xnu-4903.270.47.tar.gz

[apple/xnu.git] / bsd / netinet6 / ah_output.c

diff --git a/bsd/netinet6/ah_output.c b/bsd/netinet6/ah_output.c
index 1e723fa3f7fb767a264ca0157e56ffe228302edf..d41e2f6796c5b3fff8754ee99f9dbca3ff6b630b 100644 (file)
--- a/bsd/netinet6/ah_output.c
+++ b/bsd/netinet6/ah_output.c
@@ -2,7 +2,7 @@
  * Copyright (c) 2008-2011 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * Copyright (c) 2008-2011 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

- * 
+ *

  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in


@@ -11,10 +11,10 @@
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.

- * 
+ *

  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.

- * 
+ *

  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,


@@ -22,7 +22,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.

- * 
+ *

  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 


@@ -119,33 +119,36 @@ extern lck_mtx_t *sadb_mutex;
 size_t
 ah_hdrsiz(struct ipsecrequest *isr)
 {
 size_t
 ah_hdrsiz(struct ipsecrequest *isr)
 {

-

        /* sanity check */
        /* sanity check */

-       if (isr == NULL)
+       if (isr == NULL) {

                panic("ah_hdrsiz: NULL was passed.\n");
                panic("ah_hdrsiz: NULL was passed.\n");

+       }

 
 

-       if (isr->saidx.proto != IPPROTO_AH)
+       if (isr->saidx.proto != IPPROTO_AH) {

                panic("unsupported mode passed to ah_hdrsiz");
                panic("unsupported mode passed to ah_hdrsiz");

+       }

 
 #if 0
        {
 
 #if 0
        {

-

                lck_mtx_lock(sadb_mutex);
                const struct ah_algorithm *algo;
                size_t hdrsiz;
 
                /*%%%%% this needs to change - no sav in ipsecrequest any more */
                lck_mtx_lock(sadb_mutex);
                const struct ah_algorithm *algo;
                size_t hdrsiz;
 
                /*%%%%% this needs to change - no sav in ipsecrequest any more */

-               if (isr->sav == NULL)
+               if (isr->sav == NULL) {

                        goto estimate;
                        goto estimate;

+               }

                if (isr->sav->state != SADB_SASTATE_MATURE
                if (isr->sav->state != SADB_SASTATE_MATURE

-                && isr->sav->state != SADB_SASTATE_DYING)
+                   && isr->sav->state != SADB_SASTATE_DYING) {

                        goto estimate;
                        goto estimate;

-       
+               }
+

                /* we need transport mode AH. */
                algo = ah_algorithm_lookup(isr->sav->alg_auth);
                /* we need transport mode AH. */
                algo = ah_algorithm_lookup(isr->sav->alg_auth);

-               if (!algo)
+               if (!algo) {

                        goto estimate;
                        goto estimate;

-       
+               }
+

                /*
                 * XXX
                 * right now we don't calcurate the padding size.  simply
                /*
                 * XXX
                 * right now we don't calcurate the padding size.  simply


@@ -154,11 +157,12 @@ ah_hdrsiz(struct ipsecrequest *isr)
                 * XXX variable size padding support
                 */
                hdrsiz = (((*algo->sumsiz)(isr->sav) + 3) & ~(4 - 1));
                 * XXX variable size padding support
                 */
                hdrsiz = (((*algo->sumsiz)(isr->sav) + 3) & ~(4 - 1));

-               if (isr->sav->flags & SADB_X_EXT_OLD)
+               if (isr->sav->flags & SADB_X_EXT_OLD) {

                        hdrsiz += sizeof(struct ah);
                        hdrsiz += sizeof(struct ah);

-               else
+               } else {

                        hdrsiz += sizeof(struct newah);
                        hdrsiz += sizeof(struct newah);

-       
+               }
+

                lck_mtx_unlock(sadb_mutex);
                return hdrsiz;
        }
                lck_mtx_unlock(sadb_mutex);
                return hdrsiz;
        }


@@ -166,7 +170,7 @@ ah_hdrsiz(struct ipsecrequest *isr)
 estimate:
 #endif
 
 estimate:
 #endif
 

-    //lck_mtx_unlock(sadb_mutex);
+       //lck_mtx_unlock(sadb_mutex);

        /* ASSUMING:
         *      sizeof(struct newah) > sizeof(struct ah).
         *      16 = (16 + 3) & ~(4 - 1).
        /* ASSUMING:
         *      sizeof(struct newah) > sizeof(struct ah).
         *      16 = (16 + 3) & ~(4 - 1).


@@ -189,9 +193,9 @@ ah4_output(struct mbuf *m, struct secasvar *sav)
        u_int32_t spi;
        u_char *ahdrpos;
        u_char *ahsumpos = NULL;
        u_int32_t spi;
        u_char *ahdrpos;
        u_char *ahsumpos = NULL;

-       size_t hlen = 0;        /*IP header+option in bytes*/
-       size_t plen = 0;        /*AH payload size in bytes*/
-       size_t ahlen = 0;       /*plen + sizeof(ah)*/
+       size_t hlen = 0;        /*IP header+option in bytes*/
+       size_t plen = 0;        /*AH payload size in bytes*/
+       size_t ahlen = 0;       /*plen + sizeof(ah)*/

        struct ip *ip;
        struct in_addr dst = { 0 };
        struct in_addr *finaldst;
        struct ip *ip;
        struct in_addr dst = { 0 };
        struct in_addr *finaldst;


@@ -201,10 +205,10 @@ ah4_output(struct mbuf *m, struct secasvar *sav)
        if ((sav->flags & SADB_X_EXT_OLD) == 0 && !sav->replay) {
                ip = mtod(m, struct ip *);
                ipseclog((LOG_DEBUG, "ah4_output: internal error: "
        if ((sav->flags & SADB_X_EXT_OLD) == 0 && !sav->replay) {
                ip = mtod(m, struct ip *);
                ipseclog((LOG_DEBUG, "ah4_output: internal error: "

-                       "sav->replay is null: %x->%x, SPI=%u\n",
-                       (u_int32_t)ntohl(ip->ip_src.s_addr),
-                       (u_int32_t)ntohl(ip->ip_dst.s_addr),
-                       (u_int32_t)ntohl(sav->spi)));
+                   "sav->replay is null: %x->%x, SPI=%u\n",
+                   (u_int32_t)ntohl(ip->ip_src.s_addr),
+                   (u_int32_t)ntohl(ip->ip_dst.s_addr),
+                   (u_int32_t)ntohl(sav->spi)));

                IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
                m_freem(m);
                return EINVAL;
                IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
                m_freem(m);
                return EINVAL;


@@ -243,8 +247,9 @@ ah4_output(struct mbuf *m, struct secasvar *sav)
        hlen = ip->ip_hl << 2;
 #endif
 
        hlen = ip->ip_hl << 2;
 #endif
 

-       if (m->m_len != hlen)
+       if (m->m_len != hlen) {

                panic("ah4_output: assumption failed (first mbuf length)");
                panic("ah4_output: assumption failed (first mbuf length)");

+       }

        if (M_LEADINGSPACE(m->m_next) < ahlen) {
                struct mbuf *n;
                MGET(n, M_DONTWAIT, MT_DATA);
        if (M_LEADINGSPACE(m->m_next) < ahlen) {
                struct mbuf *n;
                MGET(n, M_DONTWAIT, MT_DATA);


@@ -266,7 +271,7 @@ ah4_output(struct mbuf *m, struct secasvar *sav)
                ahdrpos = mtod(m->m_next, u_char *);
        }
 
                ahdrpos = mtod(m->m_next, u_char *);
        }
 

-       ip = mtod(m, struct ip *);      /*just to be sure*/
+       ip = mtod(m, struct ip *);      /*just to be sure*/

 
        /*
         * initialize AH.
 
        /*
         * initialize AH.


@@ -286,7 +291,7 @@ ah4_output(struct mbuf *m, struct secasvar *sav)
 
                ahdr = (struct newah *)(void *)ahdrpos;
                ahsumpos = (u_char *)(ahdr + 1);
 
                ahdr = (struct newah *)(void *)ahdrpos;
                ahsumpos = (u_char *)(ahdr + 1);

-               ahdr->ah_len = (plen >> 2) + 1; /* plus one for seq# */
+               ahdr->ah_len = (plen >> 2) + 1; /* plus one for seq# */

                ahdr->ah_nxt = ip->ip_p;
                ahdr->ah_reserve = htons(0);
                ahdr->ah_spi = spi;
                ahdr->ah_nxt = ip->ip_p;
                ahdr->ah_reserve = htons(0);
                ahdr->ah_spi = spi;


@@ -316,9 +321,9 @@ ah4_output(struct mbuf *m, struct secasvar *sav)
         * modify IPv4 header.
         */
        ip->ip_p = IPPROTO_AH;
         * modify IPv4 header.
         */
        ip->ip_p = IPPROTO_AH;

-       if (ahlen < (IP_MAXPACKET - ntohs(ip->ip_len)))
+       if (ahlen < (IP_MAXPACKET - ntohs(ip->ip_len))) {

                ip->ip_len = htons(ntohs(ip->ip_len) + ahlen);
                ip->ip_len = htons(ntohs(ip->ip_len) + ahlen);

-       else {
+       } else {

                ipseclog((LOG_ERR, "IPv4 AH output: size exceeds limit\n"));
                IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
                m_freem(m);
                ipseclog((LOG_ERR, "IPv4 AH output: size exceeds limit\n"));
                IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
                m_freem(m);


@@ -353,7 +358,7 @@ ah4_output(struct mbuf *m, struct secasvar *sav)
        }
 
        if (finaldst) {
        }
 
        if (finaldst) {

-               ip = mtod(m, struct ip *);      /*just to make sure*/
+               ip = mtod(m, struct ip *);      /*just to make sure*/

                ip->ip_dst.s_addr = dst.s_addr;
        }
        lck_mtx_lock(sadb_stat_mutex);
                ip->ip_dst.s_addr = dst.s_addr;
        }
        lck_mtx_lock(sadb_stat_mutex);


@@ -372,21 +377,22 @@ ah_hdrlen(struct secasvar *sav)
 {
        const struct ah_algorithm *algo;
        int plen, ahlen;
 {
        const struct ah_algorithm *algo;
        int plen, ahlen;

-       
+

        algo = ah_algorithm_lookup(sav->alg_auth);
        algo = ah_algorithm_lookup(sav->alg_auth);

-       if (!algo)
+       if (!algo) {

                return 0;
                return 0;

+       }

        if (sav->flags & SADB_X_EXT_OLD) {
                /* RFC 1826 */
        if (sav->flags & SADB_X_EXT_OLD) {
                /* RFC 1826 */

-               plen = ((*algo->sumsiz)(sav) + 3) & ~(4 - 1);   /*XXX pad to 8byte?*/
+               plen = ((*algo->sumsiz)(sav) + 3) & ~(4 - 1);   /*XXX pad to 8byte?*/

                ahlen = plen + sizeof(struct ah);
        } else {
                /* RFC 2402 */
                ahlen = plen + sizeof(struct ah);
        } else {
                /* RFC 2402 */

-               plen = ((*algo->sumsiz)(sav) + 3) & ~(4 - 1);   /*XXX pad to 8byte?*/
+               plen = ((*algo->sumsiz)(sav) + 3) & ~(4 - 1);   /*XXX pad to 8byte?*/

                ahlen = plen + sizeof(struct newah);
        }
 
                ahlen = plen + sizeof(struct newah);
        }
 

-       return(ahlen);
+       return ahlen;

 }
 
 #if INET6
 }
 
 #if INET6


@@ -395,14 +401,14 @@ ah_hdrlen(struct secasvar *sav)
  */
 int
 ah6_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md,
  */
 int
 ah6_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md,

-          struct secasvar *sav)
+    struct secasvar *sav)

 {
        struct mbuf *mprev;
        struct mbuf *mah;
        const struct ah_algorithm *algo;
        u_int32_t spi;
        u_char *ahsumpos = NULL;
 {
        struct mbuf *mprev;
        struct mbuf *mah;
        const struct ah_algorithm *algo;
        u_int32_t spi;
        u_char *ahsumpos = NULL;

-       size_t plen;    /*AH payload size in bytes*/
+       size_t plen;    /*AH payload size in bytes*/

        int error = 0;
        int ahlen;
        struct ip6_hdr *ip6;
        int error = 0;
        int ahlen;
        struct ip6_hdr *ip6;


@@ -414,11 +420,13 @@ ah6_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md,
        }
 
        ahlen = ah_hdrlen(sav);
        }
 
        ahlen = ah_hdrlen(sav);

-       if (ahlen == 0)
+       if (ahlen == 0) {

                return 0;
                return 0;

+       }

 
 

-       for (mprev = m; mprev && mprev->m_next != md; mprev = mprev->m_next)
+       for (mprev = m; mprev && mprev->m_next != md; mprev = mprev->m_next) {

                ;
                ;

+       }

        if (!mprev || mprev->m_next != md) {
                ipseclog((LOG_DEBUG, "ah6_output: md is not in chain\n"));
                m_freem(m);
        if (!mprev || mprev->m_next != md) {
                ipseclog((LOG_DEBUG, "ah6_output: md is not in chain\n"));
                m_freem(m);


@@ -455,8 +463,8 @@ ah6_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md,
 
        if ((sav->flags & SADB_X_EXT_OLD) == 0 && !sav->replay) {
                ipseclog((LOG_DEBUG, "ah6_output: internal error: "
 
        if ((sav->flags & SADB_X_EXT_OLD) == 0 && !sav->replay) {
                ipseclog((LOG_DEBUG, "ah6_output: internal error: "

-                         "sav->replay is null: SPI=%u\n",
-                         (u_int32_t)ntohl(sav->spi)));
+                   "sav->replay is null: SPI=%u\n",
+                   (u_int32_t)ntohl(sav->spi)));

                IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
                m_freem(m);
                return EINVAL;
                IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
                m_freem(m);
                return EINVAL;


@@ -493,14 +501,14 @@ ah6_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md,
                ahsumpos = (u_char *)(ahdr + 1);
                ahdr->ah_nxt = *nexthdrp;
                *nexthdrp = IPPROTO_AH;
                ahsumpos = (u_char *)(ahdr + 1);
                ahdr->ah_nxt = *nexthdrp;
                *nexthdrp = IPPROTO_AH;

-               ahdr->ah_len = (plen >> 2) + 1; /* plus one for seq# */
+               ahdr->ah_len = (plen >> 2) + 1; /* plus one for seq# */

                ahdr->ah_reserve = htons(0);
                ahdr->ah_spi = spi;
                if (sav->replay->count == ~0) {
                        if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
                                /* XXX Is it noisy ? */
                                ipseclog((LOG_WARNING,
                ahdr->ah_reserve = htons(0);
                ahdr->ah_spi = spi;
                if (sav->replay->count == ~0) {
                        if ((sav->flags & SADB_X_EXT_CYCSEQ) == 0) {
                                /* XXX Is it noisy ? */
                                ipseclog((LOG_WARNING,

-                                    "replay counter overflowed. %s\n",
+                                   "replay counter overflowed. %s\n",

                                    ipsec_logsastr(sav)));
                                IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
                                m_freem(m);
                                    ipsec_logsastr(sav)));
                                IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
                                m_freem(m);


@@ -532,7 +540,7 @@ ah6_output(struct mbuf *m, u_char *nexthdrp, struct mbuf *md,
        }
        IPSEC_STAT_INCREMENT(ipsec6stat.out_ahhist[sav->alg_auth]);
 
        }
        IPSEC_STAT_INCREMENT(ipsec6stat.out_ahhist[sav->alg_auth]);
 

-       return(error);
+       return error;

 }
 #endif
 
 }
 #endif
 


@@ -554,8 +562,9 @@ ah4_finaldst(struct mbuf *m)
        int i;
        int hlen;
 
        int i;
        int hlen;
 

-       if (!m)
+       if (!m) {

                panic("ah4_finaldst: m == NULL");
                panic("ah4_finaldst: m == NULL");

+       }

        ip = mtod(m, struct ip *);
 #ifdef _IP_VHL
        hlen = IP_VHL_HL(ip->ip_vhl) << 2;
        ip = mtod(m, struct ip *);
 #ifdef _IP_VHL
        hlen = IP_VHL_HL(ip->ip_vhl) << 2;


@@ -569,8 +578,9 @@ ah4_finaldst(struct mbuf *m)
                return NULL;
        }
 
                return NULL;
        }
 

-       if (hlen == sizeof(struct ip))
+       if (hlen == sizeof(struct ip)) {

                return NULL;
                return NULL;

+       }

 
        optlen = hlen - sizeof(struct ip);
        if (optlen < 0) {
 
        optlen = hlen - sizeof(struct ip);
        if (optlen < 0) {


@@ -582,18 +592,20 @@ ah4_finaldst(struct mbuf *m)
        q = (u_char *)(ip + 1);
        i = 0;
        while (i < optlen) {
        q = (u_char *)(ip + 1);
        i = 0;
        while (i < optlen) {

-               if (i + IPOPT_OPTVAL >= optlen)
+               if (i + IPOPT_OPTVAL >= optlen) {

                        return NULL;
                        return NULL;

+               }

                if (q[i + IPOPT_OPTVAL] == IPOPT_EOL ||
                    q[i + IPOPT_OPTVAL] == IPOPT_NOP ||
                if (q[i + IPOPT_OPTVAL] == IPOPT_EOL ||
                    q[i + IPOPT_OPTVAL] == IPOPT_NOP ||

-                   i + IPOPT_OLEN < optlen)
+                   i + IPOPT_OLEN < optlen) {

                        ;
                        ;

-               else
+               } else {

                        return NULL;
                        return NULL;

+               }

 
                switch (q[i + IPOPT_OPTVAL]) {
                case IPOPT_EOL:
 
                switch (q[i + IPOPT_OPTVAL]) {
                case IPOPT_EOL:

-                       i = optlen;     /* bye */
+                       i = optlen;     /* bye */

                        break;
                case IPOPT_NOP:
                        i++;
                        break;
                case IPOPT_NOP:
                        i++;