Function ah_output

freebsd/netipsec/xform_ah.c:833–1065

* AH output routine, called by ipsec[46]_perform_request(). */

 * AH output routine, called by ipsec[46]_perform_request().
 */
static int
ah_output(struct mbuf *m, struct secpolicy *sp, struct secasvar *sav,
    u_int idx, int skip, int protoff)
{
	IPSEC_DEBUG_DECLARE(char buf[IPSEC_ADDRSTRLEN]);
	const struct auth_hash *ahx;
	struct xform_data *xd;
	struct mbuf *mi;
	struct cryptop *crp;
	struct newah *ah;
	crypto_session_t cryptoid;
	uint16_t iplen;
	int error, rplen, authsize, ahsize, maxpacketsize, roff;
	uint8_t prot;
	uint32_t seqh;

	IPSEC_ASSERT(sav != NULL, ("null SA"));
	ahx = sav->tdb_authalgxform;
	IPSEC_ASSERT(ahx != NULL, ("null authentication xform"));

	AHSTAT_INC(ahs_output);

	/* Figure out header size. */
	rplen = HDRSIZE(sav);
	authsize = AUTHSIZE(sav);
	ahsize = ah_hdrsiz(sav);

	/* Check for maximum packet size violations. */
	switch (sav->sah->saidx.dst.sa.sa_family) {
#ifdef INET
	case AF_INET:
		maxpacketsize = IP_MAXPACKET;
		break;
#endif /* INET */
#ifdef INET6
	case AF_INET6:
		maxpacketsize = IPV6_MAXPACKET;
		break;
#endif /* INET6 */
	default:
		DPRINTF(("%s: unknown/unsupported protocol family %u, "
		    "SA %s/%08lx\n", __func__,
		    sav->sah->saidx.dst.sa.sa_family,
		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
		    (u_long) ntohl(sav->spi)));
		AHSTAT_INC(ahs_nopf);
		error = EPFNOSUPPORT;
		goto bad;
	}
	if (ahsize + m->m_pkthdr.len > maxpacketsize) {
		DPRINTF(("%s: packet in SA %s/%08lx got too big "
		    "(len %u, max len %u)\n", __func__,
		    ipsec_address(&sav->sah->saidx.dst, buf, sizeof(buf)),
		    (u_long) ntohl(sav->spi),
		    ahsize + m->m_pkthdr.len, maxpacketsize));
		AHSTAT_INC(ahs_toobig);
		error = EMSGSIZE;
		goto bad;