From nobody Wed Jun 21 20:57:35 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4QmbRg2bmbz4g7Gt; Wed, 21 Jun 2023 20:57:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4QmbRg29s1z42ZN; Wed, 21 Jun 2023 20:57:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1687381055; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sIIYhDDt+XUT1fOxrwP6d3WF6qQl5Q2hu+DBGkztm9s=; b=GTtCAAKKNtfA+rvow67S5QS5ikyc5wYvILK8qdaG88VFL960IQz0jpmV/LobhJpVwZpoqG bG3U2EUPsL60dvHbCtt+TaPRkk6t8fNxYF3seya0f55zBOOAa/bIF2asuOx2gwHC5i301h zUjmEpbR3IIJ9IhxaAkmG0RcttycCyBMk2Fm+Zb0+LyNJawlXxgzLSNmf7wcoP+mxTZhrP iaTYhk/vL+zO/Z2O74Oid+uQiEHSHGRfh+7fTQtmi3rPehuVN6r0qd7e47pZrPHvFa8Cqj lZgZo9VOjg86cWh8LbHzoPpSVo7VFI5/ij+faaRYYDH27j9uBUSYUT4ImC+pIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1687381055; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sIIYhDDt+XUT1fOxrwP6d3WF6qQl5Q2hu+DBGkztm9s=; b=uFCP5K3pGLVAN8eO/Syj+oSC11/7sevSgK1j8qAuFRelRqB31W3RSMCWjjEz2aCE1Bt+zm QRotLmSHxASz3lno7GLuF4jhvkkye697pbiR5pEv5fbx07R8Ir0JFdJHnrWYOlDw6SimUh mPCnjQyLeAbbYGcZ0TxcrGvJWScZm6r7qNkmamXveno6ascMteuRyt4nD5eiwqrYE6zC7K SP+/LZq4ArryCSBWMUIs5gzeaeaof85qjrTe2JlInKk9HH6yImfAW6FAVmk8oC+66oJJjk mQFAkOBBP3roBPheAQksFvuWnlgkIMkAGwCSfojcfvtRSp9n3oj1tdtR/xbW8A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1687381055; a=rsa-sha256; cv=none; b=UU0PGTxwVom2Xz2VyF6lCPd41RQsnmXwOYBUdQzZas4L88ig72vD1riH7iYXsZxVCQzrZs j82hR5//MAqc9NMeaky5mrktsAZn9z6lEQGylDxRlMV52WznzvhpjViOvgLYbgPtt3077b ZpKMcQtBmtgn1yRvVYtJFZqU/ESHlLTs+dlIV6+5n/P4KQxzCvX3lzF+rS1hS1A2IaAX6h WJlyB1erv16PzvjZ/NRv74fQn+e4b/6yKYE9U8rPfeRDO+/61OUdAVoLHxeBwp7dUMRI60 y1L1M28/Db3ny0aejFLN62tfFHb38R7OBYsJyl/Vub0pjZ8telErzuTvAOCBXw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4QmbRg1GjnzwPL; Wed, 21 Jun 2023 20:57:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 35LKvZX1067097; Wed, 21 Jun 2023 20:57:35 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 35LKvZMJ067096; Wed, 21 Jun 2023 20:57:35 GMT (envelope-from git) Date: Wed, 21 Jun 2023 20:57:35 GMT Message-Id: <202306212057.35LKvZMJ067096@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: 02b885b09d1e - main - tcp: fix TCP MD5 computation for the BBR and RACK stack List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 02b885b09d1e90574162a1442b9ede06cef2b13a Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=02b885b09d1e90574162a1442b9ede06cef2b13a commit 02b885b09d1e90574162a1442b9ede06cef2b13a Author: Michael Tuexen AuthorDate: 2023-06-21 20:54:33 +0000 Commit: Michael Tuexen CommitDate: 2023-06-21 20:54:33 +0000 tcp: fix TCP MD5 computation for the BBR and RACK stack PR: 253096 Reviewed by: cc, rscheff MFC after: 3 days Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D40597 --- sys/netinet/tcp_stacks/bbr.c | 10 +++---- sys/netinet/tcp_stacks/rack.c | 66 ++++++++++++++++++++++++++++++++++++------- 2 files changed, 61 insertions(+), 15 deletions(-) diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c index d9952ba6bd14..1bc20de9e503 100644 --- a/sys/netinet/tcp_stacks/bbr.c +++ b/sys/netinet/tcp_stacks/bbr.c @@ -13377,6 +13377,11 @@ send: * the pointer in case of a stack switch. */ tp->snd_up = tp->snd_una; + /* + * Put TCP length in extended header, and then checksum extended + * header and data. + */ + m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */ #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) if (to.to_flags & TOF_SIGNATURE) { @@ -13396,11 +13401,6 @@ send: } #endif - /* - * Put TCP length in extended header, and then checksum extended - * header and data. - */ - m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */ #ifdef INET6 if (isipv6) { /* diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index c4d4923fb592..59dd113c03d5 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -18747,6 +18747,11 @@ rack_fast_rsm_output(struct tcpcb *tp, struct tcp_rack *rack, struct rack_sendma to.to_tsecr = tp->ts_recent; to.to_flags = TOF_TS; } +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + /* TCP-MD5 (RFC2385). */ + if (tp->t_flags & TF_SIGNATURE) + to.to_flags |= TOF_SIGNATURE; +#endif optlen = tcp_addoptions(&to, opt); hdrlen += optlen; udp = rack->r_ctl.fsb.udp; @@ -18906,6 +18911,24 @@ rack_fast_rsm_output(struct tcpcb *tp, struct tcp_rack *rack, struct rack_sendma } tcp_set_flags(th, flags); m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */ +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if (to.to_flags & TOF_SIGNATURE) { + /* + * Calculate MD5 signature and put it into the place + * determined before. + * NOTE: since TCP options buffer doesn't point into + * mbuf's data, calculate offset and use it. + */ + if (!TCPMD5_ENABLED() || TCPMD5_OUTPUT(m, th, + (u_char *)(th + 1) + (to.to_signature - opt)) != 0) { + /* + * Do not send segment if the calculation of MD5 + * digest has failed. + */ + goto failed; + } + } +#endif #ifdef INET6 if (rack->r_is_v6) { if (tp->t_port) { @@ -19312,6 +19335,11 @@ rack_fast_output(struct tcpcb *tp, struct tcp_rack *rack, uint64_t ts_val, to.to_tsecr = tp->ts_recent; to.to_flags = TOF_TS; } +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + /* TCP-MD5 (RFC2385). */ + if (tp->t_flags & TF_SIGNATURE) + to.to_flags |= TOF_SIGNATURE; +#endif optlen = tcp_addoptions(&to, opt); hdrlen += optlen; udp = rack->r_ctl.fsb.udp; @@ -19451,6 +19479,24 @@ again: } tcp_set_flags(th, flags); m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */ +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if (to.to_flags & TOF_SIGNATURE) { + /* + * Calculate MD5 signature and put it into the place + * determined before. + * NOTE: since TCP options buffer doesn't point into + * mbuf's data, calculate offset and use it. + */ + if (!TCPMD5_ENABLED() || TCPMD5_OUTPUT(m, th, + (u_char *)(th + 1) + (to.to_signature - opt)) != 0) { + /* + * Do not send segment if the calculation of MD5 + * digest has failed. + */ + goto failed; + } + } +#endif #ifdef INET6 if (rack->r_is_v6) { if (tp->t_port) { @@ -21337,7 +21383,7 @@ send: /* TCP-MD5 (RFC2385). */ if (tp->t_flags & TF_SIGNATURE) to.to_flags |= TOF_SIGNATURE; -#endif /* TCP_SIGNATURE */ +#endif /* Processing the options. */ hdrlen += optlen = tcp_addoptions(&to, opt); @@ -21831,6 +21877,15 @@ send: if (udp) udp = (struct udphdr *)(cpto + ((uint8_t *)rack->r_ctl.fsb.udp - rack->r_ctl.fsb.tcp_ip_hdr)); } + if (optlen) { + bcopy(opt, th + 1, optlen); + th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; + } + /* + * Put TCP length in extended header, and then checksum extended + * header and data. + */ + m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */ #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) if (to.to_flags & TOF_SIGNATURE) { /* @@ -21849,15 +21904,6 @@ send: } } #endif - if (optlen) { - bcopy(opt, th + 1, optlen); - th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; - } - /* - * Put TCP length in extended header, and then checksum extended - * header and data. - */ - m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */ #ifdef INET6 if (isipv6) { /*