xnu-4570.51.1.tar.gz

[apple/xnu.git] / bsd / netinet6 / ah_core.c

diff --git a/bsd/netinet6/ah_core.c b/bsd/netinet6/ah_core.c
index 27098a76f7380a113858569d0068db7dd1df38e4..b072b692ecce92e778198901b7db5281b0e5a082 100644 (file)
--- a/bsd/netinet6/ah_core.c
+++ b/bsd/netinet6/ah_core.c
@@ -1,8 +1,8 @@
 /*
 /*

- * Copyright (c) 2008 Apple Inc. All rights reserved.
+ * Copyright (c) 2008-2016 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

- * 
+ *

  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in


@@ -11,10 +11,10 @@
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.

- * 
+ *

  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.

- * 
+ *

  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,


@@ -22,7 +22,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.

- * 
+ *

  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 


@@ -108,7 +108,7 @@
 #include <netkey/keydb.h>
 #include <libkern/crypto/md5.h>
 #include <libkern/crypto/sha1.h>
 #include <netkey/keydb.h>
 #include <libkern/crypto/md5.h>
 #include <libkern/crypto/sha1.h>

-#include <crypto/sha2/sha2.h>
+#include <libkern/crypto/sha2.h>

 
 #include <net/net_osdep.h>
 
 
 #include <net/net_osdep.h>
 


@@ -136,7 +136,7 @@ static int ah_hmac_sha1_mature(struct secasvar *);
 static int ah_hmac_sha1_init(struct ah_algorithm_state *, struct secasvar *);
 static void ah_hmac_sha1_loop(struct ah_algorithm_state *, caddr_t, size_t);
 static void ah_hmac_sha1_result(struct ah_algorithm_state *, caddr_t, size_t);
 static int ah_hmac_sha1_init(struct ah_algorithm_state *, struct secasvar *);
 static void ah_hmac_sha1_loop(struct ah_algorithm_state *, caddr_t, size_t);
 static void ah_hmac_sha1_result(struct ah_algorithm_state *, caddr_t, size_t);

-#if ALLCRYPTO
+#if AH_ALL_CRYPTO

 static int ah_sumsiz_sha2_256(struct secasvar *);
 static int ah_hmac_sha2_256_mature(struct secasvar *);
 static int ah_hmac_sha2_256_init(struct ah_algorithm_state *,
 static int ah_sumsiz_sha2_256(struct secasvar *);
 static int ah_hmac_sha2_256_mature(struct secasvar *);
 static int ah_hmac_sha2_256_init(struct ah_algorithm_state *,


@@ -155,14 +155,13 @@ static int ah_hmac_sha2_512_init(struct ah_algorithm_state *,
        struct secasvar *);
 static void ah_hmac_sha2_512_loop(struct ah_algorithm_state *, caddr_t, size_t);
 static void ah_hmac_sha2_512_result(struct ah_algorithm_state *, caddr_t, size_t);
        struct secasvar *);
 static void ah_hmac_sha2_512_loop(struct ah_algorithm_state *, caddr_t, size_t);
 static void ah_hmac_sha2_512_result(struct ah_algorithm_state *, caddr_t, size_t);

-#endif /* ALLCRYPTO */
+#endif /* AH_ALL_CRYPTO */

 
 static void ah_update_mbuf(struct mbuf *, int, int,
        const struct ah_algorithm *, struct ah_algorithm_state *);
 
 const struct ah_algorithm *
 
 static void ah_update_mbuf(struct mbuf *, int, int,
        const struct ah_algorithm *, struct ah_algorithm_state *);
 
 const struct ah_algorithm *

-ah_algorithm_lookup(idx)
-       int idx;
+ah_algorithm_lookup(int idx)

 {
        /* checksum algorithms */
        static struct ah_algorithm hmac_md5 =
 {
        /* checksum algorithms */
        static struct ah_algorithm hmac_md5 =


@@ -184,7 +183,7 @@ ah_algorithm_lookup(idx)
        static struct ah_algorithm ah_none =
                { ah_sumsiz_zero, ah_none_mature, 0, 2048, "none",
                        ah_none_init, ah_none_loop, ah_none_result, };
        static struct ah_algorithm ah_none =
                { ah_sumsiz_zero, ah_none_mature, 0, 2048, "none",
                        ah_none_init, ah_none_loop, ah_none_result, };

-#if ALLCRYPTO
+#if AH_ALL_CRYPTO

        static struct ah_algorithm hmac_sha2_256 =
                { ah_sumsiz_sha2_256, ah_hmac_sha2_256_mature, 256, 256,
                        "hmac-sha2-256",
        static struct ah_algorithm hmac_sha2_256 =
                { ah_sumsiz_sha2_256, ah_hmac_sha2_256_mature, 256, 256,
                        "hmac-sha2-256",


@@ -200,7 +199,7 @@ ah_algorithm_lookup(idx)
                        "hmac-sha2-512",
                        ah_hmac_sha2_512_init, ah_hmac_sha2_512_loop,
                        ah_hmac_sha2_512_result, };
                        "hmac-sha2-512",
                        ah_hmac_sha2_512_init, ah_hmac_sha2_512_loop,
                        ah_hmac_sha2_512_result, };

-#endif /* ALLCRYPTO */
+#endif /* AH_ALL_CRYPTO */

 
        switch (idx) {
        case SADB_AALG_MD5HMAC:
 
        switch (idx) {
        case SADB_AALG_MD5HMAC:


@@ -213,14 +212,14 @@ ah_algorithm_lookup(idx)
                return &keyed_sha1;
        case SADB_X_AALG_NULL:
                return &ah_none;
                return &keyed_sha1;
        case SADB_X_AALG_NULL:
                return &ah_none;

-#if ALLCRYPTO
+#if AH_ALL_CRYPTO

        case SADB_X_AALG_SHA2_256:
                return &hmac_sha2_256;
        case SADB_X_AALG_SHA2_384:
                return &hmac_sha2_384;
        case SADB_X_AALG_SHA2_512:
                return &hmac_sha2_512;
        case SADB_X_AALG_SHA2_256:
                return &hmac_sha2_256;
        case SADB_X_AALG_SHA2_384:
                return &hmac_sha2_384;
        case SADB_X_AALG_SHA2_512:
                return &hmac_sha2_512;

-#endif /* ALLCRYPTO */
+#endif /* AH_ALL_CRYPTO */

        default:
                return NULL;
        }
        default:
                return NULL;
        }


@@ -228,8 +227,7 @@ ah_algorithm_lookup(idx)
 
 
 static int
 
 
 static int

-ah_sumsiz_1216(sav)
-       struct secasvar *sav;
+ah_sumsiz_1216(struct secasvar *sav)

 {
        if (!sav)
                return -1;
 {
        if (!sav)
                return -1;


@@ -240,8 +238,7 @@ ah_sumsiz_1216(sav)
 }
 
 static int
 }
 
 static int

-ah_sumsiz_zero(sav)
-       struct secasvar *sav;
+ah_sumsiz_zero(struct secasvar *sav)

 {
        if (!sav)
                return -1;
 {
        if (!sav)
                return -1;


@@ -249,8 +246,7 @@ ah_sumsiz_zero(sav)
 }
 
 static int
 }
 
 static int

-ah_none_mature(sav)
-       struct secasvar *sav;
+ah_none_mature(struct secasvar *sav)

 {
        if (sav->sah->saidx.proto == IPPROTO_AH) {
                ipseclog((LOG_ERR,
 {
        if (sav->sah->saidx.proto == IPPROTO_AH) {
                ipseclog((LOG_ERR,


@@ -294,13 +290,11 @@ ah_keyed_md5_mature(
 }
 
 static int
 }
 
 static int

-ah_keyed_md5_init(state, sav)
-       struct ah_algorithm_state *state;
-       struct secasvar *sav;
+ah_keyed_md5_init(struct ah_algorithm_state *state, struct secasvar *sav)

 {
        size_t padlen;
        size_t keybitlen;
 {
        size_t padlen;
        size_t keybitlen;

-       u_int8_t buf[32];
+       u_int8_t buf[32] __attribute__((aligned(4)));

 
        if (!state)
                panic("ah_keyed_md5_init: what?");
 
        if (!state)
                panic("ah_keyed_md5_init: what?");


@@ -352,10 +346,7 @@ ah_keyed_md5_init(state, sav)
 }
 
 static void
 }
 
 static void

-ah_keyed_md5_loop(state, addr, len)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t len;
+ah_keyed_md5_loop(struct ah_algorithm_state *state, caddr_t addr, size_t len)

 {
        if (!state)
                panic("ah_keyed_md5_loop: what?");
 {
        if (!state)
                panic("ah_keyed_md5_loop: what?");


@@ -364,12 +355,9 @@ ah_keyed_md5_loop(state, addr, len)
 }
 
 static void
 }
 
 static void

-ah_keyed_md5_result(state, addr, l)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t l;
+ah_keyed_md5_result(struct ah_algorithm_state *state, caddr_t addr, size_t l)

 {
 {

-       u_char digest[16];
+       u_char digest[16] __attribute__((aligned(4)));

 
        if (!state)
                panic("ah_keyed_md5_result: what?");
 
        if (!state)
                panic("ah_keyed_md5_result: what?");


@@ -385,8 +373,7 @@ ah_keyed_md5_result(state, addr, l)
 }
 
 static int
 }
 
 static int

-ah_keyed_sha1_mature(sav)
-       struct secasvar *sav;
+ah_keyed_sha1_mature(struct secasvar *sav)

 {
        const struct ah_algorithm *algo;
 
 {
        const struct ah_algorithm *algo;
 


@@ -413,14 +400,12 @@ ah_keyed_sha1_mature(sav)
 }
 
 static int
 }
 
 static int

-ah_keyed_sha1_init(state, sav)
-       struct ah_algorithm_state *state;
-       struct secasvar *sav;
+ah_keyed_sha1_init(struct ah_algorithm_state *state, struct secasvar *sav)

 {
        SHA1_CTX *ctxt;
        size_t padlen;
        size_t keybitlen;
 {
        SHA1_CTX *ctxt;
        size_t padlen;
        size_t keybitlen;

-       u_int8_t buf[32];
+       u_int8_t buf[32] __attribute__((aligned(4)));

 
        if (!state)
                panic("ah_keyed_sha1_init: what?");
 
        if (!state)
                panic("ah_keyed_sha1_init: what?");


@@ -471,10 +456,7 @@ ah_keyed_sha1_init(state, sav)
 }
 
 static void
 }
 
 static void

-ah_keyed_sha1_loop(state, addr, len)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t len;
+ah_keyed_sha1_loop(struct ah_algorithm_state *state, caddr_t addr, size_t len)

 {
        SHA1_CTX *ctxt;
 
 {
        SHA1_CTX *ctxt;
 


@@ -486,12 +468,9 @@ ah_keyed_sha1_loop(state, addr, len)
 }
 
 static void
 }
 
 static void

-ah_keyed_sha1_result(state, addr, l)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t l;
+ah_keyed_sha1_result(struct ah_algorithm_state *state, caddr_t addr, size_t l)

 {
 {

-       u_char digest[SHA1_RESULTLEN];  /* SHA-1 generates 160 bits */
+       u_char digest[SHA1_RESULTLEN] __attribute__((aligned(4)));      /* SHA-1 generates 160 bits */

        SHA1_CTX *ctxt;
 
        if (!state || !state->foo)
        SHA1_CTX *ctxt;
 
        if (!state || !state->foo)


@@ -509,8 +488,7 @@ ah_keyed_sha1_result(state, addr, l)
 }
 
 static int
 }
 
 static int

-ah_hmac_md5_mature(sav)
-       struct secasvar *sav;
+ah_hmac_md5_mature(struct secasvar *sav)

 {
        const struct ah_algorithm *algo;
 
 {
        const struct ah_algorithm *algo;
 


@@ -537,13 +515,11 @@ ah_hmac_md5_mature(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_md5_init(state, sav)
-       struct ah_algorithm_state *state;
-       struct secasvar *sav;
+ah_hmac_md5_init(struct ah_algorithm_state *state, struct secasvar *sav)

 {
        u_char *ipad;
        u_char *opad;
 {
        u_char *ipad;
        u_char *opad;

-       u_char tk[16];
+       u_char tk[16] __attribute__((aligned(4)));

        u_char *key;
        size_t keylen;
        size_t i;
        u_char *key;
        size_t keylen;
        size_t i;


@@ -559,7 +535,7 @@ ah_hmac_md5_init(state, sav)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);

-       ctxt = (MD5_CTX *)(opad + 64);
+       ctxt = (MD5_CTX *)(void *)(opad + 64);

 
        /* compress the key if necessery */
        if (64 < _KEYLEN(state->sav->key_auth)) {
 
        /* compress the key if necessery */
        if (64 < _KEYLEN(state->sav->key_auth)) {


@@ -590,26 +566,20 @@ ah_hmac_md5_init(state, sav)
 }
 
 static void
 }
 
 static void

-ah_hmac_md5_loop(state, addr, len)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t len;
+ah_hmac_md5_loop(struct ah_algorithm_state *state, caddr_t addr, size_t len)

 {
        MD5_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_md5_loop: what?");
 {
        MD5_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_md5_loop: what?");

-       ctxt = (MD5_CTX *)(((caddr_t)state->foo) + 128);
+       ctxt = (MD5_CTX *)(void *)(((caddr_t)state->foo) + 128);

        MD5Update(ctxt, addr, len);
 }
 
 static void
        MD5Update(ctxt, addr, len);
 }
 
 static void

-ah_hmac_md5_result(state, addr, l)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t l;
+ah_hmac_md5_result(struct ah_algorithm_state *state, caddr_t addr, size_t l)

 {
 {

-       u_char digest[16];
+       u_char digest[16] __attribute__((aligned(4)));

        u_char *ipad;
        u_char *opad;
        MD5_CTX *ctxt;
        u_char *ipad;
        u_char *opad;
        MD5_CTX *ctxt;


@@ -619,7 +589,7 @@ ah_hmac_md5_result(state, addr, l)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);

-       ctxt = (MD5_CTX *)(opad + 64);
+       ctxt = (MD5_CTX *)(void *)(opad + 64);

 
        MD5Final(&digest[0], ctxt);
 
 
        MD5Final(&digest[0], ctxt);
 


@@ -634,8 +604,7 @@ ah_hmac_md5_result(state, addr, l)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha1_mature(sav)
-       struct secasvar *sav;
+ah_hmac_sha1_mature(struct secasvar *sav)

 {
        const struct ah_algorithm *algo;
 
 {
        const struct ah_algorithm *algo;
 


@@ -662,14 +631,12 @@ ah_hmac_sha1_mature(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha1_init(state, sav)
-       struct ah_algorithm_state *state;
-       struct secasvar *sav;
+ah_hmac_sha1_init(struct ah_algorithm_state *state, struct secasvar *sav)

 {
        u_char *ipad;
        u_char *opad;
        SHA1_CTX *ctxt;
 {
        u_char *ipad;
        u_char *opad;
        SHA1_CTX *ctxt;

-       u_char tk[SHA1_RESULTLEN];      /* SHA-1 generates 160 bits */
+       u_char tk[SHA1_RESULTLEN] __attribute__((aligned(4)));  /* SHA-1 generates 160 bits */

        u_char *key;
        size_t keylen;
        size_t i;
        u_char *key;
        size_t keylen;
        size_t i;


@@ -685,7 +652,7 @@ ah_hmac_sha1_init(state, sav)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);

-       ctxt = (SHA1_CTX *)(opad + 64);
+       ctxt = (SHA1_CTX *)(void *)(opad + 64);

 
        /* compress the key if necessery */
        if (64 < _KEYLEN(state->sav->key_auth)) {
 
        /* compress the key if necessery */
        if (64 < _KEYLEN(state->sav->key_auth)) {


@@ -716,27 +683,21 @@ ah_hmac_sha1_init(state, sav)
 }
 
 static void
 }
 
 static void

-ah_hmac_sha1_loop(state, addr, len)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t len;
+ah_hmac_sha1_loop(struct ah_algorithm_state *state, caddr_t addr, size_t len)

 {
        SHA1_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha1_loop: what?");
 
 {
        SHA1_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha1_loop: what?");
 

-       ctxt = (SHA1_CTX *)(((u_char *)state->foo) + 128);
+       ctxt = (SHA1_CTX *)(void *)(((u_char *)state->foo) + 128);

        SHA1Update(ctxt, (caddr_t)addr, (size_t)len);
 }
 
 static void
        SHA1Update(ctxt, (caddr_t)addr, (size_t)len);
 }
 
 static void

-ah_hmac_sha1_result(state, addr, l)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t l;
+ah_hmac_sha1_result(struct ah_algorithm_state *state, caddr_t addr, size_t l)

 {
 {

-       u_char digest[SHA1_RESULTLEN];  /* SHA-1 generates 160 bits */
+       u_char digest[SHA1_RESULTLEN] __attribute__((aligned(4)));      /* SHA-1 generates 160 bits */

        u_char *ipad;
        u_char *opad;
        SHA1_CTX *ctxt;
        u_char *ipad;
        u_char *opad;
        SHA1_CTX *ctxt;


@@ -746,7 +707,7 @@ ah_hmac_sha1_result(state, addr, l)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);

-       ctxt = (SHA1_CTX *)(opad + 64);
+       ctxt = (SHA1_CTX *)(void *)(opad + 64);

 
        SHA1Final((caddr_t)&digest[0], ctxt);
 
 
        SHA1Final((caddr_t)&digest[0], ctxt);
 


@@ -760,10 +721,9 @@ ah_hmac_sha1_result(state, addr, l)
        FREE(state->foo, M_TEMP);
 }
 
        FREE(state->foo, M_TEMP);
 }
 

-#if ALLCRYPTO
+#if AH_ALL_CRYPTO

 static int
 static int

-ah_sumsiz_sha2_256(sav)
-       struct secasvar *sav;
+ah_sumsiz_sha2_256(struct secasvar *sav)

 {
        if (!sav)
                return -1;
 {
        if (!sav)
                return -1;


@@ -772,8 +732,7 @@ ah_sumsiz_sha2_256(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha2_256_mature(sav)
-       struct secasvar *sav;
+ah_hmac_sha2_256_mature(struct secasvar *sav)

 {
        const struct ah_algorithm *algo;
 
 {
        const struct ah_algorithm *algo;
 


@@ -802,14 +761,12 @@ ah_hmac_sha2_256_mature(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha2_256_init(state, sav)
-       struct ah_algorithm_state *state;
-       struct secasvar *sav;
+ah_hmac_sha2_256_init(struct ah_algorithm_state *state, struct secasvar *sav)

 {
        u_char *ipad;
        u_char *opad;
        SHA256_CTX *ctxt;
 {
        u_char *ipad;
        u_char *opad;
        SHA256_CTX *ctxt;

-       u_char tk[SHA256_DIGEST_LENGTH];
+       u_char tk[SHA256_DIGEST_LENGTH] __attribute__((aligned(4)));

        u_char *key;
        size_t keylen;
        size_t i;
        u_char *key;
        size_t keylen;
        size_t i;


@@ -825,7 +782,7 @@ ah_hmac_sha2_256_init(state, sav)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);

-       ctxt = (SHA256_CTX *)(opad + 64);
+       ctxt = (SHA256_CTX *)(void *)(opad + 64);

 
        /* compress the key if necessery */
        if (64 < _KEYLEN(state->sav->key_auth)) {
 
        /* compress the key if necessery */
        if (64 < _KEYLEN(state->sav->key_auth)) {


@@ -859,27 +816,25 @@ ah_hmac_sha2_256_init(state, sav)
 }
 
 static void
 }
 
 static void

-ah_hmac_sha2_256_loop(state, addr, len)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t len;
+ah_hmac_sha2_256_loop(struct ah_algorithm_state *state,
+                     caddr_t addr,
+                     size_t len)

 {
        SHA256_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha2_256_loop: what?");
 
 {
        SHA256_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha2_256_loop: what?");
 

-       ctxt = (SHA256_CTX *)(((u_char *)state->foo) + 128);
+       ctxt = (SHA256_CTX *)(void *)(((u_char *)state->foo) + 128);

        SHA256_Update(ctxt, (const u_int8_t *)addr, (size_t)len);
 }
 
 static void
        SHA256_Update(ctxt, (const u_int8_t *)addr, (size_t)len);
 }
 
 static void

-ah_hmac_sha2_256_result(state, addr, l)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t l;
+ah_hmac_sha2_256_result(struct ah_algorithm_state *state,
+                       caddr_t addr,
+                       size_t l)

 {
 {

-       u_char digest[SHA256_DIGEST_LENGTH];
+       u_char digest[SHA256_DIGEST_LENGTH] __attribute__((aligned(4)));

        u_char *ipad;
        u_char *opad;
        SHA256_CTX *ctxt;
        u_char *ipad;
        u_char *opad;
        SHA256_CTX *ctxt;


@@ -889,7 +844,7 @@ ah_hmac_sha2_256_result(state, addr, l)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 64);

-       ctxt = (SHA256_CTX *)(opad + 64);
+       ctxt = (SHA256_CTX *)(void *)(opad + 64);

 
        SHA256_Final((u_int8_t *)digest, ctxt);
 
 
        SHA256_Final((u_int8_t *)digest, ctxt);
 


@@ -904,8 +859,7 @@ ah_hmac_sha2_256_result(state, addr, l)
 }
 
 static int
 }
 
 static int

-ah_sumsiz_sha2_384(sav)
-       struct secasvar *sav;
+ah_sumsiz_sha2_384(struct secasvar *sav)

 {
        if (!sav)
                return -1;
 {
        if (!sav)
                return -1;


@@ -914,8 +868,7 @@ ah_sumsiz_sha2_384(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha2_384_mature(sav)
-       struct secasvar *sav;
+ah_hmac_sha2_384_mature(struct secasvar *sav)

 {
        const struct ah_algorithm *algo;
 
 {
        const struct ah_algorithm *algo;
 


@@ -944,14 +897,12 @@ ah_hmac_sha2_384_mature(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha2_384_init(state, sav)
-       struct ah_algorithm_state *state;
-       struct secasvar *sav;
+ah_hmac_sha2_384_init(struct ah_algorithm_state *state, struct secasvar *sav)

 {
        u_char *ipad;
        u_char *opad;
        SHA384_CTX *ctxt;
 {
        u_char *ipad;
        u_char *opad;
        SHA384_CTX *ctxt;

-       u_char tk[SHA384_DIGEST_LENGTH];
+       u_char tk[SHA384_DIGEST_LENGTH] __attribute__((aligned(4)));

        u_char *key;
        size_t keylen;
        size_t i;
        u_char *key;
        size_t keylen;
        size_t i;


@@ -961,14 +912,13 @@ ah_hmac_sha2_384_init(state, sav)
 
        state->sav = sav;
        state->foo = (void *)_MALLOC(128 + 128 + sizeof(SHA384_CTX),
 
        state->sav = sav;
        state->foo = (void *)_MALLOC(128 + 128 + sizeof(SHA384_CTX),

-           M_TEMP, M_NOWAIT);
+           M_TEMP, M_NOWAIT | M_ZERO);

        if (!state->foo)
                return ENOBUFS;
        if (!state->foo)
                return ENOBUFS;

-       bzero(state->foo, 128 + 128 + sizeof(SHA384_CTX));

 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);

-       ctxt = (SHA384_CTX *)(opad + 128);
+       ctxt = (SHA384_CTX *)(void *)(opad + 128);

 
        /* compress the key if necessery */
        if (128 < _KEYLEN(state->sav->key_auth)) {
 
        /* compress the key if necessery */
        if (128 < _KEYLEN(state->sav->key_auth)) {


@@ -1002,25 +952,23 @@ ah_hmac_sha2_384_init(state, sav)
 }
 
 static void
 }
 
 static void

-ah_hmac_sha2_384_loop(state, addr, len)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t len;
+ah_hmac_sha2_384_loop(struct ah_algorithm_state *state,
+                     caddr_t addr,
+                     size_t len)

 {
        SHA384_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha2_384_loop: what?");
 
 {
        SHA384_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha2_384_loop: what?");
 

-       ctxt = (SHA384_CTX *)(((u_char *)state->foo) + 256);
+       ctxt = (SHA384_CTX *)(void *)(((u_char *)state->foo) + 256);

        SHA384_Update(ctxt, (const u_int8_t *)addr, (size_t)len);
 }
 
 static void
        SHA384_Update(ctxt, (const u_int8_t *)addr, (size_t)len);
 }
 
 static void

-ah_hmac_sha2_384_result(state, addr, l)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t l;
+ah_hmac_sha2_384_result(struct ah_algorithm_state *state,
+                       caddr_t addr,
+                       size_t l)

 {
        u_char digest[SHA384_DIGEST_LENGTH];
        u_char *ipad;
 {
        u_char digest[SHA384_DIGEST_LENGTH];
        u_char *ipad;


@@ -1032,7 +980,7 @@ ah_hmac_sha2_384_result(state, addr, l)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);

-       ctxt = (SHA384_CTX *)(opad + 128);
+       ctxt = (SHA384_CTX *)(void *)(opad + 128);

 
        SHA384_Final((u_int8_t *)digest, ctxt);
 
 
        SHA384_Final((u_int8_t *)digest, ctxt);
 


@@ -1047,8 +995,7 @@ ah_hmac_sha2_384_result(state, addr, l)
 }
 
 static int
 }
 
 static int

-ah_sumsiz_sha2_512(sav)
-       struct secasvar *sav;
+ah_sumsiz_sha2_512(struct secasvar *sav)

 {
        if (!sav)
                return -1;
 {
        if (!sav)
                return -1;


@@ -1057,8 +1004,7 @@ ah_sumsiz_sha2_512(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha2_512_mature(sav)
-       struct secasvar *sav;
+ah_hmac_sha2_512_mature(struct secasvar *sav)

 {
        const struct ah_algorithm *algo;
 
 {
        const struct ah_algorithm *algo;
 


@@ -1087,14 +1033,12 @@ ah_hmac_sha2_512_mature(sav)
 }
 
 static int
 }
 
 static int

-ah_hmac_sha2_512_init(state, sav)
-       struct ah_algorithm_state *state;
-       struct secasvar *sav;
+ah_hmac_sha2_512_init(struct ah_algorithm_state *state, struct secasvar *sav)

 {
        u_char *ipad;
        u_char *opad;
        SHA512_CTX *ctxt;
 {
        u_char *ipad;
        u_char *opad;
        SHA512_CTX *ctxt;

-       u_char tk[SHA512_DIGEST_LENGTH];
+       u_char tk[SHA512_DIGEST_LENGTH] __attribute__((aligned(4)));

        u_char *key;
        size_t keylen;
        size_t i;
        u_char *key;
        size_t keylen;
        size_t i;


@@ -1104,14 +1048,13 @@ ah_hmac_sha2_512_init(state, sav)
 
        state->sav = sav;
        state->foo = (void *)_MALLOC(128 + 128 + sizeof(SHA512_CTX),
 
        state->sav = sav;
        state->foo = (void *)_MALLOC(128 + 128 + sizeof(SHA512_CTX),

-           M_TEMP, M_NOWAIT);
+           M_TEMP, M_NOWAIT | M_ZERO);

        if (!state->foo)
                return ENOBUFS;
        if (!state->foo)
                return ENOBUFS;

-       bzero(state->foo, 128 + 128 + sizeof(SHA512_CTX));

 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);

-       ctxt = (SHA512_CTX *)(opad + 128);
+       ctxt = (SHA512_CTX *)(void *)(opad + 128);

 
        /* compress the key if necessery */
        if (128 < _KEYLEN(state->sav->key_auth)) {
 
        /* compress the key if necessery */
        if (128 < _KEYLEN(state->sav->key_auth)) {


@@ -1145,27 +1088,25 @@ ah_hmac_sha2_512_init(state, sav)
 }
 
 static void
 }
 
 static void

-ah_hmac_sha2_512_loop(state, addr, len)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t len;
+ah_hmac_sha2_512_loop(struct ah_algorithm_state *state,
+                     caddr_t addr,
+                     size_t len)

 {
        SHA512_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha2_512_loop: what?");
 
 {
        SHA512_CTX *ctxt;
 
        if (!state || !state->foo)
                panic("ah_hmac_sha2_512_loop: what?");
 

-       ctxt = (SHA512_CTX *)(((u_char *)state->foo) + 256);
+       ctxt = (SHA512_CTX *)(void *)(((u_char *)state->foo) + 256);

        SHA512_Update(ctxt, (const u_int8_t *) addr, (size_t)len);
 }
 
 static void
        SHA512_Update(ctxt, (const u_int8_t *) addr, (size_t)len);
 }
 
 static void

-ah_hmac_sha2_512_result(state, addr, l)
-       struct ah_algorithm_state *state;
-       caddr_t addr;
-       size_t l;
+ah_hmac_sha2_512_result(struct ah_algorithm_state *state,
+                       caddr_t addr,
+                       size_t l)

 {
 {

-       u_char digest[SHA512_DIGEST_LENGTH];
+       u_char digest[SHA512_DIGEST_LENGTH] __attribute__((aligned(4)));

        u_char *ipad;
        u_char *opad;
        SHA512_CTX *ctxt;
        u_char *ipad;
        u_char *opad;
        SHA512_CTX *ctxt;


@@ -1175,7 +1116,7 @@ ah_hmac_sha2_512_result(state, addr, l)
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);
 
        ipad = (u_char *)state->foo;
        opad = (u_char *)(ipad + 128);

-       ctxt = (SHA512_CTX *)(opad + 128);
+       ctxt = (SHA512_CTX *)(void *)(opad + 128);

 
        SHA512_Final((u_int8_t *)digest, ctxt);
 
 
        SHA512_Final((u_int8_t *)digest, ctxt);
 


@@ -1188,7 +1129,7 @@ ah_hmac_sha2_512_result(state, addr, l)
 
        FREE(state->foo, M_TEMP);
 }
 
        FREE(state->foo, M_TEMP);
 }

-#endif /* ALLCRYPTO */
+#endif /* AH_ALL_CRYPTO */

 
 /*------------------------------------------------------------*/
 
 
 /*------------------------------------------------------------*/
 


@@ -1196,12 +1137,9 @@ ah_hmac_sha2_512_result(state, addr, l)
  * go generate the checksum.
  */
 static void
  * go generate the checksum.
  */
 static void

-ah_update_mbuf(m, off, len, algo, algos)
-       struct mbuf *m;
-       int off;
-       int len;
-       const struct ah_algorithm *algo;
-       struct ah_algorithm_state *algos;
+ah_update_mbuf(struct mbuf *m,int off, int len,
+              const struct ah_algorithm *algo,
+              struct ah_algorithm_state *algos)

 {
        struct mbuf *n;
        int tlen;
 {
        struct mbuf *n;
        int tlen;


@@ -1246,18 +1184,14 @@ ah_update_mbuf(m, off, len, algo, algos)
  * Don't use m_copy(), it will try to share cluster mbuf by using refcnt.
  */
 int
  * Don't use m_copy(), it will try to share cluster mbuf by using refcnt.
  */
 int

-ah4_calccksum(m, ahdat, len, algo, sav)
-       struct mbuf *m;
-       caddr_t ahdat;
-       size_t len;
-       const struct ah_algorithm *algo;
-       struct secasvar *sav;
+ah4_calccksum(struct mbuf *m, caddr_t ahdat, size_t len,
+             const struct ah_algorithm *algo, struct secasvar *sav)

 {
        int off;
        int hdrtype;
        size_t advancewidth;
        struct ah_algorithm_state algos;
 {
        int off;
        int hdrtype;
        size_t advancewidth;
        struct ah_algorithm_state algos;

-       u_char sumbuf[AH_MAXSUMSIZE];
+       u_char sumbuf[AH_MAXSUMSIZE] __attribute__((aligned(4)));

        int error = 0;
        int ahseen;
        struct mbuf *n = NULL;
        int error = 0;
        int ahseen;
        struct mbuf *n = NULL;


@@ -1490,12 +1424,8 @@ fail:
  * Don't use m_copy(), it will try to share cluster mbuf by using refcnt.
  */
 int
  * Don't use m_copy(), it will try to share cluster mbuf by using refcnt.
  */
 int

-ah6_calccksum(m, ahdat, len, algo, sav)
-       struct mbuf *m;
-       caddr_t ahdat;
-       size_t len;
-       const struct ah_algorithm *algo;
-       struct secasvar *sav;
+ah6_calccksum(struct mbuf *m, caddr_t ahdat, size_t len,
+             const struct ah_algorithm *algo, struct secasvar *sav)

 {
        int newoff, off;
        int proto, nxt;
 {
        int newoff, off;
        int proto, nxt;


@@ -1503,7 +1433,7 @@ ah6_calccksum(m, ahdat, len, algo, sav)
        int error;
        int ahseen;
        struct ah_algorithm_state algos;
        int error;
        int ahseen;
        struct ah_algorithm_state algos;

-       u_char sumbuf[AH_MAXSUMSIZE];
+       u_char sumbuf[AH_MAXSUMSIZE] __attribute__((aligned(4)));

 
        if ((m->m_flags & M_PKTHDR) == 0)
                return EINVAL;
 
        if ((m->m_flags & M_PKTHDR) == 0)
                return EINVAL;