* IPSEC_INPUT() method implementation for IPv6. * 0 - Permitted by inbound security policy for further processing. * EACCES - Forbidden by inbound security policy. * EINPROGRESS - consumed by IPsec. */
| 451 | * EINPROGRESS - consumed by IPsec. |
| 452 | */ |
| 453 | int |
| 454 | ipsec6_input(struct mbuf *m, int offset, int proto) |
| 455 | { |
| 456 | |
| 457 | switch (proto) { |
| 458 | case IPPROTO_AH: |
| 459 | case IPPROTO_ESP: |
| 460 | case IPPROTO_IPCOMP: |
| 461 | /* Do inbound IPsec processing for AH/ESP/IPCOMP */ |
| 462 | ipsec_common_input(m, offset, |
| 463 | offsetof(struct ip6_hdr, ip6_nxt), AF_INET6, proto); |
| 464 | return (EINPROGRESS); /* mbuf consumed by IPsec */ |
| 465 | default: |
| 466 | /* |
| 467 | * Protocols with further headers get their IPsec treatment |
| 468 | * within the protocol specific processing. |
| 469 | */ |
| 470 | if ((inet6sw[ip6_protox[proto]].pr_flags & PR_LASTHDR) == 0) |
| 471 | return (0); |
| 472 | /* FALLTHROUGH */ |
| 473 | }; |
| 474 | /* |
| 475 | * Enforce IPsec policy checking if we are seeing last header. |
| 476 | */ |
| 477 | if (ipsec6_in_reject(m, NULL) != 0) { |
| 478 | /* Forbidden by inbound security policy */ |
| 479 | m_freem(m); |
| 480 | return (EACCES); |
| 481 | } |
| 482 | return (0); |
| 483 | } |
| 484 | |
| 485 | /* |
| 486 | * IPsec input callback, called by the transform callback. Takes care of |
nothing calls this directly
no test coverage detected