IPSEC support in the kernel.

pr_input() routines prototype is also changed to support IPSEC and IPV6
chained protocol headers.

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project

1 files changed, 8 insertions, 2 deletions

diff --git a/sys/netinet/ip_dummynet.c b/sys/netinet/ip_dummynet.c
index 401e24d..9791a7f 100644
--- a/sys/netinet/ip_dummynet.c
+++ b/sys/netinet/ip_dummynet.c
@@ -220,7 +220,7 @@ dn_move(struct dn_pipe *pipe, int immediate)
 	    struct route *ro = &(pkt->ro) ;
 
 	    (void)ip_output((struct mbuf *)pkt, (struct mbuf *)pkt->ifp,
-			ro, pkt->dn_dst, NULL);
+			ro, pkt->flags, NULL);
 	    rt_unref (ro->ro_rt) ;
 	    }
 	    break ;
@@ -290,7 +290,7 @@ int
 dummynet_io(int pipe_nr, int dir,
 	struct mbuf *m, struct ifnet *ifp, struct route *ro,
 	struct sockaddr_in *dst,
-	struct ip_fw_chain *rule)
+	struct ip_fw_chain *rule, int flags)
 {
     struct dn_pkt *pkt;
     struct dn_pipe *pipe;
@@ -359,6 +359,12 @@ dummynet_io(int pipe_nr, int dir,
 	    dst = (struct sockaddr_in *)&(pkt->ro.ro_dst) ;
 
 	pkt->dn_dst = dst;		/* XXX this can't be right! */
+	/*
+	 * 'flags' also need to be kept for later packet treatment
+	 * such as IPSEC. IPSEC consider sending packet's m->m_pkthdr.rcvif
+	 * as 'socket *' at ip_output(), if IP_SOCKINMRCVIF is set.
+	 */
+	pkt->flags = flags;
     }
     if (pipe->r.head == NULL)
 	pipe->r.head = pkt;