Author: ae
Date: Wed Nov 12 22:51:30 2014
New Revision: 274454
URL: https://svnweb.freebsd.org/changeset/base/274454
Log:
ipsec6_process_packet is called before ip6_output fixes ip6_plen.
Update ip6_plen before bpf processing to be able see correct value.
MFC after: 1 week
Sponsored by: Yandex LLC
Modified:
head/sys/netipsec/ipsec_output.c
Modified: head/sys/netipsec/ipsec_output.c
==============================================================================
--- head/sys/netipsec/ipsec_output.c Wed Nov 12 22:27:53 2014
(r274453)
+++ head/sys/netipsec/ipsec_output.c Wed Nov 12 22:51:30 2014
(r274454)
@@ -649,6 +649,8 @@ ipsec6_process_packet(
sav = isr->sav;
dst = &sav->sah->saidx.dst;
+ ip6 = mtod(m, struct ip6_hdr *);
+ ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
#ifdef DEV_ENC
if_inc_counter(encif, IFCOUNTER_OPACKETS, 1);
if_inc_counter(encif, IFCOUNTER_OBYTES, m->m_pkthdr.len);
@@ -660,8 +662,6 @@ ipsec6_process_packet(
goto bad;
#endif /* DEV_ENC */
- ip6 = mtod(m, struct ip6_hdr *); /* XXX */
-
/* Do the appropriate encapsulation, if necessary */
if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
dst->sa.sa_family != AF_INET6 || /* PF mismatch */
@@ -684,9 +684,6 @@ ipsec6_process_packet(
goto bad;
}
- ip6 = mtod(m, struct ip6_hdr *);
- ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
-
/* Encapsulate the packet */
error = ipip_output(m, isr, &mp, 0, 0);
if (mp == NULL && !error) {
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
