Page MenuHomeFreeBSD
Files F163271795

D45762.id140319.diff
No OneTemporary
Actions

D45762.id140319.diff
View Options

diff --git a/sys/net/if_enc.c b/sys/net/if_enc.c
--- a/sys/net/if_enc.c
+++ b/sys/net/if_enc.c
@@ -289,6 +289,15 @@
#ifdef INET
case AF_INET:
ph = V_inet_pfil_head;
+ /*
+ * Both ipfw and pf do not expect the first mbuf being empty,
+ * as a result they may start reading the outer IP header which
+ * should be treated as stripped. It makes sense if the
+ * following is configured:
+ * sysctl net.enc.in.ipsec_filter_mask=2
+ */
+ if ((*ctx->mp)->m_len == 0)
+ *ctx->mp = m_pullup(*ctx->mp, sizeof(struct ip));
break;
#endif
#ifdef INET6
diff --git a/tests/sys/net/Makefile b/tests/sys/net/Makefile
--- a/tests/sys/net/Makefile
+++ b/tests/sys/net/Makefile
@@ -3,6 +3,7 @@
TESTSDIR= ${TESTSBASE}/sys/net
BINDIR= ${TESTSDIR}
+ATF_TESTS_SH+= if_enc
ATF_TESTS_C+= if_epair
ATF_TESTS_SH+= if_epair_test
ATF_TESTS_SH+= if_bridge_test
diff --git a/tests/sys/net/if_enc.sh b/tests/sys/net/if_enc.sh
new file mode 100644
--- /dev/null
+++ b/tests/sys/net/if_enc.sh
@@ -0,0 +1,165 @@
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+# Copyright (c) 2024 Igor Ostapenko <pm@igoro.pro>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in the
+# documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+. $(atf_get_srcdir)/../common/vnet.subr
+
+#
+# The following network is used as a base for testing.
+#
+#
+# ${awan}b |----------| ${bwan}b
+# 2.0.0.1 | host wan | 3.0.0.1
+# ---->| Internet |<----
+# A WAN / |----------| \ B WAN
+# | |
+# Office A side | | Office B side
+# | ${awan}a ${bwan}a |
+# v 2.0.0.22 3.0.0.33 v
+# ${alan}b |----------| |----------| ${blan}b
+# 1.0.0.1 | host agw | | host bgw | 4.0.0.1
+# ----------->| gateway | < IPsec > | gateway |<-----------
+# / A LAN |----------| tunnel |----------| B LAN \
+# | |
+# | |
+# | ${alan}a ${blan}a |
+# v 1.0.0.11 4.0.0.44 v
+# |----------| |----------|
+# | host a | | host b |
+# | client | | client |
+# |----------| |----------|
+#
+#
+# There is routing between office A clients and office B ones. The traffic is
+# encrypted, i.e. host wan should see IPsec flow (ESP packets).
+#
+
+atf_test_case "ip4_pfil_in_after_stripping" "cleanup"
+ip4_pfil_in_after_stripping_head()
+{
+ atf_set descr 'Test that if_enc pulls up mbuf if m_len==0 after stripping the outer header'
+ atf_set require.user root
+ atf_set require.progs nc
+}
+ip4_pfil_in_after_stripping_body()
+{
+ vnet_init
+ if ! sysctl -q kern.features.ipsec >/dev/null ; then
+ atf_skip "This test requires ipsec"
+ fi
+ if ! kldstat -q -m if_enc; then
+ atf_skip "This test requires if_enc"
+ fi
+ if [ ! -c /dev/pf ]; then
+ atf_skip "This test requires pf"
+ fi
+
+ alan=$(vnet_mkepair)
+ awan=$(vnet_mkepair)
+ bwan=$(vnet_mkepair)
+ blan=$(vnet_mkepair)
+
+ # host a
+ vnet_mkjail a ${alan}a
+ jexec a ifconfig ${alan}a 1.0.0.11/24 up
+ jexec a route add default 1.0.0.1
+
+ # host agw
+ vnet_mkjail agw ${alan}b ${awan}a
+ jexec agw ifconfig ${alan}b 1.0.0.1/24 up
+ jexec agw ifconfig ${awan}a 2.0.0.22/24 up
+ jexec agw route add default 2.0.0.1
+ jexec agw sysctl net.inet.ip.forwarding=1
+
+ # host wan
+ vnet_mkjail wan ${awan}b ${bwan}b
+ jexec wan ifconfig ${awan}b 2.0.0.1/24 up
+ jexec wan ifconfig ${bwan}b 3.0.0.1/24 up
+ jexec wan sysctl net.inet.ip.forwarding=1
+
+ # host bgw
+ vnet_mkjail bgw ${bwan}a ${blan}b
+ jexec bgw ifconfig ${bwan}a 3.0.0.33/24 up
+ jexec bgw ifconfig ${blan}b 4.0.0.1/24 up
+ jexec bgw route add default 3.0.0.1
+ jexec bgw sysctl net.inet.ip.forwarding=1
+
+ # host b
+ vnet_mkjail b ${blan}a
+ jexec b ifconfig ${blan}a 4.0.0.44/24 up
+ jexec b route add default 4.0.0.1
+
+ # Office A VPN setup
+ echo '
+ spdadd 1.0.0.0/24 4.0.0.0/24 any -P out ipsec esp/tunnel/2.0.0.22-3.0.0.33/require;
+ spdadd 4.0.0.0/24 1.0.0.0/24 any -P in ipsec esp/tunnel/3.0.0.33-2.0.0.22/require;
+ add 2.0.0.22 3.0.0.33 esp 0x203 -E aes-gcm-16 "123456789012345678901234567890123456";
+ add 3.0.0.33 2.0.0.22 esp 0x302 -E aes-gcm-16 "123456789012345678901234567890123456";
+ ' | jexec agw setkey -c
+
+ # Office B VPN setup
+ echo '
+ spdadd 4.0.0.0/24 1.0.0.0/24 any -P out ipsec esp/tunnel/3.0.0.33-2.0.0.22/require;
+ spdadd 1.0.0.0/24 4.0.0.0/24 any -P in ipsec esp/tunnel/2.0.0.22-3.0.0.33/require;
+ add 2.0.0.22 3.0.0.33 esp 0x203 -E aes-gcm-16 "123456789012345678901234567890123456";
+ add 3.0.0.33 2.0.0.22 esp 0x302 -E aes-gcm-16 "123456789012345678901234567890123456";
+ ' | jexec bgw setkey -c
+
+ # Sanity check
+ atf_check -s exit:0 -o ignore jexec a ping -c3 4.0.0.44
+
+ # Configure port forwarding on host bgw
+ jexec bgw ifconfig enc0 up
+ jexec bgw sysctl net.inet.ipsec.filtertunnel=0
+ jexec bgw sysctl net.enc.in.ipsec_filter_mask=2 # after stripping
+ jexec bgw sysctl net.enc.out.ipsec_filter_mask=1 # before outer header
+ echo '
+ rdr on enc0 proto tcp to 4.0.0.1 port 666 -> 4.0.0.44
+ pass
+ ' | jexec bgw pfctl -ef-
+
+ # Prepare the catcher on host b
+ echo "unexpected" > ./receiver
+ jexec b nc -n4l -N 666 > ./receiver &
+ nc_pid=$!
+ sleep 1
+
+ # Poke it from host a to host bgw
+ spell="Ak Ohum Oktay Weez Barsoom."
+ echo $spell | jexec a nc -w3 4.0.0.1 666
+
+ # Expect it to hit host b instead
+ jexec b kill -KILL $nc_pid
+ atf_check_equal "$spell" "$(cat ./receiver)"
+}
+ip4_pfil_in_after_stripping_cleanup()
+{
+ vnet_cleanup
+}
+
+atf_init_test_cases()
+{
+ atf_add_test_case "ip4_pfil_in_after_stripping"
+}

File Metadata

Mime Type
text/plain
Expires
Wed, Jul 22, 3:21 PM (1 h, 17 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35369264
Default Alt Text
D45762.id140319.diff (7 KB)

Event Timeline