d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Requeue mbuf via netisr when we use IPSec tunnel mode and IPv6.

Browse Source 
ipsec6_common_input_cb() uses partial copy of ip6_input() to parse
headers. But this isn't correct, when we use tunnel mode IPSec.

When we stripped outer IPv6 header from the decrypted packet, it
can become IPv4 packet and should be handled by ip_input. Also when
we use tunnel mode IPSec with IPv6 traffic, we should pass decrypted
packet with inner IPv6 header to ip6_input, it will correctly handle
it and also can decide to forward it.

The "skip" variable points to offset where payload starts. In tunnel
mode we reset it to zero after stripping the outer header. So, when
it is zero, we should requeue mbuf via netisr.

Differential Revision:	https://reviews.freebsd.org/D2306
Reviewed by:	adrian, gnn
Sponsored by:	Yandex LLC
This commit is contained in:
Andrey V. Elsukov 2015-04-18 16:51:24 +00:00
parent 1ae800e7a6
commit 1d3b268c04
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=281694
1 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
sys/netipsec/ipsec_input.c
View File

@ -627,7 +627,7 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
struct m_tag *mtag;
struct tdb_ident *tdbi;
struct secasindex *saidx;
int nxt;
int nxt, isr_prot;
u_int8_t nxt8;
int error, nest;
#ifdef notyet
@ -803,6 +803,35 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip,
if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0)
return (error);
#endif /* DEV_ENC */
if (skip == 0) {
/*
* We stripped outer IPv6 header.
* Now we should requeue decrypted packet via netisr.
*/
switch (prot) {
#ifdef INET
case IPPROTO_IPIP:
isr_prot = NETISR_IP;
break;
#endif
case IPPROTO_IPV6:
isr_prot = NETISR_IPV6;
break;
default:
DPRINTF(("%s: cannot handle inner ip proto %d\n",
__func__, prot));
IPSEC_ISTAT(sproto, nopf);
error = EPFNOSUPPORT;
goto bad;
}
error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m);
if (error) {
IPSEC_ISTAT(sproto, qfull);
DPRINTF(("%s: queue full; proto %u packet dropped\n",
__func__, sproto));
}
return (error);
}
/*
* See the end of ip6_input for this logic.
* IPPROTO_IPV[46] case will be processed just like other ones