d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Since PFIL can change mbuf pointer, we should update pointers after

Browse Source 
calling ipsec_filter().

Sponsored by:	Yandex LLC
This commit is contained in:
Andrey V. Elsukov 2015-04-28 09:29:28 +00:00
parent 9bc3222765
commit 574fde00be
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=282132
2 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/netipsec/ipsec_input.c
View File

@ -391,6 +391,7 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
return (error);
ip = mtod(m, struct ip *);
#endif /* DEV_ENC */
/* IP-in-IP encapsulation */

2
sys/netipsec/ipsec_output.c
View File

@ -578,6 +578,7 @@ ipsec4_process_packet(struct mbuf *m, struct ipsecrequest *isr)
/* pass the mbuf to enc0 for packet filtering */
if ((error = ipsec_filter(&m, PFIL_OUT, ENC_OUT|ENC_BEFORE)) != 0)
goto bad;
ip = mtod(m, struct ip *);
#endif
/* Do the appropriate encapsulation, if necessary */
if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
@ -699,6 +700,7 @@ ipsec6_process_packet(struct mbuf *m, struct ipsecrequest *isr)
/* pass the mbuf to enc0 for packet filtering */
if ((error = ipsec_filter(&m, PFIL_OUT, ENC_OUT|ENC_BEFORE)) != 0)
goto bad;
ip6 = mtod(m, struct ip6_hdr *);
#endif /* DEV_ENC */
/* Do the appropriate encapsulation, if necessary */