMENT(stat->out_inval);
1c79356b	352	}
2d21ac55	353	IPSEC_STAT_INCREMENT(stat->out_success);
9bccf70c A	354
	355	/* compute byte lifetime against original packet */
	356	key_sa_recordxfer(sav, mcopy);
	357	m_freem(mcopy);
	358
1c79356b A	359	return 0;
	360
	361	fail:
	362	#if 1
	363	return error;
	364	#else
	365	panic("something bad in ipcomp_output");
	366	#endif
	367	}
	368
	369	#if INET
	370	int
39037602	371	ipcomp4_output(struct mbuf m, struct secasvar sav)
1c79356b A	372	{
	373	struct ip *ip;
	374	if (m->m_len < sizeof(struct ip)) {
	375	ipseclog((LOG_DEBUG, "ipcomp4_output: first mbuf too short\n"));
2d21ac55	376	IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
1c79356b	377	m_freem(m);
9bccf70c	378	return 0;
1c79356b A	379	}
	380	ip = mtod(m, struct ip *);
	381	/* XXX assumes that m->m_next points to payload */
2d21ac55	382	return ipcomp_output(m, &ip->ip_p, m->m_next, AF_INET, sav);
1c79356b A	383	}
	384	#endif /INET/
	385
2d21ac55	386	#if INET6
1c79356b	387	int
39037602 A	388	ipcomp6_output(
	389	struct mbuf *m,
	390	u_char *nexthdrp,
	391	struct mbuf *md,
	392	struct secasvar *sav)
1c79356b A	393	{
	394	if (m->m_len < sizeof(struct ip6_hdr)) {
	395	ipseclog((LOG_DEBUG, "ipcomp6_output: first mbuf too short\n"));
2d21ac55	396	IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
1c79356b	397	m_freem(m);
9bccf70c	398	return 0;
1c79356b	399	}
2d21ac55	400	return ipcomp_output(m, nexthdrp, md, AF_INET6, sav);
1c79356b A	401	}
1c79356b A	402	#endif /INET6/