* XXX reorder combinations by preference */
| 6377 | * XXX reorder combinations by preference |
| 6378 | */ |
| 6379 | static struct mbuf * |
| 6380 | key_getcomb_ah() |
| 6381 | { |
| 6382 | const struct auth_hash *algo; |
| 6383 | struct sadb_comb *comb; |
| 6384 | struct mbuf *m; |
| 6385 | u_int16_t minkeysize, maxkeysize; |
| 6386 | int i; |
| 6387 | const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); |
| 6388 | |
| 6389 | m = NULL; |
| 6390 | for (i = 1; i <= SADB_AALG_MAX; i++) { |
| 6391 | #if 1 |
| 6392 | /* we prefer HMAC algorithms, not old algorithms */ |
| 6393 | if (i != SADB_AALG_SHA1HMAC && |
| 6394 | i != SADB_X_AALG_SHA2_256 && |
| 6395 | i != SADB_X_AALG_SHA2_384 && |
| 6396 | i != SADB_X_AALG_SHA2_512) |
| 6397 | continue; |
| 6398 | #endif |
| 6399 | algo = auth_algorithm_lookup(i); |
| 6400 | if (!algo) |
| 6401 | continue; |
| 6402 | key_getsizes_ah(algo, i, &minkeysize, &maxkeysize); |
| 6403 | /* discard algorithms with key size smaller than system min */ |
| 6404 | if (_BITS(minkeysize) < V_ipsec_ah_keymin) |
| 6405 | continue; |
| 6406 | |
| 6407 | if (!m) { |
| 6408 | IPSEC_ASSERT(l <= MLEN, |
| 6409 | ("l=%u > MLEN=%lu", l, (u_long) MLEN)); |
| 6410 | MGET(m, M_NOWAIT, MT_DATA); |
| 6411 | if (m) { |
| 6412 | M_ALIGN(m, l); |
| 6413 | m->m_len = l; |
| 6414 | m->m_next = NULL; |
| 6415 | } |
| 6416 | } else |
| 6417 | M_PREPEND(m, l, M_NOWAIT); |
| 6418 | if (!m) |
| 6419 | return NULL; |
| 6420 | |
| 6421 | comb = mtod(m, struct sadb_comb *); |
| 6422 | bzero(comb, sizeof(*comb)); |
| 6423 | key_getcomb_setlifetime(comb); |
| 6424 | comb->sadb_comb_auth = i; |
| 6425 | comb->sadb_comb_auth_minbits = _BITS(minkeysize); |
| 6426 | comb->sadb_comb_auth_maxbits = _BITS(maxkeysize); |
| 6427 | } |
| 6428 | |
| 6429 | return m; |
| 6430 | } |
| 6431 | |
| 6432 | /* |
| 6433 | * not really an official behavior. discussed in pf_key@inner.net in Sep2000. |
no test coverage detected