Function ktls_decrypt

freebsd/kern/uipc_ktls.c:1753–1933

}

static void
ktls_decrypt(struct socket *so)
{
	char tls_header[MBUF_PEXT_HDR_LEN];
	struct ktls_session *tls;
	struct sockbuf *sb;
	struct tls_record_layer *hdr;
	struct tls_get_record tgr;
	struct mbuf *control, *data, *m;
	uint64_t seqno;
	int error, remain, tls_len, trail_len;

	hdr = (struct tls_record_layer *)tls_header;
	sb = &so->so_rcv;
	SOCKBUF_LOCK(sb);
	KASSERT(sb->sb_flags & SB_TLS_RX_RUNNING,
	    ("%s: socket %p not running", __func__, so));

	tls = sb->sb_tls_info;
	MPASS(tls != NULL);

	for (;;) {
		/* Is there enough queued for a TLS header? */
		if (sb->sb_tlscc < tls->params.tls_hlen)
			break;

		m_copydata(sb->sb_mtls, 0, tls->params.tls_hlen, tls_header);
		tls_len = sizeof(*hdr) + ntohs(hdr->tls_length);

		if (hdr->tls_vmajor != tls->params.tls_vmajor ||
		    hdr->tls_vminor != tls->params.tls_vminor)
			error = EINVAL;
		else if (tls_len < tls->params.tls_hlen || tls_len >
		    tls->params.tls_hlen + TLS_MAX_MSG_SIZE_V10_2 +
		    tls->params.tls_tlen)
			error = EMSGSIZE;
		else
			error = 0;
		if (__predict_false(error != 0)) {
			/*
			 * We have a corrupted record and are likely
			 * out of sync.  The connection isn't
			 * recoverable at this point, so abort it.
			 */
			SOCKBUF_UNLOCK(sb);
			counter_u64_add(ktls_offload_corrupted_records, 1);

			CURVNET_SET(so->so_vnet);
			so->so_proto->pr_usrreqs->pru_abort(so);
			so->so_error = error;
			CURVNET_RESTORE();
			goto deref;
		}

		/* Is the entire record queued? */
		if (sb->sb_tlscc < tls_len)
			break;