tree a090fe622389428cd3db319ea783e8e66416fc09
parent 5484daa001ccbbbf8773b273f428dbcddc4750cc
author Alexander Chernavin <achernavin@netgate.com> 1585148212 -0400
committer Neale Ranns <nranns@cisco.com> 1585645603 +0000

ipsec: fix udp-encap in transport mode

Now UDP enacapsulation doesn't work in transport mode with crypto
algorithms that have iv_sz=8 like AES GCM or 3DES CBC. That happens
because the inserted UDP header overlaps with the old IP header and
gets filled before the information from the old IP header can be
copied to a new IP header. The result is a broken packet:

00:03:39:620863: esp4-encrypt-tun
  esp: sa-index 3 spi 3464048590 (0xce792fce) seq 31 sa-seq-hi 0
    crypto aes-gcm-128 integrity none udp-encap-enabled
00:03:39:620867: adj-midchain-tx
  ...
00:03:39:620868: ip4-rewrite
  ...
00:03:39:620869: GigabitEthernet0/8/0-output
  GigabitEthernet0/8/0
  IP4: 08:00:27:a9:6b:d6 -> 08:00:27:5a:dd:0c
  UDP: 10.255.0.10 -> 10.255.0.20
    version 0, header length 0
    tos 0x80, ttl 63, length 0, checksum 0x653e (should be 0xffff)
      dscp CS4 ecn NON_ECN
    fragment id 0x0000
  UDP: 128 -> 0
    length 0, checksum 0x0000
00:03:39:620870: GigabitEthernet0/8/0-tx
  GigabitEthernet0/8/0 tx queue 0
  ...
  IP4: 08:00:27:a9:6b:d6 -> 08:00:27:5a:dd:0c
  UDP: 10.255.0.10 -> 10.255.0.20
    version 0, header length 0
    tos 0x80, ttl 63, length 0, checksum 0x653e (should be 0xffff)
      dscp CS4 ecn NON_ECN
    fragment id 0x0000
  UDP: 128 -> 0
    length 0, checksum 0x0000

With this commit, fill UDP header after copying the IP headers in
transport mode.

Type: fix

Change-Id: Ie9a6e562aa05a8378114329d6a9ff395189fa6a8
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>