From owner-svn-src-user@FreeBSD.ORG  Sat Oct 27 21:03:29 2012
Return-Path: <owner-svn-src-user@FreeBSD.ORG>
Delivered-To: svn-src-user@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id EDAE5931;
 Sat, 27 Oct 2012 21:03:29 +0000 (UTC)
 (envelope-from andre@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
 by mx1.freebsd.org (Postfix) with ESMTP id BB9EC8FC16;
 Sat, 27 Oct 2012 21:03:29 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
 by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q9RL3TeS058268;
 Sat, 27 Oct 2012 21:03:29 GMT (envelope-from andre@svn.freebsd.org)
Received: (from andre@localhost)
 by svn.freebsd.org (8.14.4/8.14.4/Submit) id q9RL3TbK058266;
 Sat, 27 Oct 2012 21:03:29 GMT (envelope-from andre@svn.freebsd.org)
Message-Id: <201210272103.q9RL3TbK058266@svn.freebsd.org>
From: Andre Oppermann <andre@FreeBSD.org>
Date: Sat, 27 Oct 2012 21:03:29 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-user@freebsd.org
Subject: svn commit: r242190 - user/andre/tcp_workqueue/sys/netipsec
X-SVN-Group: user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-user@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "SVN commit messages for the experimental &quot; user&quot;
 src tree" <svn-src-user.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-user>,
 <mailto:svn-src-user-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-user>
List-Post: <mailto:svn-src-user@freebsd.org>
List-Help: <mailto:svn-src-user-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-user>,
 <mailto:svn-src-user-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 27 Oct 2012 21:03:30 -0000

Author: andre
Date: Sat Oct 27 21:03:29 2012
New Revision: 242190
URL: http://svn.freebsd.org/changeset/base/242190

Log:
  Add ASCII art to ipsec pfil description for better overview.

Modified:
  user/andre/tcp_workqueue/sys/netipsec/ipsec_pfil.c

Modified: user/andre/tcp_workqueue/sys/netipsec/ipsec_pfil.c
==============================================================================
--- user/andre/tcp_workqueue/sys/netipsec/ipsec_pfil.c	Sat Oct 27 20:17:59 2012	(r242189)
+++ user/andre/tcp_workqueue/sys/netipsec/ipsec_pfil.c	Sat Oct 27 21:03:29 2012	(r242190)
@@ -94,6 +94,41 @@ extern	struct protosw inetsw[];
  *     tunnel have to be made.
  *     This should be represented as virtual interfaces in the kernel.
  *
+ *
+ *      +   +--------------------------------------+ip_enqueue()
+ *      |   |                                             ^
+ *      v   v                                             |
+ *    ip_input()                                          |
+ *        +                                               |
+ *        |                                               |
+ *        v                                               |
+ *  pfil_run_hooks()+---+                                 |
+ *                      |                                 |
+ *                      v                                 |
+ *               ipsec_pfil_run()+------>AH|ESP?          |
+ *                      +                 +  +            |
+ *                      |              no |  | yes        |
+ *                      |     policy?<----+  |            |
+ *                      |      +  +          |            |
+ *                      |   no |  | yes      |            |
+ *                      |<-----+  |          v            |
+ *                      |         |    verify/decrypt     |
+ *                      |         |   no +   +            |
+ *                      |         X------+   |            |
+ *                      |        drop        v            |
+ *                      |                 next_hdr        |
+ *                      |                   +  +          |
+ *                      |             other |  | ip       +
+ *                      |<------------------+  +------>find_if()
+ *                      |
+ *                      v
+ *                next_pfil_hook()
+ *        v             +
+ *        |             |
+ *        |<------------+
+ *        |
+ *        v
+ *
  * Next steps:
  *  - Implement 1 in a pfil hook to block non-encrypted packets.
  *  - Implement 2 in a pfil hook to in-path transform transport mode packets.