ipsec: isolate knowledge about protocols that are last header
Retire PR_LASTHDR protosw flag. Reviewed by: ae Differential revision: https://reviews.freebsd.org/D36155
This commit is contained in:
parent
05b9737f10
commit
489482e276
@ -288,10 +288,6 @@ db_print_prflags(short pr_flags)
|
|||||||
db_printf("%sPR_IMPLOPCL", comma ? ", " : "");
|
db_printf("%sPR_IMPLOPCL", comma ? ", " : "");
|
||||||
comma = 1;
|
comma = 1;
|
||||||
}
|
}
|
||||||
if (pr_flags & PR_LASTHDR) {
|
|
||||||
db_printf("%sPR_LASTHDR", comma ? ", " : "");
|
|
||||||
comma = 1;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
|
@ -145,7 +145,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_SEQPACKET,
|
.pr_type = SOCK_SEQPACKET,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_WANTRCVD,
|
||||||
.pr_input = sctp_input,
|
.pr_input = sctp_input,
|
||||||
.pr_ctlinput = sctp_ctlinput,
|
.pr_ctlinput = sctp_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
@ -156,7 +156,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_STREAM,
|
.pr_type = SOCK_STREAM,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD,
|
||||||
.pr_input = sctp_input,
|
.pr_input = sctp_input,
|
||||||
.pr_ctlinput = sctp_ctlinput,
|
.pr_ctlinput = sctp_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
@ -188,7 +188,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_ICMP,
|
.pr_protocol = IPPROTO_ICMP,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = icmp_input,
|
.pr_input = icmp_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
@ -197,7 +197,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_IGMP,
|
.pr_protocol = IPPROTO_IGMP,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = igmp_input,
|
.pr_input = igmp_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_fasttimo = igmp_fasttimo,
|
.pr_fasttimo = igmp_fasttimo,
|
||||||
@ -208,7 +208,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_RSVP,
|
.pr_protocol = IPPROTO_RSVP,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = rsvp_input,
|
.pr_input = rsvp_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
@ -217,7 +217,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_IPV4,
|
.pr_protocol = IPPROTO_IPV4,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap4_input,
|
.pr_input = encap4_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
@ -226,7 +226,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_MOBILE,
|
.pr_protocol = IPPROTO_MOBILE,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap4_input,
|
.pr_input = encap4_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
@ -235,7 +235,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_ETHERIP,
|
.pr_protocol = IPPROTO_ETHERIP,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap4_input,
|
.pr_input = encap4_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
@ -244,7 +244,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_GRE,
|
.pr_protocol = IPPROTO_GRE,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap4_input,
|
.pr_input = encap4_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
@ -254,7 +254,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_IPV6,
|
.pr_protocol = IPPROTO_IPV6,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap4_input,
|
.pr_input = encap4_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
@ -264,7 +264,7 @@ struct protosw inetsw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_PIM,
|
.pr_protocol = IPPROTO_PIM,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap4_input,
|
.pr_input = encap4_input,
|
||||||
.pr_ctloutput = rip_ctloutput,
|
.pr_ctloutput = rip_ctloutput,
|
||||||
.pr_usrreqs = &rip_usrreqs
|
.pr_usrreqs = &rip_usrreqs
|
||||||
|
@ -59,7 +59,7 @@ struct protosw sctp_stream_protosw = {
|
|||||||
.pr_type = SOCK_STREAM,
|
.pr_type = SOCK_STREAM,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD,
|
||||||
.pr_input = sctp_input,
|
.pr_input = sctp_input,
|
||||||
.pr_ctlinput = sctp_ctlinput,
|
.pr_ctlinput = sctp_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
@ -71,7 +71,7 @@ struct protosw sctp_seqpacket_protosw = {
|
|||||||
.pr_type = SOCK_SEQPACKET,
|
.pr_type = SOCK_SEQPACKET,
|
||||||
.pr_domain = &inetdomain,
|
.pr_domain = &inetdomain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_WANTRCVD,
|
||||||
.pr_input = sctp_input,
|
.pr_input = sctp_input,
|
||||||
.pr_ctlinput = sctp_ctlinput,
|
.pr_ctlinput = sctp_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
@ -87,7 +87,7 @@ struct protosw sctp6_stream_protosw = {
|
|||||||
.pr_type = SOCK_STREAM,
|
.pr_type = SOCK_STREAM,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD,
|
||||||
.pr_input = sctp6_input,
|
.pr_input = sctp6_input,
|
||||||
.pr_ctlinput = sctp6_ctlinput,
|
.pr_ctlinput = sctp6_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
@ -99,7 +99,7 @@ struct protosw sctp6_seqpacket_protosw = {
|
|||||||
.pr_type = SOCK_SEQPACKET,
|
.pr_type = SOCK_SEQPACKET,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_WANTRCVD,
|
||||||
.pr_input = sctp6_input,
|
.pr_input = sctp6_input,
|
||||||
.pr_ctlinput = sctp6_ctlinput,
|
.pr_ctlinput = sctp6_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
|
@ -180,7 +180,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_SEQPACKET,
|
.pr_type = SOCK_SEQPACKET,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_WANTRCVD,
|
||||||
.pr_input = sctp6_input,
|
.pr_input = sctp6_input,
|
||||||
.pr_ctlinput = sctp6_ctlinput,
|
.pr_ctlinput = sctp6_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
@ -193,7 +193,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_STREAM,
|
.pr_type = SOCK_STREAM,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_SCTP,
|
.pr_protocol = IPPROTO_SCTP,
|
||||||
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_LASTHDR,
|
.pr_flags = PR_CONNREQUIRED|PR_WANTRCVD,
|
||||||
.pr_input = sctp6_input,
|
.pr_input = sctp6_input,
|
||||||
.pr_ctlinput = sctp6_ctlinput,
|
.pr_ctlinput = sctp6_ctlinput,
|
||||||
.pr_ctloutput = sctp_ctloutput,
|
.pr_ctloutput = sctp_ctloutput,
|
||||||
@ -225,7 +225,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_ICMPV6,
|
.pr_protocol = IPPROTO_ICMPV6,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = icmp6_input,
|
.pr_input = icmp6_input,
|
||||||
.pr_ctlinput = rip6_ctlinput,
|
.pr_ctlinput = rip6_ctlinput,
|
||||||
.pr_ctloutput = rip6_ctloutput,
|
.pr_ctloutput = rip6_ctloutput,
|
||||||
@ -262,7 +262,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_IPV4,
|
.pr_protocol = IPPROTO_IPV4,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap6_input,
|
.pr_input = encap6_input,
|
||||||
.pr_ctloutput = rip6_ctloutput,
|
.pr_ctloutput = rip6_ctloutput,
|
||||||
.pr_usrreqs = &rip6_usrreqs
|
.pr_usrreqs = &rip6_usrreqs
|
||||||
@ -272,7 +272,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_IPV6,
|
.pr_protocol = IPPROTO_IPV6,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap6_input,
|
.pr_input = encap6_input,
|
||||||
.pr_ctloutput = rip6_ctloutput,
|
.pr_ctloutput = rip6_ctloutput,
|
||||||
.pr_usrreqs = &rip6_usrreqs
|
.pr_usrreqs = &rip6_usrreqs
|
||||||
@ -281,7 +281,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_ETHERIP,
|
.pr_protocol = IPPROTO_ETHERIP,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap6_input,
|
.pr_input = encap6_input,
|
||||||
.pr_ctloutput = rip6_ctloutput,
|
.pr_ctloutput = rip6_ctloutput,
|
||||||
.pr_usrreqs = &rip6_usrreqs
|
.pr_usrreqs = &rip6_usrreqs
|
||||||
@ -290,7 +290,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_GRE,
|
.pr_protocol = IPPROTO_GRE,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap6_input,
|
.pr_input = encap6_input,
|
||||||
.pr_ctloutput = rip6_ctloutput,
|
.pr_ctloutput = rip6_ctloutput,
|
||||||
.pr_usrreqs = &rip6_usrreqs
|
.pr_usrreqs = &rip6_usrreqs
|
||||||
@ -299,7 +299,7 @@ struct protosw inet6sw[] = {
|
|||||||
.pr_type = SOCK_RAW,
|
.pr_type = SOCK_RAW,
|
||||||
.pr_domain = &inet6domain,
|
.pr_domain = &inet6domain,
|
||||||
.pr_protocol = IPPROTO_PIM,
|
.pr_protocol = IPPROTO_PIM,
|
||||||
.pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
||||||
.pr_input = encap6_input,
|
.pr_input = encap6_input,
|
||||||
.pr_ctloutput = rip6_ctloutput,
|
.pr_ctloutput = rip6_ctloutput,
|
||||||
.pr_usrreqs = &rip6_usrreqs
|
.pr_usrreqs = &rip6_usrreqs
|
||||||
|
@ -228,8 +228,6 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
|
|||||||
}
|
}
|
||||||
|
|
||||||
#ifdef INET
|
#ifdef INET
|
||||||
extern struct protosw inetsw[];
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* IPSEC_INPUT() method implementation for IPv4.
|
* IPSEC_INPUT() method implementation for IPv4.
|
||||||
* 0 - Permitted by inbound security policy for further processing.
|
* 0 - Permitted by inbound security policy for further processing.
|
||||||
@ -253,9 +251,21 @@ ipsec4_input(struct mbuf *m, int offset, int proto)
|
|||||||
* Protocols with further headers get their IPsec treatment
|
* Protocols with further headers get their IPsec treatment
|
||||||
* within the protocol specific processing.
|
* within the protocol specific processing.
|
||||||
*/
|
*/
|
||||||
if ((inetsw[ip_protox[proto]].pr_flags & PR_LASTHDR) == 0)
|
switch (proto) {
|
||||||
|
case IPPROTO_ICMP:
|
||||||
|
case IPPROTO_IGMP:
|
||||||
|
case IPPROTO_IPV4:
|
||||||
|
case IPPROTO_IPV6:
|
||||||
|
case IPPROTO_RSVP:
|
||||||
|
case IPPROTO_GRE:
|
||||||
|
case IPPROTO_MOBILE:
|
||||||
|
case IPPROTO_ETHERIP:
|
||||||
|
case IPPROTO_PIM:
|
||||||
|
case IPPROTO_SCTP:
|
||||||
|
break;
|
||||||
|
default:
|
||||||
return (0);
|
return (0);
|
||||||
/* FALLTHROUGH */
|
}
|
||||||
};
|
};
|
||||||
/*
|
/*
|
||||||
* Enforce IPsec policy checking if we are seeing last header.
|
* Enforce IPsec policy checking if we are seeing last header.
|
||||||
@ -501,6 +511,24 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
|
|||||||
#endif /* INET */
|
#endif /* INET */
|
||||||
|
|
||||||
#ifdef INET6
|
#ifdef INET6
|
||||||
|
static bool
|
||||||
|
ipsec6_lasthdr(int proto)
|
||||||
|
{
|
||||||
|
|
||||||
|
switch (proto) {
|
||||||
|
case IPPROTO_IPV4:
|
||||||
|
case IPPROTO_IPV6:
|
||||||
|
case IPPROTO_GRE:
|
||||||
|
case IPPROTO_ICMPV6:
|
||||||
|
case IPPROTO_ETHERIP:
|
||||||
|
case IPPROTO_PIM:
|
||||||
|
case IPPROTO_SCTP:
|
||||||
|
return (true);
|
||||||
|
default:
|
||||||
|
return (false);
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* IPSEC_INPUT() method implementation for IPv6.
|
* IPSEC_INPUT() method implementation for IPv6.
|
||||||
* 0 - Permitted by inbound security policy for further processing.
|
* 0 - Permitted by inbound security policy for further processing.
|
||||||
@ -524,7 +552,7 @@ ipsec6_input(struct mbuf *m, int offset, int proto)
|
|||||||
* Protocols with further headers get their IPsec treatment
|
* Protocols with further headers get their IPsec treatment
|
||||||
* within the protocol specific processing.
|
* within the protocol specific processing.
|
||||||
*/
|
*/
|
||||||
if ((inet6sw[ip6_protox[proto]].pr_flags & PR_LASTHDR) == 0)
|
if (!ipsec6_lasthdr(proto))
|
||||||
return (0);
|
return (0);
|
||||||
/* FALLTHROUGH */
|
/* FALLTHROUGH */
|
||||||
};
|
};
|
||||||
@ -728,8 +756,7 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
|
|||||||
* note that we do not visit this with protocols with pcb layer
|
* note that we do not visit this with protocols with pcb layer
|
||||||
* code - like udp/tcp/raw ip.
|
* code - like udp/tcp/raw ip.
|
||||||
*/
|
*/
|
||||||
if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
|
if (ipsec6_lasthdr(nxt) && ipsec6_in_reject(m, NULL)) {
|
||||||
ipsec6_in_reject(m, NULL)) {
|
|
||||||
error = EINVAL;
|
error = EINVAL;
|
||||||
goto bad;
|
goto bad;
|
||||||
}
|
}
|
||||||
|
@ -161,7 +161,7 @@ struct protosw {
|
|||||||
#define PR_WANTRCVD 0x08 /* want PRU_RCVD calls */
|
#define PR_WANTRCVD 0x08 /* want PRU_RCVD calls */
|
||||||
#define PR_RIGHTS 0x10 /* passes capabilities */
|
#define PR_RIGHTS 0x10 /* passes capabilities */
|
||||||
#define PR_IMPLOPCL 0x20 /* implied open/close */
|
#define PR_IMPLOPCL 0x20 /* implied open/close */
|
||||||
#define PR_LASTHDR 0x40 /* enforce ipsec policy; last header */
|
/* was PR_LASTHDR 0x40 enforce ipsec policy; last header */
|
||||||
#define PR_CAPATTACH 0x80 /* socket can attach in cap mode */
|
#define PR_CAPATTACH 0x80 /* socket can attach in cap mode */
|
||||||
#define PR_SOCKBUF 0x100 /* private implementation of buffers */
|
#define PR_SOCKBUF 0x100 /* private implementation of buffers */
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user