Function ipsec_process_done

freebsd/netipsec/ipsec_output.c:712–843

#endif /* INET6 */

int
ipsec_process_done(struct mbuf *m, struct secpolicy *sp, struct secasvar *sav,
    u_int idx)
{
	struct epoch_tracker et;
	struct xform_history *xh;
	struct secasindex *saidx;
	struct m_tag *mtag;
	int error;

	saidx = &sav->sah->saidx;
	switch (saidx->dst.sa.sa_family) {
#ifdef INET
	case AF_INET:
		/* Fix the header length, for AH processing. */
		mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
		break;
#endif /* INET */
#ifdef INET6
	case AF_INET6:
		/* Fix the header length, for AH processing. */
		if (m->m_pkthdr.len < sizeof (struct ip6_hdr)) {
			error = ENXIO;
			goto bad;
		}
		if (m->m_pkthdr.len - sizeof (struct ip6_hdr) > IPV6_MAXPACKET) {
			/* No jumbogram support. */
			error = ENXIO;	/*?*/
			goto bad;
		}
		mtod(m, struct ip6_hdr *)->ip6_plen =
			htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
		break;
#endif /* INET6 */
	default:
		DPRINTF(("%s: unknown protocol family %u\n", __func__,
		    saidx->dst.sa.sa_family));
		error = ENXIO;
		goto bad;
	}

	/*
	 * Add a record of what we've done to the packet.
	 */
	mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE, sizeof(*xh), M_NOWAIT);
	if (mtag == NULL) {
		DPRINTF(("%s: could not get packet tag\n", __func__));
		error = ENOMEM;
		goto bad;
	}

	xh = (struct xform_history *)(mtag + 1);
	xh->dst = saidx->dst;
	xh->proto = saidx->proto;
	xh->mode = saidx->mode;
	xh->spi = sav->spi;
	m_tag_prepend(m, mtag);