* Allocating an SA entry for an *OUTBOUND* packet. * OUT: positive: corresponding SA for given saidx found. * NULL: SA not found, but will be acquired, check *error * for acquiring status. */
| 1010 | * for acquiring status. |
| 1011 | */ |
| 1012 | struct secasvar * |
| 1013 | key_allocsa_policy(struct secpolicy *sp, const struct secasindex *saidx, |
| 1014 | int *error) |
| 1015 | { |
| 1016 | SAHTREE_RLOCK_TRACKER; |
| 1017 | struct secashead *sah; |
| 1018 | struct secasvar *sav; |
| 1019 | |
| 1020 | IPSEC_ASSERT(saidx != NULL, ("null saidx")); |
| 1021 | IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TRANSPORT || |
| 1022 | saidx->mode == IPSEC_MODE_TUNNEL, |
| 1023 | ("unexpected policy %u", saidx->mode)); |
| 1024 | |
| 1025 | /* |
| 1026 | * We check new SA in the IPsec request because a different |
| 1027 | * SA may be involved each time this request is checked, either |
| 1028 | * because new SAs are being configured, or this request is |
| 1029 | * associated with an unconnected datagram socket, or this request |
| 1030 | * is associated with a system default policy. |
| 1031 | */ |
| 1032 | SAHTREE_RLOCK(); |
| 1033 | LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) { |
| 1034 | KEYDBG(IPSEC_DUMP, |
| 1035 | printf("%s: checking SAH\n", __func__); |
| 1036 | kdebug_secash(sah, " ")); |
| 1037 | if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID)) |
| 1038 | break; |
| 1039 | } |
| 1040 | if (sah != NULL) { |
| 1041 | /* |
| 1042 | * Allocate the oldest SA available according to |
| 1043 | * draft-jenkins-ipsec-rekeying-03. |
| 1044 | */ |
| 1045 | if (V_key_preferred_oldsa) |
| 1046 | sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue); |
| 1047 | else |
| 1048 | sav = TAILQ_FIRST(&sah->savtree_alive); |
| 1049 | if (sav != NULL) |
| 1050 | SAV_ADDREF(sav); |
| 1051 | } else |
| 1052 | sav = NULL; |
| 1053 | SAHTREE_RUNLOCK(); |
| 1054 | |
| 1055 | if (sav != NULL) { |
| 1056 | *error = 0; |
| 1057 | KEYDBG(IPSEC_STAMP, |
| 1058 | printf("%s: chosen SA(%p) for SP(%p)\n", __func__, |
| 1059 | sav, sp)); |
| 1060 | KEYDBG(IPSEC_DATA, kdebug_secasv(sav)); |
| 1061 | return (sav); /* return referenced SA */ |
| 1062 | } |
| 1063 | |
| 1064 | /* there is no SA */ |
| 1065 | *error = key_acquire(saidx, sp); |
| 1066 | if ((*error) != 0) |
| 1067 | ipseclog((LOG_DEBUG, |
| 1068 | "%s: error %d returned from key_acquire()\n", |
| 1069 | __func__, *error)); |
no test coverage detected