Function ipcomp_input

freebsd/netipsec/xform_ipcomp.c:195–273

* ipcomp_input() gets called to uncompress an input packet */

 * ipcomp_input() gets called to uncompress an input packet
 */
static int
ipcomp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
{
	struct xform_data *xd;
	struct cryptop *crp;
	struct ipcomp *ipcomp;
	crypto_session_t cryptoid;
	caddr_t addr;
	int error, hlen = IPCOMP_HLENGTH;

	/*
	 * Check that the next header of the IPComp is not IPComp again, before
	 * doing any real work.  Given it is not possible to do double
	 * compression it means someone is playing tricks on us.
	 */
	error = ENOBUFS;
	if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) {
		IPCOMPSTAT_INC(ipcomps_hdrops);		/*XXX*/
		DPRINTF(("%s: m_pullup failed\n", __func__));
		key_freesav(&sav);
		return (error);
	}
	addr = (caddr_t) mtod(m, struct ip *) + skip;
	ipcomp = (struct ipcomp *)addr;
	if (ipcomp->comp_nxt == IPPROTO_IPCOMP) {
		IPCOMPSTAT_INC(ipcomps_pdrops);	/* XXX have our own stats? */
		DPRINTF(("%s: recursive compression detected\n", __func__));
		error = EINVAL;
		goto bad;
	}

	SECASVAR_LOCK(sav);
	cryptoid = sav->tdb_cryptoid;
	SECASVAR_UNLOCK(sav);

	/* Get crypto descriptors */
	crp = crypto_getreq(cryptoid, M_NOWAIT);
	if (crp == NULL) {
		DPRINTF(("%s: no crypto descriptors\n", __func__));
		IPCOMPSTAT_INC(ipcomps_crypto);
		goto bad;
	}
	/* Get IPsec-specific opaque pointer */
	xd = malloc(sizeof(*xd), M_XDATA, M_NOWAIT | M_ZERO);
	if (xd == NULL) {
		DPRINTF(("%s: cannot allocate xform_data\n", __func__));
		IPCOMPSTAT_INC(ipcomps_crypto);
		crypto_freereq(crp);
		goto bad;
	}

	/* Decompression operation */
	crp->crp_op = CRYPTO_OP_DECOMPRESS;
	crp->crp_payload_start = skip + hlen;
	crp->crp_payload_length = m->m_pkthdr.len - (skip + hlen);

	/* Crypto operation descriptor */
	crp->crp_flags = CRYPTO_F_CBIFSYNC;