Author: ae
Date: Thu Nov 6 20:23:57 2014
New Revision: 274193
URL: https://svnweb.freebsd.org/changeset/base/274193
Log:
When mode isn't explicitly specified (wildcard) and inner protocol isn't
IPv4 or IPv6, assume it is the transport mode.
Reported by: jmg
MFC after: 1 week
Sponsored by: Yandex LLC
Modified:
head/sys/netipsec/ipsec_input.c
Modified: head/sys/netipsec/ipsec_input.c
==============================================================================
--- head/sys/netipsec/ipsec_input.c Thu Nov 6 19:28:01 2014
(r274192)
+++ head/sys/netipsec/ipsec_input.c Thu Nov 6 20:23:57 2014
(r274193)
@@ -432,7 +432,7 @@ ipsec4_common_input_cb(struct mbuf *m, s
}
#ifdef INET6
/* IPv6-in-IP encapsulation. */
- if (prot == IPPROTO_IPV6 &&
+ else if (prot == IPPROTO_IPV6 &&
saidx->mode != IPSEC_MODE_TRANSPORT) {
if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
@@ -469,6 +469,15 @@ ipsec4_common_input_cb(struct mbuf *m, s
#endif /* notyet */
}
#endif /* INET6 */
+ else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) {
+ /*
+ * When mode is wildcard, inner protocol is IPv6 and
+ * we have no INET6 support - drop this packet a bit later.
+ * In other cases we assume transport mode and outer
+ * header was already stripped in xform_xxx_cb.
+ */
+ prot = IPPROTO_IPIP;
+ }
/*
* Record what we've done to the packet (under what SA it was
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
