svn commit: r206111 - head/sys/netipsec

[Ermal Luçi]

Author: eri
Date: Fri Apr  2 18:15:23 2010
New Revision: 206111
URL: http://svn.freebsd.org/changeset/base/206111

Log:
  Fix a logic error in ipsec code that extracts
  information from the packets.
  
  Reviewed by:	bz, mlaier
  Approved by:	mlaier(mentor)
  MFC after:	1 month

Modified:
  head/sys/netipsec/ipsec.c

Modified: head/sys/netipsec/ipsec.c
==============================================================================
--- head/sys/netipsec/ipsec.c	Fri Apr  2 17:52:50 2010	(r206110)
+++ head/sys/netipsec/ipsec.c	Fri Apr  2 18:15:23 2010	(r206111)
@@ -592,7 +592,7 @@ ipsec4_get_ulp(struct mbuf *m, struct se
 	IPSEC_ASSERT(m->m_pkthdr.len >= sizeof(struct ip),("packet too short"));
 
 	/* NB: ip_input() flips it into host endian. XXX Need more checking. */
-	if (m->m_len < sizeof (struct ip)) {
+	if (m->m_len >= sizeof (struct ip)) {
 		struct ip *ip = mtod(m, struct ip *);
 		if (ip->ip_off & (IP_MF | IP_OFFMASK))
 			goto done;