[Bug 296598] inbound ipsec packets get tracked via outer ip header when the tunnel runs over if_wg

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D296598

--- Comment #12 from Lars Kr=C3=A4mer <[email protected]> ---
(In reply to Andrey V. Elsukov from comment #11)
I'm not 100% on the IPv6 logic, and I currently don't have a setup to test =
IPv6
transport, but this ought to be all 4 occurrences of m_striphdr in that fil=
e:

diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index 472216392949..83db2076b0c2 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -404,6 +404,8 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar
*sav, int skip,
                }
                /* enc0: strip outer IPv4 header */
                m_striphdr(m, 0, ip->ip_hl << 2);
+               m =3D m_pullup(m, sizeof(struct ip));
+               if (m =3D=3D NULL) { error =3D ENOBUFS; goto bad; }
        }
 #ifdef INET6
        /* IPv6-in-IP encapsulation. */
@@ -416,6 +418,8 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar
*sav, int skip,
                }
                /* enc0: strip IPv4 header, keep IPv6 header only */
                m_striphdr(m, 0, ip->ip_hl << 2);
+               m =3D m_pullup(m, sizeof(struct ip6_hdr));
+               if (m =3D=3D NULL) { error =3D ENOBUFS; goto bad; }
        }
 #endif /* INET6 */
        else if (prot !=3D IPPROTO_IPV6 && saidx->mode =3D=3D IPSEC_MODE_AN=
Y) {
@@ -639,6 +643,8 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar
*sav, int skip,
                /* ip6n will now contain the inner IPv6 header. */
                m_striphdr(m, 0, skip);
                skip =3D 0;
+               m =3D m_pullup(m, sizeof(struct ip6_hdr));
+               if (m =3D=3D NULL) { error =3D ENOBUFS; goto bad; }
        }
 #ifdef INET
        /* IP-in-IP encapsulation */
@@ -652,6 +658,8 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar
*sav, int skip,
                /* ipn will now contain the inner IPv4 header */
                m_striphdr(m, 0, skip);
                skip =3D 0;
+               m =3D m_pullup(m, sizeof(struct ip));
+               if (m =3D=3D NULL) { error =3D ENOBUFS; goto bad; }
        }
 #endif /* INET */
        else {

--=20
You are receiving this mail because:
You are the assignee for the bug.=