d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do not strip outer header when operating in transport mode.

Browse Source 
Instead requeue mbuf back to IPv4 protocol handler. If there is one extra IP-IP
encapsulation, it will be handled with tunneling interface. And thus proper
interface will be exposed into mbuf's rcvif. Also, tcpdump that listens on tunneling
interface will see packets in both directions.

Sponsored by:	Yandex LLC
This commit is contained in:
Andrey V. Elsukov 2014-10-02 02:00:21 +00:00
parent 4a387a583b
commit a28b277a9f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=272394
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/netipsec/ipsec_input.c
View File

@ -391,7 +391,8 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
#endif /* DEV_ENC */
/* IP-in-IP encapsulation */
if (prot == IPPROTO_IPIP) {
if (prot == IPPROTO_IPIP &&
saidx->mode != IPSEC_MODE_TRANSPORT) {
if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
IPSEC_ISTAT(sproto, hdrops);
@ -431,7 +432,8 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
}
#ifdef INET6
/* IPv6-in-IP encapsulation. */
if (prot == IPPROTO_IPV6) {
if (prot == IPPROTO_IPV6 &&
saidx->mode != IPSEC_MODE_TRANSPORT) {
if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
IPSEC_ISTAT(sproto, hdrops);
@ -502,6 +504,12 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
key_sa_recordxfer(sav, m); /* record data transfer */
/*
* In transport mode requeue decrypted mbuf back to IPv4 protocol
* handler. This is necessary to correctly expose rcvif.
*/
if (saidx->mode == IPSEC_MODE_TRANSPORT)
prot = IPPROTO_IPIP;
#ifdef DEV_ENC
/*
* Pass the mbuf to enc0 for bpf and pfil.