diff options
| author | George V. Neville-Neil <gnn@FreeBSD.org> | 2015-11-05 07:26:32 +0000 |
|---|---|---|
| committer | George V. Neville-Neil <gnn@FreeBSD.org> | 2015-11-05 07:26:32 +0000 |
| commit | 33872124a5cf92662deaf1ad6582ad29520dd897 (patch) | |
| tree | 4a9828d8f2729e8c87988a3078cdbed2e9ed90a8 /sys/netinet/ip_input.c | |
| parent | f4f73431bc893cea71b046d8c4eab378601dc09f (diff) | |
| download | src-test2-33872124a5cf92662deaf1ad6582ad29520dd897.tar.gz src-test2-33872124a5cf92662deaf1ad6582ad29520dd897.zip | |
Notes
Diffstat (limited to 'sys/netinet/ip_input.c')
| -rw-r--r-- | sys/netinet/ip_input.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index a4060800194e..4998b146cb66 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -79,6 +79,8 @@ __FBSDID("$FreeBSD$"); #include <netinet/ip_carp.h> #ifdef IPSEC #include <netinet/ip_ipsec.h> +#include <netipsec/ipsec.h> +#include <netipsec/key.h> #endif /* IPSEC */ #include <netinet/in_rss.h> @@ -500,12 +502,22 @@ tooshort: m_adj(m, ip_len - m->m_pkthdr.len); } + /* Try to forward the packet, but if we fail continue */ #ifdef IPSEC + /* For now we do not handle IPSEC in tryforward. */ + if (!key_havesp(IPSEC_DIR_INBOUND) && !key_havesp(IPSEC_DIR_OUTBOUND) && + (V_ipforwarding == 1)) + if (ip_tryforward(m) == NULL) + return; /* * Bypass packet filtering for packets previously handled by IPsec. */ if (ip_ipsec_filtertunnel(m)) goto passin; +#else + if (V_ipforwarding == 1) + if (ip_tryforward(m) == NULL) + return; #endif /* IPSEC */ /* |