* Compute the MAC for the SYN cookie. SIPHASH-2-4 is chosen for its speed * and good cryptographic properties. */
| 2202 | * and good cryptographic properties. |
| 2203 | */ |
| 2204 | static uint32_t |
| 2205 | syncookie_mac(struct in_conninfo *inc, tcp_seq irs, uint8_t flags, |
| 2206 | uint8_t *secbits, uintptr_t secmod) |
| 2207 | { |
| 2208 | SIPHASH_CTX ctx; |
| 2209 | uint32_t siphash[2]; |
| 2210 | |
| 2211 | SipHash24_Init(&ctx); |
| 2212 | SipHash_SetKey(&ctx, secbits); |
| 2213 | switch (inc->inc_flags & INC_ISIPV6) { |
| 2214 | #ifdef INET |
| 2215 | case 0: |
| 2216 | SipHash_Update(&ctx, &inc->inc_faddr, sizeof(inc->inc_faddr)); |
| 2217 | SipHash_Update(&ctx, &inc->inc_laddr, sizeof(inc->inc_laddr)); |
| 2218 | break; |
| 2219 | #endif |
| 2220 | #ifdef INET6 |
| 2221 | case INC_ISIPV6: |
| 2222 | SipHash_Update(&ctx, &inc->inc6_faddr, sizeof(inc->inc6_faddr)); |
| 2223 | SipHash_Update(&ctx, &inc->inc6_laddr, sizeof(inc->inc6_laddr)); |
| 2224 | break; |
| 2225 | #endif |
| 2226 | } |
| 2227 | SipHash_Update(&ctx, &inc->inc_fport, sizeof(inc->inc_fport)); |
| 2228 | SipHash_Update(&ctx, &inc->inc_lport, sizeof(inc->inc_lport)); |
| 2229 | SipHash_Update(&ctx, &irs, sizeof(irs)); |
| 2230 | SipHash_Update(&ctx, &flags, sizeof(flags)); |
| 2231 | SipHash_Update(&ctx, &secmod, sizeof(secmod)); |
| 2232 | SipHash_Final((u_int8_t *)&siphash, &ctx); |
| 2233 | |
| 2234 | return (siphash[0] ^ siphash[1]); |
| 2235 | } |
| 2236 | |
| 2237 | static tcp_seq |
| 2238 | syncookie_generate(struct syncache_head *sch, struct syncache *sc) |
no test coverage detected