git: 95eea15111b0 - stable/13 - tcp_twrespond: send signed segment when connection is TCP-MD5
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 23 Feb 2022 18:25:07 UTC
The branch stable/13 has been updated by rew: URL: https://cgit.FreeBSD.org/src/commit/?id=95eea15111b0aca59c3fe8b0f9b33fd38df6ee9f commit 95eea15111b0aca59c3fe8b0f9b33fd38df6ee9f Author: Robert Wing <rew@FreeBSD.org> AuthorDate: 2021-12-20 20:30:24 +0000 Commit: Robert Wing <rew@FreeBSD.org> CommitDate: 2022-02-23 18:19:59 +0000 tcp_twrespond: send signed segment when connection is TCP-MD5 When a connection is established to use TCP-MD5, tcp_twrespond() doesn't respond with a signed segment. This results in the host performing the active close to remain in a TIME_WAIT state and the other host in the LAST_ACK state. Fix this by sending a signed segment when the connection is established to use TCP-MD5. Reviewed by: glebius Differential Revision: https://reviews.freebsd.org/D33490 (cherry picked from commit 2a28b045ca7f9b24dc2a8fee2148578edfc87143) --- sys/netinet/tcp_timewait.c | 16 ++++++++++++++++ sys/netinet/tcp_var.h | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c index 0ed3856b68a4..ee31c449cd1e 100644 --- a/sys/netinet/tcp_timewait.c +++ b/sys/netinet/tcp_timewait.c @@ -36,6 +36,7 @@ __FBSDID("$FreeBSD$"); #include "opt_inet.h" #include "opt_inet6.h" +#include "opt_ipsec.h" #include "opt_tcpdebug.h" #include <sys/param.h> @@ -95,6 +96,9 @@ __FBSDID("$FreeBSD$"); #include <netinet/udp.h> #include <netinet/udp_var.h> + +#include <netipsec/ipsec_support.h> + #include <machine/in_cksum.h> #include <security/mac/mac_framework.h> @@ -326,6 +330,7 @@ tcp_twstart(struct tcpcb *tp) tw->irs = tp->irs; tw->t_starttime = tp->t_starttime; tw->tw_time = 0; + tw->tw_flags = tp->t_flags; /* XXX * If this code will @@ -648,6 +653,10 @@ tcp_twrespond(struct tcptw *tw, int flags) to.to_tsval = tcp_ts_getticks() + tw->ts_offset; to.to_tsecr = tw->t_recent; } +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if (tw->tw_flags & TF_SIGNATURE) + to.to_flags |= TOF_SIGNATURE; +#endif optlen = tcp_addoptions(&to, (u_char *)(th + 1)); if (udp) { @@ -665,6 +674,13 @@ tcp_twrespond(struct tcptw *tw, int flags) th->th_flags = flags; th->th_win = htons(tw->last_win); +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if (tw->tw_flags & TF_SIGNATURE) { + if (!TCPMD5_ENABLED() || + TCPMD5_OUTPUT(m, th, to.to_signature) != 0) + return (-1); + } +#endif #ifdef INET6 if (isipv6) { if (tw->t_port) { diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h index 3dfe3cc2a035..4a05f0f5ab2e 100644 --- a/sys/netinet/tcp_var.h +++ b/sys/netinet/tcp_var.h @@ -538,7 +538,7 @@ struct tcptw { int tw_time; TAILQ_ENTRY(tcptw) tw_2msl; void *tw_pspare; /* TCP_SIGNATURE */ - u_int *tw_spare; /* TCP_SIGNATURE */ + u_int tw_flags; /* tcpcb t_flags */ }; #define intotcpcb(ip) ((struct tcpcb *)(ip)->inp_ppcb)