 @@ -1,14 +1,14 @@
-/* $NetBSD: ipsec.c,v 1.147 2018/02/28 10:09:17 maxv Exp $ */
+/* $NetBSD: ipsec.c,v 1.148 2018/02/28 10:16:19 maxv Exp $ */
 /* $FreeBSD: src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $ */
 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *	notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -22,27 +22,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.147 2018/02/28 10:09:17 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.148 2018/02/28 10:16:19 maxv Exp $");
 /*
  * IPsec controller part.
  */
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
 #include "opt_ipsec.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 @@ -160,30 +160,27 @@ int crypto_support = 0;
 static struct secpolicy *ipsec_getpolicybysock(struct mbuf *, u_int,
     struct inpcb_hdr *, int *);
 #ifdef INET6
 int ip6_esp_trans_deflev = IPSEC_LEVEL_USE;
 int ip6_esp_net_deflev = IPSEC_LEVEL_USE;
 int ip6_ah_trans_deflev = IPSEC_LEVEL_USE;
 int ip6_ah_net_deflev = IPSEC_LEVEL_USE;
 struct secpolicy ip6_def_policy;
 int ip6_ipsec_ecn = 0;		/* ECN ignore(-1)/forbidden(0)/allowed(1) */
 #endif
-static int ipsec4_setspidx_inpcb(struct mbuf *, struct inpcb *);
+static int ipsec_setspidx_inpcb(struct mbuf *, void *);
 #ifdef INET6
 static int ipsec6_setspidx_in6pcb(struct mbuf *, struct in6pcb *);
 #endif
 static int ipsec_setspidx(struct mbuf *, struct secpolicyindex *, int);
 static void ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *, int);
 static int ipsec4_setspidx_ipaddr(struct mbuf *, struct secpolicyindex *);
 #ifdef INET6
 static void ipsec6_get_ulp(struct mbuf *m, struct secpolicyindex *, int);
 static int ipsec6_setspidx_ipaddr(struct mbuf *, struct secpolicyindex *);
 #endif
 static void ipsec_delpcbpolicy(struct inpcbpolicy *);
 #if 0 /* unused */
 static struct secpolicy *ipsec_deepcopy_policy(const struct secpolicy *);
 #endif
 static void ipsec_destroy_policy(struct secpolicy *);
 static int ipsec_sp_reject(const struct secpolicy *, const struct mbuf *);
 @@ -429,35 +426,35 @@ ipsec_getpolicybysock(struct mbuf *m, u_
 	/* If we have a cached entry, and if it is still valid, use it. */
 	IPSEC_STATINC(IPSEC_STAT_SPDCACHELOOKUP);
 	currsp = ipsec_checkpcbcache(m, inph->inph_sp, dir);
 	if (currsp) {
 		*error = 0;
 		return currsp;
+	}
 	IPSEC_STATINC(IPSEC_STAT_SPDCACHEMISS);
 	switch (af) {
 	case AF_INET: {
 		struct inpcb *in4p = (struct inpcb *)inph;
 		/* set spidx in pcb */
-		*error = ipsec4_setspidx_inpcb(m, in4p);
+		*error = ipsec_setspidx_inpcb(m, in4p);
 		pcbsp = in4p->inp_sp;
 		break;
+		}
 #if defined(INET6)
 	case AF_INET6: {
 		struct in6pcb *in6p = (struct in6pcb *)inph;
 		/* set spidx in pcb */
-		*error = ipsec6_setspidx_in6pcb(m, in6p);
+		*error = ipsec_setspidx_inpcb(m, in6p);
 		pcbsp = in6p->in6p_sp;
 		break;
+		}
 #endif
 	default:
 		*error = EPFNOSUPPORT;
 		break;
+	}
 	if (*error)
 		return NULL;
 	KASSERT(pcbsp != NULL);
 	switch (dir) {
 @@ -784,74 +781,49 @@ ipsec4_forward(struct mbuf *m, int *dest
 				*destmtu = rt->rt_rmx.rmx_mtu ?
 				    rt->rt_rmx.rmx_mtu : rt->rt_ifp->if_mtu;
 				*destmtu -= ipsechdr;
+			}
 			rtcache_unref(rt, ro);
 			KEY_SA_UNREF(&sav);
+		}
+	}
 	KEY_SP_UNREF(&sp);
 	return 0;
+}
 static int
-ipsec4_setspidx_inpcb(struct mbuf *m, struct inpcb *pcb)
+ipsec_setspidx_inpcb(struct mbuf *m, void *pcb)
+{
 	struct inpcb_hdr *inph = (struct inpcb_hdr *)pcb;
 	int error;
-	KASSERT(pcb != NULL);
+	KASSERT(inph != NULL);
-	KASSERT(pcb->inp_sp != NULL);
+	KASSERT(inph->inph_sp != NULL);
-	KASSERT(pcb->inp_sp->sp_out != NULL);
+	KASSERT(inph->inph_sp->sp_out != NULL);
-	KASSERT(pcb->inp_sp->sp_in != NULL);
+	KASSERT(inph->inph_sp->sp_in != NULL);
 	error = ipsec_setspidx(m, &pcb->inp_sp->sp_in->spidx, 1);
 	if (error == 0) {
 		pcb->inp_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND;
 		pcb->inp_sp->sp_out->spidx = pcb->inp_sp->sp_in->spidx;
 		pcb->inp_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND;
 	} else {
 		memset(&pcb->inp_sp->sp_in->spidx, 0,
 		    sizeof(pcb->inp_sp->sp_in->spidx));
 		memset(&pcb->inp_sp->sp_out->spidx, 0,
 		    sizeof(pcb->inp_sp->sp_out->spidx));
 	return error;
 #ifdef INET6
 static int
 ipsec6_setspidx_in6pcb(struct mbuf *m, struct in6pcb *pcb)
 	int error;
 	KASSERT(pcb != NULL);
 	KASSERT(pcb->in6p_sp != NULL);
 	KASSERT(pcb->in6p_sp->sp_out != NULL);
 	KASSERT(pcb->in6p_sp->sp_in != NULL);
-	error = ipsec_setspidx(m, &pcb->in6p_sp->sp_in->spidx, 1);
+	error = ipsec_setspidx(m, &inph->inph_sp->sp_in->spidx, 1);
 	if (error == 0) {
-		pcb->in6p_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND;
+		inph->inph_sp->sp_in->spidx.dir = IPSEC_DIR_INBOUND;
-		pcb->in6p_sp->sp_out->spidx = pcb->in6p_sp->sp_in->spidx;
+		inph->inph_sp->sp_out->spidx = inph->inph_sp->sp_in->spidx;
-		pcb->in6p_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND;
+		inph->inph_sp->sp_out->spidx.dir = IPSEC_DIR_OUTBOUND;
 	} else {
-		memset(&pcb->in6p_sp->sp_in->spidx, 0,
+		memset(&inph->inph_sp->sp_in->spidx, 0,
-		    sizeof(pcb->in6p_sp->sp_in->spidx));
+		    sizeof(inph->inph_sp->sp_in->spidx));
-		memset(&pcb->in6p_sp->sp_out->spidx, 0,
+		memset(&inph->inph_sp->sp_out->spidx, 0,
-		    sizeof(pcb->in6p_sp->sp_out->spidx));
+		    sizeof(inph->inph_sp->sp_out->spidx));
+	}
 	return error;
+}
 #endif
 /*
  * configure security policy index (src/dst/proto/sport/dport)
  * by looking at the content of mbuf.
  * the caller is responsible for error recovery (like clearing up spidx).
  */
 static int
 ipsec_setspidx(struct mbuf *m, struct secpolicyindex *spidx, int needport)
+{
 	struct ip *ip = NULL;
 	struct ip ipbuf;
 	u_int v;
 	struct mbuf *n;