crp->crp_opaque2 = (caddr_t) skip; crp->crp_opaque3 = (caddr_t) protoff;
(long) crp->crp_opaque2 = skip; (long) crp->crp_opaque3 = protoff;
ah_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff){    struct auth_hash *ahx = (struct auth_hash *) tdb->tdb_authalgxform;    u_int32_t btsx;    u_int8_t hl;    int rplen;    struct cryptodesc *crda = NULL;    struct cryptop *crp;    if (!(tdb->tdb_flags & TDBF_NOREPLAY))      rplen = AH_FLENGTH + sizeof(u_int32_t);    else      rplen = AH_FLENGTH;    /* Save the AH header, we use it throughout */    m_copydata(m, skip + offsetof(struct ah, ah_hl), sizeof(u_int8_t),	       (caddr_t) &hl);    /* Replay window checking, if applicable */    if ((tdb->tdb_wnd > 0) && (!(tdb->tdb_flags & TDBF_NOREPLAY)))    {	m_copydata(m, skip + offsetof(struct ah, ah_rpl), sizeof(u_int32_t),		   (caddr_t) &btsx);	btsx = ntohl(btsx);	switch (checkreplaywindow32(btsx, 0, &(tdb->tdb_rpl),				    tdb->tdb_wnd, &(tdb->tdb_bitmap)))	{	    case 0: /* All's well */		break;	    case 1:		DPRINTF(("ah_input(): replay counter wrapped for SA %s/%08x\n", ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));		ahstat.ahs_wrap++;		m_freem(m);		return ENOBUFS;	    case 2:	    case 3:		DPRINTF(("ah_input(): duplicate packet received in SA %s/%08x\n", ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));		ahstat.ahs_replay++;		m_freem(m);		return ENOBUFS;	    default:                DPRINTF(("ah_input(): bogus value from checkreplaywindow32() in SA %s/%08x\n", ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));		ahstat.ahs_replay++;                m_freem(m);                return ENOBUFS;	}    }    /* Verify AH header length */    if (hl * sizeof(u_int32_t) != ahx->authsize + rplen - AH_FLENGTH)    {	DPRINTF(("ah_input(): bad authenticator length %d for packet in SA %s/%08x\n", hl * sizeof(u_int32_t), ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));	ahstat.ahs_badauthl++;	m_freem(m);	return EACCES;    }    /* Update the counters */    tdb->tdb_cur_bytes += (m->m_pkthdr.len - skip - hl * sizeof(u_int32_t));    ahstat.ahs_ibytes += (m->m_pkthdr.len - skip - hl * sizeof(u_int32_t));    /* Hard expiration */    if ((tdb->tdb_flags & TDBF_BYTES) &&	(tdb->tdb_cur_bytes >= tdb->tdb_exp_bytes))      {	  pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_HARD);	  tdb_delete(tdb, 0, TDBEXP_TIMEOUT);	  m_freem(m);	  return ENXIO;      }    /* Notify on expiration */    if ((tdb->tdb_flags & TDBF_SOFT_BYTES) &&	(tdb->tdb_cur_bytes >= tdb->tdb_soft_bytes))    {	pfkeyv2_expire(tdb, SADB_EXT_LIFETIME_SOFT);	tdb->tdb_flags &= ~TDBF_SOFT_BYTES;     /* Turn off checking */    }    /* Get crypto descriptors */    crp = crypto_getreq(1);    if (crp == NULL)    {	m_freem(m);	DPRINTF(("ah_input(): failed to acquire crypto descriptors\n"));	ahstat.ahs_crypto++;	return ENOBUFS;    }    crda = crp->crp_desc;    crda->crd_skip = 0;    crda->crd_len = m->m_pkthdr.len;    crda->crd_inject = skip + rplen;    /* Authentication operation */    crda->crd_alg = ahx->type;    crda->crd_key = tdb->tdb_amxkey;    crda->crd_klen = tdb->tdb_amxkeylen * 8;    /*     * Save the authenticator, the skipped portion of the packet, and the     * AH header.     */    MALLOC(crp->crp_opaque4, caddr_t, skip + rplen + ahx->authsize,	   M_XDATA, M_DONTWAIT);    if (crp->crp_opaque4 == 0)    {	m_freem(m);	crypto_freereq(crp);	DPRINTF(("ah_input(): failed to allocate auth array\n"));	ahstat.ahs_crypto++;	return ENOBUFS;    }    /* Save data */    m_copydata(m, 0, skip + rplen + ahx->authsize, crp->crp_opaque4);    /* Zeroize the authenticator on the packet */    m_copyback(m, skip + rplen, ahx->authsize, ipseczeroes);    /* "Massage" the packet headers for crypto processing */    if ((btsx = ah_massage_headers(&m, tdb->tdb_dst.sa.sa_family,				   skip, ahx->type, 0)) != 0)    {	/* mbuf will be free'd by callee */	FREE(crp->crp_opaque4, M_XDATA);	crypto_freereq(crp);	return btsx;    }    tdb->tdb_ref++;    /* Crypto operation descriptor */    crp->crp_ilen = m->m_pkthdr.len; /* Total input length */    crp->crp_flags = CRYPTO_F_IMBUF;    crp->crp_buf = (caddr_t) m;    crp->crp_callback = (int (*) (struct cryptop *)) ah_input_cb;    crp->crp_sid = tdb->tdb_cryptoid;    /* These are passed as-is to the callback */    crp->crp_opaque1 = (caddr_t) tdb;    crp->crp_opaque2 = (caddr_t) skip;    crp->crp_opaque3 = (caddr_t) protoff;    return crypto_dispatch(crp);}