Date: Mon, 9 Aug 2021 10:04:03 GMT From: Wojciech Macek <wma@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: d9d59bb1af14 - main - ipsec: Handle ICMP NEEDFRAG message. Message-ID: <202108091004.179A43MD085281@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by wma: URL: https://cgit.FreeBSD.org/src/commit/?id=d9d59bb1af142e7575032dd6c51fc64580de84df commit d9d59bb1af142e7575032dd6c51fc64580de84df Author: Wojciech Macek <wma@FreeBSD.org> AuthorDate: 2021-08-09 10:01:46 +0000 Commit: Wojciech Macek <wma@FreeBSD.org> CommitDate: 2021-08-09 10:01:46 +0000 ipsec: Handle ICMP NEEDFRAG message. It will be needed for upcoming PMTU implementation in ipsec. For now simply create/update an entry in tcp hostcache when needed. The code is based on https://people.freebsd.org/~ae/ipsec_transport_mode_ctlinput.diff Authored by: Kornel Duleba <mindal@semihalf.com> Differential revision: https://reviews.freebsd.org/D30992 Reviewed by: tuxen Sponsored by: Stormshield Obtained from: Semihalf --- sys/netinet/raw_ip.c | 6 ++++++ sys/netipsec/ipsec.c | 4 ++++ sys/netipsec/ipsec.h | 4 ++++ sys/netipsec/ipsec6.h | 1 + sys/netipsec/ipsec_input.c | 42 ++++++++++++++++++++++++++++++++++++++++++ sys/netipsec/ipsec_mod.c | 2 ++ sys/netipsec/ipsec_support.h | 6 ++++++ sys/netipsec/subr_ipsec.c | 5 +++++ 8 files changed, 70 insertions(+) diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c index afbdc14e47c4..00c95c451966 100644 --- a/sys/netinet/raw_ip.c +++ b/sys/netinet/raw_ip.c @@ -880,6 +880,12 @@ rip_ctlinput(int cmd, struct sockaddr *sa, void *vip) ifa_free(&ia->ia_ifa); break; +#if defined(IPSEC) || defined(IPSEC_SUPPORT) + case PRC_MSGSIZE: + if (IPSEC_ENABLED(ipv4)) + IPSEC_CTLINPUT(ipv4, cmd, sa, vip); + break; +#endif } } diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c index cd24750607ea..dcc607a5b617 100644 --- a/sys/netipsec/ipsec.c +++ b/sys/netipsec/ipsec.c @@ -112,6 +112,7 @@ VNET_PCPUSTAT_SYSUNINIT(ipsec4stat); /* DF bit on encap. 0: clear 1: set 2: copy */ VNET_DEFINE(int, ip4_ipsec_dfbit) = 0; +VNET_DEFINE(int, ip4_ipsec_min_pmtu) = 576; VNET_DEFINE(int, ip4_esp_trans_deflev) = IPSEC_LEVEL_USE; VNET_DEFINE(int, ip4_esp_net_deflev) = IPSEC_LEVEL_USE; VNET_DEFINE(int, ip4_ah_trans_deflev) = IPSEC_LEVEL_USE; @@ -196,6 +197,9 @@ SYSCTL_INT(_net_inet_ipsec, IPSECCTL_AH_CLEARTOS, ah_cleartos, SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DFBIT, dfbit, CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_dfbit), 0, "Do not fragment bit on encap."); +SYSCTL_INT(_net_inet_ipsec, IPSECCTL_MIN_PMTU, min_pmtu, + CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_min_pmtu), 0, + "Lowest acceptable PMTU value."); SYSCTL_INT(_net_inet_ipsec, IPSECCTL_ECN, ecn, CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip4_ipsec_ecn), 0, "Explicit Congestion Notification handling."); diff --git a/sys/netipsec/ipsec.h b/sys/netipsec/ipsec.h index c7a44d60f082..1f5aa1a43edc 100644 --- a/sys/netipsec/ipsec.h +++ b/sys/netipsec/ipsec.h @@ -246,6 +246,7 @@ struct ipsecstat { #define IPSECCTL_ECN 11 #define IPSECCTL_DEBUG 12 #define IPSECCTL_ESP_RANDPAD 13 +#define IPSECCTL_MIN_PMTU 14 #ifdef _KERNEL #include <sys/counter.h> @@ -277,6 +278,7 @@ VNET_DECLARE(int, ip4_esp_net_deflev); VNET_DECLARE(int, ip4_ah_trans_deflev); VNET_DECLARE(int, ip4_ah_net_deflev); VNET_DECLARE(int, ip4_ipsec_dfbit); +VNET_DECLARE(int, ip4_ipsec_min_pmtu); VNET_DECLARE(int, ip4_ipsec_ecn); VNET_DECLARE(int, crypto_support); VNET_DECLARE(int, async_crypto); @@ -289,6 +291,7 @@ VNET_DECLARE(int, natt_cksum_policy); #define V_ip4_ah_trans_deflev VNET(ip4_ah_trans_deflev) #define V_ip4_ah_net_deflev VNET(ip4_ah_net_deflev) #define V_ip4_ipsec_dfbit VNET(ip4_ipsec_dfbit) +#define V_ip4_ipsec_min_pmtu VNET(ip4_ipsec_min_pmtu) #define V_ip4_ipsec_ecn VNET(ip4_ipsec_ecn) #define V_crypto_support VNET(crypto_support) #define V_async_crypto VNET(async_crypto) @@ -341,6 +344,7 @@ int ipsec4_pcbctl(struct inpcb *, struct sockopt *); int ipsec4_output(struct mbuf *, struct inpcb *); int ipsec4_capability(struct mbuf *, u_int); int ipsec4_common_input_cb(struct mbuf *, struct secasvar *, int, int); +int ipsec4_ctlinput(int, struct sockaddr *, void *); int ipsec4_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *); int ipsec_process_done(struct mbuf *, struct secpolicy *, struct secasvar *, u_int); diff --git a/sys/netipsec/ipsec6.h b/sys/netipsec/ipsec6.h index 6d44f9891928..aaba405ce0db 100644 --- a/sys/netipsec/ipsec6.h +++ b/sys/netipsec/ipsec6.h @@ -73,6 +73,7 @@ int ipsec6_pcbctl(struct inpcb *, struct sockopt *); int ipsec6_output(struct mbuf *, struct inpcb *); int ipsec6_capability(struct mbuf *, u_int); int ipsec6_common_input_cb(struct mbuf *, struct secasvar *, int, int); +int ipsec6_ctlinput(int, struct sockaddr *, void *); int ipsec6_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *); int ip6_ipsec_filtertunnel(struct mbuf *); diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c index 48acba68a1fe..07a3ef583be8 100644 --- a/sys/netipsec/ipsec_input.c +++ b/sys/netipsec/ipsec_input.c @@ -68,7 +68,9 @@ __FBSDID("$FreeBSD$"); #include <netinet/in_systm.h> #include <netinet/ip.h> #include <netinet/ip_var.h> +#include <netinet/ip_icmp.h> #include <netinet/in_var.h> +#include <netinet/tcp_var.h> #include <netinet/ip6.h> #ifdef INET6 @@ -266,6 +268,40 @@ ipsec4_input(struct mbuf *m, int offset, int proto) return (0); } +int +ipsec4_ctlinput(int code, struct sockaddr *sa, void *v) +{ + struct in_conninfo inc; + struct secasvar *sav; + struct icmp *icp; + struct ip *ip = v; + uint32_t pmtu, spi; + + if (code != PRC_MSGSIZE || ip == NULL) + return (EINVAL); + if (sa->sa_family != AF_INET || + sa->sa_len != sizeof(struct sockaddr_in)) + return (EAFNOSUPPORT); + + icp = __containerof(ip, struct icmp, icmp_ip); + pmtu = ntohs(icp->icmp_nextmtu); + + if (pmtu < V_ip4_ipsec_min_pmtu) + return (EINVAL); + + memcpy(&spi, (caddr_t)ip + (ip->ip_hl << 2), sizeof(spi)); + sav = key_allocsa((union sockaddr_union *)sa, ip->ip_p, spi); + if (sav == NULL) + return (ENOENT); + + key_freesav(&sav); + + memset(&inc, 0, sizeof(inc)); + inc.inc_faddr = satosin(sa)->sin_addr; + tcp_hc_updatemtu(&inc, pmtu); + return (0); +} + /* * IPsec input callback for INET protocols. * This routine is called as the transform callback. @@ -482,6 +518,12 @@ ipsec6_input(struct mbuf *m, int offset, int proto) return (0); } +int +ipsec6_ctlinput(int code, struct sockaddr *sa, void *v) +{ + return (0); +} + /* * IPsec input callback, called by the transform callback. Takes care of * filtering and other sanity checks on the processed packet. diff --git a/sys/netipsec/ipsec_mod.c b/sys/netipsec/ipsec_mod.c index 06523337f9fb..90cffde21968 100644 --- a/sys/netipsec/ipsec_mod.c +++ b/sys/netipsec/ipsec_mod.c @@ -63,6 +63,7 @@ static const struct ipsec_methods ipv4_methods = { .pcbctl = ipsec4_pcbctl, .capability = ipsec4_capability, .check_policy = ipsec4_in_reject, + .ctlinput = ipsec4_ctlinput, .hdrsize = ipsec_hdrsiz_inpcb, .udp_input = udp_ipsec_input, .udp_pcbctl = udp_ipsec_pcbctl, @@ -84,6 +85,7 @@ static const struct ipsec_methods ipv6_methods = { .pcbctl = ipsec6_pcbctl, .capability = ipsec6_capability, .check_policy = ipsec6_in_reject, + .ctlinput = ipsec6_ctlinput, .hdrsize = ipsec_hdrsiz_inpcb, }; #ifndef KLD_MODULE diff --git a/sys/netipsec/ipsec_support.h b/sys/netipsec/ipsec_support.h index b72aee20a7ae..e4d0aea906f1 100644 --- a/sys/netipsec/ipsec_support.h +++ b/sys/netipsec/ipsec_support.h @@ -134,6 +134,8 @@ extern const struct ipsec_support * const ipv6_ipsec_support; (*(proto ## _ipsec_support)->methods->capability)(m, __VA_ARGS__) #define IPSEC_HDRSIZE(proto, inp) \ (*(proto ## _ipsec_support)->methods->hdrsize)(inp) +#define IPSEC_CTLINPUT(proto, code, sa, v) \ + (*(proto ## _ipsec_support)->methods->ctlinput)(code, sa, v) #define UDPENCAP_INPUT(m, ...) \ (*ipv4_ipsec_support->methods->udp_input)(m, __VA_ARGS__) @@ -162,6 +164,8 @@ int ipsec_kmod_pcbctl(struct ipsec_support * const, struct inpcb *, struct sockopt *); int ipsec_kmod_capability(struct ipsec_support * const, struct mbuf *, u_int); size_t ipsec_kmod_hdrsize(struct ipsec_support * const, struct inpcb *); +int ipsec_kmod_ctlinput(struct ipsec_support * const, int, + struct sockaddr *, void *); int ipsec_kmod_udp_input(struct ipsec_support * const, struct mbuf *, int, int); int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *, struct sockopt *); @@ -185,6 +189,8 @@ int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *, ipsec_kmod_capability(proto ## _ipsec_support, __VA_ARGS__) #define IPSEC_HDRSIZE(proto, ...) \ ipsec_kmod_hdrsize(proto ## _ipsec_support, __VA_ARGS__) +#define IPSEC_CTLINPUT(proto, ...) \ + ipsec_kmod_ctlinput(proto ## _ipsec_support, __VA_ARGS__) #endif /* IPSEC_SUPPORT */ #endif /* _KERNEL */ #endif /* _NETIPSEC_IPSEC_SUPPORT_H_ */ diff --git a/sys/netipsec/subr_ipsec.c b/sys/netipsec/subr_ipsec.c index 37b686a7e91e..13c7336154e4 100644 --- a/sys/netipsec/subr_ipsec.c +++ b/sys/netipsec/subr_ipsec.c @@ -366,6 +366,11 @@ IPSEC_KMOD_METHOD(int, ipsec_kmod_forward, sc, (m) ) +IPSEC_KMOD_METHOD(int, ipsec_kmod_ctlinput, sc, + ctlinput, METHOD_DECL(struct ipsec_support * const sc, int code, + struct sockaddr *sa, void *v), METHOD_ARGS(code, sa, v) +) + IPSEC_KMOD_METHOD(int, ipsec_kmod_output, sc, output, METHOD_DECL(struct ipsec_support * const sc, struct mbuf *m, struct inpcb *inp), METHOD_ARGS(m, inp)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202108091004.179A43MD085281>