自学教程：C++ xfrm_state_put函数代码示例

static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x){	struct xfrm_state *t = NULL;	t = xfrm_state_alloc();	if (!t)		goto out;	t->id.proto = IPPROTO_IPV6;	t->id.spi = xfrm6_tunnel_alloc_spi((xfrm_address_t *)&x->props.saddr);	memcpy(t->id.daddr.a6, x->id.daddr.a6, sizeof(struct in6_addr));	memcpy(&t->sel, &x->sel, sizeof(t->sel));	t->props.family = AF_INET6;	t->props.mode = 1;	memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));	t->type = xfrm_get_type(IPPROTO_IPV6, t->props.family);	if (t->type == NULL)		goto error;	if (t->type->init_state(t, NULL))		goto error;	t->km.state = XFRM_STATE_VALID;	atomic_set(&t->tunnel_users, 1);out:	return t;error:	xfrm_state_put(t);	goto out;}

static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x){	struct net *net = xs_net(x);	struct xfrm_state *t;	t = xfrm_state_alloc(net);	if (t == NULL)		goto out;	t->id.proto = IPPROTO_IPIP;	t->id.spi = x->props.saddr.a4;	t->id.daddr.a4 = x->id.daddr.a4;	memcpy(&t->sel, &x->sel, sizeof(t->sel));	t->props.family = AF_INET;	t->props.mode = x->props.mode;	t->props.saddr.a4 = x->props.saddr.a4;	t->props.flags = x->props.flags;	memcpy(&t->mark, &x->mark, sizeof(t->mark));	if (xfrm_init_state(t))		goto error;	atomic_set(&t->tunnel_users, 1);out:	return t;error:	t->km.state = XFRM_STATE_DEAD;	xfrm_state_put(t);	t = NULL;	goto out;}

static void ipcomp4_err(struct sk_buff *skb, u32 info){	struct net *net = dev_net(skb->dev);	__be32 spi;	const struct iphdr *iph = (const struct iphdr *)skb->data;	struct ip_comp_hdr *ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));	struct xfrm_state *x;	switch (icmp_hdr(skb)->type) {	case ICMP_DEST_UNREACH:		if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)			return;	case ICMP_REDIRECT:		break;	default:		return;	}	spi = htonl(ntohs(ipch->cpi));	x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,			      spi, IPPROTO_COMP, AF_INET);	if (!x)		return;	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {		atomic_inc(&flow_cache_genid);		rt_genid_bump(net);		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0);	} else		ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0);	xfrm_state_put(x);}

void __secpath_destroy(struct sec_path *sp){	int i;	for (i = 0; i < sp->len; i++)		xfrm_state_put(sp->xvec[i]);	kmem_cache_free(secpath_cachep, sp);}

static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x){	struct net *net = xs_net(x);	struct xfrm_state *t = NULL;	t = xfrm_state_alloc(net);	if (!t)		goto out;	t->id.proto = IPPROTO_IPV6;	t->id.spi = xfrm6_tunnel_alloc_spi(net, (xfrm_address_t *)&x->props.saddr);	if (!t->id.spi)		goto error;	memcpy(t->id.daddr.a6, x->id.daddr.a6, sizeof(struct in6_addr));	memcpy(&t->sel, &x->sel, sizeof(t->sel));	t->props.family = AF_INET6;	t->props.mode = x->props.mode;	memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));	memcpy(&t->mark, &x->mark, sizeof(t->mark));	if (xfrm_init_state(t))		goto error;	atomic_set(&t->tunnel_users, 1);out:	return t;error:	t->km.state = XFRM_STATE_DEAD;	xfrm_state_put(t);	t = NULL;	goto out;}

static int vti4_err(struct sk_buff *skb, u32 info){	__be32 spi;	struct xfrm_state *x;	struct ip_tunnel *tunnel;	struct ip_esp_hdr *esph;	struct ip_auth_hdr *ah ;	struct ip_comp_hdr *ipch;	struct net *net = dev_net(skb->dev);	const struct iphdr *iph = (const struct iphdr *)skb->data;	int protocol = iph->protocol;	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);	tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,				  iph->daddr, iph->saddr, 0);	if (!tunnel)		return -1;	switch (protocol) {	case IPPROTO_ESP:		esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));		spi = esph->spi;		break;	case IPPROTO_AH:		ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));		spi = ah->spi;		break;	case IPPROTO_COMP:		ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));		spi = htonl(ntohs(ipch->cpi));		break;	default:		return 0;	}	switch (icmp_hdr(skb)->type) {	case ICMP_DEST_UNREACH:		if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)			return 0;	case ICMP_REDIRECT:		break;	default:		return 0;	}	x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,			      spi, protocol, AF_INET);	if (!x)		return 0;	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)		ipv4_update_pmtu(skb, net, info, 0, 0, protocol, 0);	else		ipv4_redirect(skb, net, 0, 0, protocol, 0);	xfrm_state_put(x);	return 0;}

static void ah4_err(struct sk_buff *skb, u32 info){	const struct iphdr *iph = (struct iphdr*)skb->data;	struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+(iph->ihl<<2));	struct xfrm_state *x;	if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH ||	    icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)		return;	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);	if (!x)		return;	printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x/n",	       ntohl(ah->spi), ntohl(iph->daddr));	xfrm_state_put(x);}

static void esp4_err(struct sk_buff *skb, u32 info){	struct iphdr *iph = (struct iphdr*)skb->data;	struct ip_esp_hdr *esph = (struct ip_esp_hdr*)(skb->data+(iph->ihl<<2));	struct xfrm_state *x;	if (skb->h.icmph->type != ICMP_DEST_UNREACH ||	    skb->h.icmph->code != ICMP_FRAG_NEEDED)		return;	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);	if (!x)		return;	NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x/n",		 ntohl(esph->spi), ntohl(iph->daddr));	xfrm_state_put(x);}

static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,                     int type, int code, int offset, __be32 info){	struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;	struct ipv6_esp_hdr *esph = (struct ipv6_esp_hdr*)(skb->data+offset);	struct xfrm_state *x;	if (type != ICMPV6_DEST_UNREACH && 	    type != ICMPV6_PKT_TOOBIG)		return;	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);	if (!x)		return;	printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/" NIP6_FMT "/n", 			ntohl(esph->spi), NIP6(iph->daddr));	xfrm_state_put(x);}

static void ipcomp4_err(struct sk_buff *skb, u32 info){	__be32 spi;	struct iphdr *iph = (struct iphdr *)skb->data;	struct ip_comp_hdr *ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));	struct xfrm_state *x;	if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH ||	    icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)		return;	spi = htonl(ntohs(ipch->cpi));	x = xfrm_state_lookup(&init_net, (xfrm_address_t *)&iph->daddr,			      spi, IPPROTO_COMP, AF_INET);	if (!x)		return;	NETDEBUG(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%pI4/n",		 spi, &iph->daddr);	xfrm_state_put(x);}

static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,		                int type, int code, int offset, __u32 info){	u32 spi;	struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;	struct ipv6_comp_hdr *ipcomph = (struct ipv6_comp_hdr*)(skb->data+offset);	struct xfrm_state *x;	if (type != ICMPV6_DEST_UNREACH || type != ICMPV6_PKT_TOOBIG)		return;	spi = ntohl(ntohs(ipcomph->cpi));	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);	if (!x)		return;	printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/"			"%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x/n",			spi, NIP6(iph->daddr));	xfrm_state_put(x);}

static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,                     int type, int code, int offset, __u32 info){	struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;	struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);	struct xfrm_state *x;	if (type != ICMPV6_DEST_UNREACH &&	    type != ICMPV6_PKT_TOOBIG)		return;	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);	if (!x)		return;	NETDEBUG(printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/"			"%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x/n",	       ntohl(ah->spi), NIP6(iph->daddr)));	xfrm_state_put(x);}

static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,		    u8 type, u8 code, int offset, __be32 info){	struct net *net = dev_net(skb->dev);	struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;	struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);	struct xfrm_state *x;	if (type != ICMPV6_DEST_UNREACH &&	    type != ICMPV6_PKT_TOOBIG)		return;	x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);	if (!x)		return;	NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/%pI6/n",		 ntohl(ah->spi), &iph->daddr);	xfrm_state_put(x);}

static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,                        u8 type, u8 code, int offset, __be32 info){    __be32 spi;    struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;    struct ip_comp_hdr *ipcomph =        (struct ip_comp_hdr *)(skb->data + offset);    struct xfrm_state *x;    if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)        return;    spi = htonl(ntohs(ipcomph->cpi));    x = xfrm_state_lookup(&init_net, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);    if (!x)        return;    printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%pI6/n",           spi, &iph->daddr);    xfrm_state_put(x);}

static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,                        u8 type, u8 code, int offset, __be32 info){    struct net *net = dev_net(skb->dev);    __be32 spi;    const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;    struct ip_comp_hdr *ipcomph =        (struct ip_comp_hdr *)(skb->data + offset);    struct xfrm_state *x;    if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)        return;    spi = htonl(ntohs(ipcomph->cpi));    x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,                          spi, IPPROTO_COMP, AF_INET6);    if (!x)        return;    pr_debug("pmtu discovery on SA IPCOMP/%08x/%pI6/n",             spi, &iph->daddr);    ip6_update_pmtu(skb, net, info, 0, 0);    xfrm_state_put(x);}

int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,		     xfrm_address_t *saddr, u8 proto){	struct net *net = dev_net(skb->dev);	struct xfrm_state *x = NULL;	int i = 0;		if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {		struct sec_path *sp;		sp = secpath_dup(skb->sp);		if (!sp) {			XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);			goto drop;		}		if (skb->sp)			secpath_put(skb->sp);		skb->sp = sp;	}	if (1 + skb->sp->len == XFRM_MAX_DEPTH) {		XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);		goto drop;	}	for (i = 0; i < 3; i++) {		xfrm_address_t *dst, *src;		switch (i) {		case 0:			dst = daddr;			src = saddr;			break;		case 1:						dst = daddr;			src = (xfrm_address_t *)&in6addr_any;			break;		default:						dst = (xfrm_address_t *)&in6addr_any;			src = (xfrm_address_t *)&in6addr_any;			break;		}		x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6);		if (!x)			continue;		spin_lock(&x->lock);		if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) &&		    likely(x->km.state == XFRM_STATE_VALID) &&		    !xfrm_state_check_expire(x)) {			spin_unlock(&x->lock);			if (x->type->input(x, skb) > 0) {								break;			}		} else			spin_unlock(&x->lock);		xfrm_state_put(x);		x = NULL;	}	if (!x) {		XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);		xfrm_audit_state_notfound_simple(skb, AF_INET6);		goto drop;	}	skb->sp->xvec[skb->sp->len++] = x;	spin_lock(&x->lock);	x->curlft.bytes += skb->len;	x->curlft.packets++;	spin_unlock(&x->lock);	return 1;drop:	return -1;}

//.........这里部分代码省略.........	if ((err = xfrm4_parse_spi(skb, skb->nh.iph->protocol, &spi)) != 0)		goto drop;	do {		struct iphdr *iph = skb->nh.iph;		if (xfrm_nr == XFRM_MAX_DEPTH)			goto drop;		x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, iph->protocol, AF_INET);		if (x == NULL)			goto drop;		spin_lock(&x->lock);		if (unlikely(x->km.state != XFRM_STATE_VALID))			goto drop_unlock;		if ((x->encap ? x->encap->encap_type : 0) != encap_type)			goto drop_unlock;		if (xfrm_state_check_expire(x))			goto drop_unlock;		if (x->type->input(x, skb))			goto drop_unlock;		/* only the first xfrm gets the encap type */		encap_type = 0;		x->curlft.bytes += skb->len;		x->curlft.packets++;		spin_unlock(&x->lock);		xfrm_vec[xfrm_nr++] = x;		if (x->mode->input(x, skb))			goto drop;		if (x->props.mode == XFRM_MODE_TUNNEL) {			decaps = 1;			break;		}		if ((err = xfrm_parse_spi(skb, skb->nh.iph->protocol, &spi)) < 0)			goto drop;	} while (!err);	/* Allocate new secpath or COW existing one. */	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {		struct sec_path *sp;		sp = secpath_dup(skb->sp);		if (!sp)			goto drop;		if (skb->sp)			secpath_put(skb->sp);		skb->sp = sp;	}	if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)		goto drop;	memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,	       xfrm_nr * sizeof(xfrm_vec[0]));	skb->sp->len += xfrm_nr;	nf_reset(skb);	if (decaps) {		if (!(skb->dev->flags&IFF_LOOPBACK)) {			dst_release(skb->dst);			skb->dst = NULL;		}		netif_rx(skb);		return 0;	} else {#ifdef CONFIG_NETFILTER		__skb_push(skb, skb->data - skb->nh.raw);		skb->nh.iph->tot_len = htons(skb->len);		ip_send_check(skb->nh.iph);		NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,		        xfrm4_rcv_encap_finish);		return 0;#else		return -skb->nh.iph->protocol;#endif	}drop_unlock:	spin_unlock(&x->lock);	xfrm_state_put(x);drop:	while (--xfrm_nr >= 0)		xfrm_state_put(xfrm_vec[xfrm_nr]);	kfree_skb(skb);	return 0;}

//.........这里部分代码省略.........	do {		struct iphdr *iph = skb->nh.iph;		if (xfrm_nr == XFRM_MAX_DEPTH)			goto drop;		x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, iph->protocol, AF_INET);		if (x == NULL)			goto drop;		spin_lock(&x->lock);		if (unlikely(x->km.state != XFRM_STATE_VALID))			goto drop_unlock;		if (x->props.replay_window && xfrm_replay_check(x, seq))			goto drop_unlock;		if (xfrm_state_check_expire(x))			goto drop_unlock;		xfrm_vec[xfrm_nr].decap.decap_type = encap_type;		if (x->type->input(x, &(xfrm_vec[xfrm_nr].decap), skb))			goto drop_unlock;		/* only the first xfrm gets the encap type */		encap_type = 0;		if (x->props.replay_window)			xfrm_replay_advance(x, seq);		x->curlft.bytes += skb->len;		x->curlft.packets++;		spin_unlock(&x->lock);		xfrm_vec[xfrm_nr++].xvec = x;		iph = skb->nh.iph;		if (x->props.mode) {			if (iph->protocol != IPPROTO_IPIP)				goto drop;			if (!pskb_may_pull(skb, sizeof(struct iphdr)))				goto drop;			if (skb_cloned(skb) &&			    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))				goto drop;			if (!(x->props.flags & XFRM_STATE_NOECN))				ipip_ecn_decapsulate(skb);			skb->mac.raw = memmove(skb->data - skb->mac_len,					       skb->mac.raw, skb->mac_len);			skb->nh.raw = skb->data;			memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));			decaps = 1;			break;		}		if ((err = xfrm_parse_spi(skb, skb->nh.iph->protocol, &spi, &seq)) < 0)			goto drop;	} while (!err);	/* Allocate new secpath or COW existing one. */	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {		struct sec_path *sp;		sp = secpath_dup(skb->sp);		if (!sp)			goto drop;		if (skb->sp)			secpath_put(skb->sp);		skb->sp = sp;	}	if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)		goto drop;	memcpy(skb->sp->x+skb->sp->len, xfrm_vec, xfrm_nr*sizeof(struct sec_decap_state));	skb->sp->len += xfrm_nr;	if (decaps) {		if (!(skb->dev->flags&IFF_LOOPBACK)) {			dst_release(skb->dst);			skb->dst = NULL;		}		netif_rx(skb);		return 0;	} else {		return -skb->nh.iph->protocol;	}drop_unlock:	spin_unlock(&x->lock);	xfrm_state_put(x);drop:	while (--xfrm_nr >= 0)		xfrm_state_put(xfrm_vec[xfrm_nr].xvec);	kfree_skb(skb);	return 0;}

//.........这里部分代码省略.........	seq = 0;	if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0)		goto drop;	do {		struct ipv6hdr *iph = skb->nh.ipv6h;		if (xfrm_nr == XFRM_MAX_DEPTH)			goto drop;		x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,				nexthdr != IPPROTO_IPIP ? nexthdr : IPPROTO_IPV6, AF_INET6);		if (x == NULL)			goto drop;		spin_lock(&x->lock);		if (unlikely(x->km.state != XFRM_STATE_VALID))			goto drop_unlock;		if (x->props.replay_window && xfrm_replay_check(x, seq))			goto drop_unlock;		if (xfrm_state_check_expire(x))			goto drop_unlock;		nexthdr = x->type->input(x, skb);		if (nexthdr <= 0)			goto drop_unlock;		skb_network_header(skb)[nhoff] = nexthdr;		if (x->props.replay_window)			xfrm_replay_advance(x, seq);		x->curlft.bytes += skb->len;		x->curlft.packets++;		spin_unlock(&x->lock);		xfrm_vec[xfrm_nr++] = x;		if (x->mode->input(x, skb))			goto drop;		if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */			decaps = 1;			break;		}		if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0)			goto drop;	} while (!err);	/* Allocate new secpath or COW existing one. */	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {		struct sec_path *sp;		sp = secpath_dup(skb->sp);		if (!sp)			goto drop;		if (skb->sp)			secpath_put(skb->sp);		skb->sp = sp;	}	if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)		goto drop;	memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,	       xfrm_nr * sizeof(xfrm_vec[0]));	skb->sp->len += xfrm_nr;	skb->ip_summed = CHECKSUM_NONE;	nf_reset(skb);	if (decaps) {		dst_release(skb->dst);		skb->dst = NULL;		netif_rx(skb);		return -1;	} else {#ifdef CONFIG_NETFILTER		skb->nh.ipv6h->payload_len = htons(skb->len);		__skb_push(skb, skb->data - skb_network_header(skb));		NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,			ip6_rcv_finish);		return -1;#else		return 1;#endif	}drop_unlock:	spin_unlock(&x->lock);	xfrm_state_put(x);drop:	while (--xfrm_nr >= 0)		xfrm_state_put(xfrm_vec[xfrm_nr]);	kfree_skb(skb);	return -1;}

int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,		     xfrm_address_t *saddr, u8 proto){	struct xfrm_state *x = NULL;	int wildcard = 0;	struct in6_addr any;	xfrm_address_t *xany;	struct xfrm_state *xfrm_vec_one = NULL;	int nh = 0;	int i = 0;	ipv6_addr_set(&any, 0, 0, 0, 0);	xany = (xfrm_address_t *)&any;	for (i = 0; i < 3; i++) {		xfrm_address_t *dst, *src;		switch (i) {		case 0:			dst = daddr;			src = saddr;			break;		case 1:			/* lookup state with wild-card source address */			wildcard = 1;			dst = daddr;			src = xany;			break;		case 2:		default:			/* lookup state with wild-card addresses */			wildcard = 1; /* XXX */			dst = xany;			src = xany;			break;		}		x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6);		if (!x)			continue;		spin_lock(&x->lock);		if (wildcard) {			if ((x->props.flags & XFRM_STATE_WILDRECV) == 0) {				spin_unlock(&x->lock);				xfrm_state_put(x);				x = NULL;				continue;			}		}		if (unlikely(x->km.state != XFRM_STATE_VALID)) {			spin_unlock(&x->lock);			xfrm_state_put(x);			x = NULL;			continue;		}		if (xfrm_state_check_expire(x)) {			spin_unlock(&x->lock);			xfrm_state_put(x);			x = NULL;			continue;		}		nh = x->type->input(x, skb);		if (nh <= 0) {			spin_unlock(&x->lock);			xfrm_state_put(x);			x = NULL;			continue;		}		x->curlft.bytes += skb->len;		x->curlft.packets++;		spin_unlock(&x->lock);		xfrm_vec_one = x;		break;	}	if (!xfrm_vec_one)		goto drop;	/* Allocate new secpath or COW existing one. */	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {		struct sec_path *sp;		sp = secpath_dup(skb->sp);		if (!sp)			goto drop;		if (skb->sp)			secpath_put(skb->sp);		skb->sp = sp;	}	if (1 + skb->sp->len > XFRM_MAX_DEPTH)		goto drop;	skb->sp->xvec[skb->sp->len] = xfrm_vec_one;	skb->sp->len ++;//.........这里部分代码省略.........

int __xfrm6_rcv_one(struct sk_buff *skb, xfrm_address_t *daddr, 		    xfrm_address_t *saddr, u8 proto){ 	struct xfrm_state *x = NULL; 	int wildcard = 0;	struct in6_addr any;	xfrm_address_t *xany; 	struct xfrm_state *xfrm_vec_one = NULL; 	int nh = 0;	int i = 0;	ipv6_addr_set(&any, 0, 0, 0, 0);	xany = (xfrm_address_t *)&any;	for (i = 0; i < 3; i++) {		xfrm_address_t *dst, *src;		switch (i) {		case 0:			dst = daddr;			src = saddr;			break;		case 1:			/* lookup state with wild-card source address */			wildcard = 1;			dst = daddr;			src = xany;			break;		case 2:		default: 			/* lookup state with wild-card addresses */			wildcard = 1; /* XXX */			dst = xany;			src = xany;			break; 		}		x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6);		if (!x)			continue;		spin_lock(&x->lock);		if (wildcard) {			if ((x->props.flags & XFRM_STATE_WILDRECV) == 0) {				printk(KERN_INFO "%s: found state is not wild-card./n", __FUNCTION__);				spin_unlock(&x->lock);				xfrm_state_put(x);				x = NULL;				continue;			}		}		if (unlikely(x->km.state != XFRM_STATE_VALID)) {			spin_unlock(&x->lock);			xfrm_state_put(x); 			x = NULL; 			continue;		}		if (xfrm_state_check_expire(x)) {			spin_unlock(&x->lock);			xfrm_state_put(x);			x = NULL;			continue;		}		nh = x->type->input(x, skb);		if (nh <= 0) {			spin_unlock(&x->lock);			xfrm_state_put(x);			x = NULL;			continue;		}		break;	}	if (!x)		goto error; 	x->curlft.bytes += skb->len; 	x->curlft.packets++;	x->curlft.use_time = (unsigned long) xtime.tv_sec; 	spin_unlock(&x->lock); 	xfrm_vec_one = x; 	/* Allocate new secpath or COW existing one. */ 	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { 		struct sec_path *sp; 		sp = secpath_dup(skb->sp); 		if (!sp) { 			printk(KERN_INFO "%s: dup secpath failed/n", __FUNCTION__); 			goto error; 		} 		if (skb->sp) 			secpath_put(skb->sp); 		skb->sp = sp; 	}//.........这里部分代码省略.........