sys/netproto/ipsec/xform_ipcomp.c

   1 /*      $FreeBSD: src/sys/netipsec/xform_ipcomp.c,v 1.1.4.2 2003/02/26 00:14:06 sam Exp $       */
   2 /* $OpenBSD: ip_ipcomp.c,v 1.1 2001/07/05 12:08:52 jjbg Exp $ */
   3
   4 /*
   5  * Copyright (c) 2001 Jean-Jacques Bernard-Gundol (jj@wabbitt.org)
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *   notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *   notice, this list of conditions and the following disclaimer in the
  15  *   documentation and/or other materials provided with the distribution.
  16  * 3. The name of the author may not be used to endorse or promote products
  17  *   derived from this software without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* IP payload compression protocol (IPComp), see RFC 2393 */
  32 #include "opt_inet.h"
  33 #include "opt_inet6.h"
  34
  35 #include <sys/param.h>
  36 #include <sys/systm.h>
  37 #include <sys/mbuf.h>
  38 #include <sys/socket.h>
  39 #include <sys/kernel.h>
  40 #include <sys/protosw.h>
  41 #include <sys/sysctl.h>
  42 #include <sys/thread2.h>
  43
  44 #include <netinet/in.h>
  45 #include <netinet/in_systm.h>
  46 #include <netinet/ip.h>
  47 #include <netinet/ip_var.h>
  48
  49 #include <net/route.h>
  50 #include <netproto/ipsec/ipsec.h>
  51 #include <netproto/ipsec/xform.h>
  52
  53 #ifdef INET6
  54 #include <netinet/ip6.h>
  55 #include <netproto/ipsec/ipsec6.h>
  56 #endif
  57
  58 #include <netproto/ipsec/ipcomp.h>
  59 #include <netproto/ipsec/ipcomp_var.h>
  60
  61 #include <netproto/ipsec/key.h>
  62 #include <netproto/ipsec/key_debug.h>
  63
  64 #include <opencrypto/cryptodev.h>
  65 #include <opencrypto/deflate.h>
  66 #include <opencrypto/xform.h>
  67
  68 int     ipcomp_enable = 0;
  69 struct  ipcompstat ipcompstat;
  70
  71 SYSCTL_DECL(_net_inet_ipcomp);
  72 SYSCTL_INT(_net_inet_ipcomp, OID_AUTO,
  73         ipcomp_enable,  CTLFLAG_RW,     &ipcomp_enable, 0, "");
  74 SYSCTL_STRUCT(_net_inet_ipcomp, IPSECCTL_STATS,
  75         stats,          CTLFLAG_RD,     &ipcompstat,    ipcompstat, "");
  76
  77 static int ipcomp_input_cb(struct cryptop *crp);
  78 static int ipcomp_output_cb(struct cryptop *crp);
  79
  80 struct comp_algo *
  81 ipcomp_algorithm_lookup(int alg)
  82 {
  83         if (alg >= IPCOMP_ALG_MAX)
  84                 return NULL;
  85         switch (alg) {
  86         case SADB_X_CALG_DEFLATE:
  87                 return &comp_algo_deflate;
  88         }
  89         return NULL;
  90 }
  91
  92 /*
  93  * ipcomp_init() is called when an CPI is being set up.
  94  */
  95 static int
  96 ipcomp_init(struct secasvar *sav, struct xformsw *xsp)
  97 {
  98         struct comp_algo *tcomp;
  99         struct cryptoini cric;
 100
 101         /* NB: algorithm really comes in alg_enc and not alg_comp! */
 102         tcomp = ipcomp_algorithm_lookup(sav->alg_enc);
 103         if (tcomp == NULL) {
 104                 DPRINTF(("ipcomp_init: unsupported compression algorithm %d\n",
 105                          sav->alg_comp));
 106                 return EINVAL;
 107         }
 108         sav->alg_comp = sav->alg_enc;           /* set for doing histogram */
 109         sav->tdb_xform = xsp;
 110         sav->tdb_compalgxform = tcomp;
 111
 112         /* Initialize crypto session */
 113         bzero(&cric, sizeof (cric));
 114         cric.cri_alg = sav->tdb_compalgxform->type;
 115
 116         return crypto_newsession(&sav->tdb_cryptoid, &cric, crypto_support);
 117 }
 118
 119 /*
 120  * ipcomp_zeroize() used when IPCA is deleted
 121  */
 122 static int
 123 ipcomp_zeroize(struct secasvar *sav)
 124 {
 125         int err;
 126
 127         err = crypto_freesession(sav->tdb_cryptoid);
 128         sav->tdb_cryptoid = 0;
 129         return err;
 130 }
 131
 132 /*
 133  * ipcomp_input() gets called to uncompress an input packet
 134  */
 135 static int
 136 ipcomp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
 137 {
 138         struct tdb_crypto *tc;
 139         struct cryptodesc *crdc;
 140         struct cryptop *crp;
 141         struct ipcomp *ipcomp;
 142         caddr_t addr;
 143         int hlen = IPCOMP_HLENGTH;
 144
 145         /*
 146          * Check that the next header of the IPComp is not IPComp again, before
 147          * doing any real work.  Given it is not possible to do double
 148          * compression it means someone is playing tricks on us.
 149          */
 150         if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) {
 151                 ipcompstat.ipcomps_hdrops++;            /*XXX*/
 152                 DPRINTF(("%s: m_pullup failed\n", __func__));
 153                 return (ENOBUFS);
 154         }
 155         addr = (caddr_t) mtod(m, struct ip *) + skip;
 156         ipcomp = (struct ipcomp *)addr;
 157         if (ipcomp->comp_nxt == IPPROTO_IPCOMP) {
 158                 m_freem(m);
 159                 ipcompstat.ipcomps_pdrops++;    /* XXX have our own stats? */
 160                 DPRINTF(("%s: recursive compression detected\n", __func__));
 161                 return (EINVAL);
 162         }
 163
 164         /* Get crypto descriptors */
 165         crp = crypto_getreq(1);
 166         if (crp == NULL) {
 167                 m_freem(m);
 168                 DPRINTF(("ipcomp_input: no crypto descriptors\n"));
 169                 ipcompstat.ipcomps_crypto++;
 170                 return ENOBUFS;
 171         }
 172         /* Get IPsec-specific opaque pointer */
 173         tc = kmalloc(sizeof (*tc), M_XDATA,
 174                     M_INTWAIT | M_ZERO | M_NULLOK);
 175         if (tc == NULL) {
 176                 m_freem(m);
 177                 crypto_freereq(crp);
 178                 DPRINTF(("ipcomp_input: cannot allocate tdb_crypto\n"));
 179                 ipcompstat.ipcomps_crypto++;
 180                 return ENOBUFS;
 181         }
 182         crdc = crp->crp_desc;
 183
 184         crdc->crd_skip = skip + hlen;
 185         crdc->crd_len = m->m_pkthdr.len - (skip + hlen);
 186         crdc->crd_inject = skip;
 187
 188         tc->tc_ptr = 0;
 189
 190         /* Decompression operation */
 191         crdc->crd_alg = sav->tdb_compalgxform->type;
 192
 193         /* Crypto operation descriptor */
 194         crp->crp_ilen = m->m_pkthdr.len - (skip + hlen);
 195         crp->crp_flags = CRYPTO_F_IMBUF;
 196         crp->crp_buf = (caddr_t) m;
 197         crp->crp_callback = ipcomp_input_cb;
 198         crp->crp_sid = sav->tdb_cryptoid;
 199         crp->crp_opaque = (caddr_t) tc;
 200
 201         /* These are passed as-is to the callback */
 202         tc->tc_spi = sav->spi;
 203         tc->tc_dst = sav->sah->saidx.dst;
 204         tc->tc_proto = sav->sah->saidx.proto;
 205         tc->tc_protoff = protoff;
 206         tc->tc_skip = skip;
 207
 208         return crypto_dispatch(crp);
 209 }
 210
 211 #ifdef INET6
 212 #define IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag) do {              \
 213         if (saidx->dst.sa.sa_family == AF_INET6) {                           \
 214                 error = ipsec6_common_input_cb(m, sav, skip, protoff, mtag); \
 215         } else {                                                             \
 216                 error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag); \
 217         }                                                                    \
 218 } while (0)
 219 #else
 220 #define IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, mtag)                   \
 221         (error = ipsec4_common_input_cb(m, sav, skip, protoff, mtag))
 222 #endif
 223
 224 /*
 225  * IPComp input callback from the crypto driver.
 226  */
 227 static int
 228 ipcomp_input_cb(struct cryptop *crp)
 229 {
 230         struct cryptodesc *crd;
 231         struct tdb_crypto *tc;
 232         int skip, protoff;
 233         struct mtag *mtag;
 234         struct mbuf *m;
 235         struct secasvar *sav;
 236         struct secasindex *saidx;
 237         int hlen = IPCOMP_HLENGTH, error, clen;
 238         u_int8_t nproto;
 239         caddr_t addr;
 240
 241         crd = crp->crp_desc;
 242
 243         tc = (struct tdb_crypto *) crp->crp_opaque;
 244         KASSERT(tc != NULL, ("ipcomp_input_cb: null opaque crypto data area!"));
 245         skip = tc->tc_skip;
 246         protoff = tc->tc_protoff;
 247         mtag = (struct mtag *) tc->tc_ptr;
 248         m = (struct mbuf *) crp->crp_buf;
 249
 250         crit_enter();
 251
 252         sav = KEY_ALLOCSA(&tc->tc_dst, tc->tc_proto, tc->tc_spi);
 253         if (sav == NULL) {
 254                 ipcompstat.ipcomps_notdb++;
 255                 DPRINTF(("ipcomp_input_cb: SA expired while in crypto\n"));
 256                 error = ENOBUFS;                /*XXX*/
 257                 goto bad;
 258         }
 259
 260         saidx = &sav->sah->saidx;
 261         KASSERT(saidx->dst.sa.sa_family == AF_INET ||
 262                 saidx->dst.sa.sa_family == AF_INET6,
 263                 ("ah_input_cb: unexpected protocol family %u",
 264                  saidx->dst.sa.sa_family));
 265
 266         /* Check for crypto errors */
 267         if (crp->crp_etype) {
 268                 /* Reset the session ID */
 269                 if (sav->tdb_cryptoid != 0)
 270                         sav->tdb_cryptoid = crp->crp_sid;
 271
 272                 if (crp->crp_etype == EAGAIN) {
 273                         KEY_FREESAV(&sav);
 274                         crit_exit();
 275                         return crypto_dispatch(crp);
 276                 }
 277
 278                 ipcompstat.ipcomps_noxform++;
 279                 DPRINTF(("ipcomp_input_cb: crypto error %d\n", crp->crp_etype));
 280                 error = crp->crp_etype;
 281                 goto bad;
 282         }
 283         /* Shouldn't happen... */
 284         if (m == NULL) {
 285                 ipcompstat.ipcomps_crypto++;
 286                 DPRINTF(("ipcomp_input_cb: null mbuf returned from crypto\n"));
 287                 error = EINVAL;
 288                 goto bad;
 289         }
 290         ipcompstat.ipcomps_hist[sav->alg_comp]++;
 291
 292         clen = crp->crp_olen;           /* Length of data after processing */
 293
 294         /* Release the crypto descriptors */
 295         kfree(tc, M_XDATA), tc = NULL;
 296         crypto_freereq(crp), crp = NULL;
 297
 298         /* In case it's not done already, adjust the size of the mbuf chain */
 299         m->m_pkthdr.len = clen + hlen + skip;
 300
 301         if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) {
 302                 ipcompstat.ipcomps_hdrops++;            /*XXX*/
 303                 DPRINTF(("ipcomp_input_cb: m_pullup failed\n"));
 304                 error = EINVAL;                         /*XXX*/
 305                 goto bad;
 306         }
 307
 308         /* Keep the next protocol field */
 309         addr = (caddr_t) mtod(m, struct ip *) + skip;
 310         nproto = ((struct ipcomp *) addr)->comp_nxt;
 311
 312         /* Remove the IPCOMP header */
 313         error = m_striphdr(m, skip, hlen);
 314         if (error) {
 315                 ipcompstat.ipcomps_hdrops++;
 316                 DPRINTF(("ipcomp_input_cb: bad mbuf chain, IPCA %s/%08lx\n",
 317                          ipsec_address(&sav->sah->saidx.dst),
 318                          (u_long) ntohl(sav->spi)));
 319                 goto bad;
 320         }
 321
 322         /* Restore the Next Protocol field */
 323         m_copyback(m, protoff, sizeof (u_int8_t), (u_int8_t *) &nproto);
 324
 325         IPSEC_COMMON_INPUT_CB(m, sav, skip, protoff, NULL);
 326
 327         KEY_FREESAV(&sav);
 328         crit_exit();
 329         return error;
 330 bad:
 331         if (sav)
 332                 KEY_FREESAV(&sav);
 333         crit_exit();
 334         if (m)
 335                 m_freem(m);
 336         if (tc != NULL)
 337                 kfree(tc, M_XDATA);
 338         if (crp)
 339                 crypto_freereq(crp);
 340         return error;
 341 }
 342
 343 /*
 344  * IPComp output routine, called by ipsec[46]_process_packet()
 345  */
 346 static int
 347 ipcomp_output(
 348         struct mbuf *m,
 349         struct ipsecrequest *isr,
 350         struct mbuf **mp,
 351         int skip,
 352         int protoff
 353 )
 354 {
 355         struct secasvar *sav;
 356         struct comp_algo *ipcompx;
 357         int error, ralen, hlen, maxpacketsize, roff;
 358         u_int8_t prot;
 359         struct cryptodesc *crdc;
 360         struct cryptop *crp;
 361         struct tdb_crypto *tc;
 362         struct mbuf *mo;
 363         struct ipcomp *ipcomp;
 364
 365         sav = isr->sav;
 366         KASSERT(sav != NULL, ("ipcomp_output: null SA"));
 367         ipcompx = sav->tdb_compalgxform;
 368         KASSERT(ipcompx != NULL, ("ipcomp_output: null compression xform"));
 369
 370         ralen = m->m_pkthdr.len - skip; /* Raw payload length before comp. */
 371         hlen = IPCOMP_HLENGTH;
 372
 373         ipcompstat.ipcomps_output++;
 374
 375         /* Check for maximum packet size violations. */
 376         switch (sav->sah->saidx.dst.sa.sa_family) {
 377 #ifdef INET
 378         case AF_INET:
 379                 maxpacketsize =  IP_MAXPACKET;
 380                 break;
 381 #endif /* INET */
 382 #ifdef INET6
 383         case AF_INET6:
 384                 maxpacketsize =  IPV6_MAXPACKET;
 385                 break;
 386 #endif /* INET6 */
 387         default:
 388                 ipcompstat.ipcomps_nopf++;
 389                 DPRINTF(("ipcomp_output: unknown/unsupported protocol family %d"
 390                     ", IPCA %s/%08lx\n",
 391                     sav->sah->saidx.dst.sa.sa_family,
 392                     ipsec_address(&sav->sah->saidx.dst),
 393                     (u_long) ntohl(sav->spi)));
 394                 error = EPFNOSUPPORT;
 395                 goto bad;
 396         }
 397         if (skip + hlen + ralen > maxpacketsize) {
 398                 ipcompstat.ipcomps_toobig++;
 399                 DPRINTF(("ipcomp_output: packet in IPCA %s/%08lx got too big "
 400                     "(len %u, max len %u)\n",
 401                     ipsec_address(&sav->sah->saidx.dst),
 402                     (u_long) ntohl(sav->spi),
 403                     skip + hlen + ralen, maxpacketsize));
 404                 error = EMSGSIZE;
 405                 goto bad;
 406         }
 407
 408         /* Update the counters */
 409         ipcompstat.ipcomps_obytes += m->m_pkthdr.len - skip;
 410
 411         m = m_clone(m);
 412         if (m == NULL) {
 413                 ipcompstat.ipcomps_hdrops++;
 414                 DPRINTF(("ipcomp_output: cannot clone mbuf chain, IPCA %s/%08lx\n",
 415                     ipsec_address(&sav->sah->saidx.dst),
 416                     (u_long) ntohl(sav->spi)));
 417                 error = ENOBUFS;
 418                 goto bad;
 419         }
 420
 421         /* Inject IPCOMP header */
 422         mo = m_makespace(m, skip, hlen, &roff);
 423         if (mo == NULL) {
 424                 ipcompstat.ipcomps_wrap++;
 425                 DPRINTF(("ipcomp_output: failed to inject IPCOMP header for "
 426                     "IPCA %s/%08lx\n",
 427                     ipsec_address(&sav->sah->saidx.dst),
 428                     (u_long) ntohl(sav->spi)));
 429                 error = ENOBUFS;
 430                 goto bad;
 431         }
 432         ipcomp = (struct ipcomp *)(mtod(mo, caddr_t) + roff);
 433
 434         /* Initialize the IPCOMP header */
 435         /* XXX alignment always correct? */
 436         switch (sav->sah->saidx.dst.sa.sa_family) {
 437 #ifdef INET
 438         case AF_INET:
 439                 ipcomp->comp_nxt = mtod(m, struct ip *)->ip_p;
 440                 break;
 441 #endif /* INET */
 442 #ifdef INET6
 443         case AF_INET6:
 444                 ipcomp->comp_nxt = mtod(m, struct ip6_hdr *)->ip6_nxt;
 445                 break;
 446 #endif
 447         }
 448         ipcomp->comp_flags = 0;
 449         ipcomp->comp_cpi = htons((u_int16_t) ntohl(sav->spi));
 450
 451         /* Fix Next Protocol in IPv4/IPv6 header */
 452         prot = IPPROTO_IPCOMP;
 453         m_copyback(m, protoff, sizeof(u_int8_t), (u_char *) &prot);
 454
 455         /* Ok now, we can pass to the crypto processing */
 456
 457         /* Get crypto descriptors */
 458         crp = crypto_getreq(1);
 459         if (crp == NULL) {
 460                 ipcompstat.ipcomps_crypto++;
 461                 DPRINTF(("ipcomp_output: failed to acquire crypto descriptor\n"));
 462                 error = ENOBUFS;
 463                 goto bad;
 464         }
 465         crdc = crp->crp_desc;
 466
 467         /* Compression descriptor */
 468         crdc->crd_skip = skip + hlen;
 469         crdc->crd_len = m->m_pkthdr.len - (skip + hlen);
 470         crdc->crd_flags = CRD_F_COMP;
 471         crdc->crd_inject = skip + hlen;
 472
 473         /* Compression operation */
 474         crdc->crd_alg = ipcompx->type;
 475
 476         /* IPsec-specific opaque crypto info */
 477         tc = kmalloc(sizeof(struct tdb_crypto),
 478                     M_XDATA, M_INTWAIT | M_ZERO | M_NULLOK);
 479         if (tc == NULL) {
 480                 ipcompstat.ipcomps_crypto++;
 481                 DPRINTF(("ipcomp_output: failed to allocate tdb_crypto\n"));
 482                 crypto_freereq(crp);
 483                 error = ENOBUFS;
 484                 goto bad;
 485         }
 486
 487         tc->tc_isr = isr;
 488         tc->tc_spi = sav->spi;
 489         tc->tc_dst = sav->sah->saidx.dst;
 490         tc->tc_proto = sav->sah->saidx.proto;
 491         tc->tc_skip = skip + hlen;
 492
 493         /* Crypto operation descriptor */
 494         crp->crp_ilen = m->m_pkthdr.len;        /* Total input length */
 495         crp->crp_flags = CRYPTO_F_IMBUF;
 496         crp->crp_buf = (caddr_t) m;
 497         crp->crp_callback = ipcomp_output_cb;
 498         crp->crp_opaque = (caddr_t) tc;
 499         crp->crp_sid = sav->tdb_cryptoid;
 500
 501         return crypto_dispatch(crp);
 502 bad:
 503         if (m)
 504                 m_freem(m);
 505         return (error);
 506 }
 507
 508 /*
 509  * IPComp output callback from the crypto driver.
 510  */
 511 static int
 512 ipcomp_output_cb(struct cryptop *crp)
 513 {
 514         struct tdb_crypto *tc;
 515         struct ipsecrequest *isr;
 516         struct secasvar *sav;
 517         struct mbuf *m;
 518         int error, skip, rlen;
 519
 520         tc = (struct tdb_crypto *) crp->crp_opaque;
 521         KASSERT(tc != NULL, ("ipcomp_output_cb: null opaque data area!"));
 522         m = (struct mbuf *) crp->crp_buf;
 523         skip = tc->tc_skip;
 524         rlen = crp->crp_ilen - skip;
 525
 526         crit_enter();
 527
 528         isr = tc->tc_isr;
 529         sav = KEY_ALLOCSA(&tc->tc_dst, tc->tc_proto, tc->tc_spi);
 530         if (sav == NULL) {
 531                 ipcompstat.ipcomps_notdb++;
 532                 DPRINTF(("ipcomp_output_cb: SA expired while in crypto\n"));
 533                 error = ENOBUFS;                /*XXX*/
 534                 goto bad;
 535         }
 536         KASSERT(isr->sav == sav, ("ipcomp_output_cb: SA changed"));
 537
 538         /* Check for crypto errors */
 539         if (crp->crp_etype) {
 540                 /* Reset session ID */
 541                 if (sav->tdb_cryptoid != 0)
 542                         sav->tdb_cryptoid = crp->crp_sid;
 543
 544                 if (crp->crp_etype == EAGAIN) {
 545                         KEY_FREESAV(&sav);
 546                         crit_exit();
 547                         return crypto_dispatch(crp);
 548                 }
 549                 ipcompstat.ipcomps_noxform++;
 550                 DPRINTF(("ipcomp_output_cb: crypto error %d\n", crp->crp_etype));
 551                 error = crp->crp_etype;
 552                 goto bad;
 553         }
 554         /* Shouldn't happen... */
 555         if (m == NULL) {
 556                 ipcompstat.ipcomps_crypto++;
 557                 DPRINTF(("ipcomp_output_cb: bogus return buffer from crypto\n"));
 558                 error = EINVAL;
 559                 goto bad;
 560         }
 561         ipcompstat.ipcomps_hist[sav->alg_comp]++;
 562
 563         if (rlen > crp->crp_olen) {
 564                 /* Adjust the length in the IP header */
 565                 switch (sav->sah->saidx.dst.sa.sa_family) {
 566 #ifdef INET
 567                 case AF_INET:
 568                         mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
 569                         break;
 570 #endif /* INET */
 571 #ifdef INET6
 572                 case AF_INET6:
 573                         mtod(m, struct ip6_hdr *)->ip6_plen =
 574                                 htons(m->m_pkthdr.len) - sizeof(struct ip6_hdr);
 575                         break;
 576 #endif /* INET6 */
 577                 default:
 578                         ipcompstat.ipcomps_nopf++;
 579                         DPRINTF(("ipcomp_output: unknown/unsupported protocol "
 580                             "family %d, IPCA %s/%08lx\n",
 581                             sav->sah->saidx.dst.sa.sa_family,
 582                             ipsec_address(&sav->sah->saidx.dst),
 583                             (u_long) ntohl(sav->spi)));
 584                         error = EPFNOSUPPORT;
 585                         goto bad;
 586                 }
 587         } else {
 588                 /* compression was useless, we have lost time */
 589                 /* XXX add statistic */
 590         }
 591
 592         /* Release the crypto descriptor */
 593         kfree(tc, M_XDATA);
 594         crypto_freereq(crp);
 595
 596         /* NB: m is reclaimed by ipsec_process_done. */
 597         error = ipsec_process_done(m, isr);
 598         KEY_FREESAV(&sav);
 599         crit_exit();
 600         return error;
 601 bad:
 602         if (sav)
 603                 KEY_FREESAV(&sav);
 604         crit_exit();
 605         if (m)
 606                 m_freem(m);
 607         kfree(tc, M_XDATA);
 608         crypto_freereq(crp);
 609         return error;
 610 }
 611
 612 static struct xformsw ipcomp_xformsw = {
 613         XF_IPCOMP,              XFT_COMP,               "IPcomp",
 614         ipcomp_init,            ipcomp_zeroize,         ipcomp_input,
 615         ipcomp_output
 616 };
 617
 618 static void
 619 ipcomp_attach(void)
 620 {
 621         xform_register(&ipcomp_xformsw);
 622 }
 623 SYSINIT(ipcomp_xform_init, SI_SUB_DRIVERS, SI_ORDER_FIRST, ipcomp_attach, NULL)