Function esp_input

freebsd/netipsec/xform_esp.c:259–475

* ESP input processing, called (eventually) through the protocol switch. */

 * ESP input processing, called (eventually) through the protocol switch.
 */
static int
esp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
{
	IPSEC_DEBUG_DECLARE(char buf[128]);
	const struct auth_hash *esph;
	const struct enc_xform *espx;
	struct xform_data *xd;
	struct cryptop *crp;
	struct newesp *esp;
	uint8_t *ivp;
	crypto_session_t cryptoid;
	int alen, error, hlen, plen;
	uint32_t seqh;
	const struct crypto_session_params *csp;

	IPSEC_ASSERT(sav != NULL, ("null SA"));
	IPSEC_ASSERT(sav->tdb_encalgxform != NULL, ("null encoding xform"));

	error = EINVAL;
	/* Valid IP Packet length ? */
	if ( (skip&3) || (m->m_pkthdr.len&3) ){
		DPRINTF(("%s: misaligned packet, skip %u pkt len %u",
				__func__, skip, m->m_pkthdr.len));
		ESPSTAT_INC(esps_badilen);
		goto bad;
	}

	if (m->m_len < skip + sizeof(*esp)) {
		m = m_pullup(m, skip + sizeof(*esp));
		if (m == NULL) {
			DPRINTF(("%s: cannot pullup header\n", __func__));
			ESPSTAT_INC(esps_hdrops);	/*XXX*/
			error = ENOBUFS;
			goto bad;
		}
	}
	esp = (struct newesp *)(mtod(m, caddr_t) + skip);

	esph = sav->tdb_authalgxform;
	espx = sav->tdb_encalgxform;

	/* Determine the ESP header and auth length */
	if (sav->flags & SADB_X_EXT_OLD)
		hlen = sizeof (struct esp) + sav->ivlen;
	else
		hlen = sizeof (struct newesp) + sav->ivlen;

	alen = xform_ah_authsize(esph);

	/*
	 * Verify payload length is multiple of encryption algorithm
	 * block size.
	 *
	 * NB: This works for the null algorithm because the blocksize
	 *     is 4 and all packets must be 4-byte aligned regardless
	 *     of the algorithm.
	 */
	plen = m->m_pkthdr.len - (skip + hlen + alen);