svn commit: r231217 - in stable/7/sys: netinet netinet6

Bjoern A. Zeeb bz at FreeBSD.org
Wed Feb 8 17:54:12 UTC 2012


Author: bz
Date: Wed Feb  8 17:54:11 2012
New Revision: 231217
URL: http://svn.freebsd.org/changeset/base/231217

Log:
  MFC r222845:
  
   Correct comments and debug logging in ipsec to better match reality.

Modified:
  stable/7/sys/netinet/ip_input.c
  stable/7/sys/netinet/ip_ipsec.c
  stable/7/sys/netinet6/ip6_ipsec.c
Directory Properties:
  stable/7/sys/   (props changed)

Modified: stable/7/sys/netinet/ip_input.c
==============================================================================
--- stable/7/sys/netinet/ip_input.c	Wed Feb  8 17:54:02 2012	(r231216)
+++ stable/7/sys/netinet/ip_input.c	Wed Feb  8 17:54:11 2012	(r231217)
@@ -393,7 +393,7 @@ tooshort:
 	}
 #ifdef IPSEC
 	/*
-	 * Bypass packet filtering for packets from a tunnel (gif).
+	 * Bypass packet filtering for packets previously handled by IPsec.
 	 */
 	if (ip_ipsec_filtertunnel(m))
 		goto passin;

Modified: stable/7/sys/netinet/ip_ipsec.c
==============================================================================
--- stable/7/sys/netinet/ip_ipsec.c	Wed Feb  8 17:54:02 2012	(r231216)
+++ stable/7/sys/netinet/ip_ipsec.c	Wed Feb  8 17:54:11 2012	(r231217)
@@ -75,7 +75,7 @@ ip_ipsec_filtertunnel(struct mbuf *m)
 {
 #if defined(IPSEC) && !defined(IPSEC_FILTERTUNNEL)
 	/*
-	 * Bypass packet filtering for packets from a tunnel.
+	 * Bypass packet filtering for packets previously handled by IPsec.
 	 */
 	if (m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
 		return 1;

Modified: stable/7/sys/netinet6/ip6_ipsec.c
==============================================================================
--- stable/7/sys/netinet6/ip6_ipsec.c	Wed Feb  8 17:54:02 2012	(r231216)
+++ stable/7/sys/netinet6/ip6_ipsec.c	Wed Feb  8 17:54:11 2012	(r231217)
@@ -75,7 +75,7 @@ extern	struct protosw inet6sw[];
 
 /*
  * Check if we have to jump over firewall processing for this packet.
- * Called from ip_input().
+ * Called from ip6_input().
  * 1 = jump over firewall, 0 = packet goes through firewall.
  */
 int
@@ -83,7 +83,7 @@ ip6_ipsec_filtertunnel(struct mbuf *m)
 {
 #if defined(IPSEC) && !defined(IPSEC_FILTERTUNNEL)
 	/*
-	 * Bypass packet filtering for packets from a tunnel.
+	 * Bypass packet filtering for packets previously handled by IPsec.
 	 */
 	if (m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL)
 		return 1;
@@ -94,7 +94,7 @@ ip6_ipsec_filtertunnel(struct mbuf *m)
 /*
  * Check if this packet has an active SA and needs to be dropped instead
  * of forwarded.
- * Called from ip_input().
+ * Called from ip6_input().
  * 1 = drop packet, 0 = forward packet.
  */
 int
@@ -117,7 +117,7 @@ ip6_ipsec_fwd(struct mbuf *m)
 	if (sp == NULL) {	/* NB: can happen if error */
 		splx(s);
 		/*XXX error stat???*/
-		DPRINTF(("ip_input: no SP for forwarding\n"));	/*XXX*/
+		DPRINTF(("%s: no SP for forwarding\n", __func__));	/*XXX*/
 		return 1;
 	}
 
@@ -139,7 +139,7 @@ ip6_ipsec_fwd(struct mbuf *m)
  * Check if protocol type doesn't have a further header and do IPSEC
  * decryption or reject right now.  Protocols with further headers get
  * their IPSEC treatment within the protocol specific processing.
- * Called from ip_input().
+ * Called from ip6_input().
  * 1 = drop packet, 0 = continue processing packet.
  */
 int
@@ -182,7 +182,7 @@ ip6_ipsec_input(struct mbuf *m, int nxt)
 		} else {
 			/* XXX error stat??? */
 			error = EINVAL;
-			DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/
+			DPRINTF(("%s: no SP, packet discarded\n", __func__));/*XXX*/
 			return 1;
 		}
 		splx(s);


More information about the svn-src-all mailing list