Page MenuHomeFreeBSD
Files F171687446

D2986.id6677.diff
No OneTemporary
Actions

D2986.id6677.diff
View Options

Index: sys/netinet/ip_input.c
===================================================================
--- sys/netinet/ip_input.c
+++ sys/netinet/ip_input.c
@@ -907,13 +907,6 @@
m_freem(m);
return;
}
-#ifdef IPSEC
- if (ip_ipsec_fwd(m) != 0) {
- IPSTAT_INC(ips_cantforward);
- m_freem(m);
- return;
- }
-#endif /* IPSEC */
#ifdef IPSTEALTH
if (!V_ipstealth) {
#endif
Index: sys/netinet/ip_ipsec.h
===================================================================
--- sys/netinet/ip_ipsec.h
+++ sys/netinet/ip_ipsec.h
@@ -33,7 +33,6 @@
#define _NETINET_IP_IPSEC_H_
int ip_ipsec_filtertunnel(struct mbuf *);
-int ip_ipsec_fwd(struct mbuf *);
int ip_ipsec_input(struct mbuf *, int);
int ip_ipsec_mtu(struct mbuf *, int);
int ip_ipsec_output(struct mbuf **, struct inpcb *, int *);
Index: sys/netinet/ip_ipsec.c
===================================================================
--- sys/netinet/ip_ipsec.c
+++ sys/netinet/ip_ipsec.c
@@ -99,19 +99,6 @@
}
/*
- * Check if this packet has an active SA and needs to be dropped instead
- * of forwarded.
- * Called from ip_forward().
- * 1 = drop packet, 0 = forward packet.
- */
-int
-ip_ipsec_fwd(struct mbuf *m)
-{
-
- return (ipsec4_in_reject(m, NULL));
-}
-
-/*
* Check if protocol type doesn't have a further header and do IPSEC
* decryption or reject right now. Protocols with further headers get
* their IPSEC treatment within the protocol specific processing.
@@ -180,6 +167,12 @@
* sp == NULL, error != 0 discard packet, report error
*/
if (sp != NULL) {
+ /* Only for forwarded packets */
+ if (inp == NULL && ipsec_in_reject(sp, *m)) {
+ IPSECSTAT_INC(ips_in_polvio);
+ goto bad;
+ }
+
/*
* Do delayed checksums now because we send before
* this is done in the normal processing path.
Index: sys/netinet/ip_output.c
===================================================================
--- sys/netinet/ip_output.c
+++ sys/netinet/ip_output.c
@@ -451,6 +451,8 @@
#ifdef IPSEC
switch(ip_ipsec_output(&m, inp, &error)) {
case 1:
+ if (inp == NULL)
+ IPSTAT_INC(ips_cantforward);
goto bad;
case -1:
goto done;
Index: sys/netinet6/ip6_forward.c
===================================================================
--- sys/netinet6/ip6_forward.c
+++ sys/netinet6/ip6_forward.c
@@ -134,17 +134,6 @@
m_freem(m);
return;
}
-#ifdef IPSEC
- /*
- * Check if this packet has an active SA and needs to be dropped
- * instead of forwarded.
- */
- if (ip6_ipsec_fwd(m) != 0) {
- IP6STAT_INC(ip6s_cantforward);
- m_freem(m);
- return;
- }
-#endif /* IPSEC */
#ifdef IPSTEALTH
if (!V_ip6stealth) {
@@ -161,6 +150,33 @@
}
#endif
+#ifdef IPSEC
+ /* get a security policy for this packet */
+ sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, &error);
+ if (sp == NULL) {
+ IPSEC6STAT_INC(ips_out_inval);
+ IP6STAT_INC(ip6s_cantforward);
+
+ /* XXX: what icmp ? */
+ m_freem(m);
+ return;
+ } else {
+ /*
+ * Check if this packet has an active SA and needs to be dropped
+ * instead of forwarded.
+ */
+ if (ipsec_in_reject(sp, m)) {
+ IPSEC6STAT_INC(ips_out_polvio);
+ IP6STAT_INC(ip6s_cantforward);
+ KEY_FREESP(&sp);
+
+ /* XXX: what icmp ? */
+ m_freem(m);
+ return;
+ }
+ }
+#endif
+
/*
* Save at most ICMPV6_PLD_MAXLEN (= the min IPv6 MTU -
* size of IPv6 + ICMPv6 headers) bytes of the packet in case
@@ -173,42 +189,13 @@
mcopy = m_copy(m, 0, imin(m->m_pkthdr.len, ICMPV6_PLD_MAXLEN));
#ifdef IPSEC
- /* get a security policy for this packet */
- sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, &error);
- if (sp == NULL) {
- IPSEC6STAT_INC(ips_out_inval);
- IP6STAT_INC(ip6s_cantforward);
- if (mcopy) {
-#if 0
- /* XXX: what icmp ? */
-#else
- m_freem(mcopy);
-#endif
- }
- m_freem(m);
- return;
- }
error = 0;
/* check policy */
switch (sp->policy) {
- case IPSEC_POLICY_DISCARD:
- /*
- * This packet is just discarded.
- */
- IPSEC6STAT_INC(ips_out_polvio);
- IP6STAT_INC(ip6s_cantforward);
- KEY_FREESP(&sp);
- if (mcopy) {
-#if 0
- /* XXX: what icmp ? */
-#else
- m_freem(mcopy);
-#endif
- }
- m_freem(m);
- return;
+ /* NOTE: _DISCARD is checked above in ipsec_in_reject */
+ /* case IPSEC_POLICY_DISCARD: */
case IPSEC_POLICY_BYPASS:
case IPSEC_POLICY_NONE:
Index: sys/netinet6/ip6_ipsec.h
===================================================================
--- sys/netinet6/ip6_ipsec.h
+++ sys/netinet6/ip6_ipsec.h
@@ -33,7 +33,6 @@
#define _NETINET_IP6_IPSEC_H_
int ip6_ipsec_filtertunnel(struct mbuf *);
-int ip6_ipsec_fwd(struct mbuf *);
int ip6_ipsec_input(struct mbuf *, int);
int ip6_ipsec_output(struct mbuf **, struct inpcb *, int *);
#if 0
Index: sys/netinet6/ip6_ipsec.c
===================================================================
--- sys/netinet6/ip6_ipsec.c
+++ sys/netinet6/ip6_ipsec.c
@@ -110,19 +110,6 @@
}
/*
- * Check if this packet has an active SA and needs to be dropped instead
- * of forwarded.
- * Called from ip6_forward().
- * 1 = drop packet, 0 = forward packet.
- */
-int
-ip6_ipsec_fwd(struct mbuf *m)
-{
-
- return (ipsec6_in_reject(m, NULL));
-}
-
-/*
* Check if protocol type doesn't have a further header and do IPSEC
* decryption or reject right now. Protocols with further headers get
* their IPSEC treatment within the protocol specific processing.
Index: sys/netipsec/ipsec.h
===================================================================
--- sys/netipsec/ipsec.h
+++ sys/netipsec/ipsec.h
@@ -315,6 +315,7 @@
extern int ipsec_get_policy(struct inpcb *inpcb, caddr_t request,
size_t len, struct mbuf **mp);
extern int ipsec_delete_pcbpolicy(struct inpcb *);
+extern int ipsec_in_reject(struct secpolicy *, struct mbuf *);
extern int ipsec4_in_reject(struct mbuf *, struct inpcb *);
struct secas;
Index: sys/netipsec/ipsec.c
===================================================================
--- sys/netipsec/ipsec.c
+++ sys/netipsec/ipsec.c
@@ -238,7 +238,6 @@
struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics.");
#endif /* INET6 */
-static int ipsec_in_reject(struct secpolicy *, struct mbuf *);
static int ipsec_setspidx_inpcb(struct mbuf *, struct inpcb *);
static int ipsec_setspidx(struct mbuf *, struct secpolicyindex *, int);
static void ipsec4_get_ulp(struct mbuf *m, struct secpolicyindex *, int);
@@ -1198,7 +1197,7 @@
* 0: valid
* 1: invalid
*/
-static int
+int
ipsec_in_reject(struct secpolicy *sp, struct mbuf *m)
{
struct ipsecrequest *isr;

File Metadata

Mime Type
text/plain
Expires
Sun, Sep 13, 5:21 PM (11 h, 22 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
38865615
Default Alt Text
D2986.id6677.diff (6 KB)

Event Timeline