svn commit: r274454 - head/sys/netipsec

[Andrey V. Elsukov]

Author: ae
Date: Wed Nov 12 22:51:30 2014
New Revision: 274454
URL: https://svnweb.freebsd.org/changeset/base/274454

Log:
  ipsec6_process_packet is called before ip6_output fixes ip6_plen.
  Update ip6_plen before bpf processing to be able see correct value.
  
  MFC after:	1 week
  Sponsored by:	Yandex LLC

Modified:
  head/sys/netipsec/ipsec_output.c

Modified: head/sys/netipsec/ipsec_output.c
==============================================================================
--- head/sys/netipsec/ipsec_output.c	Wed Nov 12 22:27:53 2014	(r274453)
+++ head/sys/netipsec/ipsec_output.c	Wed Nov 12 22:51:30 2014	(r274454)
@@ -649,6 +649,8 @@ ipsec6_process_packet(
 	sav = isr->sav;
 	dst = &sav->sah->saidx.dst;
 
+	ip6 = mtod(m, struct ip6_hdr *);
+	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
 #ifdef DEV_ENC
 	if_inc_counter(encif, IFCOUNTER_OPACKETS, 1);
 	if_inc_counter(encif, IFCOUNTER_OBYTES, m->m_pkthdr.len);
@@ -660,8 +662,6 @@ ipsec6_process_packet(
 		goto bad;
 #endif /* DEV_ENC */
 
-	ip6 = mtod(m, struct ip6_hdr *); /* XXX */
-
 	/* Do the appropriate encapsulation, if necessary */
 	if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
 	    dst->sa.sa_family != AF_INET6 ||        /* PF mismatch */
@@ -684,9 +684,6 @@ ipsec6_process_packet(
 			goto bad;
 		}
 
-		ip6 = mtod(m, struct ip6_hdr *);
-		ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
-
 		/* Encapsulate the packet */
 		error = ipip_output(m, isr, &mp, 0, 0);
 		if (mp == NULL && !error) {