[Bug 296598] inbound ipsec packets get tracked via outer ip header when the tunnel runs over if_wg

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D296598

--- Comment #10 from Lars Kr=C3=A4mer <[email protected]> ---
Yes, I misunderstood m_pullup's parameters.
Also, the repro against 15.1 was mistaken, I had forgotten about the sysctls
and didn't check that it was actually still broken.
This is present up to and including 14.4.
Patch against 14.4.0 would be this:

diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index 1150f3f470d..33505d6680e 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -404,6 +404,8 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar
*sav, int skip,
                }
                /* enc0: strip outer IPv4 header */
                m_striphdr(m, 0, ip->ip_hl << 2);
+               m =3D m_pullup(m, sizeof(struct ip));
+               if (m =3D=3D NULL) { error =3D ENOBUFS; goto bad; }
        }
 #ifdef INET6
        /* IPv6-in-IP encapsulation. */
@@ -416,6 +418,8 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar
*sav, int skip,
                }
                /* enc0: strip IPv4 header, keep IPv6 header only */
                m_striphdr(m, 0, ip->ip_hl << 2);
+               m =3D m_pullup(m, sizeof(struct ip6_hdr));
+               if (m =3D=3D NULL) { error =3D ENOBUFS; goto bad; }
        }
 #endif /* INET6 */
        else if (prot !=3D IPPROTO_IPV6 && saidx->mode =3D=3D IPSEC_MODE_AN=
Y) {

--=20
You are receiving this mail because:
You are the assignee for the bug.=