Add support for dummy ESP packets with next header field equal to
IPPROTO_NONE. According to RFC4303 2.6 they should be silently dropped. Submitted by: aurelien.cazuc.external_stormshield.eu MFC after: 10 days Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D22557
This commit is contained in:
parent
1861313623
commit
3f44ee8e99
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=355129
@ -614,6 +614,13 @@ esp_input_cb(struct cryptop *crp)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* RFC4303 2.6:
|
||||||
|
* Silently drop packet if next header field is IPPROTO_NONE.
|
||||||
|
*/
|
||||||
|
if (lastthree[2] == IPPROTO_NONE)
|
||||||
|
goto bad;
|
||||||
|
|
||||||
/* Trim the mbuf chain to remove trailing authenticator and padding */
|
/* Trim the mbuf chain to remove trailing authenticator and padding */
|
||||||
m_adj(m, -(lastthree[1] + 2));
|
m_adj(m, -(lastthree[1] + 2));
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user