summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sys/netinet/ip_output.c10
-rw-r--r--sys/netinet/raw_ip.c2
-rw-r--r--sys/netinet/tcp_input.c4
-rw-r--r--sys/netinet/tcp_output.c7
-rw-r--r--sys/netinet/tcp_reass.c4
-rw-r--r--sys/netinet/udp_usrreq.c2
-rw-r--r--sys/netinet6/icmp6.c8
-rw-r--r--sys/netinet6/ip6_output.c9
-rw-r--r--sys/netinet6/ipsec.c148
-rw-r--r--sys/netinet6/ipsec.h11
-rw-r--r--sys/netinet6/ipsec6.h2
-rw-r--r--sys/netinet6/nd6_nbr.c8
-rw-r--r--sys/netinet6/raw_ip6.c11
-rw-r--r--sys/netinet6/udp6_output.c6
-rw-r--r--sys/netinet6/udp6_usrreq.c6
15 files changed, 84 insertions, 154 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 733df47..a872c00 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -144,7 +144,6 @@ ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro,
struct in_addr pkt_dst;
struct route iproute;
#ifdef IPSEC
- struct socket *so;
struct secpolicy *sp = NULL;
#endif
#ifdef FAST_IPSEC
@@ -195,11 +194,6 @@ ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro,
}
m = m0;
-#ifdef IPSEC
- so = ipsec_getsocket(m);
- (void)ipsec_setsocket(m, NULL);
-#endif /*IPSEC*/
-
M_ASSERTPKTHDR(m);
if (ro == NULL) {
@@ -481,11 +475,11 @@ ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro,
sendit:
#ifdef IPSEC
/* get SP for this packet */
- if (so == NULL)
+ if (inp == NULL)
sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
flags, &error);
else
- sp = ipsec4_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
+ sp = ipsec4_getpolicybypcb(m, IPSEC_DIR_OUTBOUND, inp, &error);
if (sp == NULL) {
ipsecstat.out_inval++;
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index bd65e81..eff86d3 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -147,7 +147,7 @@ raw_append(struct inpcb *last, struct ip *ip, struct mbuf *n)
#ifdef IPSEC
/* check AH/ESP integrity. */
- if (ipsec4_in_reject_so(n, last->inp_socket)) {
+ if (ipsec4_in_reject(n, last)) {
policyfail = 1;
ipsecstat.in_polvio++;
/* do not inject data to pcb */
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index eef736c..2b7f99a 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -572,12 +572,12 @@ findpcb:
#ifdef IPSEC
if (isipv6) {
- if (inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) {
+ if (inp != NULL && ipsec6_in_reject(m, inp)) {
ipsec6stat.in_polvio++;
goto drop;
}
} else {
- if (inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {
+ if (inp != NULL && ipsec4_in_reject(m, inp)) {
ipsecstat.in_polvio++;
goto drop;
}
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index c44fa96..f30d6c3 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -878,13 +878,6 @@ send:
ip6->ip6_hlim = in6_selecthlim(tp->t_inpcb, NULL);
/* TODO: IPv6 IP6TOS_ECT bit on */
-#if defined(IPSEC) && !defined(FAST_IPSEC)
- if (ipsec_setsocket(m, so) != 0) {
- m_freem(m);
- error = ENOBUFS;
- goto out;
- }
-#endif /*IPSEC*/
error = ip6_output(m,
tp->t_inpcb->in6p_outputopts, NULL,
(so->so_options & SO_DONTROUTE), NULL, NULL,
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c
index eef736c..2b7f99a 100644
--- a/sys/netinet/tcp_reass.c
+++ b/sys/netinet/tcp_reass.c
@@ -572,12 +572,12 @@ findpcb:
#ifdef IPSEC
if (isipv6) {
- if (inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) {
+ if (inp != NULL && ipsec6_in_reject(m, inp)) {
ipsec6stat.in_polvio++;
goto drop;
}
} else {
- if (inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {
+ if (inp != NULL && ipsec4_in_reject(m, inp)) {
ipsecstat.in_polvio++;
goto drop;
}
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 02a0e77..3852583 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -455,7 +455,7 @@ udp_append(last, ip, n, off)
#ifdef IPSEC
/* check AH/ESP integrity. */
- if (ipsec4_in_reject_so(n, last->inp_socket)) {
+ if (ipsec4_in_reject(n, last)) {
ipsecstat.in_polvio++;
m_freem(n);
return;
diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c
index 6baa2db..5ef4fff 100644
--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -2203,10 +2203,6 @@ icmp6_reflect(m, off)
*/
m->m_flags &= ~(M_BCAST|M_MCAST);
-#ifdef IPSEC
- /* Don't lookup socket */
- (void)ipsec_setsocket(m, NULL);
-#endif /* IPSEC */
#ifdef COMPAT_RFC1885
ip6_output(m, NULL, &icmp6_reflect_rt, 0, NULL, &outif, NULL);
@@ -2714,10 +2710,6 @@ noredhdropt:;
sizeof(*ip6), ntohs(ip6->ip6_plen));
/* send the packet to outside... */
-#ifdef IPSEC
- /* Don't lookup socket */
- (void)ipsec_setsocket(m, NULL);
-#endif /* IPSEC */
ip6_output(m, NULL, NULL, 0, NULL, &outif, NULL);
if (outif) {
icmp6_ifstat_inc(outif, ifs6_out_msg);
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 821a035..fc69de1 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -191,12 +191,7 @@ ip6_output(m0, opt, ro, flags, im6o, ifpp, inp)
#endif /* FAST_IPSEC */
#ifdef IPSEC
int needipsectun = 0;
- struct socket *so;
struct secpolicy *sp = NULL;
-
- /* for AH processing. stupid to have "socket" variable in IP layer... */
- so = ipsec_getsocket(m);
- (void)ipsec_setsocket(m, NULL);
#endif /* IPSEC */
ip6 = mtod(m, struct ip6_hdr *);
@@ -240,10 +235,10 @@ ip6_output(m0, opt, ro, flags, im6o, ifpp, inp)
#ifdef IPSEC
/* get a security policy for this packet */
- if (so == NULL)
+ if (inp == NULL)
sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
else
- sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
+ sp = ipsec6_getpolicybypcb(m, IPSEC_DIR_OUTBOUND, inp, &error);
if (sp == NULL) {
ipsec6stat.out_inval++;
diff --git a/sys/netinet6/ipsec.c b/sys/netinet6/ipsec.c
index 240cc29..5bb7c93 100644
--- a/sys/netinet6/ipsec.c
+++ b/sys/netinet6/ipsec.c
@@ -409,10 +409,10 @@ ipsec_invalpcbcacheall()
* NOTE: IPv6 mapped adddress concern is implemented here.
*/
struct secpolicy *
-ipsec4_getpolicybysock(m, dir, so, error)
+ipsec4_getpolicybypcb(m, dir, inp, error)
struct mbuf *m;
u_int dir;
- struct socket *so;
+ struct inpcb *inp;
int *error;
{
struct inpcbpolicy *pcbsp = NULL;
@@ -422,21 +422,10 @@ ipsec4_getpolicybysock(m, dir, so, error)
u_int16_t tag;
/* sanity check */
- if (m == NULL || so == NULL || error == NULL)
+ if (m == NULL || inp == NULL || error == NULL)
panic("ipsec4_getpolicybysock: NULL pointer was passed.");
- switch (so->so_proto->pr_domain->dom_family) {
- case AF_INET:
- pcbsp = sotoinpcb(so)->inp_sp;
- break;
-#ifdef INET6
- case AF_INET6:
- pcbsp = sotoin6pcb(so)->in6p_sp;
- break;
-#endif
- default:
- panic("ipsec4_getpolicybysock: unsupported address family");
- }
+ pcbsp = inp->inp_sp;
#ifdef DIAGNOSTIC
if (pcbsp == NULL)
@@ -555,6 +544,19 @@ ipsec4_getpolicybysock(m, dir, so, error)
/* NOTREACHED */
}
+struct secpolicy *
+ipsec4_getpolicybysock(m, dir, so, error)
+ struct mbuf *m;
+ u_int dir;
+ struct socket *so;
+ int *error;
+{
+
+ if (so == NULL)
+ panic("ipsec4_getpolicybysock: NULL pointer was passed.\n");
+ return (ipsec4_getpolicybypcb(m, dir, sotoinpcb(so), error));
+}
+
/*
* For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
* and return a pointer to SP.
@@ -624,10 +626,10 @@ ipsec4_getpolicybyaddr(m, dir, flag, error)
* others: a pointer to SP
*/
struct secpolicy *
-ipsec6_getpolicybysock(m, dir, so, error)
+ipsec6_getpolicybypcb(m, dir, inp, error)
struct mbuf *m;
u_int dir;
- struct socket *so;
+ struct inpcb *inp;
int *error;
{
struct inpcbpolicy *pcbsp = NULL;
@@ -637,15 +639,15 @@ ipsec6_getpolicybysock(m, dir, so, error)
u_int16_t tag;
/* sanity check */
- if (m == NULL || so == NULL || error == NULL)
+ if (m == NULL || inp == NULL || error == NULL)
panic("ipsec6_getpolicybysock: NULL pointer was passed.");
#ifdef DIAGNOSTIC
- if (so->so_proto->pr_domain->dom_family != AF_INET6)
+ if ((inp->inp_vflag & INP_IPV6PROTO) == 0)
panic("ipsec6_getpolicybysock: socket domain != inet6");
#endif
- pcbsp = sotoin6pcb(so)->in6p_sp;
+ pcbsp = inp->in6p_sp;
#ifdef DIAGNOSTIC
if (pcbsp == NULL)
@@ -765,6 +767,19 @@ ipsec6_getpolicybysock(m, dir, so, error)
/* NOTREACHED */
}
+struct secpolicy *
+ipsec6_getpolicybysock(m, dir, so, error)
+ struct mbuf *m;
+ u_int dir;
+ struct socket *so;
+ int *error;
+{
+
+ if (so == NULL)
+ panic("ipsec6_getpolicybysock: NULL pointer was passed.\n");
+ return (ipsec6_getpolicybypcb(m, dir, sotoin6pcb(so), error));
+}
+
/*
* For FORWADING packet or OUTBOUND without a socket. Searching SPD for packet,
* and return a pointer to SP.
@@ -1821,9 +1836,9 @@ ipsec_in_reject(sp, m)
* and {ah,esp}4_input for tunnel mode
*/
int
-ipsec4_in_reject_so(m, so)
+ipsec4_in_reject(m, inp)
struct mbuf *m;
- struct socket *so;
+ struct inpcb *inp;
{
struct secpolicy *sp = NULL;
int error;
@@ -1837,11 +1852,11 @@ ipsec4_in_reject_so(m, so)
* When we are called from ip_forward(), we call
* ipsec4_getpolicybyaddr() with IP_FORWARDING flag.
*/
- if (so == NULL)
+ if (inp == NULL)
sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
IP_FORWARDING, &error);
else
- sp = ipsec4_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
+ sp = ipsec4_getpolicybypcb(m, IPSEC_DIR_INBOUND, inp, &error);
/* XXX should be panic ? -> No, there may be error. */
if (sp == NULL)
@@ -1849,23 +1864,20 @@ ipsec4_in_reject_so(m, so)
result = ipsec_in_reject(sp, m);
KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
- printf("DP ipsec4_in_reject_so call free SP:%p\n", sp));
+ printf("DP ipsec4_in_reject call free SP:%p\n", sp));
key_freesp(sp);
return result;
}
int
-ipsec4_in_reject(m, inp)
+ipsec4_in_reject_so(m, so)
struct mbuf *m;
- struct inpcb *inp;
+ struct socket *so;
{
- if (inp == NULL)
- return ipsec4_in_reject_so(m, NULL);
- if (inp->inp_socket)
- return ipsec4_in_reject_so(m, inp->inp_socket);
- else
- panic("ipsec4_in_reject: invalid inpcb/socket");
+ if (so == NULL)
+ return ipsec4_in_reject(m, NULL);
+ return ipsec4_in_reject(m, sotoinpcb(so));
}
#ifdef INET6
@@ -1875,9 +1887,9 @@ ipsec4_in_reject(m, inp)
* and {ah,esp}6_input for tunnel mode
*/
int
-ipsec6_in_reject_so(m, so)
+ipsec6_in_reject(m, in6p)
struct mbuf *m;
- struct socket *so;
+ struct in6pcb *in6p;
{
struct secpolicy *sp = NULL;
int error;
@@ -1891,34 +1903,31 @@ ipsec6_in_reject_so(m, so)
* When we are called from ip_forward(), we call
* ipsec6_getpolicybyaddr() with IP_FORWARDING flag.
*/
- if (so == NULL)
+ if (in6p == NULL)
sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
IP_FORWARDING, &error);
else
- sp = ipsec6_getpolicybysock(m, IPSEC_DIR_INBOUND, so, &error);
+ sp = ipsec6_getpolicybypcb(m, IPSEC_DIR_INBOUND, in6p, &error);
if (sp == NULL)
return 0; /* XXX should be panic ? */
result = ipsec_in_reject(sp, m);
KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
- printf("DP ipsec6_in_reject_so call free SP:%p\n", sp));
+ printf("DP ipsec6_in_reject call free SP:%p\n", sp));
key_freesp(sp);
return result;
}
int
-ipsec6_in_reject(m, in6p)
+ipsec6_in_reject_so(m, so)
struct mbuf *m;
- struct in6pcb *in6p;
+ struct socket *so;
{
- if (in6p == NULL)
- return ipsec6_in_reject_so(m, NULL);
- if (in6p->in6p_socket)
- return ipsec6_in_reject_so(m, in6p->in6p_socket);
- else
- panic("ipsec6_in_reject: invalid in6p/socket");
+ if (so == NULL)
+ return ipsec6_in_reject(m, NULL);
+ return ipsec6_in_reject(m, sotoin6pcb(so));
}
#endif
@@ -2012,8 +2021,11 @@ ipsec4_hdrsiz(m, dir, inp)
/* sanity check */
if (m == NULL)
return 0; /* XXX should be panic ? */
+#if 0
+ /* this is possible in TIME_WAIT state */
if (inp != NULL && inp->inp_socket == NULL)
panic("ipsec4_hdrsize: why is socket NULL but there is PCB.");
+#endif
/* get SP for this packet.
* When we are called from ip_forward(), we call
@@ -2022,7 +2034,7 @@ ipsec4_hdrsiz(m, dir, inp)
if (inp == NULL)
sp = ipsec4_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
else
- sp = ipsec4_getpolicybysock(m, dir, inp->inp_socket, &error);
+ sp = ipsec4_getpolicybypcb(m, dir, inp, &error);
if (sp == NULL)
return 0; /* XXX should be panic ? */
@@ -2054,15 +2066,18 @@ ipsec6_hdrsiz(m, dir, in6p)
/* sanity check */
if (m == NULL)
return 0; /* XXX should be panic ? */
+#if 0
+ /* this is possible in TIME_WAIT state */
if (in6p != NULL && in6p->in6p_socket == NULL)
panic("ipsec6_hdrsize: why is socket NULL but there is PCB.");
+#endif
/* get SP for this packet */
/* XXX Is it right to call with IP_FORWARDING. */
if (in6p == NULL)
sp = ipsec6_getpolicybyaddr(m, dir, IP_FORWARDING, &error);
else
- sp = ipsec6_getpolicybysock(m, dir, in6p->in6p_socket, &error);
+ sp = ipsec6_getpolicybypcb(m, dir, in6p, &error);
if (sp == NULL)
return 0;
@@ -3625,42 +3640,7 @@ ipsec_optaux(m, aux)
if (aux == NULL)
return;
- if (!aux->so && !aux->sp)
- ipsec_delaux(m);
-}
-
-int
-ipsec_setsocket(m, so)
- struct mbuf *m;
- struct socket *so;
-{
- struct ipsecaux *aux;
-
- /* if so == NULL, don't insist on getting the aux mbuf */
- if (so) {
- aux = ipsec_addaux(m);
- if (aux == NULL)
- return ENOBUFS;
- } else
- aux = ipsec_findaux(m);
- if (aux != NULL) {
- aux->so = so;
- }
- ipsec_optaux(m, aux);
- return 0;
-}
-
-struct socket *
-ipsec_getsocket(m)
- struct mbuf *m;
-{
- struct ipsecaux *aux;
-
- aux = ipsec_findaux(m);
- if (aux != NULL)
- return aux->so;
- else
- return NULL;
+ ipsec_delaux(m);
}
int
diff --git a/sys/netinet6/ipsec.h b/sys/netinet6/ipsec.h
index 58a4ff9..d74a066 100644
--- a/sys/netinet6/ipsec.h
+++ b/sys/netinet6/ipsec.h
@@ -149,11 +149,7 @@ struct secspacq {
};
struct ipsecaux {
- struct socket *so;
int hdrs; /* # of ipsec headers */
-
- struct secpolicy *sp;
- struct ipsecrequest *req;
};
#endif /* _KERNEL */
@@ -335,12 +331,13 @@ extern int ipsec_pcbconn __P((struct inpcbpolicy *));
extern int ipsec_pcbdisconn __P((struct inpcbpolicy *));
extern int ipsec_invalpcbcacheall __P((void));
+struct inpcb;
+extern struct secpolicy *ipsec4_getpolicybypcb
+ __P((struct mbuf *, u_int, struct inpcb *, int *));
extern struct secpolicy *ipsec4_getpolicybysock
__P((struct mbuf *, u_int, struct socket *, int *));
extern struct secpolicy *ipsec4_getpolicybyaddr
__P((struct mbuf *, u_int, int, int *));
-extern struct secpolicy *ipsec4_getpolicybytag
- __P((struct mbuf *, u_int, int *));
struct inpcb;
extern int ipsec_init_pcbpolicy __P((struct socket *, struct inpcbpolicy **));
@@ -376,8 +373,6 @@ extern int ipsec4_tunnel_validate __P((struct mbuf *, int, u_int,
struct secasvar *));
extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
extern void ipsec_delaux __P((struct mbuf *));
-extern int ipsec_setsocket __P((struct mbuf *, struct socket *));
-extern struct socket *ipsec_getsocket __P((struct mbuf *));
extern int ipsec_addhist __P((struct mbuf *, int, u_int32_t));
extern int ipsec_getnhist __P((struct mbuf *));
extern void ipsec_clearhist __P((struct mbuf *));
diff --git a/sys/netinet6/ipsec6.h b/sys/netinet6/ipsec6.h
index e99dea3..978635e 100644
--- a/sys/netinet6/ipsec6.h
+++ b/sys/netinet6/ipsec6.h
@@ -51,6 +51,8 @@ extern int ip6_ipsec_ecn;
extern int ip6_esp_randpad;
struct inpcb;
+extern struct secpolicy *ipsec6_getpolicybypcb
+ __P((struct mbuf *, u_int, struct inpcb *, int *));
extern struct secpolicy *ipsec6_getpolicybysock
__P((struct mbuf *, u_int, struct socket *, int *));
extern struct secpolicy *ipsec6_getpolicybyaddr
diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
index fcda84f..8a26928 100644
--- a/sys/netinet6/nd6_nbr.c
+++ b/sys/netinet6/nd6_nbr.c
@@ -487,10 +487,6 @@ nd6_ns_output(ifp, daddr6, taddr6, ln, dad)
nd_ns->nd_ns_cksum =
in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
-#ifdef IPSEC
- /* Don't lookup socket */
- (void)ipsec_setsocket(m, NULL);
-#endif
ip6_output(m, NULL, NULL, dad ? IPV6_DADOUTPUT : 0, &im6o, &outif, NULL);
if (outif) {
icmp6_ifstat_inc(outif, ifs6_out_msg);
@@ -932,10 +928,6 @@ nd6_na_output(ifp, daddr6, taddr6, flags, tlladdr, sdl0)
nd_na->nd_na_cksum =
in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
-#ifdef IPSEC
- /* Don't lookup socket */
- (void)ipsec_setsocket(m, NULL);
-#endif
ip6_output(m, NULL, NULL, 0, &im6o, &outif, NULL);
if (outif) {
icmp6_ifstat_inc(outif, ifs6_out_msg);
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
index 36e3fbc..56f3758 100644
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -180,7 +180,7 @@ rip6_input(mp, offp, proto)
/*
* Check AH/ESP integrity.
*/
- if (n && ipsec6_in_reject_so(n, last->inp_socket)) {
+ if (n && ipsec6_in_reject(n, last)) {
m_freem(n);
ipsec6stat.in_polvio++;
/* do not inject data into pcb */
@@ -219,7 +219,7 @@ rip6_input(mp, offp, proto)
/*
* Check AH/ESP integrity.
*/
- if (last && ipsec6_in_reject_so(m, last->inp_socket)) {
+ if (last && ipsec6_in_reject(m, last)) {
m_freem(m);
ipsec6stat.in_polvio++;
ip6stat.ip6s_delivered--;
@@ -467,13 +467,6 @@ rip6_output(m, va_alist)
*p = in6_cksum(m, ip6->ip6_nxt, sizeof(*ip6), plen);
}
-#ifdef IPSEC
- if (ipsec_setsocket(m, so) != 0) {
- error = ENOBUFS;
- goto bad;
- }
-#endif /*IPSEC*/
-
error = ip6_output(m, in6p->in6p_outputopts, NULL, 0,
in6p->in6p_moptions, &oifp, in6p);
if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
diff --git a/sys/netinet6/udp6_output.c b/sys/netinet6/udp6_output.c
index d905e84..5de9188 100644
--- a/sys/netinet6/udp6_output.c
+++ b/sys/netinet6/udp6_output.c
@@ -288,12 +288,6 @@ udp6_output(in6p, m, addr6, control, td)
flags = 0;
udp6stat.udp6s_opackets++;
-#ifdef IPSEC
- if (ipsec_setsocket(m, in6p->in6p_socket) != 0) {
- error = ENOBUFS;
- goto release;
- }
-#endif /* IPSEC */
error = ip6_output(m, in6p->in6p_outputopts, NULL,
flags, in6p->in6p_moptions, NULL, in6p);
break;
diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c
index e0612b3..deb2a31 100644
--- a/sys/netinet6/udp6_usrreq.c
+++ b/sys/netinet6/udp6_usrreq.c
@@ -261,7 +261,7 @@ udp6_input(mp, offp, proto)
/*
* Check AH/ESP integrity.
*/
- if (ipsec6_in_reject_so(m, last->inp_socket))
+ if (ipsec6_in_reject(m, last))
ipsec6stat.in_polvio++;
/* do not inject data into pcb */
else
@@ -327,7 +327,7 @@ udp6_input(mp, offp, proto)
/*
* Check AH/ESP integrity.
*/
- if (ipsec6_in_reject_so(m, last->inp_socket)) {
+ if (ipsec6_in_reject(m, last)) {
ipsec6stat.in_polvio++;
goto bad;
}
@@ -383,7 +383,7 @@ udp6_input(mp, offp, proto)
/*
* Check AH/ESP integrity.
*/
- if (ipsec6_in_reject_so(m, in6p->inp_socket)) {
+ if (ipsec6_in_reject(m, in6p)) {
ipsec6stat.in_polvio++;
goto bad;
}
OpenPOWER on IntegriCloud