diff options
| author | Luiz Otavio O Souza <luiz@netgate.com> | 2015-09-15 14:38:44 -0500 |
|---|---|---|
| committer | Luiz Otavio O Souza <luiz@netgate.com> | 2015-10-20 11:54:46 -0500 |
| commit | 9b36e0ba9d28beaf5a086c47070f4324621a728f (patch) | |
| tree | ecbb3897a803f6b2c3c546d4af1597935cc23974 /sys/netinet/ip_input.c | |
| parent | 35579e99c39d480d190f0e29606710433c0d3bf0 (diff) | |
| download | FreeBSD-src-9b36e0ba9d28beaf5a086c47070f4324621a728f.zip FreeBSD-src-9b36e0ba9d28beaf5a086c47070f4324621a728f.tar.gz | |
MFC r275704:
Move ip_ipsec_fwd() from ip_input() into ip_forward().
Remove check for presence PACKET_TAG_IPSEC_IN_DONE mbuf tag from
ip_ipsec_fwd(). PACKET_TAG_IPSEC_IN_DONE tag means that packet is
already handled by IPSEC code. This means that before IPSEC processing
it was destined to our address and security policy was checked in
the ip_ipsec_input(). After IPSEC processing packet has new IP
addresses and destination address isn't our own. So, anyway we can't
check security policy from the mbuf tag, because it corresponds
to different addresses.
We should check security policy that corresponds to packet
attributes in both cases - when it has a mbuf tag and when it has not.
Obtained from: Yandex LLC
Sponsored by: Yandex LLC
TAG: IPSEC-HEAD
Issue: #4841
Diffstat (limited to 'sys/netinet/ip_input.c')
| -rw-r--r-- | sys/netinet/ip_input.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index ad1e7eb..287417c 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -676,10 +676,6 @@ passin: IPSTAT_INC(ips_cantforward); m_freem(m); } else { -#ifdef IPSEC - if (ip_ipsec_fwd(m)) - goto bad; -#endif /* IPSEC */ ip_forward(m, dchg); } return; @@ -1357,6 +1353,13 @@ ip_forward(struct mbuf *m, int srcrt) m_freem(m); return; } +#ifdef IPSEC + if (ip_ipsec_fwd(m) != 0) { + IPSTAT_INC(ips_cantforward); + m_freem(m); + return; + } +#endif /* IPSEC */ #ifdef IPSTEALTH if (!V_ipstealth) { #endif |
