diff options
| author | Hajimu UMEMOTO <ume@FreeBSD.org> | 2004-02-19 14:57:22 +0000 |
|---|---|---|
| committer | Hajimu UMEMOTO <ume@FreeBSD.org> | 2004-02-19 14:57:22 +0000 |
| commit | 931282ced7fa4e04e7001626daa51f9df38a9d1d (patch) | |
| tree | 8cbe3ad7c2894c32b4cdbc288ebfdf621d5f988b /sys/netinet6/ip6_forward.c | |
| parent | 6babc58b2fd6e30d3b814d590a153beb8610bcbd (diff) | |
Notes
Diffstat (limited to 'sys/netinet6/ip6_forward.c')
| -rw-r--r-- | sys/netinet6/ip6_forward.c | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index 508e665d6ece..689404b61369 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -267,11 +267,20 @@ ip6_forward(m, srcrt) * ipsec esp/tunnel/xxx-xxx/require esp/transport//require; */ for (isr = sp->req; isr; isr = isr->next) { - if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) - goto skip_ipsec; + if (isr->saidx.mode == IPSEC_MODE_ANY) + goto doipsectunnel; + if (isr->saidx.mode == IPSEC_MODE_TUNNEL) + goto doipsectunnel; } /* + * if there's no need for tunnel mode IPsec, skip. + */ + if (!isr) + goto skip_ipsec; + + doipsectunnel: + /* * All the extension headers will become inaccessible * (since they can be encrypted). * Don't panic, we need no more updates to extension headers @@ -317,8 +326,17 @@ ip6_forward(m, srcrt) return; } + if (ip6 != mtod(m, struct ip6_hdr *)) { + /* + * now tunnel mode headers are added. we are originating + * packet instead of forwarding the packet. + */ + ip6_output(m, NULL, NULL, IPV6_FORWARDING/*XXX*/, NULL, NULL, + NULL); + goto freecopy; + } + /* adjust pointer */ - ip6 = mtod(m, struct ip6_hdr *); dst = (struct sockaddr_in6 *)state.dst; rt = state.ro ? state.ro->ro_rt : NULL; if (dst != NULL && rt != NULL) |