src/sys/netipsec/ipsec_input.c, branch release/7.0.0_cvs FreeBSD source tree This commit was manufactured by cvs2svn to create tag 2008-02-24T05:45:17+00:00 cvs2svn cvs2svn@FreeBSD.org 2008-02-24T05:45:17+00:00 a9c219fa3cec18ef9f30edec6fa106bf0e2d423d 'RELENG_7_0_0_RELEASE'. This commit was manufactured to restore the state of the 7.0-RELEASE image. 
'RELENG_7_0_0_RELEASE'.

This commit was manufactured to restore the state of the 7.0-RELEASE image.
Fix for an infinite loop in processing ESP, IPv6 packets. 2007-09-12T05:54:53+00:00 George V. Neville-Neil gnn@FreeBSD.org 2007-09-12T05:54:53+00:00 e61a9df52b49892676471f8ff40fe23e23f2c7e4 The control input routine passes a NULL as its void argument when it has reached the innermost header, which terminates the loop. Reported by: Pawel Worach <pawel.worach@gmail.com> Approved by: re 
The control input routine passes a NULL as its void argument when it
has reached the innermost header, which terminates the loop.

Reported by: Pawel Worach <pawel.worach@gmail.com>
Approved by: re
Replace hard coded options by their defined PFIL_{IN,OUT} names. 2007-07-19T09:57:54+00:00 Bjoern A. Zeeb bz@FreeBSD.org 2007-07-19T09:57:54+00:00 b28cd3345920b8820e47bf2da8b3964b01126a87 Approved by: re (hrs) 
Approved by:	re (hrs)
Looking at {ah,esp}_input_cb it seems we might be able to end up 2007-06-15T22:23:33+00:00 Bjoern A. Zeeb bz@FreeBSD.org 2007-06-15T22:23:33+00:00 0e41ce659bd87a83b65bedcd2a733a38e99db41b without an mtag in ipsec4_common_input_cb. So in case of !IPCOMP (AH,ESP) only change the m_tag_id if an mtag was passed to ipsec4_common_input_cb. Found with: Coverity Prevent(tm) CID: 2523 
without an mtag in ipsec4_common_input_cb.
So in case of !IPCOMP (AH,ESP) only change the m_tag_id if an mtag
was passed to ipsec4_common_input_cb.

Found with:	Coverity Prevent(tm)
CID:		2523
s,#,*, in a multi-line comment. This is C. 2007-06-15T21:34:12+00:00 Bjoern A. Zeeb bz@FreeBSD.org 2007-06-15T21:34:12+00:00 ceda1e7c3e0e4a540ff6881b7eee395a94b091a5 No functional change. 
No functional change.
Though we are only called for the three security protocols we can 2007-06-15T21:32:51+00:00 Bjoern A. Zeeb bz@FreeBSD.org 2007-06-15T21:32:51+00:00 f4760821dbe9934086f47ce9df51d43f2ca7d929 handle, document those sprotos using an IPSEC_ASSERT so that it will be clear that 'spi' will always be initialized when used the first time. Found with: Coverity Prevent(tm) CID: 2533 
handle, document those sprotos using an IPSEC_ASSERT so that it will
be clear that 'spi' will always be initialized when used the first time.

Found with:	Coverity Prevent(tm)
CID:		2533
s,#if INET6,#ifdef INET6, 2006-12-14T17:33:46+00:00 Bjoern A. Zeeb bz@FreeBSD.org 2006-12-14T17:33:46+00:00 224c45c4f2e2e95b514efe10668c9108b4ba81ce This unbreaks the build for FAST_IPSEC && !INET6 and was wrong anyway. Reported by: Dmitry Pryanishnikov <dmitry atlantis.dp.ua> 
This unbreaks the build for FAST_IPSEC && !INET6 and was wrong anyway.

Reported by:	Dmitry Pryanishnikov <dmitry atlantis.dp.ua>
MFp4: 92972, 98913 + one more change 2006-12-12T12:17:58+00:00 Bjoern A. Zeeb bz@FreeBSD.org 2006-12-12T12:17:58+00:00 1d54aa3ba94f4d9883b0746ce45123d5b5be773b In ip6_sprintf no longer use and return one of eight static buffers for printing/logging ipv6 addresses. The caller now has to hand in a sufficiently large buffer as first argument. 
In ip6_sprintf no longer use and return one of eight static buffers
for printing/logging ipv6 addresses.
The caller now has to hand in a sufficiently large buffer as first
argument.
Add a pseudo interface for packet filtering IPSec connections before or after 2006-06-26T22:30:08+00:00 Andrew Thompson thompsa@FreeBSD.org 2006-06-26T22:30:08+00:00 bdea400f3ba20dd0ffcaef20d68912f7041d9eeb encryption. There are two functions, a bpf tap which has a basic header with the SPI number which our current tcpdump knows how to display, and handoff to pfil(9) for packet filtering. Obtained from: OpenBSD Based on: kern/94829 No objections: arch, net MFC after: 1 month 
encryption. There are two functions, a bpf tap which has a basic header with
the SPI number which our current tcpdump knows how to display, and handoff to
pfil(9) for packet filtering.

Obtained from:	OpenBSD
Based on:	kern/94829
No objections:	arch, net
MFC after:	1 month
Change '#if INET' and '#if INET6' to '#ifdef INET' and '#ifdef INET6'. 2006-06-04T19:32:32+00:00 Pawel Jakub Dawidek pjd@FreeBSD.org 2006-06-04T19:32:32+00:00 49ddabdfce79924a090f5222943f8a2c13ce800f This unbreaks compiling a kernel with FAST_IPSEC and no INET6. 
This unbreaks compiling a kernel with FAST_IPSEC and no INET6.