Page MenuHomeFreeBSD
Files F177552164

D61384.1794698247.diff
No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

D61384.1794698247.diff
View Options

diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -312,6 +312,19 @@
return (V_def_policy);
}
+/*
+ * The default SP lives as long as its vnet and is either NONE or DISCARD.
+ * Packets without a PCB check it here without a reference: forwarded
+ * packets get this far once any SP exists, and the reference count is one
+ * cache line written by every CPU.
+ */
+static bool
+ipsec_default_discard(void)
+{
+
+ return (V_def_policy->policy == IPSEC_POLICY_DISCARD);
+}
+
static void
ipsec_invalidate_cache(struct inpcb *inp, u_int dir)
{
@@ -583,7 +596,11 @@
spidx.dir = dir;
sp = key_allocsp(&spidx, dir);
}
- if (sp == NULL) /* No SP found, use system default. */
+ /*
+ * No SP found, use system default. Without a PCB the caller checks
+ * it with ipsec_default_discard().
+ */
+ if (sp == NULL && inp != NULL)
sp = key_allocsp_default();
return (sp);
}
@@ -601,6 +618,8 @@
sp = ipsec4_getpolicy(m, inp, ip1, IPSEC_DIR_OUTBOUND, needport);
if (sp != NULL)
sp = ipsec_checkpolicy(sp, inp, error);
+ else if (ipsec_default_discard())
+ *error = -EINVAL; /* Packet is discarded by caller. */
if (sp == NULL) {
switch (*error) {
case 0: /* No IPsec required: BYPASS or NONE */
@@ -648,8 +667,11 @@
}
sp = ipsec4_getpolicy(m, inp, ip1, IPSEC_DIR_INBOUND, 0);
- result = ipsec_in_reject(sp, inp, m);
- key_freesp(&sp);
+ if (sp != NULL) {
+ result = ipsec_in_reject(sp, inp, m);
+ key_freesp(&sp);
+ } else
+ result = ipsec_default_discard();
if (result != 0)
IPSECSTAT_INC(ips_in_polvio);
return (result);
@@ -772,7 +794,11 @@
spidx.dir = dir;
sp = key_allocsp(&spidx, dir);
}
- if (sp == NULL) /* No SP found, use system default. */
+ /*
+ * No SP found, use system default. Without a PCB the caller checks
+ * it with ipsec_default_discard().
+ */
+ if (sp == NULL && inp != NULL)
sp = key_allocsp_default();
return (sp);
}
@@ -790,6 +816,8 @@
sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport);
if (sp != NULL)
sp = ipsec_checkpolicy(sp, inp, error);
+ else if (ipsec_default_discard())
+ *error = -EINVAL; /* Packet is discarded by caller. */
if (sp == NULL) {
switch (*error) {
case 0: /* No IPsec required: BYPASS or NONE */
@@ -828,8 +856,11 @@
return (0);
#endif
sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0);
- result = ipsec_in_reject(sp, inp, m);
- key_freesp(&sp);
+ if (sp != NULL) {
+ result = ipsec_in_reject(sp, inp, m);
+ key_freesp(&sp);
+ } else
+ result = ipsec_default_discard();
if (result)
IPSEC6STAT_INC(ips_in_polvio);
return (result);

File Metadata

Mime Type
text/plain
Expires
Sat, Nov 14, 11:17 PM (5 h, 19 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41658984
Default Alt Text
D61384.1794698247.diff (2 KB)

Event Timeline