hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-15 23:05:49 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

When mode isn't explicitly specified (wildcard) and inner protocol isn't

Browse Source 
IPv4 or IPv6, assume it is the transport mode.

Reported by:	jmg
MFC after:	1 week
Sponsored by:	Yandex LLC
This commit is contained in:
Andrey V. Elsukov 2014-11-06 20:23:57 +00:00
parent 7fc89952f1
commit 1f194d8ae1
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=274193
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/netipsec/ipsec_input.c
View File

@ -432,7 +432,7 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
}
#ifdef INET6
/* IPv6-in-IP encapsulation. */
if (prot == IPPROTO_IPV6 &&
else if (prot == IPPROTO_IPV6 &&
saidx->mode != IPSEC_MODE_TRANSPORT) {
if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
@ -469,6 +469,15 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
#endif /* notyet */
}
#endif /* INET6 */
else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) {
/*
* When mode is wildcard, inner protocol is IPv6 and
* we have no INET6 support - drop this packet a bit later.
* In other cases we assume transport mode and outer
* header was already stripped in xform_xxx_cb.
*/
prot = IPPROTO_IPIP;
}
/*
* Record what we've done to the packet (under what SA it was