| 439 | } |
| 440 | |
| 441 | static struct secpolicy * |
| 442 | ipsec_getpcbpolicy(struct inpcb *inp, u_int dir) |
| 443 | { |
| 444 | struct secpolicy *sp; |
| 445 | int flags, downgrade; |
| 446 | |
| 447 | if (inp == NULL || inp->inp_sp == NULL) |
| 448 | return (NULL); |
| 449 | |
| 450 | INP_LOCK_ASSERT(inp); |
| 451 | |
| 452 | flags = inp->inp_sp->flags; |
| 453 | if (dir == IPSEC_DIR_OUTBOUND) { |
| 454 | sp = inp->inp_sp->sp_out; |
| 455 | flags &= INP_OUTBOUND_POLICY; |
| 456 | } else { |
| 457 | sp = inp->inp_sp->sp_in; |
| 458 | flags &= INP_INBOUND_POLICY; |
| 459 | } |
| 460 | /* |
| 461 | * Check flags. If we have PCB SP, just return it. |
| 462 | * Otherwise we need to check that cached SP entry isn't stale. |
| 463 | */ |
| 464 | if (flags == 0) { |
| 465 | if (sp == NULL) |
| 466 | return (NULL); |
| 467 | if (inp->inp_sp->genid != key_getspgen()) { |
| 468 | /* Invalidate the cache. */ |
| 469 | downgrade = 0; |
| 470 | if (!INP_WLOCKED(inp)) { |
| 471 | if ((downgrade = INP_TRY_UPGRADE(inp)) == 0) |
| 472 | return (NULL); |
| 473 | } |
| 474 | ipsec_invalidate_cache(inp, IPSEC_DIR_OUTBOUND); |
| 475 | ipsec_invalidate_cache(inp, IPSEC_DIR_INBOUND); |
| 476 | if (downgrade != 0) |
| 477 | INP_DOWNGRADE(inp); |
| 478 | return (NULL); |
| 479 | } |
| 480 | KEYDBG(IPSEC_STAMP, |
| 481 | printf("%s: PCB(%p): cache hit SP(%p)\n", |
| 482 | __func__, inp, sp)); |
| 483 | /* Return referenced cached policy */ |
| 484 | } |
| 485 | key_addref(sp); |
| 486 | return (sp); |
| 487 | } |
| 488 | |
| 489 | #ifdef INET |
| 490 | static void |
no test coverage detected