Date: Tue, 22 Nov 2022 12:23:33 GMT From: Mateusz Guzik <mjg@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: c1bfe8c593f9 - main - ipsec: add key_havesp_any Message-ID: <202211221223.2AMCNXl4099190@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by mjg: URL: https://cgit.FreeBSD.org/src/commit/?id=c1bfe8c593f9047ff00c1204e4f086256af45bc2 commit c1bfe8c593f9047ff00c1204e4f086256af45bc2 Author: Mateusz Guzik <mjg@FreeBSD.org> AuthorDate: 2022-09-07 20:05:38 +0000 Commit: Mateusz Guzik <mjg@FreeBSD.org> CommitDate: 2022-11-22 12:23:08 +0000 ipsec: add key_havesp_any Saves on work in a common case of checking both directions. Note further work in the area is impending to elide these in the common case to begin with. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D36485 --- sys/netipsec/ipsec.c | 10 ++-------- sys/netipsec/key.c | 7 +++++++ sys/netipsec/key.h | 1 + sys/netipsec/subr_ipsec.c | 3 +-- 4 files changed, 11 insertions(+), 10 deletions(-) diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c index d0217723bca6..94eb68658e30 100644 --- a/sys/netipsec/ipsec.c +++ b/sys/netipsec/ipsec.c @@ -666,10 +666,7 @@ ipsec4_capability(struct mbuf *m, u_int cap) return (0); case IPSEC_CAP_OPERABLE: /* Do we have active security policies? */ - if (key_havesp(IPSEC_DIR_INBOUND) != 0 || - key_havesp(IPSEC_DIR_OUTBOUND) != 0) - return (1); - return (0); + return (key_havesp_any()); }; return (EOPNOTSUPP); } @@ -835,10 +832,7 @@ ipsec6_capability(struct mbuf *m, u_int cap) return (0); case IPSEC_CAP_OPERABLE: /* Do we have active security policies? */ - if (key_havesp(IPSEC_DIR_INBOUND) != 0 || - key_havesp(IPSEC_DIR_OUTBOUND) != 0) - return (1); - return (0); + return (key_havesp_any()); }; return (EOPNOTSUPP); } diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index 093db4fb9126..98bd97f465bf 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -811,6 +811,13 @@ key_havesp(u_int dir) return (TAILQ_FIRST(&V_sptree[dir]) != NULL); } +int +key_havesp_any(void) +{ + + return (V_spd_size != 0); +} + /* %%% IPsec policy management */ /* * Return current SPDB generation. diff --git a/sys/netipsec/key.h b/sys/netipsec/key.h index 4d0f4b1ea512..81e30ecdc010 100644 --- a/sys/netipsec/key.h +++ b/sys/netipsec/key.h @@ -56,6 +56,7 @@ void key_addref(struct secpolicy *); void key_freesp(struct secpolicy **); int key_spdacquire(struct secpolicy *); int key_havesp(u_int); +int key_havesp_any(void); void key_bumpspgen(void); uint32_t key_getspgen(void); uint32_t key_newreqid(void); diff --git a/sys/netipsec/subr_ipsec.c b/sys/netipsec/subr_ipsec.c index 3eac9d6aaad0..56ddf71ae87a 100644 --- a/sys/netipsec/subr_ipsec.c +++ b/sys/netipsec/subr_ipsec.c @@ -401,8 +401,7 @@ ipsec_kmod_capability(struct ipsec_support * const sc, struct mbuf *m, * call key_havesp() without additional synchronizations. */ if (cap == IPSEC_CAP_OPERABLE) - return (key_havesp(IPSEC_DIR_INBOUND) != 0 || - key_havesp(IPSEC_DIR_OUTBOUND) != 0); + return (key_havesp_any()); return (ipsec_kmod_caps(sc, m, cap)); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202211221223.2AMCNXl4099190>