* IPSEC_INPUT() method implementation for IPv4. * 0 - Permitted by inbound security policy for further processing. * EACCES - Forbidden by inbound security policy. * EINPROGRESS - consumed by IPsec. */
| 235 | * EINPROGRESS - consumed by IPsec. |
| 236 | */ |
| 237 | int |
| 238 | ipsec4_input(struct mbuf *m, int offset, int proto) |
| 239 | { |
| 240 | |
| 241 | switch (proto) { |
| 242 | case IPPROTO_AH: |
| 243 | case IPPROTO_ESP: |
| 244 | case IPPROTO_IPCOMP: |
| 245 | /* Do inbound IPsec processing for AH/ESP/IPCOMP */ |
| 246 | ipsec_common_input(m, offset, |
| 247 | offsetof(struct ip, ip_p), AF_INET, proto); |
| 248 | return (EINPROGRESS); /* mbuf consumed by IPsec */ |
| 249 | default: |
| 250 | /* |
| 251 | * Protocols with further headers get their IPsec treatment |
| 252 | * within the protocol specific processing. |
| 253 | */ |
| 254 | if ((inetsw[ip_protox[proto]].pr_flags & PR_LASTHDR) == 0) |
| 255 | return (0); |
| 256 | /* FALLTHROUGH */ |
| 257 | }; |
| 258 | /* |
| 259 | * Enforce IPsec policy checking if we are seeing last header. |
| 260 | */ |
| 261 | if (ipsec4_in_reject(m, NULL) != 0) { |
| 262 | /* Forbidden by inbound security policy */ |
| 263 | m_freem(m); |
| 264 | return (EACCES); |
| 265 | } |
| 266 | return (0); |
| 267 | } |
| 268 | |
| 269 | /* |
| 270 | * IPsec input callback for INET protocols. |
nothing calls this directly
no test coverage detected