diff options
author | ae <ae@FreeBSD.org> | 2014-12-11 14:58:55 +0000 |
---|---|---|
committer | ae <ae@FreeBSD.org> | 2014-12-11 14:58:55 +0000 |
commit | 8e6349d4bcea839f004de921402559ba85da1a5e (patch) | |
tree | 89c1e58ca7d3d507929b16d725a5260a8b6e131d /sys/netinet6/ip6_ipsec.c | |
parent | 1cca983d1bb1daccc62e83498b3dc3f64d78aef0 (diff) | |
download | FreeBSD-src-8e6349d4bcea839f004de921402559ba85da1a5e.zip FreeBSD-src-8e6349d4bcea839f004de921402559ba85da1a5e.tar.gz |
Remove PACKET_TAG_IPSEC_IN_DONE mbuf tag lookup and usage of its
security policy. The changed block of code in ip*_ipsec_input() is
called when packet has ESP/AH header. Presence of
PACKET_TAG_IPSEC_IN_DONE mbuf tag in the same time means that
packet was already handled by IPSEC and reinjected in the netisr,
and it has another ESP/AH headers (encrypted twice?).
Since it was already processed by IPSEC code, the AH/ESP headers
was already stripped (and probably outer IP header was stripped too)
and security policy from the tdb_ident was applied to those headers.
It is incorrect to apply this security policy to current headers.
Also make ip_ipsec_input() prototype similar to ip6_ipsec_input().
Obtained from: Yandex LLC
Sponsored by: Yandex LLC
Diffstat (limited to 'sys/netinet6/ip6_ipsec.c')
-rw-r--r-- | sys/netinet6/ip6_ipsec.c | 26 |
1 files changed, 5 insertions, 21 deletions
diff --git a/sys/netinet6/ip6_ipsec.c b/sys/netinet6/ip6_ipsec.c index e438c3b..6472a36 100644 --- a/sys/netinet6/ip6_ipsec.c +++ b/sys/netinet6/ip6_ipsec.c @@ -167,8 +167,6 @@ int ip6_ipsec_input(struct mbuf *m, int nxt) { #ifdef IPSEC - struct m_tag *mtag; - struct tdb_ident *tdbi; struct secpolicy *sp; int error; /* @@ -178,21 +176,8 @@ ip6_ipsec_input(struct mbuf *m, int nxt) */ if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && ipsec6_in_reject(m, NULL)) { - - /* - * Check if the packet has already had IPsec processing - * done. If so, then just pass it along. This tag gets - * set during AH, ESP, etc. input handling, before the - * packet is returned to the ip input queue for delivery. - */ - mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); - if (mtag != NULL) { - tdbi = (struct tdb_ident *)(mtag + 1); - sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); - } else { - sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, - IP_FORWARDING, &error); - } + sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, + IP_FORWARDING, &error); if (sp != NULL) { /* * Check security policy against packet attributes. @@ -203,13 +188,12 @@ ip6_ipsec_input(struct mbuf *m, int nxt) /* XXX error stat??? */ error = EINVAL; DPRINTF(("%s: no SP, packet discarded\n", __func__));/*XXX*/ - return 1; } - if (error) - return 1; + if (error != 0) + return (1); } #endif /* IPSEC */ - return 0; + return (0); } /* |