skip = (int) crp->crp_opaque2; protoff = (int) crp->crp_opaque3;
skip = (long) crp->crp_opaque2; protoff = (long) crp->crp_opaque3;
ah_input_cb(void *op){     int roff, rplen, error, skip, protoff;    unsigned char calc[AH_ALEN_MAX];    struct mbuf *m1, *m0, *m;    struct cryptodesc *crd;    struct auth_hash *ahx;    struct cryptop *crp;    struct tdb *tdb;    crp = (struct cryptop *) op;    crd = crp->crp_desc;    tdb = (struct tdb *) crp->crp_opaque1;    ahx = (struct auth_hash *) tdb->tdb_authalgxform;    skip = (int) crp->crp_opaque2;    protoff = (int) crp->crp_opaque3;    m = (struct mbuf *) crp->crp_buf;    tdb->tdb_ref--;    /* Check for crypto errors */    if (crp->crp_etype)    {        if (tdb->tdb_cryptoid != 0)	  tdb->tdb_cryptoid = crp->crp_sid;	if (crp->crp_etype == EAGAIN)	{	    tdb->tdb_ref++;	    return crypto_dispatch(crp);	}	ahstat.ahs_noxform++;	DPRINTF(("ah_input_cb(): crypto error %d\n", crp->crp_etype));	error = crp->crp_etype;	goto baddone;    }    /* Shouldn't happen... */    if (!m)    {	ahstat.ahs_crypto++;	DPRINTF(("ah_input_cb(): bogus returned buffer from crypto\n"));	error = EINVAL;	goto baddone;    }    /*     * Check that the TDB is still valid -- not really an error, but     * we need to handle it as such. It may happen if the TDB expired     * or was deleted while there was a pending request in the crypto     * queue.     */    if (tdb->tdb_flags & TDBF_INVALID)    {	ahstat.ahs_invalid++;	tdb_delete(tdb, 0, 0);	error = ENXIO;	DPRINTF(("ah_input_cb(): TDB expired while processing crypto\n"));	goto baddone;    }    if (!(tdb->tdb_flags & TDBF_NOREPLAY))      rplen = AH_FLENGTH + sizeof(u_int32_t);    else      rplen = AH_FLENGTH;    /* Copy computed authenticator */    m_copydata(m, skip + rplen, ahx->authsize, calc);    /* Verify authenticator */    if (bcmp(crp->crp_opaque4 + skip + rplen, calc, ahx->authsize))    {	DPRINTF(("ah_input(): authentication failed for packet in SA %s/%08x\n", ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));	ahstat.ahs_badauth++;	error = EACCES;	goto baddone;    }    /* Fix the Next Protocol field */    ((u_int8_t *) crp->crp_opaque4)[protoff] =				((u_int8_t *) crp->crp_opaque4)[skip];    /* Copyback the saved (uncooked) network headers */    m_copyback(m, 0, skip, crp->crp_opaque4);    /* No longer needed */    FREE(crp->crp_opaque4, M_XDATA);    crypto_freereq(crp);    /* Record the beginning of the AH header */    m1 = m_getptr(m, skip, &roff);    if (m1 == NULL)    {	DPRINTF(("ah_input(): bad mbuf chain for packet in SA %s/%08x\n",		 ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));	ahstat.ahs_hdrops++;	m_freem(m);	return EINVAL;    }    /* Remove the AH header from the mbuf */    if (roff == 0)     {	/* The AH header was conveniently at the beginning of the mbuf */	m_adj(m1, rplen + ahx->authsize);	if (!(m1->m_flags & M_PKTHDR))	  m->m_pkthdr.len -= rplen + ahx->authsize;    }    else      if (roff + rplen + ahx->authsize >= m1->m_len)      {	  /*	   * Part or all of the AH header is at the end of this mbuf, so first	   * let's remove the remainder of the AH header from the	   * beginning of the remainder of the mbuf chain, if any.	   */	  if (roff + rplen + ahx->authsize > m1->m_len)	  {	      /* Adjust the next mbuf by the remainder */	      m_adj(m1->m_next, roff + rplen + ahx->authsize - m1->m_len);	      /* The second mbuf is guaranteed not to have a pkthdr... */	      m->m_pkthdr.len -= (roff + rplen + ahx->authsize - m1->m_len);	  }	  /* Now, let's unlink the mbuf chain for a second...*/	  m0 = m1->m_next;	  m1->m_next = NULL;	  /* ...and trim the end of the first part of the chain...sick */	  m_adj(m1, -(m1->m_len - roff));	  if (!(m1->m_flags & M_PKTHDR))	    m->m_pkthdr.len -= (m1->m_len - roff);	  /* Finally, let's relink */	  m1->m_next = m0;      }      else      {	  /* 	   * The AH header lies in the "middle" of the mbuf...do an	   * overlapping copy of the remainder of the mbuf over the ESP	   * header.	   */	  bcopy(mtod(m1, u_char *) + roff + rplen + ahx->authsize,		mtod(m1, u_char *) + roff,		m1->m_len - (roff + rplen + ahx->authsize));	  m1->m_len -= rplen + ahx->authsize;	  m->m_pkthdr.len -= rplen + ahx->authsize;      }    return ipsec_common_input_cb(m, tdb, skip, protoff); baddone:    if (m)      m_freem(m);    /* We have to free this manually */    if (crp && crp->crp_opaque4)      FREE(crp->crp_opaque4, M_XDATA);    crypto_freereq(crp);    return error;}