 @@ -1,14 +1,14 @@
-/*	$NetBSD: ipsec.c,v 1.99 2017/06/02 03:41:20 ozaki-r Exp $	*/
+/*	$NetBSD: ipsec.c,v 1.100 2017/06/14 02:00:43 ozaki-r Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $	*/
 /*	$KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *	notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -22,27 +22,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.99 2017/06/02 03:41:20 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.100 2017/06/14 02:00:43 ozaki-r Exp $");
 /*
  * IPsec controller part.
  */
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
 #include "opt_ipsec.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 @@ -227,30 +227,28 @@ ipsec_checkpcbcache(struct mbuf *m, stru
 	if (pcbsp->sp_cache[dir].cachesp->state != IPSEC_SPSTATE_ALIVE) {
 		ipsec_invalpcbcache(pcbsp, dir);
 		return NULL;
+	}
 	if ((pcbsp->sp_cacheflags & IPSEC_PCBSP_CONNECTED) == 0) {
 		if (ipsec_setspidx(m, &spidx, 1) != 0)
 			return NULL;
 		/*
 		 * We have to make an exact match here since the cached rule
 		 * might have lower priority than a rule that would otherwise
 		 * have matched the packet.
 		 */
 		if (memcmp(&pcbsp->sp_cache[dir].cacheidx, &spidx, sizeof(spidx)))
 			return NULL;
 	} else {
 		/*
 		 * The pcb is connected, and the L4 code is sure that:
 		 * - outgoing side uses inp_[lf]addr
 		 * - incoming side looks up policy after inpcb lookup
 		 * and address pair is know to be stable.  We do not need
 		 * to generate spidx again, nor check the address match again.
+		 *
 		 * For IPv4/v6 SOCK_STREAM sockets, this assumptions holds
 		 * and there are calls to ipsec_pcbconn() from in_pcbconnect().
 		 */
+	}
 @@ -286,56 +284,56 @@ ipsec_fillpcbcache(struct inpcbpolicy *p
 		    "DP cause refcnt++:%d SP:%p\n",
 		    pcbsp->sp_cache[dir].cachesp->refcnt,
 		    pcbsp->sp_cache[dir].cachesp);
 		/*
 		 * If the PCB is connected, we can remember a hint to
 		 * possibly short-circuit IPsec processing in other places.
 		 */
 		if (pcbsp->sp_cacheflags & IPSEC_PCBSP_CONNECTED) {
 			switch (pcbsp->sp_cache[dir].cachesp->policy) {
 			case IPSEC_POLICY_NONE:
 			case IPSEC_POLICY_BYPASS:
 				pcbsp->sp_cache[dir].cachehint =
-					IPSEC_PCBHINT_NO;
+				    IPSEC_PCBHINT_NO;
 				break;
 			default:
 				pcbsp->sp_cache[dir].cachehint =
-					IPSEC_PCBHINT_YES;
+				    IPSEC_PCBHINT_YES;
+			}
+		}
+	}
 	pcbsp->sp_cache[dir].cachegen = ipsec_spdgen;
 	return 0;
+}
 static int
 ipsec_invalpcbcache(struct inpcbpolicy *pcbsp, int dir)
+{
 	int i;
 	KASSERT(inph_locked(pcbsp->sp_inph));
 	for (i = IPSEC_DIR_INBOUND; i <= IPSEC_DIR_OUTBOUND; i++) {
 		if (dir != IPSEC_DIR_ANY && i != dir)
 			continue;
 		if (pcbsp->sp_cache[i].cachesp)
 			KEY_FREESP(&pcbsp->sp_cache[i].cachesp);
 		pcbsp->sp_cache[i].cachesp = NULL;
 		pcbsp->sp_cache[i].cachehint = IPSEC_PCBHINT_UNKNOWN;
 		pcbsp->sp_cache[i].cachegen = 0;
 		memset(&pcbsp->sp_cache[i].cacheidx, 0,
-			  sizeof(pcbsp->sp_cache[i].cacheidx));
+		    sizeof(pcbsp->sp_cache[i].cacheidx));
+	}
 	return 0;
+}
 void
 ipsec_pcbconn(struct inpcbpolicy *pcbsp)
+{
 	KASSERT(inph_locked(pcbsp->sp_inph));
 	pcbsp->sp_cacheflags |= IPSEC_PCBSP_CONNECTED;
 	ipsec_invalpcbcache(pcbsp, IPSEC_DIR_ANY);
+}
 @@ -906,29 +904,29 @@ ipsec4_setspidx_inpcb(struct mbuf *m, st
 	KASSERT(pcb != NULL);
 	KASSERT(pcb->inp_sp != NULL);
 	KASSERT(pcb->inp_sp->sp_out != NULL);
 	KASSERT(pcb->inp_sp->sp_in != NULL);
 	error = ipsec_setspidx(m, &pcb->inp_sp->sp_in->spidx, 1);
 	if (error == 0) {
 		pcb->inp_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND;
 		pcb->inp_sp->sp_out->spidx = pcb->inp_sp->sp_in->spidx;
 		pcb->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND;
 	} else {
 		memset(&pcb->inp_sp->sp_in->spidx, 0,
-			sizeof (pcb->inp_sp->sp_in->spidx));
+		    sizeof(pcb->inp_sp->sp_in->spidx));
 		memset(&pcb->inp_sp->sp_out->spidx, 0,
-			sizeof (pcb->inp_sp->sp_in->spidx));
+		    sizeof(pcb->inp_sp->sp_in->spidx));
+	}
 	return error;
+}
 #ifdef INET6
 static int
 ipsec6_setspidx_in6pcb(struct mbuf *m, struct in6pcb *pcb)
+{
 	struct secpolicyindex *spidx;
 	int error;
 	KASSERT(pcb != NULL);
 	KASSERT(pcb->in6p_sp != NULL);
 @@ -1123,31 +1121,29 @@ static int
 ipsec4_setspidx_ipaddr(struct mbuf *m, struct secpolicyindex *spidx)
+{
 	static const struct sockaddr_in template = {
 		sizeof (struct sockaddr_in),
 		AF_INET,
 , { 0 }, { 0, 0, 0, 0, 0, 0, 0, 0 }
 	};
 	spidx->src.sin = template;
 	spidx->dst.sin = template;
 	if (m->m_len < sizeof (struct ip)) {
 		m_copydata(m, offsetof(struct ip, ip_src),
-			   sizeof (struct  in_addr),
+		    sizeof(struct in_addr), &spidx->src.sin.sin_addr);
 			   &spidx->src.sin.sin_addr);
 		m_copydata(m, offsetof(struct ip, ip_dst),
-			   sizeof (struct  in_addr),
+		    sizeof(struct in_addr), &spidx->dst.sin.sin_addr);
 			   &spidx->dst.sin.sin_addr);
 	} else {
 		struct ip *ip = mtod(m, struct ip *);
 		spidx->src.sin.sin_addr = ip->ip_src;
 		spidx->dst.sin.sin_addr = ip->ip_dst;
+	}
 	spidx->prefs = sizeof(struct in_addr) << 3;
 	spidx->prefd = sizeof(struct in_addr) << 3;
 	return 0;
+}
 #ifdef INET6