svn commit: r231216 - in stable/8/sys: netinet netinet6

[Bjoern A. Zeeb]

Author: bz
Date: Wed Feb  8 17:54:02 2012
New Revision: 231216
URL: http://svn.freebsd.org/changeset/base/231216

Log:
  MFC r222845:
  
   Correct comments and debug logging in ipsec to better match reality.

Modified:
  stable/8/sys/netinet/ip_input.c
  stable/8/sys/netinet/ip_ipsec.c
  stable/8/sys/netinet6/ip6_ipsec.c
Directory Properties:
  stable/8/sys/   (props changed)

Modified: stable/8/sys/netinet/ip_input.c
==============================================================================
--- stable/8/sys/netinet/ip_input.c	Wed Feb  8 17:03:30 2012	(r231215)
+++ stable/8/sys/netinet/ip_input.c	Wed Feb  8 17:54:02 2012	(r231216)
@@ -510,7 +510,7 @@ tooshort:
 	}
 #ifdef IPSEC
 	/*
-	 * Bypass packet filtering for packets from a tunnel (gif).
+	 * Bypass packet filtering for packets previously handled by IPsec.
 	 */
 	if (ip_ipsec_filtertunnel(m))
 		goto passin;

Modified: stable/8/sys/netinet/ip_ipsec.c
==============================================================================
--- stable/8/sys/netinet/ip_ipsec.c	Wed Feb  8 17:03:30 2012	(r231215)
+++ stable/8/sys/netinet/ip_ipsec.c	Wed Feb  8 17:54:02 2012	(r231216)
@@ -95,7 +95,7 @@ ip_ipsec_filtertunnel(struct mbuf *m)
 #if defined(IPSEC)
 
 	/*
-	 * Bypass packet filtering for packets from a tunnel.
+	 * Bypass packet filtering for packets previously handled by IPsec.
 	 */
 	if (!V_ip4_ipsec_filtertunnel &&
 	    m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)

Modified: stable/8/sys/netinet6/ip6_ipsec.c
==============================================================================
--- stable/8/sys/netinet6/ip6_ipsec.c	Wed Feb  8 17:03:30 2012	(r231215)
+++ stable/8/sys/netinet6/ip6_ipsec.c	Wed Feb  8 17:54:02 2012	(r231216)
@@ -95,7 +95,7 @@ SYSCTL_VNET_INT(_net_inet6_ipsec6, OID_A
 
 /*
  * Check if we have to jump over firewall processing for this packet.
- * Called from ip_input().
+ * Called from ip6_input().
  * 1 = jump over firewall, 0 = packet goes through firewall.
  */
 int
@@ -104,7 +104,7 @@ ip6_ipsec_filtertunnel(struct mbuf *m)
 #if defined(IPSEC)
 
 	/*
-	 * Bypass packet filtering for packets from a tunnel.
+	 * Bypass packet filtering for packets previously handled by IPsec.
 	 */
 	if (!V_ip6_ipsec6_filtertunnel &&
 	    m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
@@ -116,7 +116,7 @@ ip6_ipsec_filtertunnel(struct mbuf *m)
 /*
  * Check if this packet has an active SA and needs to be dropped instead
  * of forwarded.
- * Called from ip_input().
+ * Called from ip6_input().
  * 1 = drop packet, 0 = forward packet.
  */
 int
@@ -139,7 +139,7 @@ ip6_ipsec_fwd(struct mbuf *m)
 	if (sp == NULL) {	/* NB: can happen if error */
 		splx(s);
 		/*XXX error stat???*/
-		DPRINTF(("ip_input: no SP for forwarding\n"));	/*XXX*/
+		DPRINTF(("%s: no SP for forwarding\n", __func__));	/*XXX*/
 		return 1;
 	}
 
@@ -161,7 +161,7 @@ ip6_ipsec_fwd(struct mbuf *m)
  * Check if protocol type doesn't have a further header and do IPSEC
  * decryption or reject right now.  Protocols with further headers get
  * their IPSEC treatment within the protocol specific processing.
- * Called from ip_input().
+ * Called from ip6_input().
  * 1 = drop packet, 0 = continue processing packet.
  */
 int
@@ -204,7 +204,7 @@ ip6_ipsec_input(struct mbuf *m, int nxt)
 		} else {
 			/* XXX error stat??? */
 			error = EINVAL;
-			DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/
+			DPRINTF(("%s: no SP, packet discarded\n", __func__));/*XXX*/
 			return 1;
 		}
 		splx(s);