* Compute the byte size to be occupied by IPsec header. * In case it is tunnelled, it includes the size of outer IP header. */
| 1090 | * In case it is tunnelled, it includes the size of outer IP header. |
| 1091 | */ |
| 1092 | static size_t |
| 1093 | ipsec_hdrsiz_internal(struct secpolicy *sp) |
| 1094 | { |
| 1095 | size_t size; |
| 1096 | int i; |
| 1097 | |
| 1098 | KEYDBG(IPSEC_STAMP, printf("%s: using SP(%p)\n", __func__, sp)); |
| 1099 | KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); |
| 1100 | |
| 1101 | switch (sp->policy) { |
| 1102 | case IPSEC_POLICY_DISCARD: |
| 1103 | case IPSEC_POLICY_BYPASS: |
| 1104 | case IPSEC_POLICY_NONE: |
| 1105 | return (0); |
| 1106 | } |
| 1107 | |
| 1108 | IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC, |
| 1109 | ("invalid policy %u", sp->policy)); |
| 1110 | |
| 1111 | /* |
| 1112 | * XXX: for each transform we need to lookup suitable SA |
| 1113 | * and use info from SA to calculate headers size. |
| 1114 | * XXX: for NAT-T we need to cosider UDP header size. |
| 1115 | */ |
| 1116 | size = 0; |
| 1117 | for (i = 0; i < sp->tcount; i++) { |
| 1118 | switch (sp->req[i]->saidx.proto) { |
| 1119 | case IPPROTO_ESP: |
| 1120 | size += esp_hdrsiz(NULL); |
| 1121 | break; |
| 1122 | case IPPROTO_AH: |
| 1123 | size += ah_hdrsiz(NULL); |
| 1124 | break; |
| 1125 | case IPPROTO_IPCOMP: |
| 1126 | size += sizeof(struct ipcomp); |
| 1127 | break; |
| 1128 | } |
| 1129 | |
| 1130 | if (sp->req[i]->saidx.mode == IPSEC_MODE_TUNNEL) { |
| 1131 | switch (sp->req[i]->saidx.dst.sa.sa_family) { |
| 1132 | #ifdef INET |
| 1133 | case AF_INET: |
| 1134 | size += sizeof(struct ip); |
| 1135 | break; |
| 1136 | #endif |
| 1137 | #ifdef INET6 |
| 1138 | case AF_INET6: |
| 1139 | size += sizeof(struct ip6_hdr); |
| 1140 | break; |
| 1141 | #endif |
| 1142 | default: |
| 1143 | ipseclog((LOG_ERR, "%s: unknown AF %d in " |
| 1144 | "IPsec tunnel SA\n", __func__, |
| 1145 | sp->req[i]->saidx.dst.sa.sa_family)); |
| 1146 | break; |
| 1147 | } |
| 1148 | } |
| 1149 | } |
no test coverage detected