diff options
author | Renato Botelho <renato@netgate.com> | 2016-02-22 17:14:03 -0300 |
---|---|---|
committer | Renato Botelho <renato@netgate.com> | 2016-02-22 17:15:17 -0300 |
commit | 7c17fc70241a215de420457e10a510834441b90f (patch) | |
tree | b2f879569f9d9deb23e4d7accb103d30a64e1527 /sys/netinet/ip_input.c | |
parent | f1832699781cbd404f0f9b60a41fe59c8cc4dd1a (diff) | |
download | FreeBSD-src-7c17fc70241a215de420457e10a510834441b90f.zip FreeBSD-src-7c17fc70241a215de420457e10a510834441b90f.tar.gz |
Revert "Revert 295285 which was an MFC of the tryforward work (r290383,295282,295283)"
We are keeping tryforward enabled on pfSense since we do not use IPFW +
NAT
This reverts commit b899cad3faf3673f41a3fcf021164dcd7ee19a7e.
Diffstat (limited to 'sys/netinet/ip_input.c')
-rw-r--r-- | sys/netinet/ip_input.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index 287417c..1eefadc 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -77,6 +77,8 @@ __FBSDID("$FreeBSD$"); #include <netinet/ip_carp.h> #ifdef IPSEC #include <netinet/ip_ipsec.h> +#include <netipsec/ipsec.h> +#include <netipsec/key.h> #endif /* IPSEC */ #include <sys/socketvar.h> @@ -467,12 +469,22 @@ tooshort: } else m_adj(m, ip_len - m->m_pkthdr.len); } + /* Try to forward the packet, but if we fail continue */ #ifdef IPSEC + /* For now we do not handle IPSEC in tryforward. */ + if (!key_havesp(IPSEC_DIR_INBOUND) && !key_havesp(IPSEC_DIR_OUTBOUND) && + (V_ipforwarding == 1)) + if (ip_tryforward(m) == NULL) + return; /* * Bypass packet filtering for packets previously handled by IPsec. */ if (ip_ipsec_filtertunnel(m)) goto passin; +#else + if (V_ipforwarding == 1) + if (ip_tryforward(m) == NULL) + return; #endif /* IPSEC */ /* |