Function tcp_signature_compute

freebsd/netipsec/xform_tcp.c:172–219

#endif

static int
tcp_signature_compute(struct mbuf *m, struct tcphdr *th,
    struct secasvar *sav, u_char *buf)
{
	MD5_CTX ctx;
	int len;
	u_short csum;

	MD5Init(&ctx);
	 /* Step 1: Update MD5 hash with IP(v6) pseudo-header. */
	switch (sav->sah->saidx.dst.sa.sa_family) {
#ifdef INET
	case AF_INET:
		len = ip_pseudo_compute(m, &ctx);
		break;
#endif
#ifdef INET6
	case AF_INET6:
		len = ip6_pseudo_compute(m, &ctx);
		break;
#endif
	default:
		return (EAFNOSUPPORT);
	}
	/*
	 * Step 2: Update MD5 hash with TCP header, excluding options.
	 * The TCP checksum must be set to zero.
	 */
	csum = th->th_sum;
	th->th_sum = 0;
	MD5Update(&ctx, (char *)th, sizeof(struct tcphdr));
	th->th_sum = csum;
	/*
	 * Step 3: Update MD5 hash with TCP segment data.
	 * Use m_apply() to avoid an early m_pullup().
	 */
	len += (th->th_off << 2);
	if (m->m_pkthdr.len - len > 0)
		m_apply(m, len, m->m_pkthdr.len - len,
		    tcp_signature_apply, &ctx);
	/*
	 * Step 4: Update MD5 hash with shared secret.
	 */
	MD5Update(&ctx, sav->key_auth->key_data, _KEYLEN(sav->key_auth));
	MD5Final(buf, &ctx);
	key_sa_recordxfer(sav, m);
	return (0);
}

static void
setsockaddrs(const struct mbuf *m, union sockaddr_union *src,