Hi, The function ipip_output() is registered as .xf_output() xform function. But it is never called via this pointer. It would immediatley crash as mp is always NULL when called via .xf_output().
Do not set .xf_output to ipip_output. This allows us to pass only the parameter that are actually needed and the contoll flow is clearer. ok? bluhm Index: netinet/ip_ah.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ah.c,v retrieving revision 1.154 diff -u -p -r1.154 ip_ah.c --- netinet/ip_ah.c 27 Jul 2021 17:13:03 -0000 1.154 +++ netinet/ip_ah.c 6 Oct 2021 18:06:21 -0000 @@ -884,8 +884,7 @@ ah_input_cb(struct tdb *tdb, struct tdb_ * AH output routine, called by ipsp_process_packet(). */ int -ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip, - int protoff) +ah_output(struct mbuf *m, struct tdb *tdb, int skip, int protoff) { const struct auth_hash *ahx = tdb->tdb_authalgxform; struct cryptodesc *crda; Index: netinet/ip_esp.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_esp.c,v retrieving revision 1.172 diff -u -p -r1.172 ip_esp.c --- netinet/ip_esp.c 27 Jul 2021 17:13:03 -0000 1.172 +++ netinet/ip_esp.c 6 Oct 2021 18:06:26 -0000 @@ -740,8 +740,7 @@ esp_input_cb(struct tdb *tdb, struct tdb * ESP output routine, called by ipsp_process_packet(). */ int -esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip, - int protoff) +esp_output(struct mbuf *m, struct tdb *tdb, int skip, int protoff) { const struct enc_xform *espx = tdb->tdb_encalgxform; const struct auth_hash *esph = tdb->tdb_authalgxform; Index: netinet/ip_ipcomp.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipcomp.c,v retrieving revision 1.74 diff -u -p -r1.74 ip_ipcomp.c --- netinet/ip_ipcomp.c 27 Jul 2021 17:13:03 -0000 1.74 +++ netinet/ip_ipcomp.c 6 Oct 2021 18:06:33 -0000 @@ -320,8 +320,7 @@ ipcomp_input_cb(struct tdb *tdb, struct * IPComp output routine, called by ipsp_process_packet() */ int -ipcomp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip, - int protoff) +ipcomp_output(struct mbuf *m, struct tdb *tdb, int skip, int protoff) { const struct comp_algo *ipcompx = tdb->tdb_compalgxform; int error, hlen; Index: netinet/ip_ipip.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipip.c,v retrieving revision 1.94 diff -u -p -r1.94 ip_ipip.c --- netinet/ip_ipip.c 5 Oct 2021 11:45:26 -0000 1.94 +++ netinet/ip_ipip.c 6 Oct 2021 17:52:35 -0000 @@ -331,9 +331,9 @@ ipip_input_if(struct mbuf **mp, int *off } int -ipip_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int dummy, - int dummy2) +ipip_output(struct mbuf **mp, struct tdb *tdb) { + struct mbuf *m = *mp; u_int8_t tp, otos, itos; u_int64_t obytes; struct ip *ipo; @@ -366,13 +366,14 @@ ipip_output(struct mbuf *m, struct tdb * goto drop; } - M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); - if (m == NULL) { + M_PREPEND(*mp, sizeof(struct ip), M_DONTWAIT); + if (*mp == NULL) { DPRINTF("M_PREPEND failed"); ipipstat_inc(ipips_hdrops); error = ENOBUFS; goto drop; } + m = *mp; ipo = mtod(m, struct ip *); @@ -464,13 +465,14 @@ ipip_output(struct mbuf *m, struct tdb * ip6->ip6_dst.s6_addr16[1] = 0; } - M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); - if (m == NULL) { + M_PREPEND(*mp, sizeof(struct ip6_hdr), M_DONTWAIT); + if (*mp == NULL) { DPRINTF("M_PREPEND failed"); ipipstat_inc(ipips_hdrops); error = ENOBUFS; goto drop; } + m = *mp; /* Initialize IPv6 header */ ip6o = mtod(m, struct ip6_hdr *); @@ -526,13 +528,11 @@ ipip_output(struct mbuf *m, struct tdb * goto drop; } - *mp = m; ipipstat_pkt(ipips_opackets, ipips_obytes, obytes); return 0; drop: - m_freem(m); - *mp = NULL; + m_freemp(mp); return error; } Index: netinet/ip_ipip.h =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipip.h,v retrieving revision 1.12 diff -u -p -r1.12 ip_ipip.h --- netinet/ip_ipip.h 5 Oct 2021 11:45:26 -0000 1.12 +++ netinet/ip_ipip.h 6 Oct 2021 17:53:15 -0000 @@ -115,7 +115,7 @@ struct tdb; void ipip_init(void); int ipip_input(struct mbuf **, int *, int, int); int ipip_input_if(struct mbuf **, int *, int, int, struct ifnet *); -int ipip_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); +int ipip_output(struct mbuf **, struct tdb *); int ipip_sysctl(int *, u_int, void *, size_t *, void *, size_t); extern int ipip_allow; Index: netinet/ip_ipsp.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipsp.c,v retrieving revision 1.245 diff -u -p -r1.245 ip_ipsp.c --- netinet/ip_ipsp.c 29 Sep 2021 22:08:13 -0000 1.245 +++ netinet/ip_ipsp.c 6 Oct 2021 18:08:24 -0000 @@ -135,7 +135,7 @@ const struct xformsw xformsw[] = { .xf_init = ipe4_init, .xf_zeroize = ipe4_zeroize, .xf_input = ipe4_input, - .xf_output = ipip_output, + .xf_output = NULL, }, { .xf_type = XF_AH, Index: netinet/ip_ipsp.h =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipsp.h,v retrieving revision 1.209 diff -u -p -r1.209 ip_ipsp.h --- netinet/ip_ipsp.h 5 Oct 2021 11:45:26 -0000 1.209 +++ netinet/ip_ipsp.h 6 Oct 2021 18:06:06 -0000 @@ -479,9 +479,8 @@ struct xformsw { int (*xf_init)(struct tdb *, const struct xformsw *, struct ipsecinit *); int (*xf_zeroize)(struct tdb *); /* termination */ - int (*xf_input)(struct mbuf *, struct tdb *, int, int); /* input */ - int (*xf_output)(struct mbuf *, struct tdb *, struct mbuf **, - int, int); /* output */ + int (*xf_input)(struct mbuf *, struct tdb *, int, int); + int (*xf_output)(struct mbuf *, struct tdb *, int, int); }; extern int ipsec_in_use; @@ -573,7 +572,7 @@ int ah_init(struct tdb *, const struct x int ah_zeroize(struct tdb *); int ah_input(struct mbuf *, struct tdb *, int, int); int ah_input_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int); -int ah_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); +int ah_output(struct mbuf *, struct tdb *, int, int); int ah_output_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int, int); int ah_sysctl(int *, u_int, void *, size_t *, void *, size_t); @@ -592,7 +591,7 @@ int esp_init(struct tdb *, const struct int esp_zeroize(struct tdb *); int esp_input(struct mbuf *, struct tdb *, int, int); int esp_input_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int); -int esp_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); +int esp_output(struct mbuf *, struct tdb *, int, int); int esp_output_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int, int); int esp_sysctl(int *, u_int, void *, size_t *, void *, size_t); @@ -610,7 +609,7 @@ int ipcomp_init(struct tdb *, const stru int ipcomp_zeroize(struct tdb *); int ipcomp_input(struct mbuf *, struct tdb *, int, int); int ipcomp_input_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int); -int ipcomp_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); +int ipcomp_output(struct mbuf *, struct tdb *, int, int); int ipcomp_output_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int, int); int ipcomp_sysctl(int *, u_int, void *, size_t *, void *, size_t); @@ -625,8 +624,7 @@ int tcp_signature_tdb_init(struct tdb *, struct ipsecinit *); int tcp_signature_tdb_zeroize(struct tdb *); int tcp_signature_tdb_input(struct mbuf *, struct tdb *, int, int); -int tcp_signature_tdb_output(struct mbuf *, struct tdb *, struct mbuf **, - int, int); +int tcp_signature_tdb_output(struct mbuf *, struct tdb *, int, int); /* Replay window */ int checkreplaywindow(struct tdb *, u_int64_t, u_int32_t, u_int32_t *, int); Index: netinet/ipsec_output.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ipsec_output.c,v retrieving revision 1.87 diff -u -p -r1.87 ipsec_output.c --- netinet/ipsec_output.c 5 Oct 2021 11:45:26 -0000 1.87 +++ netinet/ipsec_output.c 6 Oct 2021 18:03:43 -0000 @@ -73,7 +73,6 @@ int ipsp_process_packet(struct mbuf *m, struct tdb *tdb, int af, int tunalready) { int hlen, off, error; - struct mbuf *mp; #ifdef INET6 struct ip6_ext ip6e; int nxt; @@ -242,12 +241,10 @@ ipsp_process_packet(struct mbuf *m, stru } #endif /* INET6 */ - /* Encapsulate -- the last two arguments are unused. */ - error = ipip_output(m, tdb, &mp, 0, 0); - if ((mp == NULL) && (!error)) + /* Encapsulate -- m may be changed or set to NULL. */ + error = ipip_output(&m, tdb); + if ((m == NULL) && (!error)) error = EFAULT; - m = mp; - mp = NULL; if (error) goto drop; @@ -266,19 +263,15 @@ ipsp_process_packet(struct mbuf *m, stru /* Remember that we appended a tunnel header. */ tdb->tdb_flags |= TDBF_USEDTUNNEL; } - - /* We may be done with this TDB */ - if (tdb->tdb_xform->xf_type == XF_IP4) - return ipsp_process_done(m, tdb); - } else { - /* - * If this is just an IP-IP TDB and we're told there's - * already an encapsulation header, move on. - */ - if (tdb->tdb_xform->xf_type == XF_IP4) - return ipsp_process_done(m, tdb); } + /* + * If this is just an IP-IP TDB and we're told there's already an + * encapsulation header or ipip_output() has encapsulted it, move on. + */ + if (tdb->tdb_xform->xf_type == XF_IP4) + return ipsp_process_done(m, tdb); + /* Extract some information off the headers. */ switch (tdb->tdb_dst.sa.sa_family) { case AF_INET: @@ -377,7 +370,7 @@ ipsp_process_packet(struct mbuf *m, stru } /* Invoke the IPsec transform. */ - return (*(tdb->tdb_xform->xf_output))(m, tdb, NULL, hlen, off); + return (*(tdb->tdb_xform->xf_output))(m, tdb, hlen, off); drop: m_freem(m); Index: netinet/tcp_subr.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/tcp_subr.c,v retrieving revision 1.179 diff -u -p -r1.179 tcp_subr.c --- netinet/tcp_subr.c 14 Jul 2021 21:07:36 -0000 1.179 +++ netinet/tcp_subr.c 6 Oct 2021 18:07:53 -0000 @@ -966,8 +966,8 @@ tcp_signature_tdb_input(struct mbuf *m, } int -tcp_signature_tdb_output(struct mbuf *m, struct tdb *tdbp, struct mbuf **mp, - int skip, int protoff) +tcp_signature_tdb_output(struct mbuf *m, struct tdb *tdbp, int skip, + int protoff) { return (EINVAL); }