From e287c474bec9cff26497ef120e5a4f151f6db963 Mon Sep 17 00:00:00 2001 From: "Andrey V. Elsukov" Date: Fri, 11 May 2018 16:50:25 +0000 Subject: [PATCH] Apply the change from r272770 to if_ipsec(4) interface. It is guaranteed that if_ipsec(4) interface is used only for tunnel mode IPsec, i.e. decrypted and decapsultaed packet has its own IP header. Thus we can consider it as new packet and clear the protocols flags. This allows ICMP/ICMPv6 properly handle errors that may cause this packet. PR: 228108 MFC after: 1 week --- sys/net/if_ipsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/net/if_ipsec.c b/sys/net/if_ipsec.c index 7ae27a0d8f2..c9dcbc6488a 100644 --- a/sys/net/if_ipsec.c +++ b/sys/net/if_ipsec.c @@ -434,7 +434,7 @@ ipsec_if_input(struct mbuf *m, struct secasvar *sav, uint32_t af) m->m_pkthdr.rcvif = ifp; IPSEC_SC_RUNLOCK(); - /* m_clrprotoflags(m); */ + m_clrprotoflags(m); M_SETFIB(m, ifp->if_fib); BPF_MTAP2(ifp, &af, sizeof(af), m); if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);