From owner-svn-src-projects@freebsd.org Thu Dec 22 13:58:31 2016 Return-Path: Delivered-To: svn-src-projects@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 16005C8A73E for ; Thu, 22 Dec 2016 13:58:31 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E5124680; Thu, 22 Dec 2016 13:58:30 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uBMDwUrv064950; Thu, 22 Dec 2016 13:58:30 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uBMDwTvk064946; Thu, 22 Dec 2016 13:58:29 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201612221358.uBMDwTvk064946@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Thu, 22 Dec 2016 13:58:29 +0000 (UTC) To: src-committers@freebsd.org, svn-src-projects@freebsd.org Subject: svn commit: r310399 - projects/ipsec/sys/netinet X-SVN-Group: projects MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-projects@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "SVN commit messages for the src " projects" tree" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 13:58:31 -0000 Author: ae Date: Thu Dec 22 13:58:29 2016 New Revision: 310399 URL: https://svnweb.freebsd.org/changeset/base/310399 Log: Convert SCTP code to use IPsec methods. Modified: projects/ipsec/sys/netinet/sctp_input.c projects/ipsec/sys/netinet/sctp_os_bsd.h projects/ipsec/sys/netinet/sctp_pcb.c Modified: projects/ipsec/sys/netinet/sctp_input.c ============================================================================== --- projects/ipsec/sys/netinet/sctp_input.c Thu Dec 22 13:57:29 2016 (r310398) +++ projects/ipsec/sys/netinet/sctp_input.c Thu Dec 22 13:58:29 2016 (r310399) @@ -5771,7 +5771,7 @@ sctp_common_input_processing(struct mbuf } else if (stcb == NULL) { inp_decr = inp; } -#ifdef IPSEC +#if defined(IPSEC) || defined(IPSEC_SUPPORT) /*- * I very much doubt any of the IPSEC stuff will work but I have no * idea, so I will leave it in place. @@ -5780,17 +5780,23 @@ sctp_common_input_processing(struct mbuf switch (dst->sa_family) { #ifdef INET case AF_INET: - if (ipsec4_in_reject(m, &inp->ip_inp.inp)) { - SCTP_STAT_INCR(sctps_hdrops); - goto out; + if (IPSEC_ENABLED(ipv4)) { + if (IPSEC_CHECK_POLICY(ipv4, m, + &inp->ip_inp.inp) != 0) { + SCTP_STAT_INCR(sctps_hdrops); + goto out; + } } break; #endif #ifdef INET6 case AF_INET6: - if (ipsec6_in_reject(m, &inp->ip_inp.inp)) { - SCTP_STAT_INCR(sctps_hdrops); - goto out; + if (IPSEC_ENABLED(ipv6)) { + if (IPSEC_CHECK_POLICY(ipv6, m, + &inp->ip_inp.inp) != 0) { + SCTP_STAT_INCR(sctps_hdrops); + goto out; + } } break; #endif @@ -5798,7 +5804,7 @@ sctp_common_input_processing(struct mbuf break; } } -#endif +#endif /* IPSEC */ SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n", (void *)m, iphlen, offset, length, (void *)stcb); if (stcb) { Modified: projects/ipsec/sys/netinet/sctp_os_bsd.h ============================================================================== --- projects/ipsec/sys/netinet/sctp_os_bsd.h Thu Dec 22 13:57:29 2016 (r310398) +++ projects/ipsec/sys/netinet/sctp_os_bsd.h Thu Dec 22 13:58:29 2016 (r310399) @@ -82,16 +82,10 @@ __FBSDID("$FreeBSD$"); #include #include -#ifdef IPSEC -#include -#include -#endif /* IPSEC */ +#include #ifdef INET6 #include -#ifdef IPSEC -#include -#endif #include #include #include Modified: projects/ipsec/sys/netinet/sctp_pcb.c ============================================================================== --- projects/ipsec/sys/netinet/sctp_pcb.c Thu Dec 22 13:57:29 2016 (r310398) +++ projects/ipsec/sys/netinet/sctp_pcb.c Thu Dec 22 13:58:29 2016 (r310399) @@ -2459,7 +2459,7 @@ sctp_inpcb_alloc(struct socket *so, uint SCTP_INP_INFO_WUNLOCK(); return (ENOBUFS); } -#ifdef IPSEC +#if defined(IPSEC) || defined(IPSEC_SUPPORT) error = ipsec_init_pcbpolicy(&inp->ip_inp.inp); if (error != 0) { crfree(inp->ip_inp.inp.inp_cred); @@ -2494,7 +2494,7 @@ sctp_inpcb_alloc(struct socket *so, uint SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EOPNOTSUPP); so->so_pcb = NULL; crfree(inp->ip_inp.inp.inp_cred); -#ifdef IPSEC +#if defined(IPSEC) || defined(IPSEC_SUPPORT) ipsec_delete_pcbpolicy(&inp->ip_inp.inp); #endif SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp); @@ -2517,7 +2517,7 @@ sctp_inpcb_alloc(struct socket *so, uint SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS); so->so_pcb = NULL; crfree(inp->ip_inp.inp.inp_cred); -#ifdef IPSEC +#if defined(IPSEC) || defined(IPSEC_SUPPORT) ipsec_delete_pcbpolicy(&inp->ip_inp.inp); #endif SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp); @@ -3623,7 +3623,7 @@ sctp_inpcb_free(struct sctp_inpcb *inp, * macro here since le_next will get freed as part of the * sctp_free_assoc() call. */ -#ifdef IPSEC +#if defined(IPSEC) || defined(IPSEC_SUPPORT) ipsec_delete_pcbpolicy(ip_pcb); #endif if (ip_pcb->inp_options) {