key_allocsp
sp = key_allocsp(&spidx, IPSEC_DIR_OUTBOUND);
sp = key_allocsp(&spidx, dir);
struct secpolicy *key_allocsp(struct secpolicyindex *, u_int);