Since PFIL can change mbuf pointer, we should update pointers after
calling ipsec_filter(). Sponsored by: Yandex LLC
This commit is contained in:
parent
9bc3222765
commit
574fde00be
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=282132
@ -391,6 +391,7 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
|
||||
ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
|
||||
if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
|
||||
return (error);
|
||||
ip = mtod(m, struct ip *);
|
||||
#endif /* DEV_ENC */
|
||||
|
||||
/* IP-in-IP encapsulation */
|
||||
|
@ -578,6 +578,7 @@ ipsec4_process_packet(struct mbuf *m, struct ipsecrequest *isr)
|
||||
/* pass the mbuf to enc0 for packet filtering */
|
||||
if ((error = ipsec_filter(&m, PFIL_OUT, ENC_OUT|ENC_BEFORE)) != 0)
|
||||
goto bad;
|
||||
ip = mtod(m, struct ip *);
|
||||
#endif
|
||||
/* Do the appropriate encapsulation, if necessary */
|
||||
if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
|
||||
@ -699,6 +700,7 @@ ipsec6_process_packet(struct mbuf *m, struct ipsecrequest *isr)
|
||||
/* pass the mbuf to enc0 for packet filtering */
|
||||
if ((error = ipsec_filter(&m, PFIL_OUT, ENC_OUT|ENC_BEFORE)) != 0)
|
||||
goto bad;
|
||||
ip6 = mtod(m, struct ip6_hdr *);
|
||||
#endif /* DEV_ENC */
|
||||
|
||||
/* Do the appropriate encapsulation, if necessary */
|
||||
|
Loading…
Reference in New Issue
Block a user