Re: [Bug 296598] pf: IPsec tunnel mode over if_wg, inner header not visible to pf

On 28 Jul 2026, at 10:18, Kr=C3=A4mer, Lars wrote:
> I've tracked down a bug where TCP connections over IPsec die after a sh=
ort time when IPsec runs over if_wg.
> I would appreciate if someone could take a look at it.
> Lots of diagnostic data is in the bugzilla report: https://bugs.freebsd=
=2Eorg/bugzilla/show_bug.cgi?id=3D296598
>
> In a few words, ipsec4_common_input_cb tries stripping the outer IP-IP =
header from the packet before passing it to pf hooks.
> When a packet arrives via if_wg, the head of the mbuf is just the outer=
 IP header and m_striphdr leaves behind a zero-length head.
> This breaks when pf_test tries to read the IP header via mtod(), becaus=
e this condition is never checked, and pf reads the outer header instead.=

>
Where does it do this? As far as I can see pf_test() will first call pf_s=
etup_pdesc(), which will m_pullup(sizeof(ip/ip6_hdr)).

=E2=80=94
Kristof