svn commit: r309819 - projects/ipsec/sys/netipsec
Andrey V. Elsukov
ae at FreeBSD.org
Sat Dec 10 16:21:11 UTC 2016
Author: ae
Date: Sat Dec 10 16:21:09 2016
New Revision: 309819
URL: https://svnweb.freebsd.org/changeset/base/309819
Log:
Remove some disabled and unused code.
Modified:
projects/ipsec/sys/netipsec/ipsec_input.c
projects/ipsec/sys/netipsec/key.c
Modified: projects/ipsec/sys/netipsec/ipsec_input.c
==============================================================================
--- projects/ipsec/sys/netipsec/ipsec_input.c Sat Dec 10 16:20:39 2016 (r309818)
+++ projects/ipsec/sys/netipsec/ipsec_input.c Sat Dec 10 16:21:09 2016 (r309819)
@@ -306,11 +306,6 @@ ipsec4_common_input_cb(struct mbuf *m, s
struct m_tag *mtag;
struct ip *ip;
int error, prot, af, sproto, isr_prot;
-#ifdef INET6
-#ifdef notyet
- char ip6buf[IPSEC_ADDRSTRLEN];
-#endif
-#endif
IPSEC_ASSERT(sav != NULL, ("null SA"));
IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
@@ -360,7 +355,6 @@ ipsec4_common_input_cb(struct mbuf *m, s
/* IP-in-IP encapsulation */
if (prot == IPPROTO_IPIP &&
saidx->mode != IPSEC_MODE_TRANSPORT) {
-
if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
IPSEC_ISTAT(sproto, hdrops);
error = EINVAL;
@@ -368,40 +362,11 @@ ipsec4_common_input_cb(struct mbuf *m, s
}
/* enc0: strip outer IPv4 header */
m_striphdr(m, 0, ip->ip_hl << 2);
-
-#ifdef notyet
- /* XXX PROXY address isn't recorded in SAH */
- /*
- * Check that the inner source address is the same as
- * the proxy address, if available.
- */
- if ((saidx->proxy.sa.sa_family == AF_INET &&
- saidx->proxy.sin.sin_addr.s_addr !=
- INADDR_ANY &&
- ipn.ip_src.s_addr !=
- saidx->proxy.sin.sin_addr.s_addr) ||
- (saidx->proxy.sa.sa_family != AF_INET &&
- saidx->proxy.sa.sa_family != 0)) {
-
- DPRINTF(("%s: inner source address %s doesn't "
- "correspond to expected proxy source %s, "
- "SA %s/%08lx\n", __func__,
- inet_ntoa4(ipn.ip_src),
- ipsp_address(saidx->proxy),
- ipsp_address(saidx->dst),
- (u_long) ntohl(sav->spi)));
-
- IPSEC_ISTAT(sproto, pdrops);
- error = EACCES;
- goto bad;
- }
-#endif /* notyet */
}
#ifdef INET6
/* IPv6-in-IP encapsulation. */
else if (prot == IPPROTO_IPV6 &&
saidx->mode != IPSEC_MODE_TRANSPORT) {
-
if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
IPSEC_ISTAT(sproto, hdrops);
error = EINVAL;
@@ -409,31 +374,6 @@ ipsec4_common_input_cb(struct mbuf *m, s
}
/* enc0: strip IPv4 header, keep IPv6 header only */
m_striphdr(m, 0, ip->ip_hl << 2);
-#ifdef notyet
- /*
- * Check that the inner source address is the same as
- * the proxy address, if available.
- */
- if ((saidx->proxy.sa.sa_family == AF_INET6 &&
- !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
- !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
- &saidx->proxy.sin6.sin6_addr)) ||
- (saidx->proxy.sa.sa_family != AF_INET6 &&
- saidx->proxy.sa.sa_family != 0)) {
-
- DPRINTF(("%s: inner source address %s doesn't "
- "correspond to expected proxy source %s, "
- "SA %s/%08lx\n", __func__,
- ip6_sprintf(ip6buf, &ip6n.ip6_src),
- ipsec_address(&saidx->proxy),
- ipsec_address(&saidx->dst),
- (u_long) ntohl(sav->spi)));
-
- IPSEC_ISTAT(sproto, pdrops);
- error = EACCES;
- goto bad;
- }
-#endif /* notyet */
}
#endif /* INET6 */
else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) {
@@ -592,9 +532,6 @@ ipsec6_common_input_cb(struct mbuf *m, s
int nxt, isr_prot;
int error, nest;
uint8_t nxt8;
-#ifdef notyet
- char ip6buf[IPSEC_ADDRSTRLEN];
-#endif
IPSEC_ASSERT(sav != NULL, ("null SA"));
IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
@@ -641,31 +578,6 @@ ipsec6_common_input_cb(struct mbuf *m, s
/* ip6n will now contain the inner IPv6 header. */
m_striphdr(m, 0, skip);
skip = 0;
-#ifdef notyet
- /*
- * Check that the inner source address is the same as
- * the proxy address, if available.
- */
- if ((saidx->proxy.sa.sa_family == AF_INET6 &&
- !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
- !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
- &saidx->proxy.sin6.sin6_addr)) ||
- (saidx->proxy.sa.sa_family != AF_INET6 &&
- saidx->proxy.sa.sa_family != 0)) {
-
- DPRINTF(("%s: inner source address %s doesn't "
- "correspond to expected proxy source %s, "
- "SA %s/%08lx\n", __func__,
- ip6_sprintf(ip6buf, &ip6n.ip6_src),
- ipsec_address(&saidx->proxy),
- ipsec_address(&saidx->dst),
- (u_long) ntohl(sav->spi)));
-
- IPSEC_ISTAT(sproto, pdrops);
- error = EACCES;
- goto bad;
- }
-#endif /* notyet */
}
#ifdef INET
/* IP-in-IP encapsulation */
@@ -677,32 +589,8 @@ ipsec6_common_input_cb(struct mbuf *m, s
goto bad;
}
/* ipn will now contain the inner IPv4 header */
- m_striphdr(m, 0, skip);
+ m_striphdr(m, 0, skip);
skip = 0;
-#ifdef notyet
- /*
- * Check that the inner source address is the same as
- * the proxy address, if available.
- */
- if ((saidx->proxy.sa.sa_family == AF_INET &&
- saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
- ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
- (saidx->proxy.sa.sa_family != AF_INET &&
- saidx->proxy.sa.sa_family != 0)) {
-
- DPRINTF(("%s: inner source address %s doesn't "
- "correspond to expected proxy source %s, "
- "SA %s/%08lx\n", __func__,
- inet_ntoa4(ipn.ip_src),
- ipsec_address(&saidx->proxy),
- ipsec_address(&saidx->dst),
- (u_long) ntohl(sav->spi)));
-
- IPSEC_ISTAT(sproto, pdrops);
- error = EACCES;
- goto bad;
- }
-#endif /* notyet */
}
#endif /* INET */
else {
Modified: projects/ipsec/sys/netipsec/key.c
==============================================================================
--- projects/ipsec/sys/netipsec/key.c Sat Dec 10 16:20:39 2016 (r309818)
+++ projects/ipsec/sys/netipsec/key.c Sat Dec 10 16:21:09 2016 (r309819)
@@ -560,13 +560,9 @@ static uint8_t key_proto2satype(uint8_t)
static int key_getspi(struct socket *, struct mbuf *,
const struct sadb_msghdr *);
-static u_int32_t key_do_getnewspi(struct sadb_spirange *,
- struct secasindex *);
+static uint32_t key_do_getnewspi(struct sadb_spirange *, struct secasindex *);
static int key_update(struct socket *, struct mbuf *,
const struct sadb_msghdr *);
-#ifdef IPSEC_DOSEQCHECK
-static struct secasvar *key_getsavbyseq(struct secashead *, u_int32_t);
-#endif
static int key_add(struct socket *, struct mbuf *,
const struct sadb_msghdr *);
static int key_setident(struct secashead *, const struct sadb_msghdr *);
@@ -610,11 +606,6 @@ static struct mbuf *key_setlifetime(stru
u_int16_t exttype);
static struct mbuf *key_setkey(struct seckey *src, u_int16_t exttype);
-#if 0
-static const char *key_getfqdn(void);
-static const char *key_getuserfqdn(void);
-#endif
-
#define DBG_IPSEC_INITREF(t, p) do { \
refcount_init(&(p)->refcnt, 1); \
KEYDBG(KEY_STAMP, \
More information about the svn-src-projects
mailing list