Hi,
The function ipip_output() is registered as .xf_output() xform
function. But it is never called via this pointer. It would
immediatley crash as mp is always NULL when called via .xf_output().
Do not set .xf_output to ipip_output. This allows us to pass only
the parameter that are actually needed and the contoll flow is
clearer.
ok?
bluhm
Index: netinet/ip_ah.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ah.c,v
retrieving revision 1.154
diff -u -p -r1.154 ip_ah.c
--- netinet/ip_ah.c 27 Jul 2021 17:13:03 -0000 1.154
+++ netinet/ip_ah.c 6 Oct 2021 18:06:21 -0000
@@ -884,8 +884,7 @@ ah_input_cb(struct tdb *tdb, struct tdb_
* AH output routine, called by ipsp_process_packet().
*/
int
-ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
- int protoff)
+ah_output(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
{
const struct auth_hash *ahx = tdb->tdb_authalgxform;
struct cryptodesc *crda;
Index: netinet/ip_esp.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_esp.c,v
retrieving revision 1.172
diff -u -p -r1.172 ip_esp.c
--- netinet/ip_esp.c 27 Jul 2021 17:13:03 -0000 1.172
+++ netinet/ip_esp.c 6 Oct 2021 18:06:26 -0000
@@ -740,8 +740,7 @@ esp_input_cb(struct tdb *tdb, struct tdb
* ESP output routine, called by ipsp_process_packet().
*/
int
-esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
- int protoff)
+esp_output(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
{
const struct enc_xform *espx = tdb->tdb_encalgxform;
const struct auth_hash *esph = tdb->tdb_authalgxform;
Index: netinet/ip_ipcomp.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipcomp.c,v
retrieving revision 1.74
diff -u -p -r1.74 ip_ipcomp.c
--- netinet/ip_ipcomp.c 27 Jul 2021 17:13:03 -0000 1.74
+++ netinet/ip_ipcomp.c 6 Oct 2021 18:06:33 -0000
@@ -320,8 +320,7 @@ ipcomp_input_cb(struct tdb *tdb, struct
* IPComp output routine, called by ipsp_process_packet()
*/
int
-ipcomp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
- int protoff)
+ipcomp_output(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
{
const struct comp_algo *ipcompx = tdb->tdb_compalgxform;
int error, hlen;
Index: netinet/ip_ipip.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipip.c,v
retrieving revision 1.94
diff -u -p -r1.94 ip_ipip.c
--- netinet/ip_ipip.c 5 Oct 2021 11:45:26 -0000 1.94
+++ netinet/ip_ipip.c 6 Oct 2021 17:52:35 -0000
@@ -331,9 +331,9 @@ ipip_input_if(struct mbuf **mp, int *off
}
int
-ipip_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int dummy,
- int dummy2)
+ipip_output(struct mbuf **mp, struct tdb *tdb)
{
+ struct mbuf *m = *mp;
u_int8_t tp, otos, itos;
u_int64_t obytes;
struct ip *ipo;
@@ -366,13 +366,14 @@ ipip_output(struct mbuf *m, struct tdb *
goto drop;
}
- M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
- if (m == NULL) {
+ M_PREPEND(*mp, sizeof(struct ip), M_DONTWAIT);
+ if (*mp == NULL) {
DPRINTF("M_PREPEND failed");
ipipstat_inc(ipips_hdrops);
error = ENOBUFS;
goto drop;
}
+ m = *mp;
ipo = mtod(m, struct ip *);
@@ -464,13 +465,14 @@ ipip_output(struct mbuf *m, struct tdb *
ip6->ip6_dst.s6_addr16[1] = 0;
}
- M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
- if (m == NULL) {
+ M_PREPEND(*mp, sizeof(struct ip6_hdr), M_DONTWAIT);
+ if (*mp == NULL) {
DPRINTF("M_PREPEND failed");
ipipstat_inc(ipips_hdrops);
error = ENOBUFS;
goto drop;
}
+ m = *mp;
/* Initialize IPv6 header */
ip6o = mtod(m, struct ip6_hdr *);
@@ -526,13 +528,11 @@ ipip_output(struct mbuf *m, struct tdb *
goto drop;
}
- *mp = m;
ipipstat_pkt(ipips_opackets, ipips_obytes, obytes);
return 0;
drop:
- m_freem(m);
- *mp = NULL;
+ m_freemp(mp);
return error;
}
Index: netinet/ip_ipip.h
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipip.h,v
retrieving revision 1.12
diff -u -p -r1.12 ip_ipip.h
--- netinet/ip_ipip.h 5 Oct 2021 11:45:26 -0000 1.12
+++ netinet/ip_ipip.h 6 Oct 2021 17:53:15 -0000
@@ -115,7 +115,7 @@ struct tdb;
void ipip_init(void);
int ipip_input(struct mbuf **, int *, int, int);
int ipip_input_if(struct mbuf **, int *, int, int, struct ifnet *);
-int ipip_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
+int ipip_output(struct mbuf **, struct tdb *);
int ipip_sysctl(int *, u_int, void *, size_t *, void *, size_t);
extern int ipip_allow;
Index: netinet/ip_ipsp.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipsp.c,v
retrieving revision 1.245
diff -u -p -r1.245 ip_ipsp.c
--- netinet/ip_ipsp.c 29 Sep 2021 22:08:13 -0000 1.245
+++ netinet/ip_ipsp.c 6 Oct 2021 18:08:24 -0000
@@ -135,7 +135,7 @@ const struct xformsw xformsw[] = {
.xf_init = ipe4_init,
.xf_zeroize = ipe4_zeroize,
.xf_input = ipe4_input,
- .xf_output = ipip_output,
+ .xf_output = NULL,
},
{
.xf_type = XF_AH,
Index: netinet/ip_ipsp.h
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_ipsp.h,v
retrieving revision 1.209
diff -u -p -r1.209 ip_ipsp.h
--- netinet/ip_ipsp.h 5 Oct 2021 11:45:26 -0000 1.209
+++ netinet/ip_ipsp.h 6 Oct 2021 18:06:06 -0000
@@ -479,9 +479,8 @@ struct xformsw {
int (*xf_init)(struct tdb *, const struct xformsw *,
struct ipsecinit *);
int (*xf_zeroize)(struct tdb *); /* termination */
- int (*xf_input)(struct mbuf *, struct tdb *, int, int); /* input */
- int (*xf_output)(struct mbuf *, struct tdb *, struct mbuf **,
- int, int); /* output */
+ int (*xf_input)(struct mbuf *, struct tdb *, int, int);
+ int (*xf_output)(struct mbuf *, struct tdb *, int, int);
};
extern int ipsec_in_use;
@@ -573,7 +572,7 @@ int ah_init(struct tdb *, const struct x
int ah_zeroize(struct tdb *);
int ah_input(struct mbuf *, struct tdb *, int, int);
int ah_input_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int);
-int ah_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
+int ah_output(struct mbuf *, struct tdb *, int, int);
int ah_output_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int,
int);
int ah_sysctl(int *, u_int, void *, size_t *, void *, size_t);
@@ -592,7 +591,7 @@ int esp_init(struct tdb *, const struct
int esp_zeroize(struct tdb *);
int esp_input(struct mbuf *, struct tdb *, int, int);
int esp_input_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int);
-int esp_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
+int esp_output(struct mbuf *, struct tdb *, int, int);
int esp_output_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int,
int);
int esp_sysctl(int *, u_int, void *, size_t *, void *, size_t);
@@ -610,7 +609,7 @@ int ipcomp_init(struct tdb *, const stru
int ipcomp_zeroize(struct tdb *);
int ipcomp_input(struct mbuf *, struct tdb *, int, int);
int ipcomp_input_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int);
-int ipcomp_output(struct mbuf *, struct tdb *, struct mbuf **, int, int);
+int ipcomp_output(struct mbuf *, struct tdb *, int, int);
int ipcomp_output_cb(struct tdb *, struct tdb_crypto *, struct mbuf *, int,
int);
int ipcomp_sysctl(int *, u_int, void *, size_t *, void *, size_t);
@@ -625,8 +624,7 @@ int tcp_signature_tdb_init(struct tdb *,
struct ipsecinit *);
int tcp_signature_tdb_zeroize(struct tdb *);
int tcp_signature_tdb_input(struct mbuf *, struct tdb *, int, int);
-int tcp_signature_tdb_output(struct mbuf *, struct tdb *, struct mbuf **,
- int, int);
+int tcp_signature_tdb_output(struct mbuf *, struct tdb *, int, int);
/* Replay window */
int checkreplaywindow(struct tdb *, u_int64_t, u_int32_t, u_int32_t *, int);
Index: netinet/ipsec_output.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ipsec_output.c,v
retrieving revision 1.87
diff -u -p -r1.87 ipsec_output.c
--- netinet/ipsec_output.c 5 Oct 2021 11:45:26 -0000 1.87
+++ netinet/ipsec_output.c 6 Oct 2021 18:03:43 -0000
@@ -73,7 +73,6 @@ int
ipsp_process_packet(struct mbuf *m, struct tdb *tdb, int af, int tunalready)
{
int hlen, off, error;
- struct mbuf *mp;
#ifdef INET6
struct ip6_ext ip6e;
int nxt;
@@ -242,12 +241,10 @@ ipsp_process_packet(struct mbuf *m, stru
}
#endif /* INET6 */
- /* Encapsulate -- the last two arguments are unused. */
- error = ipip_output(m, tdb, &mp, 0, 0);
- if ((mp == NULL) && (!error))
+ /* Encapsulate -- m may be changed or set to NULL. */
+ error = ipip_output(&m, tdb);
+ if ((m == NULL) && (!error))
error = EFAULT;
- m = mp;
- mp = NULL;
if (error)
goto drop;
@@ -266,19 +263,15 @@ ipsp_process_packet(struct mbuf *m, stru
/* Remember that we appended a tunnel header. */
tdb->tdb_flags |= TDBF_USEDTUNNEL;
}
-
- /* We may be done with this TDB */
- if (tdb->tdb_xform->xf_type == XF_IP4)
- return ipsp_process_done(m, tdb);
- } else {
- /*
- * If this is just an IP-IP TDB and we're told there's
- * already an encapsulation header, move on.
- */
- if (tdb->tdb_xform->xf_type == XF_IP4)
- return ipsp_process_done(m, tdb);
}
+ /*
+ * If this is just an IP-IP TDB and we're told there's already an
+ * encapsulation header or ipip_output() has encapsulted it, move on.
+ */
+ if (tdb->tdb_xform->xf_type == XF_IP4)
+ return ipsp_process_done(m, tdb);
+
/* Extract some information off the headers. */
switch (tdb->tdb_dst.sa.sa_family) {
case AF_INET:
@@ -377,7 +370,7 @@ ipsp_process_packet(struct mbuf *m, stru
}
/* Invoke the IPsec transform. */
- return (*(tdb->tdb_xform->xf_output))(m, tdb, NULL, hlen, off);
+ return (*(tdb->tdb_xform->xf_output))(m, tdb, hlen, off);
drop:
m_freem(m);
Index: netinet/tcp_subr.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/tcp_subr.c,v
retrieving revision 1.179
diff -u -p -r1.179 tcp_subr.c
--- netinet/tcp_subr.c 14 Jul 2021 21:07:36 -0000 1.179
+++ netinet/tcp_subr.c 6 Oct 2021 18:07:53 -0000
@@ -966,8 +966,8 @@ tcp_signature_tdb_input(struct mbuf *m,
}
int
-tcp_signature_tdb_output(struct mbuf *m, struct tdb *tdbp, struct mbuf **mp,
- int skip, int protoff)
+tcp_signature_tdb_output(struct mbuf *m, struct tdb *tdbp, int skip,
+ int protoff)
{
return (EINVAL);
}
