[Bug 253096] TCP MD5 regression on STABLE/13

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=253096

            Bug ID: 253096
           Summary: TCP MD5 regression on STABLE/13
           Product: Base System
           Version: 13.0-STABLE
          Hardware: amd64
                OS: Any
            Status: New
          Keywords: regression
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: zarychtam at plan-b.pwste.edu.pl

Created attachment 222023
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=222023&action=edit
A sample of MD5 signed traffic

I was testing net/bird on 13.0-ALPHA3 and found that BGP MD5 signed IPv4
session with another instance of Bird running on stable/11 cannot be
established.

Please let me describe the scenario.

On affected machine running 13.0-ALPHA I have:

# cat /etc/ipsec.conf 
flush ;
add 172.31.1.2 172.31.1.6 tcp 0x1000 -A tcp-md5 "abigpassword" ;
add 172.31.1.6 172.31.1.2 tcp 0x1001 -A tcp-md5 "abigpassword" ;

# setkey -D
172.31.1.6 172.31.1.2
        tcp mode=any spi=4097(0x00001001) reqid=0(0x00000000)
        A: tcp-md5  61626967 70617373 776f7264
        seq=0x00000000 replay=0 flags=0x00000040 state=mature 
        created: Jan 30 15:32:23 2021   current: Jan 30 15:54:43 2021
        diff: 1340(s)   hard: 0(s)      soft: 0(s)
        last: Jan 30 15:33:05 2021      hard: 0(s)      soft: 0(s)
        current: 440(bytes)     hard: 0(bytes)  soft: 0(bytes)
        allocated: 131  hard: 0 soft: 0
        sadb_seq=1 pid=7647 refcnt=1
172.31.1.2 172.31.1.6
        tcp mode=any spi=4096(0x00001000) reqid=0(0x00000000)
        A: tcp-md5  61626967 70617373 776f7264
        seq=0x00000000 replay=0 flags=0x00000040 state=mature 
        created: Jan 30 15:32:23 2021   current: Jan 30 15:54:43 2021
        diff: 1340(s)   hard: 0(s)      soft: 0(s)
        last: Jan 30 15:33:05 2021      hard: 0(s)      soft: 0(s)
        current: 4111(bytes)    hard: 0(bytes)  soft: 0(bytes)
        allocated: 52   hard: 0 soft: 0
        sadb_seq=0 pid=7647 refcnt=1

On machine running stable/11 I have:

# cat /etc/ipsec.conf
flush ;

add 172.31.1.6 172.31.1.2 tcp 0x1000 -A tcp-md5 "abigpassword" ;
add 172.31.1.2 172.31.1.6 tcp 0x1001 -A tcp-md5 "abigpassword" ;

# setkey -D
172.31.1.2 172.31.1.6
        tcp mode=any spi=4097(0x00001001) reqid=0(0x00000000)
        A: tcp-md5  61626967 70617373 776f7264
        seq=0x00000000 replay=0 flags=0x00000040 state=mature 
        created: Jan 30 15:18:20 2021   current: Jan 30 15:55:13 2021
        diff: 2213(s)   hard: 0(s)      soft: 0(s)
        last: Jan 30 15:26:32 2021      hard: 0(s)      soft: 0(s)
        current: 8031(bytes)    hard: 0(bytes)  soft: 0(bytes)
        allocated: 101  hard: 0 soft: 0
        sadb_seq=1 pid=85243 refcnt=1
172.31.1.6 172.31.1.2
        tcp mode=any spi=4096(0x00001000) reqid=0(0x00000000)
        A: tcp-md5  61626967 70617373 776f7264
        seq=0x00000000 replay=0 flags=0x00000040 state=mature 
        created: Jan 30 15:18:20 2021   current: Jan 30 15:55:13 2021
        diff: 2213(s)   hard: 0(s)      soft: 0(s)
        last: Jan 30 15:33:05 2021      hard: 0(s)      soft: 0(s)
        current: 10226(bytes)   hard: 0(bytes)  soft: 0(bytes)
        allocated: 131  hard: 0 soft: 0
        sadb_seq=0 pid=85243 refcnt=1

So far, everything looks fine, now for easier debugging I take nc(1) and try to
transmit some signed TCP segments. They arrive from stable/11 to stable/13 as
signed correctly, but the responding traffic is reported to be signed
incorrectly (please see attached dumps). The handshake looks fine, but the
segments send later from the affected stable/13 have invalid signatures what is
reported accordingly on both sides.

-- 
You are receiving this mail because:
You are the assignee for the bug.