Function ah_init0

freebsd/netipsec/xform_ah.c:174–226

* NB: public for use by esp_init. */

 * NB: public for use by esp_init.
 */
int
ah_init0(struct secasvar *sav, struct xformsw *xsp,
    struct crypto_session_params *csp)
{
	const struct auth_hash *thash;
	int keylen;

	thash = auth_algorithm_lookup(sav->alg_auth);
	if (thash == NULL) {
		DPRINTF(("%s: unsupported authentication algorithm %u\n",
			__func__, sav->alg_auth));
		return EINVAL;
	}

	/*
	 * Verify the replay state block allocation is consistent with
	 * the protocol type.  We check here so we can make assumptions
	 * later during protocol processing.
	 */
	/* NB: replay state is setup elsewhere (sigh) */
	if (((sav->flags&SADB_X_EXT_OLD) == 0) ^ (sav->replay != NULL)) {
		DPRINTF(("%s: replay state block inconsistency, "
			"%s algorithm %s replay state\n", __func__,
			(sav->flags & SADB_X_EXT_OLD) ? "old" : "new",
			sav->replay == NULL ? "without" : "with"));
		return EINVAL;
	}
	if (sav->key_auth == NULL) {
		DPRINTF(("%s: no authentication key for %s algorithm\n",
			__func__, thash->name));
		return EINVAL;
	}
	keylen = _KEYLEN(sav->key_auth);
	if (keylen > thash->keysize && thash->keysize != 0) {
		DPRINTF(("%s: invalid keylength %d, algorithm %s requires "
			"keysize less than %d\n", __func__,
			 keylen, thash->name, thash->keysize));
		return EINVAL;
	}

	sav->tdb_xform = xsp;
	sav->tdb_authalgxform = thash;

	/* Initialize crypto session. */
	csp->csp_auth_alg = sav->tdb_authalgxform->type;
	if (csp->csp_auth_alg != CRYPTO_NULL_HMAC) {
		csp->csp_auth_klen = _KEYBITS(sav->key_auth) / 8;
		csp->csp_auth_key = sav->key_auth->key_data;
	};
	csp->csp_auth_mlen = AUTHSIZE(sav);

	return 0;
}

/*
 * ah_init() is called when an SPI is being set up.