When no security policy matches a packet, ipsec[46]_getpolicy() returns
the default policy with a new reference, and the caller drops it right
after looking at the policy type. Once any security policy is
configured, every forwarded packet goes through ip_forward() and
ipsec4_forward(), which checks the inbound and the outbound policy.
That is four atomic operations per packet on one reference count that
all CPUs write.
The default policy is allocated with its vnet and freed only when the
vnet goes away, and the sysctl limits it to NONE or DISCARD. A packet
without a PCB has no policy cache to keep it in. In that case, check
the policy type directly and take no reference. Packets with a PCB
still take the reference, because the PCB caches the policy.
No functional change intended. DISCARD still drops the packet, and the
policy violation counters are incremented as before.
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")