Function tcp_ipsec_input

freebsd/netipsec/xform_tcp.c:256–286

* Compute TCP-MD5 hash of an *INBOUND* TCP segment. * Parameters: * m pointer to head of mbuf chain * th pointer to TCP header * buf pointer to storage for computed MD5 digest * * Return 0 if successful, otherwise return -1. */

 * Return 0 if successful, otherwise return -1.
 */
static int
tcp_ipsec_input(struct mbuf *m, struct tcphdr *th, u_char *buf)
{
	char tmpdigest[TCP_SIGLEN];
	struct secasindex saidx;
	struct secasvar *sav;

	setsockaddrs(m, &saidx.src, &saidx.dst);
	saidx.proto = IPPROTO_TCP;
	saidx.mode = IPSEC_MODE_TCPMD5;
	saidx.reqid = 0;
	sav = key_allocsa_tcpmd5(&saidx);
	if (sav == NULL) {
		KMOD_TCPSTAT_INC(tcps_sig_err_buildsig);
		return (EACCES);
	}
	/*
	 * tcp_input() operates with TCP header fields in host
	 * byte order. We expect them in network byte order.
	 */
	tcp_fields_to_net(th);
	tcp_signature_compute(m, th, sav, tmpdigest);
	tcp_fields_to_host(th);
	key_freesav(&sav);
	if (bcmp(buf, tmpdigest, TCP_SIGLEN) != 0) {
		KMOD_TCPSTAT_INC(tcps_sig_rcvbadsig);
		return (EACCES);
	}
	KMOD_TCPSTAT_INC(tcps_sig_rcvgoodsig);
	return (0);
}

/*
 * Compute TCP-MD5 hash of an *OUTBOUND* TCP segment.