From 654205592319e75563e57a6262ca44fece0d13c6 Mon Sep 17 00:00:00 2001 From: Reyk Floeter Date: Thu, 1 Jul 2010 02:09:46 +0000 Subject: Allow to specify an alternative enc(4) interface for an SA. All traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@ --- sys/netinet/ip_ah.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sys/netinet/ip_ah.c') diff --git a/sys/netinet/ip_ah.c b/sys/netinet/ip_ah.c index 9e30a8cd6ef..caa6d66ce5a 100644 --- a/sys/netinet/ip_ah.c +++ b/sys/netinet/ip_ah.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_ah.c,v 1.94 2010/06/29 21:28:37 reyk Exp $ */ +/* $OpenBSD: ip_ah.c,v 1.95 2010/07/01 02:09:45 reyk Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), * Angelos D. Keromytis (kermit@csd.uch.gr) and @@ -986,7 +986,7 @@ ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip, #if NBPFILTER > 0 struct ifnet *encif; - if ((encif = enc_getif(0)) != NULL) { + if ((encif = enc_getif(0, tdb->tdb_tap)) != NULL) { encif->if_opackets++; encif->if_obytes += m->m_pkthdr.len; -- cgit v1.2.3