git: 081ecd9cf028 - stable/13 - tcp: fix TCP MD5 digest computation for TCP over UDP

The branch stable/13 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=081ecd9cf0285a2f094be42792c7bea45bbc72ed

commit 081ecd9cf0285a2f094be42792c7bea45bbc72ed
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2023-06-21 20:48:12 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2023-06-25 19:25:37 +0000

    tcp: fix TCP MD5 digest computation for TCP over UDP
    
    Skip the UDP header for the computation. This is similar to
    skipping IPv6 extension headers.
    
    Reviewed by:            cc, rscheff
    Sponsored by:           Netflix, Inc.
    Differential Revision:  https://reviews.freebsd.org/D40596
    
    (cherry picked from commit 0fb0711dba76a32a2202d2f41d64aa1247b5e51d)
---
 sys/netipsec/xform_tcp.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/sys/netipsec/xform_tcp.c b/sys/netipsec/xform_tcp.c
index ce2552f0a205..e9513d5476d0 100644
--- a/sys/netipsec/xform_tcp.c
+++ b/sys/netipsec/xform_tcp.c
@@ -55,6 +55,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/ip_var.h>
 #include <netinet/tcp.h>
 #include <netinet/tcp_var.h>
+#include <netinet/udp.h>
 
 #include <net/vnet.h>
 
@@ -136,15 +137,20 @@ ip_pseudo_compute(struct mbuf *m, MD5_CTX *ctx)
 {
 	struct ippseudo ipp;
 	struct ip *ip;
+	int hdr_len;
 
 	ip = mtod(m, struct ip *);
 	ipp.ippseudo_src.s_addr = ip->ip_src.s_addr;
 	ipp.ippseudo_dst.s_addr = ip->ip_dst.s_addr;
 	ipp.ippseudo_p = IPPROTO_TCP;
 	ipp.ippseudo_pad = 0;
-	ipp.ippseudo_len = htons(m->m_pkthdr.len - (ip->ip_hl << 2));
+	hdr_len = ip->ip_hl << 2;
+	if (ip->ip_p == IPPROTO_UDP)
+		/* TCP over UDP */
+		hdr_len += sizeof(struct udphdr);
+	ipp.ippseudo_len = htons(m->m_pkthdr.len - hdr_len);
 	MD5Update(ctx, (char *)&ipp, sizeof(ipp));
-	return (ip->ip_hl << 2);
+	return (hdr_len);
 }
 #endif
 
@@ -158,14 +164,20 @@ ip6_pseudo_compute(struct mbuf *m, MD5_CTX *ctx)
 		uint32_t nxt;
 	} ip6p __aligned(4);
 	struct ip6_hdr *ip6;
+	int hdr_len;
 
 	ip6 = mtod(m, struct ip6_hdr *);
 	ip6p.src = ip6->ip6_src;
 	ip6p.dst = ip6->ip6_dst;
-	ip6p.len = htonl(m->m_pkthdr.len - sizeof(*ip6)); /* XXX: ext headers */
+	hdr_len = sizeof(struct ip6_hdr);
+	if (ip6->ip6_nxt == IPPROTO_UDP)
+		/* TCP over UDP */
+		hdr_len += sizeof(struct udphdr);
+	/* XXX: ext headers */
+	ip6p.len = htonl(m->m_pkthdr.len - hdr_len);
 	ip6p.nxt = htonl(IPPROTO_TCP);
 	MD5Update(ctx, (char *)&ip6p, sizeof(ip6p));
-	return (sizeof(*ip6));
+	return (hdr_len);
 }
 #endif