diff options
| author | bz <bz@FreeBSD.org> | 2008-03-14 16:38:11 +0000 |
|---|---|---|
| committer | bz <bz@FreeBSD.org> | 2008-03-14 16:38:11 +0000 |
| commit | 33dfb1706b9985093bf2f15b13b6d6fcf86e117f (patch) | |
| tree | c38b7d05bd49b6aa0f1e85463850a23ad784aabd /sys/netinet | |
| parent | 1fe21ae27841d6cbf56490b24eb61e21cf7dd03b (diff) | |
| download | FreeBSD-src-33dfb1706b9985093bf2f15b13b6d6fcf86e117f.zip FreeBSD-src-33dfb1706b9985093bf2f15b13b6d6fcf86e117f.tar.gz | |
Correct IPsec behaviour with a 'use' level in SP but no SA available.
In that case return an continue processing the packet without IPsec.
PR: 121384
MFC after: 5 days
Reported by: Cyrus Rahman (crahman gmail.com)
Tested by: Cyrus Rahman (crahman gmail.com) [slightly older version]
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/ip_ipsec.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/sys/netinet/ip_ipsec.c b/sys/netinet/ip_ipsec.c index b15a6dc..53311d0 100644 --- a/sys/netinet/ip_ipsec.c +++ b/sys/netinet/ip_ipsec.c @@ -34,6 +34,7 @@ __FBSDID("$FreeBSD$"); #include <sys/param.h> #include <sys/systm.h> +#include <sys/errno.h> #include <sys/kernel.h> #include <sys/malloc.h> #include <sys/mbuf.h> @@ -329,6 +330,17 @@ ip_ipsec_output(struct mbuf **m, struct inpcb *inp, int *flags, int *error, /* NB: callee frees mbuf */ *error = ipsec4_process_packet(*m, sp->req, *flags, 0); + if (*error == EJUSTRETURN) { + /* + * We had a SP with a level of 'use' and no SA. We + * will just continue to process the packet without + * IPsec processing and return without error. + */ + *error = 0; + ip->ip_len = ntohs(ip->ip_len); + ip->ip_off = ntohs(ip->ip_off); + goto done; + } /* * Preserve KAME behaviour: ENOENT can be returned * when an SA acquire is in progress. Don't propagate |
