When mode isn't explicitly specified (wildcard) and inner protocol isn't
IPv4 or IPv6, assume it is the transport mode. Reported by: jmg MFC after: 1 week Sponsored by: Yandex LLC
This commit is contained in:
parent
7fc89952f1
commit
1f194d8ae1
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=274193
@ -432,7 +432,7 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
|
||||
}
|
||||
#ifdef INET6
|
||||
/* IPv6-in-IP encapsulation. */
|
||||
if (prot == IPPROTO_IPV6 &&
|
||||
else if (prot == IPPROTO_IPV6 &&
|
||||
saidx->mode != IPSEC_MODE_TRANSPORT) {
|
||||
|
||||
if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
|
||||
@ -469,6 +469,15 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
|
||||
#endif /* notyet */
|
||||
}
|
||||
#endif /* INET6 */
|
||||
else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) {
|
||||
/*
|
||||
* When mode is wildcard, inner protocol is IPv6 and
|
||||
* we have no INET6 support - drop this packet a bit later.
|
||||
* In other cases we assume transport mode and outer
|
||||
* header was already stripped in xform_xxx_cb.
|
||||
*/
|
||||
prot = IPPROTO_IPIP;
|
||||
}
|
||||
|
||||
/*
|
||||
* Record what we've done to the packet (under what SA it was
|
||||
|
Loading…
Reference in New Issue
Block a user