d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipsec: Handle ICMP NEEDFRAG message.

Browse Source 
It will be needed for upcoming PMTU implementation in ipsec.
    For now simply create/update an entry in tcp hostcache when needed.
    The code is based on https://people.freebsd.org/~ae/ipsec_transport_mode_ctlinput.diff

Authored by: 		Kornel Duleba <mindal@semihalf.com>
Differential revision: 	https://reviews.freebsd.org/D30992
Reviewed by: 		tuxen
Sponsored by: 		Stormshield
Obtained from:	 	Semihalf
This commit is contained in:
Wojciech Macek 2021-08-09 12:01:46 +02:00
parent a8d54fc903
commit d9d59bb1af
8 changed files with 70 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/netinet/raw_ip.c
View File

@ -880,6 +880,12 @@ rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
ifa_free(&ia->ia_ifa);
break;
#if defined(IPSEC) || defined(IPSEC_SUPPORT)
case PRC_MSGSIZE:
if (IPSEC_ENABLED(ipv4))
IPSEC_CTLINPUT(ipv4, cmd, sa, vip);
break;
#endif
}
}

4
sys/netipsec/ipsec.c
View File

@ -112,6 +112,7 @@ VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
/* DF bit on encap. 0: clear 1: set 2: copy */
VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
VNET_DEFINE(int, ip4_ipsec_min_pmtu) = 576;
VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE;
VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE;
VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE;
@ -196,6 +197,9 @@ SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos,
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit,
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0,
"Do not fragment bit on encap.");
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_MIN_PMTU, min_pmtu,
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_min_pmtu), 0,
"Lowest acceptable PMTU value.");
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn,
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0,
"Explicit Congestion Notification handling.");

4
sys/netipsec/ipsec.h
View File

@ -246,6 +246,7 @@ struct ipsecstat {
#define IPSECCTL_ECN 11
#define IPSECCTL_DEBUG 12
#define IPSECCTL_ESP_RANDPAD 13
#define IPSECCTL_MIN_PMTU 14
#ifdef _KERNEL
#include <sys/counter.h>
@ -277,6 +278,7 @@ VNET_DECLARE(int, ip4_esp_net_deflev);
VNET_DECLARE(int, ip4_ah_trans_deflev);
VNET_DECLARE(int, ip4_ah_net_deflev);
VNET_DECLARE(int, ip4_ipsec_dfbit);
VNET_DECLARE(int, ip4_ipsec_min_pmtu);
VNET_DECLARE(int, ip4_ipsec_ecn);
VNET_DECLARE(int, crypto_support);
VNET_DECLARE(int, async_crypto);
@ -289,6 +291,7 @@ VNET_DECLARE(int, natt_cksum_policy);
#define V_ip4_ah_trans_deflev VNET(ip4_ah_trans_deflev)
#define V_ip4_ah_net_deflev VNET(ip4_ah_net_deflev)
#define V_ip4_ipsec_dfbit VNET(ip4_ipsec_dfbit)
#define V_ip4_ipsec_min_pmtu VNET(ip4_ipsec_min_pmtu)
#define V_ip4_ipsec_ecn VNET(ip4_ipsec_ecn)
#define V_crypto_support VNET(crypto_support)
#define V_async_crypto VNET(async_crypto)
@ -341,6 +344,7 @@ int ipsec4_pcbctl(struct inpcb *, struct sockopt *);
int ipsec4_output(struct mbuf *, struct inpcb *);
int ipsec4_capability(struct mbuf *, u_int);
int ipsec4_common_input_cb(struct mbuf *, struct secasvar *, int, int);
int ipsec4_ctlinput(int, struct sockaddr *, void *);
int ipsec4_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *);
int ipsec_process_done(struct mbuf *, struct secpolicy *, struct secasvar *,
u_int);

1
sys/netipsec/ipsec6.h
View File

@ -73,6 +73,7 @@ int ipsec6_pcbctl(struct inpcb *, struct sockopt *);
int ipsec6_output(struct mbuf *, struct inpcb *);
int ipsec6_capability(struct mbuf *, u_int);
int ipsec6_common_input_cb(struct mbuf *, struct secasvar *, int, int);
int ipsec6_ctlinput(int, struct sockaddr *, void *);
int ipsec6_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *);
int ip6_ipsec_filtertunnel(struct mbuf *);

42
sys/netipsec/ipsec_input.c
View File

@ -68,7 +68,9 @@ __FBSDID("$FreeBSD$");
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/ip_icmp.h>
#include <netinet/in_var.h>
#include <netinet/tcp_var.h>
#include <netinet/ip6.h>
#ifdef INET6
@ -266,6 +268,40 @@ ipsec4_input(struct mbuf *m, int offset, int proto)
return (0);
}
int
ipsec4_ctlinput(int code, struct sockaddr *sa, void *v)
{
struct in_conninfo inc;
struct secasvar *sav;
struct icmp *icp;
struct ip *ip = v;
uint32_t pmtu, spi;
if (code != PRC_MSGSIZE || ip == NULL)
return (EINVAL);
if (sa->sa_family != AF_INET ||
sa->sa_len != sizeof(struct sockaddr_in))
return (EAFNOSUPPORT);
icp = __containerof(ip, struct icmp, icmp_ip);
pmtu = ntohs(icp->icmp_nextmtu);
if (pmtu < V_ip4_ipsec_min_pmtu)
return (EINVAL);
memcpy(&spi, (caddr_t)ip + (ip->ip_hl << 2), sizeof(spi));
sav = key_allocsa((union sockaddr_union *)sa, ip->ip_p, spi);
if (sav == NULL)
return (ENOENT);
key_freesav(&sav);
memset(&inc, 0, sizeof(inc));
inc.inc_faddr = satosin(sa)->sin_addr;
tcp_hc_updatemtu(&inc, pmtu);
return (0);
}
/*
* IPsec input callback for INET protocols.
* This routine is called as the transform callback.
@ -482,6 +518,12 @@ ipsec6_input(struct mbuf *m, int offset, int proto)
return (0);
}
int
ipsec6_ctlinput(int code, struct sockaddr *sa, void *v)
{
return (0);
}
/*
* IPsec input callback, called by the transform callback. Takes care of
* filtering and other sanity checks on the processed packet.

2
sys/netipsec/ipsec_mod.c
View File

@ -63,6 +63,7 @@ static const struct ipsec_methods ipv4_methods = {
.pcbctl = ipsec4_pcbctl,
.capability = ipsec4_capability,
.check_policy = ipsec4_in_reject,
.ctlinput = ipsec4_ctlinput,
.hdrsize = ipsec_hdrsiz_inpcb,
.udp_input = udp_ipsec_input,
.udp_pcbctl = udp_ipsec_pcbctl,
@ -84,6 +85,7 @@ static const struct ipsec_methods ipv6_methods = {
.pcbctl = ipsec6_pcbctl,
.capability = ipsec6_capability,
.check_policy = ipsec6_in_reject,
.ctlinput = ipsec6_ctlinput,
.hdrsize = ipsec_hdrsiz_inpcb,
};
#ifndef KLD_MODULE

6
sys/netipsec/ipsec_support.h
View File

@ -134,6 +134,8 @@ extern const struct ipsec_support * const ipv6_ipsec_support;
(*(proto ## _ipsec_support)->methods->capability)(m, __VA_ARGS__)
#define IPSEC_HDRSIZE(proto, inp) \
(*(proto ## _ipsec_support)->methods->hdrsize)(inp)
#define IPSEC_CTLINPUT(proto, code, sa, v) \
(*(proto ## _ipsec_support)->methods->ctlinput)(code, sa, v)
#define UDPENCAP_INPUT(m, ...) \
(*ipv4_ipsec_support->methods->udp_input)(m, __VA_ARGS__)
@ -162,6 +164,8 @@ int ipsec_kmod_pcbctl(struct ipsec_support * const, struct inpcb *,
struct sockopt *);
int ipsec_kmod_capability(struct ipsec_support * const, struct mbuf *, u_int);
size_t ipsec_kmod_hdrsize(struct ipsec_support * const, struct inpcb *);
int ipsec_kmod_ctlinput(struct ipsec_support * const, int,
struct sockaddr *, void *);
int ipsec_kmod_udp_input(struct ipsec_support * const, struct mbuf *, int, int);
int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *,
struct sockopt *);
@ -185,6 +189,8 @@ int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *,
ipsec_kmod_capability(proto ## _ipsec_support, __VA_ARGS__)
#define IPSEC_HDRSIZE(proto, ...) \
ipsec_kmod_hdrsize(proto ## _ipsec_support, __VA_ARGS__)
#define IPSEC_CTLINPUT(proto, ...) \
ipsec_kmod_ctlinput(proto ## _ipsec_support, __VA_ARGS__)
#endif /* IPSEC_SUPPORT */
#endif /* _KERNEL */
#endif /* _NETIPSEC_IPSEC_SUPPORT_H_ */

5
sys/netipsec/subr_ipsec.c
View File

@ -366,6 +366,11 @@ IPSEC_KMOD_METHOD(int, ipsec_kmod_forward, sc,
(m)
)
IPSEC_KMOD_METHOD(int, ipsec_kmod_ctlinput, sc,
ctlinput, METHOD_DECL(struct ipsec_support * const sc, int code,
struct sockaddr *sa, void *v), METHOD_ARGS(code, sa, v)
)
IPSEC_KMOD_METHOD(int, ipsec_kmod_output, sc,
output, METHOD_DECL(struct ipsec_support * const sc, struct mbuf *m,
struct inpcb *inp), METHOD_ARGS(m, inp)