diff options
| author | Xavier Beaudouin <xavier.beaudouin@klarasystems.com> | 2024-01-16 20:44:34 +0000 |
|---|---|---|
| committer | Allan Jude <allanjude@FreeBSD.org> | 2024-01-16 20:44:34 +0000 |
| commit | 80044c785cb040a2cf73779d23f9e1e81a00c6c3 (patch) | |
| tree | e5a7903d34e77d9bcb507622531204431d37ca65 /sys/netipsec/ipsec_input.c | |
| parent | 38f5f2a4af5daeec7f13d39cad1ff4dc90da52d8 (diff) | |
Diffstat (limited to 'sys/netipsec/ipsec_input.c')
| -rw-r--r-- | sys/netipsec/ipsec_input.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c index 472216392949..1150f3f470d3 100644 --- a/sys/netipsec/ipsec_input.c +++ b/sys/netipsec/ipsec_input.c @@ -628,6 +628,15 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, m_copydata(m, protoff, 1, &nxt8); prot = nxt8; + /* + * Check that we have NAT-T enabled and apply transport mode + * decapsulation NAT procedure (RFC3948). + * Do this before invoking into the PFIL. + */ + if (sav->natt != NULL && + (prot == IPPROTO_UDP || prot == IPPROTO_TCP)) + udp_ipsec_adjust_cksum(m, sav, prot, skip); + /* IPv6-in-IP encapsulation */ if (prot == IPPROTO_IPV6 && saidx->mode != IPSEC_MODE_TRANSPORT) { |