Date: Wed, 7 Dec 2016 09:40:06 +0000 (UTC) From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: src-committers@freebsd.org, svn-src-projects@freebsd.org Subject: svn commit: r309672 - projects/ipsec/sys/netipsec Message-ID: <201612070940.uB79e6dx081288@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ae Date: Wed Dec 7 09:40:06 2016 New Revision: 309672 URL: https://svnweb.freebsd.org/changeset/base/309672 Log: Convert TCP header fields into network byte order only if we have SA. Modified: projects/ipsec/sys/netipsec/xform_tcp.c Modified: projects/ipsec/sys/netipsec/xform_tcp.c ============================================================================== --- projects/ipsec/sys/netipsec/xform_tcp.c Wed Dec 7 09:36:08 2016 (r309671) +++ projects/ipsec/sys/netipsec/xform_tcp.c Wed Dec 7 09:40:06 2016 (r309672) @@ -239,24 +239,23 @@ tcp_ipsec_input(struct mbuf *m, struct t struct secasindex saidx; struct secasvar *sav; - /* - * tcp_input() operates with TCP header fields in host - * byte order. We expect them in network byte order. - */ - tcp_fields_to_net(th); ipsec_setsockaddrs(m, &saidx.src, &saidx.dst); saidx.proto = IPPROTO_TCP; saidx.mode = IPSEC_MODE_TCPMD5; saidx.reqid = 0; sav = key_allocsa_tcpmd5(&saidx); if (sav == NULL) { - tcp_fields_to_host(th); KMOD_TCPSTAT_INC(tcps_sig_err_buildsig); return (EACCES); } + /* + * tcp_input() operates with TCP header fields in host + * byte order. We expect them in network byte order. + */ + tcp_fields_to_net(th); tcp_signature_compute(m, th, sav, tmpdigest); - key_freesav(&sav); tcp_fields_to_host(th); + key_freesav(&sav); if (bcmp(buf, tmpdigest, TCP_SIGLEN) != 0) { KMOD_TCPSTAT_INC(tcps_sig_rcvbadsig); return (EACCES);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201612070940.uB79e6dx081288>