Attachment 161220 Details for Bug 201876 – Proposed patch (untested)

[patch] Proposed patch (untested)

ipsec.diff (text/plain), 3.40 KB, created by Andrey V. Elsukov on 2015-09-21 03:40:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrey V. Elsukov

Created: 2015-09-21 03:40:40 UTC

Size: 3.40 KB

patch

obsolete

>Index: netinet/ip_ipsec.c
>===================================================================
>--- netinet/ip_ipsec.c	(revision 288047)
>+++ netinet/ip_ipsec.c	(working copy)
>@@ -199,9 +199,7 @@ ip_ipsec_output(struct mbuf **m, struct inpcb *inp
> 
> 		/* NB: callee frees mbuf */
> 		*error = ipsec4_process_packet(*m, sp->req);
>-		/* Release SP if an error occured */
>-		if (*error != 0)
>-			KEY_FREESP(&sp);
>+		KEY_FREESP(&sp);
> 		if (*error == EJUSTRETURN) {
> 			/*
> 			 * We had a SP with a level of 'use' and no SA. We
>Index: netinet6/ip6_ipsec.c
>===================================================================
>--- netinet6/ip6_ipsec.c	(revision 288047)
>+++ netinet6/ip6_ipsec.c	(working copy)
>@@ -200,9 +200,7 @@ ip6_ipsec_output(struct mbuf **m, struct inpcb *in
> 
> 		/* NB: callee frees mbuf */
> 		*error = ipsec6_process_packet(*m, sp->req);
>-		/* Release SP if an error occured */
>-		if (*error != 0)
>-			KEY_FREESP(&sp);
>+		KEY_FREESP(&sp);
> 		if (*error == EJUSTRETURN) {
> 			/*
> 			 * We had a SP with a level of 'use' and no SA. We
>Index: netipsec/ipsec_output.c
>===================================================================
>--- netipsec/ipsec_output.c	(revision 288047)
>+++ netipsec/ipsec_output.c	(working copy)
>@@ -166,10 +166,6 @@ ipsec_process_done(struct mbuf *m, struct ipsecreq
> 	 * If this is a problem we'll need to introduce a queue
> 	 * to set the packet on so we can unwind the stack before
> 	 * doing further processing.
>-	 *
>-	 * If ipsec[46]_process_packet() will successfully queue
>-	 * the request, we need to take additional reference to SP,
>-	 * because xform callback will release reference.
> 	 */
> 	if (isr->next) {
> 		/* XXX-BZ currently only support same AF bundles. */
>@@ -179,8 +175,7 @@ ipsec_process_done(struct mbuf *m, struct ipsecreq
> 			IPSECSTAT_INC(ips_out_bundlesa);
> 			key_addref(isr->sp);
> 			error = ipsec4_process_packet(m, isr->next);
>-			if (error != 0)
>-				KEY_FREESP(&isr->sp);
>+			KEY_FREESP(&isr->sp);
> 			return (error);
> 			/* NOTREACHED */
> #endif
>@@ -191,8 +186,7 @@ ipsec_process_done(struct mbuf *m, struct ipsecreq
> 			IPSEC6STAT_INC(ips_out_bundlesa);
> 			key_addref(isr->sp);
> 			error = ipsec6_process_packet(m, isr->next);
>-			if (error != 0)
>-				KEY_FREESP(&isr->sp);
>+			KEY_FREESP(&isr->sp);
> 			return (error);
> 			/* NOTREACHED */
> #endif /* INET6 */
>Index: netipsec/xform_ah.c
>===================================================================
>--- netipsec/xform_ah.c	(revision 288047)
>+++ netipsec/xform_ah.c	(working copy)
>@@ -1068,6 +1068,7 @@ ah_output(struct mbuf *m, struct ipsecrequest *isr
> 	crp->crp_opaque = (caddr_t) tc;
> 
> 	/* These are passed as-is to the callback. */
>+	key_addref(isr->sp);
> 	tc->tc_isr = isr;
> 	KEY_ADDREFSA(sav);
> 	tc->tc_sav = sav;
>Index: netipsec/xform_esp.c
>===================================================================
>--- netipsec/xform_esp.c	(revision 288047)
>+++ netipsec/xform_esp.c	(working copy)
>@@ -874,6 +874,7 @@ esp_output(struct mbuf *m, struct ipsecrequest *is
> 	}
> 
> 	/* Callback parameters */
>+	key_addref(isr->sp);
> 	tc->tc_isr = isr;
> 	KEY_ADDREFSA(sav);
> 	tc->tc_sav = sav;
>Index: netipsec/xform_ipcomp.c
>===================================================================
>--- netipsec/xform_ipcomp.c	(revision 288047)
>+++ netipsec/xform_ipcomp.c	(working copy)
>@@ -449,6 +449,7 @@ ipcomp_output(struct mbuf *m, struct ipsecrequest
> 		goto bad;
> 	}
> 
>+	key_addref(isr->sp);
> 	tc->tc_isr = isr;
> 	KEY_ADDREFSA(sav);
> 	tc->tc_sav = sav;

Actions: View | Diff

Attachments on bug 201876: 161220 | 161221