sys/netipsec/ipsec.c

192 ipsec_checkpcbcache(struct mbuf *m, struct inpcbpolicy *pcbsp, int dir)
198 	KASSERT(IPSEC_DIR_IS_VALID(dir));
200 	KASSERT(dir < __arraycount(pcbsp->sp_cache));
209 	if (ipsec_spdgen != pcbsp->sp_cache[dir].cachegen) {
210 		ipsec_invalpcbcache(pcbsp, dir);
213 	sp = pcbsp->sp_cache[dir].cachesp;
218 		ipsec_invalpcbcache(pcbsp, dir);
223 		if (ipsec_setspidx(m, &spidx, dir, 1) != 0) {
233 		if (memcmp(&pcbsp->sp_cache[dir].cacheidx, &spidx,
255 	    key_sp_refcnt(sp), pcbsp->sp_cache[dir].cachesp);
263     struct secpolicy *sp, int dir)
266 	KASSERT(IPSEC_DIR_IS_INOROUT(dir));
267 	KASSERT(dir < __arraycount(pcbsp->sp_cache));
270 	pcbsp->sp_cache[dir].cachesp = NULL;
271 	pcbsp->sp_cache[dir].cachehint = IPSEC_PCBHINT_UNKNOWN;
272 	if (ipsec_setspidx(m, &pcbsp->sp_cache[dir].cacheidx, dir, 1) != 0) {
275 	pcbsp->sp_cache[dir].cachesp = sp;
276 	if (pcbsp->sp_cache[dir].cachesp) {
282 			switch (pcbsp->sp_cache[dir].cachesp->policy) {
285 				pcbsp->sp_cache[dir].cachehint =
289 				pcbsp->sp_cache[dir].cachehint =
294 	pcbsp->sp_cache[dir].cachegen = ipsec_spdgen;
300 ipsec_invalpcbcache(struct inpcbpolicy *pcbsp, int dir)
307 		if (dir != IPSEC_DIR_ANY && i != dir)
402 ipsec_getpolicybysock(struct mbuf *m, u_int dir, struct inpcb *inp,
413 	KASSERTMSG(IPSEC_DIR_IS_INOROUT(dir), "invalid direction %u", dir);
426 	currsp = ipsec_checkpcbcache(m, inp->inp_sp, dir);
449 	switch (dir) {
469 			if (key_havesp(dir))
470 				sp = KEY_LOOKUP_SP_BYSPIDX(&currsp->spidx, dir);
484 		if (key_havesp(dir))
485 			sp = KEY_LOOKUP_SP_BYSPIDX(&currsp->spidx, dir);
519 	ipsec_fillpcbcache(pcbsp, m, sp, dir);
534 ipsec_getpolicybyaddr(struct mbuf *m, u_int dir, int flag, int *error)
541 	KASSERTMSG(IPSEC_DIR_IS_INOROUT(dir), "invalid direction %u", dir);
546 	*error = ipsec_setspidx(m, &spidx, dir, 1);
548 		IPSECLOG(LOG_DEBUG, "setpidx failed, dir %u flag %u\n", dir, flag);
553 	spidx.dir = dir;
555 	if (key_havesp(dir)) {
556 		sp = KEY_LOOKUP_SP_BYSPIDX(&spidx, dir);
568 ipsec_checkpolicy(struct mbuf *m, u_int dir, u_int flag, int *error,
576 		sp = ipsec_getpolicybyaddr(m, dir, flag, error);
579 		sp = ipsec_getpolicybysock(m, dir, inp, error);
794 		inp->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND;
810 ipsec_setspidx(struct mbuf *m, struct secpolicyindex *spidx, int dir,
829 	spidx->dir = dir;
1545 ipsec_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
1556 		sp = ipsec_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
1558 		sp = ipsec_getpolicybysock(m, dir, inp, &error);