Do not count security policy violation twice.
ipsec*_in_reject() do this by their own. Obtained from: Yandex LLC Sponsored by: Yandex LLC
This commit is contained in:
parent
49ada98eac
commit
44eb8bbe7b
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=275716
@ -5698,7 +5698,6 @@ sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int lengt
|
||||
#ifdef INET
|
||||
case AF_INET:
|
||||
if (ipsec4_in_reject(m, &inp->ip_inp.inp)) {
|
||||
IPSECSTAT_INC(ips_in_polvio);
|
||||
SCTP_STAT_INCR(sctps_hdrops);
|
||||
goto out;
|
||||
}
|
||||
@ -5707,7 +5706,6 @@ sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int lengt
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
if (ipsec6_in_reject(m, &inp->ip_inp.inp)) {
|
||||
IPSEC6STAT_INC(ips_in_polvio);
|
||||
SCTP_STAT_INCR(sctps_hdrops);
|
||||
goto out;
|
||||
}
|
||||
|
@ -894,12 +894,10 @@ tcp_input(struct mbuf **mp, int *offp, int proto)
|
||||
#ifdef IPSEC
|
||||
#ifdef INET6
|
||||
if (isipv6 && ipsec6_in_reject(m, inp)) {
|
||||
IPSEC6STAT_INC(ips_in_polvio);
|
||||
goto dropunlock;
|
||||
} else
|
||||
#endif /* INET6 */
|
||||
if (ipsec4_in_reject(m, inp) != 0) {
|
||||
IPSECSTAT_INC(ips_in_polvio);
|
||||
goto dropunlock;
|
||||
}
|
||||
#endif /* IPSEC */
|
||||
|
@ -323,7 +323,6 @@ udp_append(struct inpcb *inp, struct ip *ip, struct mbuf *n, int off,
|
||||
/* Check AH/ESP integrity. */
|
||||
if (ipsec4_in_reject(n, inp)) {
|
||||
m_freem(n);
|
||||
IPSECSTAT_INC(ips_in_polvio);
|
||||
return;
|
||||
}
|
||||
#ifdef IPSEC_NAT_T
|
||||
|
@ -264,7 +264,6 @@ rip6_input(struct mbuf **mp, int *offp, int proto)
|
||||
*/
|
||||
if (n && ipsec6_in_reject(n, last)) {
|
||||
m_freem(n);
|
||||
IPSEC6STAT_INC(ips_in_polvio);
|
||||
/* Do not inject data into pcb. */
|
||||
} else
|
||||
#endif /* IPSEC */
|
||||
@ -296,7 +295,6 @@ rip6_input(struct mbuf **mp, int *offp, int proto)
|
||||
*/
|
||||
if ((last != NULL) && ipsec6_in_reject(m, last)) {
|
||||
m_freem(m);
|
||||
IPSEC6STAT_INC(ips_in_polvio);
|
||||
IP6STAT_DEC(ip6s_delivered);
|
||||
/* Do not inject data into pcb. */
|
||||
INP_RUNLOCK(last);
|
||||
|
@ -158,7 +158,6 @@ udp6_append(struct inpcb *inp, struct mbuf *n, int off,
|
||||
/* Check AH/ESP integrity. */
|
||||
if (ipsec6_in_reject(n, inp)) {
|
||||
m_freem(n);
|
||||
IPSEC6STAT_INC(ips_in_polvio);
|
||||
return;
|
||||
}
|
||||
#endif /* IPSEC */
|
||||
|
Loading…
Reference in New Issue
Block a user