Function key_allocsa_tcpmd5

freebsd/netipsec/key.c:960–1004

* Allocating an SA entry for an *INBOUND* or *OUTBOUND* TCP packet, signed * or should be signed by MD5 signature. * We don't use key_allocsa() for such lookups, because we don't know SPI. * Unlike ESP and AH protocols, SPI isn't transmitted in the TCP header with * signed packet. We use SADB only as storage for password. * OUT: positive: corresponding SA for given saidx found. * NULL: SA n

 *	NULL:		SA not found
 */
struct secasvar *
key_allocsa_tcpmd5(struct secasindex *saidx)
{
	SAHTREE_RLOCK_TRACKER;
	struct secashead *sah;
	struct secasvar *sav;

	IPSEC_ASSERT(saidx->proto == IPPROTO_TCP,
	    ("unexpected security protocol %u", saidx->proto));
	IPSEC_ASSERT(saidx->mode == IPSEC_MODE_TCPMD5,
	    ("unexpected mode %u", saidx->mode));

	SAHTREE_RLOCK();
	LIST_FOREACH(sah, SAHADDRHASH_HASH(saidx), addrhash) {
		KEYDBG(IPSEC_DUMP,
		    printf("%s: checking SAH\n", __func__);
		    kdebug_secash(sah, "  "));
		if (sah->saidx.proto != IPPROTO_TCP)
			continue;
		if (!key_sockaddrcmp(&saidx->dst.sa, &sah->saidx.dst.sa, 0) &&
		    !key_sockaddrcmp(&saidx->src.sa, &sah->saidx.src.sa, 0))
			break;
	}
	if (sah != NULL) {
		if (V_key_preferred_oldsa)
			sav = TAILQ_LAST(&sah->savtree_alive, secasvar_queue);
		else
			sav = TAILQ_FIRST(&sah->savtree_alive);
		if (sav != NULL)
			SAV_ADDREF(sav);
	} else
		sav = NULL;
	SAHTREE_RUNLOCK();

	if (sav != NULL) {
		KEYDBG(IPSEC_STAMP,
		    printf("%s: return SA(%p)\n", __func__, sav));
		KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
	} else {
		KEYDBG(IPSEC_STAMP,
		    printf("%s: SA not found\n", __func__));
		KEYDBG(IPSEC_DATA, kdebug_secasindex(saidx, NULL));
	}
	return (sav);
}

/*
 * Allocating an SA entry for an *OUTBOUND* packet.