* Check security policy for *OUTBOUND* IPv6 packet. */
| 766 | * Check security policy for *OUTBOUND* IPv6 packet. |
| 767 | */ |
| 768 | struct secpolicy * |
| 769 | ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error, |
| 770 | int needport) |
| 771 | { |
| 772 | struct secpolicy *sp; |
| 773 | |
| 774 | *error = 0; |
| 775 | sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport); |
| 776 | if (sp != NULL) |
| 777 | sp = ipsec_checkpolicy(sp, inp, error); |
| 778 | if (sp == NULL) { |
| 779 | switch (*error) { |
| 780 | case 0: /* No IPsec required: BYPASS or NONE */ |
| 781 | break; |
| 782 | case -EINVAL: |
| 783 | IPSEC6STAT_INC(ips_out_polvio); |
| 784 | break; |
| 785 | default: |
| 786 | IPSEC6STAT_INC(ips_out_inval); |
| 787 | } |
| 788 | } |
| 789 | KEYDBG(IPSEC_STAMP, |
| 790 | printf("%s: using SP(%p), error %d\n", __func__, sp, *error)); |
| 791 | if (sp != NULL) |
| 792 | KEYDBG(IPSEC_DATA, kdebug_secpolicy(sp)); |
| 793 | return (sp); |
| 794 | } |
| 795 | |
| 796 | /* |
| 797 | * Check IPv6 packet against inbound security policy. |
no test coverage detected