svn commit: r274469 - stable/10/sys/netipsec

[Andrey V. Elsukov]

Author: ae
Date: Thu Nov 13 13:08:46 2014
New Revision: 274469
URL: https://svnweb.freebsd.org/changeset/base/274469

Log:
  MFC r274193:
    When mode isn't explicitly specified (wildcard) and inner protocol isn't
    IPv4 or IPv6, assume it is the transport mode.
  
  Sponsored by:	Yandex LLC

Modified:
  stable/10/sys/netipsec/ipsec_input.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netipsec/ipsec_input.c
==============================================================================
--- stable/10/sys/netipsec/ipsec_input.c	Thu Nov 13 13:05:31 2014	(r274468)
+++ stable/10/sys/netipsec/ipsec_input.c	Thu Nov 13 13:08:46 2014	(r274469)
@@ -406,7 +406,7 @@ ipsec4_common_input_cb(struct mbuf *m, s
 	}
 #ifdef INET6
 	/* IPv6-in-IP encapsulation. */
-	if (prot == IPPROTO_IPV6 &&
+	else if (prot == IPPROTO_IPV6 &&
 	    saidx->mode != IPSEC_MODE_TRANSPORT) {
 
 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
@@ -443,6 +443,15 @@ ipsec4_common_input_cb(struct mbuf *m, s
 #endif /* notyet */
 	}
 #endif /* INET6 */
+	else if (prot != IPPROTO_IPV6 && saidx->mode == IPSEC_MODE_ANY) {
+		/*
+		 * When mode is wildcard, inner protocol is IPv6 and
+		 * we have no INET6 support - drop this packet a bit later.
+		 * In other cases we assume transport mode and outer
+		 * header was already stripped in xform_xxx_cb.
+		 */
+		prot = IPPROTO_IPIP;
+	}
 
 	/*
 	 * Record what we've done to the packet (under what SA it was