The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=7093414c63b08864dd9348f63e67b39a70c8b1be
commit 7093414c63b08864dd9348f63e67b39a70c8b1be Author: Kristof Provost <[email protected]> AuthorDate: 2023-11-17 12:52:34 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2023-11-17 22:33:44 +0000 pf: sctp heartbeats confirm a connection When we create a new state for multihomed sctp connections (i.e. based on INIT/INIT_ACK or ASCONF parameters) the new connection will never see a COOKIE/COOKIE_ACK exchange. We should consider HEARTBEAT_ACK to be a confirmation that the connection is established. This ensures that such connections do not time out earlier than expected. MFC after: 1 week Sponsored by: Orange Business Services --- sys/net/pfvar.h | 17 ++++++++++------- sys/netpfil/pf/pf.c | 2 +- sys/netpfil/pf/pf_norm.c | 10 +++++++++- 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 27992864c899..4b10190bf9ea 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -1580,13 +1580,16 @@ struct pf_pdesc { #define PFDESC_SCTP_INIT 0x0001 #define PFDESC_SCTP_INIT_ACK 0x0002 #define PFDESC_SCTP_COOKIE 0x0004 -#define PFDESC_SCTP_ABORT 0x0008 -#define PFDESC_SCTP_SHUTDOWN 0x0010 -#define PFDESC_SCTP_SHUTDOWN_COMPLETE 0x0020 -#define PFDESC_SCTP_DATA 0x0040 -#define PFDESC_SCTP_ASCONF 0x0080 -#define PFDESC_SCTP_OTHER 0x0100 -#define PFDESC_SCTP_ADD_IP 0x0200 +#define PFDESC_SCTP_COOKIE_ACK 0x0008 +#define PFDESC_SCTP_ABORT 0x0010 +#define PFDESC_SCTP_SHUTDOWN 0x0020 +#define PFDESC_SCTP_SHUTDOWN_COMPLETE 0x0040 +#define PFDESC_SCTP_DATA 0x0080 +#define PFDESC_SCTP_ASCONF 0x0100 +#define PFDESC_SCTP_HEARTBEAT 0x0200 +#define PFDESC_SCTP_HEARTBEAT_ACK 0x0400 +#define PFDESC_SCTP_OTHER 0x0800 +#define PFDESC_SCTP_ADD_IP 0x1000 u_int16_t sctp_flags; u_int32_t sctp_initiate_tag; diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 082987d34b07..84bd75276af7 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -5932,7 +5932,7 @@ pf_test_state_sctp(struct pf_kstate **state, struct pfi_kkif *kif, dst->scrub->pfss_v_tag = pd->sctp_initiate_tag; } - if (pd->sctp_flags & PFDESC_SCTP_COOKIE) { + if (pd->sctp_flags & (PFDESC_SCTP_COOKIE | PFDESC_SCTP_HEARTBEAT_ACK)) { if (src->state < SCTP_ESTABLISHED) { pf_set_protostate(*state, psrc, SCTP_ESTABLISHED); (*state)->timeout = PFTM_SCTP_ESTABLISHED; diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index fb165cf548b0..a92462c53f15 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -2126,12 +2126,20 @@ pf_scan_sctp(struct mbuf *m, int ipoff, int off, struct pf_pdesc *pd, pd->sctp_flags |= PFDESC_SCTP_SHUTDOWN_COMPLETE; break; case SCTP_COOKIE_ECHO: - case SCTP_COOKIE_ACK: pd->sctp_flags |= PFDESC_SCTP_COOKIE; break; + case SCTP_COOKIE_ACK: + pd->sctp_flags |= PFDESC_SCTP_COOKIE_ACK; + break; case SCTP_DATA: pd->sctp_flags |= PFDESC_SCTP_DATA; break; + case SCTP_HEARTBEAT_REQUEST: + pd->sctp_flags |= PFDESC_SCTP_HEARTBEAT; + break; + case SCTP_HEARTBEAT_ACK: + pd->sctp_flags |= PFDESC_SCTP_HEARTBEAT_ACK; + break; case SCTP_ASCONF: pd->sctp_flags |= PFDESC_SCTP_ASCONF;
