diff options
| author | luigi <luigi@FreeBSD.org> | 2003-07-04 21:42:32 +0000 |
|---|---|---|
| committer | luigi <luigi@FreeBSD.org> | 2003-07-04 21:42:32 +0000 |
| commit | c530f5973f70002f8d4f101d8be867a7b2cd031c (patch) | |
| tree | 2273123f1eca64c0add21999e5c7ee78411d66b4 /sys/netinet/ip_fw2.c | |
| parent | d9dfac9f45d8211c085077869a18bbb7761f562b (diff) | |
| download | FreeBSD-src-c530f5973f70002f8d4f101d8be867a7b2cd031c.zip FreeBSD-src-c530f5973f70002f8d4f101d8be867a7b2cd031c.tar.gz | |
Implement the 'ipsec' option to match packets coming out of an ipsec tunnel.
Should work with both regular and fast ipsec (mutually exclusive).
See manpage for more details.
Submitted by: Ari Suutari (ari.suutari@syncrontech.com)
Revised by: sam
MFC after: 1 week
Diffstat (limited to 'sys/netinet/ip_fw2.c')
| -rw-r--r-- | sys/netinet/ip_fw2.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/sys/netinet/ip_fw2.c b/sys/netinet/ip_fw2.c index ad930f9..652c74e 100644 --- a/sys/netinet/ip_fw2.c +++ b/sys/netinet/ip_fw2.c @@ -73,6 +73,10 @@ #include <netinet/udp.h> #include <netinet/udp_var.h> +#ifdef IPSEC +#include <netinet6/ipsec.h> +#endif + #include <netinet/if_ether.h> /* XXX for ETHERTYPE_IP */ #include <machine/in_cksum.h> /* XXX for in_cksum */ @@ -1820,6 +1824,17 @@ check_body: verify_rev_path(src_ip, m->m_pkthdr.rcvif)); break; + case O_IPSEC: +#ifdef FAST_IPSEC + match = (m_tag_find(m, + PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL); +#endif +#ifdef IPSEC + match = (ipsec_gethist(m, NULL) != NULL); +#endif + /* otherwise no match */ + break; + /* * The second set of opcodes represents 'actions', * i.e. the terminal part of a rule once the packet @@ -2392,6 +2407,7 @@ check_ipfw_struct(struct ip_fw *rule, int size) case O_TCPOPTS: case O_ESTAB: case O_VERREVPATH: + case O_IPSEC: if (cmdlen != F_INSN_SIZE(ipfw_insn)) goto bad_size; break; |
