| 972 | } |
| 973 | |
| 974 | static int |
| 975 | ipsec_check_history(const struct mbuf *m, struct secpolicy *sp, u_int idx) |
| 976 | { |
| 977 | struct xform_history *xh; |
| 978 | struct m_tag *mtag; |
| 979 | |
| 980 | mtag = NULL; |
| 981 | while ((mtag = m_tag_find(__DECONST(struct mbuf *, m), |
| 982 | PACKET_TAG_IPSEC_IN_DONE, mtag)) != NULL) { |
| 983 | xh = (struct xform_history *)(mtag + 1); |
| 984 | KEYDBG(IPSEC_DATA, |
| 985 | char buf[IPSEC_ADDRSTRLEN]; |
| 986 | printf("%s: mode %s proto %u dst %s\n", __func__, |
| 987 | kdebug_secasindex_mode(xh->mode), xh->proto, |
| 988 | ipsec_address(&xh->dst, buf, sizeof(buf)))); |
| 989 | if (xh->proto != sp->req[idx]->saidx.proto) |
| 990 | continue; |
| 991 | /* If SA had IPSEC_MODE_ANY, consider this as match. */ |
| 992 | if (xh->mode != sp->req[idx]->saidx.mode && |
| 993 | xh->mode != IPSEC_MODE_ANY) |
| 994 | continue; |
| 995 | /* |
| 996 | * For transport mode IPsec request doesn't contain |
| 997 | * addresses. We need to use address from spidx. |
| 998 | */ |
| 999 | if (sp->req[idx]->saidx.mode == IPSEC_MODE_TRANSPORT) { |
| 1000 | if (key_sockaddrcmp_withmask(&xh->dst.sa, |
| 1001 | &sp->spidx.dst.sa, sp->spidx.prefd) != 0) |
| 1002 | continue; |
| 1003 | } else { |
| 1004 | if (key_sockaddrcmp(&xh->dst.sa, |
| 1005 | &sp->req[idx]->saidx.dst.sa, 0) != 0) |
| 1006 | continue; |
| 1007 | } |
| 1008 | return (0); /* matched */ |
| 1009 | } |
| 1010 | return (1); |
| 1011 | } |
| 1012 | |
| 1013 | /* |
| 1014 | * Check security policy requirements against the actual |
no test coverage detected