sys/netipsec/ipsec.c

264 	struct secpolicy *sp;
269 	sp = &V_def_policy;
270 	if (sp->policy != IPSEC_POLICY_DISCARD &&
271 	    sp->policy != IPSEC_POLICY_NONE) {
273 		    sp->policy, IPSEC_POLICY_NONE));
274 		sp->policy = IPSEC_POLICY_NONE;
276 	key_addref(sp);
280 			sp, sp->refcnt));
281 	return (sp);
301 	struct secpolicy *sp;
307 	sp = KEY_ALLOCSP2(tdbi->spi, &tdbi->dst, tdbi->proto, dir);
308 	if (sp == NULL)			/*XXX????*/
309 		sp = KEY_ALLOCSP_DEFAULT();
310 	IPSEC_ASSERT(sp != NULL, ("null SP"));
311 	return (sp);
332 	struct secpolicy *sp;
342 		sp = KEY_ALLOCSP_DEFAULT();
343 		return (sp);
368 			sp = currsp;
373 			sp = KEY_ALLOCSP(&currsp->spidx, dir);
374 			if (sp == NULL)		/* No SP found. */
375 				sp = KEY_ALLOCSP_DEFAULT();
385 		sp = KEY_ALLOCSP(&currsp->spidx, dir);
386 		if (sp == NULL) {		/* No SP found. */
396 				sp = KEY_ALLOCSP_DEFAULT();
401 				sp = currsp;
412 	IPSEC_ASSERT(sp != NULL,
416 			__func__, pcbsp->priv, currsp->policy, sp, sp->refcnt));
417 	return (sp);
434 	struct secpolicy *sp;
441 	sp = NULL;
452 		sp = KEY_ALLOCSP(&spidx, dir);
454 	if (sp == NULL)			/* No SP found, use system default. */
455 		sp = KEY_ALLOCSP_DEFAULT();
456 	IPSEC_ASSERT(sp != NULL, ("null SP"));
457 	return (sp);
464 	struct secpolicy *sp;
468 		sp = ipsec_getpolicybyaddr(m, dir, error);
470 		sp = ipsec_getpolicybysock(m, dir, inp, error);
471 	if (sp == NULL) {
476 	IPSEC_ASSERT(*error == 0, ("sp w/ error set to %u", *error));
477 	switch (sp->policy) {
480 		printf("%s: invalid policy %u\n", __func__, sp->policy);
488 		KEY_FREESP(&sp);
489 		sp = NULL;		/* NB: force NULL result. */
492 		if (sp->req == NULL)	/* Acquire a SA. */
493 			*error = key_spdacquire(sp);
497 		KEY_FREESP(&sp);
498 		sp = NULL;
500 	return (sp);
890 	struct secpolicy *sp;
892 	sp = ipsec_deepcopy_policy(old->sp_in);
893 	if (sp) {
895 		new->sp_in = sp;
899 	sp = ipsec_deepcopy_policy(old->sp_out);
900 	if (sp) {
902 		new->sp_out = sp;
963 		(*q)->sp = dst;
1140 	IPSEC_ASSERT(isr != NULL && isr->sp != NULL, ("null argument"));
1141 	IPSEC_ASSERT(isr->sp->spidx.src.sa.sa_family == isr->sp->spidx.dst.sa.sa_family,
1143 		 isr->sp->spidx.src.sa.sa_family,
1144 		 isr->sp->spidx.dst.sa.sa_family));
1159 	switch (((struct sockaddr *)&isr->sp->spidx.src)->sa_family) {
1178 			__func__, isr->sp->spidx.src.sa.sa_family);
1238 ipsec_in_reject(struct secpolicy *sp, const struct mbuf *m)
1244 		printf("%s: using SP\n", __func__); kdebug_secpolicy(sp));
1247 	switch (sp->policy) {
1255 	IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1256 		("invalid policy %u", sp->policy));
1261 	for (isr = sp->req; isr != NULL; isr = isr->next) {
1311 	struct secpolicy *sp;
1322 		sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, &error);
1324 		sp = ipsec_getpolicybysock(m, IPSEC_DIR_INBOUND, inp, &error);
1326 	if (sp != NULL) {
1327 		result = ipsec_in_reject(sp, m);
1328 		KEY_FREESP(&sp);
1377 ipsec_hdrsiz_internal(struct secpolicy *sp)
1383 		printf("%s: using SP\n", __func__); kdebug_secpolicy(sp));
1385 	switch (sp->policy) {
1392 	IPSEC_ASSERT(sp->policy == IPSEC_POLICY_IPSEC,
1393 		("invalid policy %u", sp->policy));
1396 	for (isr = sp->req; isr != NULL; isr = isr->next) {
1441 	struct secpolicy *sp;
1452 		sp = ipsec_getpolicybyaddr(m, dir, &error);
1454 		sp = ipsec_getpolicybysock(m, dir, inp, &error);
1456 	if (sp != NULL) {
1457 		size = ipsec_hdrsiz_internal(sp);
1462 		KEY_FREESP(&sp);