diff options
| author | Robert Wing <rew@FreeBSD.org> | 2021-12-20 20:30:24 +0000 |
|---|---|---|
| committer | Robert Wing <rew@FreeBSD.org> | 2022-02-23 18:19:59 +0000 |
| commit | 95eea15111b0aca59c3fe8b0f9b33fd38df6ee9f (patch) | |
| tree | 1115d876c68d9f33e16773e55bfd091e98782f55 | |
| parent | bcc9518b98b3c6c7ac9d45dffd947592a5e9993a (diff) | |
| download | src-95eea15111b0aca59c3fe8b0f9b33fd38df6ee9f.tar.gz src-95eea15111b0aca59c3fe8b0f9b33fd38df6ee9f.zip | |
tcp_twrespond: send signed segment when connection is TCP-MD5
When a connection is established to use TCP-MD5, tcp_twrespond() doesn't
respond with a signed segment. This results in the host performing the
active close to remain in a TIME_WAIT state and the other host in the
LAST_ACK state. Fix this by sending a signed segment when the connection
is established to use TCP-MD5.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D33490
(cherry picked from commit 2a28b045ca7f9b24dc2a8fee2148578edfc87143)
| -rw-r--r-- | sys/netinet/tcp_timewait.c | 16 | ||||
| -rw-r--r-- | sys/netinet/tcp_var.h | 2 |
2 files changed, 17 insertions, 1 deletions
diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c index 0ed3856b68a4..ee31c449cd1e 100644 --- a/sys/netinet/tcp_timewait.c +++ b/sys/netinet/tcp_timewait.c @@ -36,6 +36,7 @@ __FBSDID("$FreeBSD$"); #include "opt_inet.h" #include "opt_inet6.h" +#include "opt_ipsec.h" #include "opt_tcpdebug.h" #include <sys/param.h> @@ -95,6 +96,9 @@ __FBSDID("$FreeBSD$"); #include <netinet/udp.h> #include <netinet/udp_var.h> + +#include <netipsec/ipsec_support.h> + #include <machine/in_cksum.h> #include <security/mac/mac_framework.h> @@ -326,6 +330,7 @@ tcp_twstart(struct tcpcb *tp) tw->irs = tp->irs; tw->t_starttime = tp->t_starttime; tw->tw_time = 0; + tw->tw_flags = tp->t_flags; /* XXX * If this code will @@ -648,6 +653,10 @@ tcp_twrespond(struct tcptw *tw, int flags) to.to_tsval = tcp_ts_getticks() + tw->ts_offset; to.to_tsecr = tw->t_recent; } +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if (tw->tw_flags & TF_SIGNATURE) + to.to_flags |= TOF_SIGNATURE; +#endif optlen = tcp_addoptions(&to, (u_char *)(th + 1)); if (udp) { @@ -665,6 +674,13 @@ tcp_twrespond(struct tcptw *tw, int flags) th->th_flags = flags; th->th_win = htons(tw->last_win); +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if (tw->tw_flags & TF_SIGNATURE) { + if (!TCPMD5_ENABLED() || + TCPMD5_OUTPUT(m, th, to.to_signature) != 0) + return (-1); + } +#endif #ifdef INET6 if (isipv6) { if (tw->t_port) { diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h index 3dfe3cc2a035..4a05f0f5ab2e 100644 --- a/sys/netinet/tcp_var.h +++ b/sys/netinet/tcp_var.h @@ -538,7 +538,7 @@ struct tcptw { int tw_time; TAILQ_ENTRY(tcptw) tw_2msl; void *tw_pspare; /* TCP_SIGNATURE */ - u_int *tw_spare; /* TCP_SIGNATURE */ + u_int tw_flags; /* tcpcb t_flags */ }; #define intotcpcb(ip) ((struct tcpcb *)(ip)->inp_ppcb) |