!
! While IPv6 does count iterations over next headers in ip6_input,
! we will still disallow directly recursive IPComp.
!
Index: sys/netinet6/ipcomp_input.c
===================================================================
--- sys/netinet6/ipcomp_input.c	(revision 220237)
+++ sys/netinet6/ipcomp_input.c	(working copy)
@@ -117,8 +117,21 @@ ipcomp4_input(m, off)
 		goto fail;
 	}
 	ipcomp = mtod(md, struct ipcomp *);
+	nxt = ipcomp->comp_nxt;
+
+	/*
+	 * Check that the next header of the IPComp is not IPComp again, before
+	 * doing any real work.  Given it is not possible to do double
+	 * compression it means someone is playing tricks on us.
+	 */
+	if (nxt == IPPROTO_IPCOMP) {
+		ipseclog((LOG_ERR, "IPv4 IPComp input: "
+		    "recursive compression detected."));
+		ipsecstat.in_inval++;
+		goto fail;
+	}
+
 	ip = mtod(m, struct ip *);
-	nxt = ipcomp->comp_nxt;
 #ifdef _IP_VHL
 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 #else
@@ -269,6 +282,18 @@ ipcomp6_input(mp, offp, proto)
 	ip6 = mtod(m, struct ip6_hdr *);
 	nxt = ipcomp->comp_nxt;
 
+	/*
+	 * Check that the next header of the IPComp is not IPComp again, before
+	 * doing any real work.  Given it is not possible to do double
+	 * compression it means someone is playing tricks on us.
+	 */
+	if (nxt == IPPROTO_IPCOMP) {
+		ipseclog((LOG_ERR, "IPv6 IPComp input: "
+		    "recursive compression detected."));
+		ipsecstat.in_inval++;
+		goto fail;
+	}
+
 	cpi = ntohs(ipcomp->comp_cpi);
 
 	if (cpi >= IPCOMP_CPI_NEGOTIATE_MIN) {
Index: sys/netipsec/xform_ipcomp.c
===================================================================
--- sys/netipsec/xform_ipcomp.c	(revision 220237)
+++ sys/netipsec/xform_ipcomp.c	(working copy)
@@ -139,10 +139,31 @@ ipcomp_input(struct mbuf *m, struct secasvar *sav,
 	struct tdb_crypto *tc;
 	struct cryptodesc *crdc;
 	struct cryptop *crp;
+	struct ipcomp *ipcomp;
+	caddr_t addr;
 	int hlen = IPCOMP_HLENGTH;
 
 	IPSEC_SPLASSERT_SOFTNET(__func__);
 
+	/*
+	 * Check that the next header of the IPComp is not IPComp again, before
+	 * doing any real work.  Given it is not possible to do double
+	 * compression it means someone is playing tricks on us.
+	 */
+	if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) {
+		ipcompstat.ipcomps_hdrops++;		/*XXX*/
+		DPRINTF(("%s: m_pullup failed\n", __func__));
+		return (ENOBUFS);
+	}
+	addr = (caddr_t) mtod(m, struct ip *) + skip;
+	ipcomp = (struct ipcomp *)addr;
+	if (ipcomp->comp_nxt == IPPROTO_IPCOMP) {
+		m_freem(m);
+		ipcompstat.ipcomps_pdrops++;	/* XXX have our own stats? */
+		DPRINTF(("%s: recursive compression detected\n", __func__));
+		return (EINVAL);
+	}
+
 	/* Get crypto descriptors */
 	crp = crypto_getreq(1);
 	if (crp == NULL) {