The branch main has been updated by wma:
URL:
https://cgit.FreeBSD.org/src/commit/?id=d9d59bb1af142e7575032dd6c51fc64580de84df
commit d9d59bb1af142e7575032dd6c51fc64580de84df
Author: Wojciech Macek <w...@freebsd.org>
AuthorDate: 2021-08-09 10:01:46 +0000
Commit: Wojciech Macek <w...@freebsd.org>
CommitDate: 2021-08-09 10:01:46 +0000
ipsec: Handle ICMP NEEDFRAG message.
It will be needed for upcoming PMTU implementation in ipsec.
For now simply create/update an entry in tcp hostcache when needed.
The code is based on
https://people.freebsd.org/~ae/ipsec_transport_mode_ctlinput.diff
Authored by: Kornel Duleba <min...@semihalf.com>
Differential revision: https://reviews.freebsd.org/D30992
Reviewed by: tuxen
Sponsored by: Stormshield
Obtained from: Semihalf
---
sys/netinet/raw_ip.c | 6 ++++++
sys/netipsec/ipsec.c | 4 ++++
sys/netipsec/ipsec.h | 4 ++++
sys/netipsec/ipsec6.h | 1 +
sys/netipsec/ipsec_input.c | 42 ++++++++++++++++++++++++++++++++++++++++++
sys/netipsec/ipsec_mod.c | 2 ++
sys/netipsec/ipsec_support.h | 6 ++++++
sys/netipsec/subr_ipsec.c | 5 +++++
8 files changed, 70 insertions(+)
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index afbdc14e47c4..00c95c451966 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -880,6 +880,12 @@ rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
ifa_free(&ia->ia_ifa);
break;
+#if defined(IPSEC) || defined(IPSEC_SUPPORT)
+ case PRC_MSGSIZE:
+ if (IPSEC_ENABLED(ipv4))
+ IPSEC_CTLINPUT(ipv4, cmd, sa, vip);
+ break;
+#endif
}
}
diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index cd24750607ea..dcc607a5b617 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -112,6 +112,7 @@ VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
/* DF bit on encap. 0: clear 1: set 2: copy */
VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
+VNET_DEFINE(int, ip4_ipsec_min_pmtu) = 576;
VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE;
VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE;
VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE;
@@ -196,6 +197,9 @@ SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS,
ah_cleartos,
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit,
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0,
"Do not fragment bit on encap.");
+SYSCTL_INT(_net_inet_ipsec, IPSECCTL_MIN_PMTU, min_pmtu,
+ CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_min_pmtu), 0,
+ "Lowest acceptable PMTU value.");
SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn,
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0,
"Explicit Congestion Notification handling.");
diff --git a/sys/netipsec/ipsec.h b/sys/netipsec/ipsec.h
index c7a44d60f082..1f5aa1a43edc 100644
--- a/sys/netipsec/ipsec.h
+++ b/sys/netipsec/ipsec.h
@@ -246,6 +246,7 @@ struct ipsecstat {
#define IPSECCTL_ECN 11
#define IPSECCTL_DEBUG 12
#define IPSECCTL_ESP_RANDPAD 13
+#define IPSECCTL_MIN_PMTU 14
#ifdef _KERNEL
#include <sys/counter.h>
@@ -277,6 +278,7 @@ VNET_DECLARE(int, ip4_esp_net_deflev);
VNET_DECLARE(int, ip4_ah_trans_deflev);
VNET_DECLARE(int, ip4_ah_net_deflev);
VNET_DECLARE(int, ip4_ipsec_dfbit);
+VNET_DECLARE(int, ip4_ipsec_min_pmtu);
VNET_DECLARE(int, ip4_ipsec_ecn);
VNET_DECLARE(int, crypto_support);
VNET_DECLARE(int, async_crypto);
@@ -289,6 +291,7 @@ VNET_DECLARE(int, natt_cksum_policy);
#define V_ip4_ah_trans_deflev VNET(ip4_ah_trans_deflev)
#define V_ip4_ah_net_deflev VNET(ip4_ah_net_deflev)
#define V_ip4_ipsec_dfbit VNET(ip4_ipsec_dfbit)
+#define V_ip4_ipsec_min_pmtu VNET(ip4_ipsec_min_pmtu)
#define V_ip4_ipsec_ecn VNET(ip4_ipsec_ecn)
#define V_crypto_support VNET(crypto_support)
#define V_async_crypto VNET(async_crypto)
@@ -341,6 +344,7 @@ int ipsec4_pcbctl(struct inpcb *, struct sockopt *);
int ipsec4_output(struct mbuf *, struct inpcb *);
int ipsec4_capability(struct mbuf *, u_int);
int ipsec4_common_input_cb(struct mbuf *, struct secasvar *, int, int);
+int ipsec4_ctlinput(int, struct sockaddr *, void *);
int ipsec4_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *);
int ipsec_process_done(struct mbuf *, struct secpolicy *, struct secasvar *,
u_int);
diff --git a/sys/netipsec/ipsec6.h b/sys/netipsec/ipsec6.h
index 6d44f9891928..aaba405ce0db 100644
--- a/sys/netipsec/ipsec6.h
+++ b/sys/netipsec/ipsec6.h
@@ -73,6 +73,7 @@ int ipsec6_pcbctl(struct inpcb *, struct sockopt *);
int ipsec6_output(struct mbuf *, struct inpcb *);
int ipsec6_capability(struct mbuf *, u_int);
int ipsec6_common_input_cb(struct mbuf *, struct secasvar *, int, int);
+int ipsec6_ctlinput(int, struct sockaddr *, void *);
int ipsec6_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *);
int ip6_ipsec_filtertunnel(struct mbuf *);
diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index 48acba68a1fe..07a3ef583be8 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -68,7 +68,9 @@ __FBSDID("$FreeBSD$");
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
+#include <netinet/ip_icmp.h>
#include <netinet/in_var.h>
+#include <netinet/tcp_var.h>
#include <netinet/ip6.h>
#ifdef INET6
@@ -266,6 +268,40 @@ ipsec4_input(struct mbuf *m, int offset, int proto)
return (0);
}
+int
+ipsec4_ctlinput(int code, struct sockaddr *sa, void *v)
+{
+ struct in_conninfo inc;
+ struct secasvar *sav;
+ struct icmp *icp;
+ struct ip *ip = v;
+ uint32_t pmtu, spi;
+
+ if (code != PRC_MSGSIZE || ip == NULL)
+ return (EINVAL);
+ if (sa->sa_family != AF_INET ||
+ sa->sa_len != sizeof(struct sockaddr_in))
+ return (EAFNOSUPPORT);
+
+ icp = __containerof(ip, struct icmp, icmp_ip);
+ pmtu = ntohs(icp->icmp_nextmtu);
+
+ if (pmtu < V_ip4_ipsec_min_pmtu)
+ return (EINVAL);
+
+ memcpy(&spi, (caddr_t)ip + (ip->ip_hl << 2), sizeof(spi));
+ sav = key_allocsa((union sockaddr_union *)sa, ip->ip_p, spi);
+ if (sav == NULL)
+ return (ENOENT);
+
+ key_freesav(&sav);
+
+ memset(&inc, 0, sizeof(inc));
+ inc.inc_faddr = satosin(sa)->sin_addr;
+ tcp_hc_updatemtu(&inc, pmtu);
+ return (0);
+}
+
/*
* IPsec input callback for INET protocols.
* This routine is called as the transform callback.
@@ -482,6 +518,12 @@ ipsec6_input(struct mbuf *m, int offset, int proto)
return (0);
}
+int
+ipsec6_ctlinput(int code, struct sockaddr *sa, void *v)
+{
+ return (0);
+}
+
/*
* IPsec input callback, called by the transform callback. Takes care of
* filtering and other sanity checks on the processed packet.
diff --git a/sys/netipsec/ipsec_mod.c b/sys/netipsec/ipsec_mod.c
index 06523337f9fb..90cffde21968 100644
--- a/sys/netipsec/ipsec_mod.c
+++ b/sys/netipsec/ipsec_mod.c
@@ -63,6 +63,7 @@ static const struct ipsec_methods ipv4_methods = {
.pcbctl = ipsec4_pcbctl,
.capability = ipsec4_capability,
.check_policy = ipsec4_in_reject,
+ .ctlinput = ipsec4_ctlinput,
.hdrsize = ipsec_hdrsiz_inpcb,
.udp_input = udp_ipsec_input,
.udp_pcbctl = udp_ipsec_pcbctl,
@@ -84,6 +85,7 @@ static const struct ipsec_methods ipv6_methods = {
.pcbctl = ipsec6_pcbctl,
.capability = ipsec6_capability,
.check_policy = ipsec6_in_reject,
+ .ctlinput = ipsec6_ctlinput,
.hdrsize = ipsec_hdrsiz_inpcb,
};
#ifndef KLD_MODULE
diff --git a/sys/netipsec/ipsec_support.h b/sys/netipsec/ipsec_support.h
index b72aee20a7ae..e4d0aea906f1 100644
--- a/sys/netipsec/ipsec_support.h
+++ b/sys/netipsec/ipsec_support.h
@@ -134,6 +134,8 @@ extern const struct ipsec_support * const
ipv6_ipsec_support;
(*(proto ## _ipsec_support)->methods->capability)(m, __VA_ARGS__)
#define IPSEC_HDRSIZE(proto, inp) \
(*(proto ## _ipsec_support)->methods->hdrsize)(inp)
+#define IPSEC_CTLINPUT(proto, code, sa, v) \
+ (*(proto ## _ipsec_support)->methods->ctlinput)(code, sa, v)
#define UDPENCAP_INPUT(m, ...) \
(*ipv4_ipsec_support->methods->udp_input)(m, __VA_ARGS__)
@@ -162,6 +164,8 @@ int ipsec_kmod_pcbctl(struct ipsec_support * const, struct
inpcb *,
struct sockopt *);
int ipsec_kmod_capability(struct ipsec_support * const, struct mbuf *, u_int);
size_t ipsec_kmod_hdrsize(struct ipsec_support * const, struct inpcb *);
+int ipsec_kmod_ctlinput(struct ipsec_support * const, int,
+ struct sockaddr *, void *);
int ipsec_kmod_udp_input(struct ipsec_support * const, struct mbuf *, int,
int);
int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *,
struct sockopt *);
@@ -185,6 +189,8 @@ int ipsec_kmod_udp_pcbctl(struct ipsec_support * const,
struct inpcb *,
ipsec_kmod_capability(proto ## _ipsec_support, __VA_ARGS__)
#define IPSEC_HDRSIZE(proto, ...) \
ipsec_kmod_hdrsize(proto ## _ipsec_support, __VA_ARGS__)
+#define IPSEC_CTLINPUT(proto, ...) \
+ ipsec_kmod_ctlinput(proto ## _ipsec_support, __VA_ARGS__)
#endif /* IPSEC_SUPPORT */
#endif /* _KERNEL */
#endif /* _NETIPSEC_IPSEC_SUPPORT_H_ */
diff --git a/sys/netipsec/subr_ipsec.c b/sys/netipsec/subr_ipsec.c
index 37b686a7e91e..13c7336154e4 100644
--- a/sys/netipsec/subr_ipsec.c
+++ b/sys/netipsec/subr_ipsec.c
@@ -366,6 +366,11 @@ IPSEC_KMOD_METHOD(int, ipsec_kmod_forward, sc,
(m)
)
+IPSEC_KMOD_METHOD(int, ipsec_kmod_ctlinput, sc,
+ ctlinput, METHOD_DECL(struct ipsec_support * const sc, int code,
+ struct sockaddr *sa, void *v), METHOD_ARGS(code, sa, v)
+)
+
IPSEC_KMOD_METHOD(int, ipsec_kmod_output, sc,
output, METHOD_DECL(struct ipsec_support * const sc, struct mbuf *m,
struct inpcb *inp), METHOD_ARGS(m, inp)
_______________________________________________
dev-commits-src-main@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-main
To unsubscribe, send any mail to "dev-commits-src-main-unsubscr...@freebsd.org"
