Page MenuHomeFreeBSD

Add ESP dummy frames support
ClosedPublic

Authored by aurelien.cazuc.external_stormshield.eu on Nov 26 2019, 9:45 AM.
Tags
None
Referenced Files
F106115212: D22557.diff
Wed, Dec 25, 3:42 PM
Unknown Object (File)
Thu, Dec 12, 6:30 PM
Unknown Object (File)
Sat, Dec 7, 10:58 PM
Unknown Object (File)
Fri, Dec 6, 7:57 AM
Unknown Object (File)
Wed, Dec 4, 1:21 PM
Unknown Object (File)
Nov 22 2024, 9:10 AM
Unknown Object (File)
Oct 6 2024, 4:24 AM
Unknown Object (File)
Oct 5 2024, 10:33 PM
Subscribers

Details

Summary

This patch provides support of dummy frames as specified by RFC 4303
Packets with IPPROTO_NONE are silently dropped just before ipsecX_common_input_cb

Test Plan

In manual testing, when generating packets with IPPROTO_NONE as next_header, packets are correctly dropped

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

sys/netipsec/xform_esp.c
629

This indentation does not conform to style(9). I think you can just use

if (lastthree[2] == IPPROTO_NONE)
      goto bad;

the error variable should already be zero.

This revision is now accepted and ready to land.Nov 27 2019, 12:45 AM

Hi @ae ,

Would you prefer commit it yourself or let fabient commit it ?
If you commit it yourself, please mention Stormshield as sponsor.

Thanks