svn commit: r274193 - head/sys/netipsec

[Andrey V. Elsukov]

Author: ae
Date: Thu Nov  6 20:23:57 2014
New Revision: 274193
URL: https://svnweb.freebsd.org/changeset/base/274193

Log:
  When mode isn't explicitly specified (wildcard) and inner protocol isn't
  IPv4 or IPv6, assume it is the transport mode.
  
  Reported by:	jmg
  MFC after:	1 week
  Sponsored by:	Yandex LLC

Modified:
  head/sys/netipsec/ipsec_input.c

Modified: head/sys/netipsec/ipsec_input.c
==============================================================================
--- head/sys/netipsec/ipsec_input.c	Thu Nov  6 19:28:01 2014	(r274192)
+++ head/sys/netipsec/ipsec_input.c	Thu Nov  6 20:23:57 2014	(r274193)
@@ -432,7 +432,7 @@ ipsec4_common_input_cb(struct mbuf *m, s
 	}
 #ifdef INET6
 	/* IPv6-in-IP encapsulation. */
-	if (prot == IPPROTO_IPV6 &&
+	else if (prot == IPPROTO_IPV6 &&
 	    saidx->mode != IPSEC_MODE_TRANSPORT) {
 
 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
@@ -469,6 +469,15 @@ ipsec4_common_input_cb(struct mbuf *m, s
 #endif /* notyet */
 	}
 #endif /* INET6 */
+	else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) {
+		/*
+		 * When mode is wildcard, inner protocol is IPv6 and
+		 * we have no INET6 support - drop this packet a bit later.
+		 * In other cases we assume transport mode and outer
+		 * header was already stripped in xform_xxx_cb.
+		 */
+		prot = IPPROTO_IPIP;
+	}
 
 	/*
 	 * Record what we've done to the packet (under what SA it was