Correct L2TP header offset handling:

- according to RFC2661 an offset size of 0 is allowed.
- when skipping offset padding do not forget to also skip
  the 2 octets of the offset size field.

Reviewed by:	archie
Approved by:	pjd (mentor)

sys/netgraph/ng_l2tp.c

@@ -819,13 +819,13 @@ ng_l2tp_recv_lower(node_p node, item_p item)
 		offset = ntohs(offset);
 
 		/* Trim offset padding */
-		if (offset <= 2 || offset > m->m_pkthdr.len) {
+		if ((2+offset) > m->m_pkthdr.len) {
 			priv->stats.recvInvalid++;
 			NG_FREE_ITEM(item);
 			NG_FREE_M(m);
 			return (EINVAL);
 		}
-		m_adj(m, offset);
+		m_adj(m, 2+offset);
 	}
 
 	/* Handle control packets */