Function ah_input

freebsd/netipsec/xform_ah.c:531–679

* ah_input() gets called to verify that an input packet * passes authentication. */

 * passes authentication.
 */
static int
ah_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
{
	IPSEC_DEBUG_DECLARE(char buf[128]);
	const struct auth_hash *ahx;
	struct cryptop *crp;
	struct xform_data *xd;
	struct newah *ah;
	crypto_session_t cryptoid;
	int hl, rplen, authsize, ahsize, error;
	uint32_t seqh;

	IPSEC_ASSERT(sav != NULL, ("null SA"));
	IPSEC_ASSERT(sav->key_auth != NULL, ("null authentication key"));
	IPSEC_ASSERT(sav->tdb_authalgxform != NULL,
		("null authentication xform"));

	/* Figure out header size. */
	rplen = HDRSIZE(sav);

	if (m->m_len < skip + rplen) {
		m = m_pullup(m, skip + rplen);
		if (m == NULL) {
			DPRINTF(("ah_input: cannot pullup header\n"));
			AHSTAT_INC(ahs_hdrops);		/*XXX*/
			error = ENOBUFS;
			goto bad;
		}
	}
	ah = (struct newah *)(mtod(m, caddr_t) + skip);

	/* Check replay window, if applicable. */
	SECASVAR_LOCK(sav);
	if (sav->replay != NULL && sav->replay->wsize != 0 &&
	    ipsec_chkreplay(ntohl(ah->ah_seq), &seqh, sav) == 0) {
		SECASVAR_UNLOCK(sav);
		AHSTAT_INC(ahs_replay);
		DPRINTF(("%s: packet replay failure: %s\n", __func__,
		    ipsec_sa2str(sav, buf, sizeof(buf))));
		error = EACCES;
		goto bad;
	}
	cryptoid = sav->tdb_cryptoid;
	SECASVAR_UNLOCK(sav);

	/* Verify AH header length. */
	hl = sizeof(struct ah) + (ah->ah_len * sizeof (u_int32_t));
	ahx = sav->tdb_authalgxform;
	authsize = AUTHSIZE(sav);
	ahsize = ah_hdrsiz(sav);
	if (hl != ahsize) {
		DPRINTF(("%s: bad authenticator length %u (expecting %lu)"
		    " for packet in SA %s/%08lx\n", __func__, hl,
		    (u_long)ahsize,
		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
		    (u_long) ntohl(sav->spi)));
		AHSTAT_INC(ahs_badauthl);
		error = EACCES;