svn commit: r274794 - stable/10/sys/netipsec

[Andrey V. Elsukov]

Author: ae
Date: Fri Nov 21 15:21:39 2014
New Revision: 274794
URL: https://svnweb.freebsd.org/changeset/base/274794

Log:
  MFC r274230:
    Pass mbuf to pfil processing before stripping outer IP header as it
    is described in if_enc(4).

Modified:
  stable/10/sys/netipsec/ipsec_input.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netipsec/ipsec_input.c
==============================================================================
--- stable/10/sys/netipsec/ipsec_input.c	Fri Nov 21 14:57:24 2014	(r274793)
+++ stable/10/sys/netipsec/ipsec_input.c	Fri Nov 21 15:21:39 2014	(r274794)
@@ -353,15 +353,10 @@ ipsec4_common_input_cb(struct mbuf *m, s
 	encif->if_ipackets++;
 	encif->if_ibytes += m->m_pkthdr.len;
 
-	/*
-	 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
-	 * packet later after it has been decapsulated.
-	 */
+	/* Pass the mbuf to enc0 for bpf and pfil. */
 	ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
-
-	if (prot != IPPROTO_IPIP)
-		if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
-			return (error);
+	if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
+		return (error);
 #endif /* DEV_ENC */
 
 	/* IP-in-IP encapsulation */
@@ -657,16 +652,10 @@ ipsec6_common_input_cb(struct mbuf *m, s
 	encif->if_ipackets++;
 	encif->if_ibytes += m->m_pkthdr.len;
 
-	/*
-	 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
-	 * packet later after it has been decapsulated.
-	 */
+	/* Pass the mbuf to enc0 for bpf and pfil. */
 	ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
-
-	/* XXX-BZ does not make sense. */
-	if (prot != IPPROTO_IPIP)
-		if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
-			return (error);
+	if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
+		return (error);
 #endif /* DEV_ENC */
 
 	/* IPv6-in-IP encapsulation */