* XXX reorder combinations by preference * XXX no idea if the user wants ESP authentication or not */
| 6276 | * XXX no idea if the user wants ESP authentication or not |
| 6277 | */ |
| 6278 | static struct mbuf * |
| 6279 | key_getcomb_ealg(void) |
| 6280 | { |
| 6281 | struct sadb_comb *comb; |
| 6282 | const struct enc_xform *algo; |
| 6283 | struct mbuf *result = NULL, *m, *n; |
| 6284 | int encmin; |
| 6285 | int i, off, o; |
| 6286 | int totlen; |
| 6287 | const int l = PFKEY_ALIGN8(sizeof(struct sadb_comb)); |
| 6288 | |
| 6289 | m = NULL; |
| 6290 | for (i = 1; i <= SADB_EALG_MAX; i++) { |
| 6291 | algo = enc_algorithm_lookup(i); |
| 6292 | if (algo == NULL) |
| 6293 | continue; |
| 6294 | |
| 6295 | /* discard algorithms with key size smaller than system min */ |
| 6296 | if (_BITS(algo->maxkey) < V_ipsec_esp_keymin) |
| 6297 | continue; |
| 6298 | if (_BITS(algo->minkey) < V_ipsec_esp_keymin) |
| 6299 | encmin = V_ipsec_esp_keymin; |
| 6300 | else |
| 6301 | encmin = _BITS(algo->minkey); |
| 6302 | |
| 6303 | if (V_ipsec_esp_auth) |
| 6304 | m = key_getcomb_ah(); |
| 6305 | else { |
| 6306 | IPSEC_ASSERT(l <= MLEN, |
| 6307 | ("l=%u > MLEN=%lu", l, (u_long) MLEN)); |
| 6308 | MGET(m, M_NOWAIT, MT_DATA); |
| 6309 | if (m) { |
| 6310 | M_ALIGN(m, l); |
| 6311 | m->m_len = l; |
| 6312 | m->m_next = NULL; |
| 6313 | bzero(mtod(m, caddr_t), m->m_len); |
| 6314 | } |
| 6315 | } |
| 6316 | if (!m) |
| 6317 | goto fail; |
| 6318 | |
| 6319 | totlen = 0; |
| 6320 | for (n = m; n; n = n->m_next) |
| 6321 | totlen += n->m_len; |
| 6322 | IPSEC_ASSERT((totlen % l) == 0, ("totlen=%u, l=%u", totlen, l)); |
| 6323 | |
| 6324 | for (off = 0; off < totlen; off += l) { |
| 6325 | n = m_pulldown(m, off, l, &o); |
| 6326 | if (!n) { |
| 6327 | /* m is already freed */ |
| 6328 | goto fail; |
| 6329 | } |
| 6330 | comb = (struct sadb_comb *)(mtod(n, caddr_t) + o); |
| 6331 | bzero(comb, sizeof(*comb)); |
| 6332 | key_getcomb_setlifetime(comb); |
| 6333 | comb->sadb_comb_encrypt = i; |
| 6334 | comb->sadb_comb_encrypt_minbits = encmin; |
| 6335 | comb->sadb_comb_encrypt_maxbits = _BITS(algo->maxkey); |
no test coverage detected