mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-14 10:09:48 +00:00
Code Issues Releases Activity

Add the missing call to ip6_ipsec_filtertunnel() to be able to control

Browse Source 
whether decapsulated IPsec packets will be passed to pfil again depending
on the setting of the net.ip6.ipsec6.filtertunnel sysctl.

PR:		kern/157670
Submitted by:	Manuel Kasper (mk neon1.net)
MFC after:	2 weeks
This commit is contained in:
Bjoern A. Zeeb 2011-06-08 10:59:36 +00:00
parent 0b545d875b
commit 869052041d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=222856
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/netinet6/ip6_input.c
View File

@ -504,6 +504,13 @@ ip6_input(struct mbuf *m)
goto bad;
}
#endif
#ifdef IPSEC
/*
* Bypass packet filtering for packets previously handled by IPsec.
*/
if (ip6_ipsec_filtertunnel(m))
goto passin;
#endif /* IPSEC */
/*
* Run through list of hooks for input packets.