git: 95eea15111b0 - stable/13 - tcp_twrespond: send signed segment when connection is TCP-MD5

[Robert Wing]

The branch stable/13 has been updated by rew:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=95eea15111b0aca59c3fe8b0f9b33fd38df6ee9f

commit 95eea15111b0aca59c3fe8b0f9b33fd38df6ee9f
Author:     Robert Wing <r...@freebsd.org>
AuthorDate: 2021-12-20 20:30:24 +0000
Commit:     Robert Wing <r...@freebsd.org>
CommitDate: 2022-02-23 18:19:59 +0000

    tcp_twrespond: send signed segment when connection is TCP-MD5
    
    When a connection is established to use TCP-MD5, tcp_twrespond() doesn't
    respond with a signed segment. This results in the host performing the
    active close to remain in a TIME_WAIT state and the other host in the
    LAST_ACK state. Fix this by sending a signed segment when the connection
    is established to use TCP-MD5.
    
    Reviewed by:    glebius
    Differential Revision:  https://reviews.freebsd.org/D33490
    
    (cherry picked from commit 2a28b045ca7f9b24dc2a8fee2148578edfc87143)
---
 sys/netinet/tcp_timewait.c | 16 ++++++++++++++++
 sys/netinet/tcp_var.h      |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c
index 0ed3856b68a4..ee31c449cd1e 100644
--- a/sys/netinet/tcp_timewait.c
+++ b/sys/netinet/tcp_timewait.c
@@ -36,6 +36,7 @@ __FBSDID("$FreeBSD$");
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_ipsec.h"
 #include "opt_tcpdebug.h"
 
 #include <sys/param.h>
@@ -95,6 +96,9 @@ __FBSDID("$FreeBSD$");
 
 #include <netinet/udp.h>
 #include <netinet/udp_var.h>
+
+#include <netipsec/ipsec_support.h>
+
 #include <machine/in_cksum.h>
 
 #include <security/mac/mac_framework.h>
@@ -326,6 +330,7 @@ tcp_twstart(struct tcpcb *tp)
        tw->irs     = tp->irs;
        tw->t_starttime = tp->t_starttime;
        tw->tw_time = 0;
+       tw->tw_flags = tp->t_flags;
 
 /* XXX
  * If this code will
@@ -648,6 +653,10 @@ tcp_twrespond(struct tcptw *tw, int flags)
                to.to_tsval = tcp_ts_getticks() + tw->ts_offset;
                to.to_tsecr = tw->t_recent;
        }
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+       if (tw->tw_flags & TF_SIGNATURE)
+               to.to_flags |= TOF_SIGNATURE;
+#endif
        optlen = tcp_addoptions(&to, (u_char *)(th + 1));
 
        if (udp) {
@@ -665,6 +674,13 @@ tcp_twrespond(struct tcptw *tw, int flags)
        th->th_flags = flags;
        th->th_win = htons(tw->last_win);
 
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+       if (tw->tw_flags & TF_SIGNATURE) {
+               if (!TCPMD5_ENABLED() ||
+                   TCPMD5_OUTPUT(m, th, to.to_signature) != 0)
+                       return (-1);
+       }
+#endif
 #ifdef INET6
        if (isipv6) {
                if (tw->t_port) {
diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h
index 3dfe3cc2a035..4a05f0f5ab2e 100644
--- a/sys/netinet/tcp_var.h
+++ b/sys/netinet/tcp_var.h
@@ -538,7 +538,7 @@ struct tcptw {
        int             tw_time;
        TAILQ_ENTRY(tcptw) tw_2msl;
        void            *tw_pspare;     /* TCP_SIGNATURE */
-       u_int           *tw_spare;      /* TCP_SIGNATURE */
+       u_int           tw_flags;       /* tcpcb t_flags */
 };
 
 #define        intotcpcb(ip)   ((struct tcpcb *)(ip)->inp_ppcb)