tree 1166583492cd5a43aa664596f7123798e32e50d8
parent 734d430f37251bc7e71d507983ee640ae1625fbe
author Matthew G Smith <mgsmith@netgate.com> 1558550048 -0500
committer Damjan Marion <dmarion@me.com> 1559205680 +0000

IPsec: modify post-decrypt buf len calculation

For tunnel mode, after decryption the buffer length was being adjusted
by adding (iv length + esp header size). Subtract it instead.

Required for BFD to work on an IPsec tunnel interface. BFD verifies
that the amount of received data is the expected size. It drops the
packet if the buffer metadata says that the packet buffer contains
more data than the packet headers say it should.

Change-Id: I3146d5c3cbf1cceccc9989eefbc9a59e604e9975
Signed-off-by: Matthew Smith <mgsmith@netgate.com>