Module Name: src
Committed By: riastradh
Date: Sun Jul 28 14:45:51 UTC 2024
Modified Files:
src/sys/net: if_wg.c
Log Message:
wg(4): On rx of valid ciphertext, make sure to update state machine.
Previously, we also required the plaintext to be a plausible-looking
IP packet before updating the state machine.
But keepalive packets are empty -- and if the peer initiated the
session to rekey after last tx but had no more data to tx, it will
send a keepalive to finish session initiation.
If we didn't update the state machine in that case, we would stay in
INIT_PASSIVE state unable to tx on the session, which would make
things hang.
So make sure to always update the state machine once we have accepted
a packet as genuine, even if it's genuine garbage on the inside.
PR kern/55729: net/if_wg/t_misc:wg_rekey test case fails
PR kern/56252: wg(4) state machine has race conditions
PR kern/58463: if_wg does not work when idle.
To generate a diff of this commit:
cvs rdiff -u -r1.101 -r1.102 src/sys/net/if_wg.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_wg.c
diff -u src/sys/net/if_wg.c:1.101 src/sys/net/if_wg.c:1.102
--- src/sys/net/if_wg.c:1.101 Sun Jul 28 14:45:33 2024
+++ src/sys/net/if_wg.c Sun Jul 28 14:45:51 2024
@@ -1,4 +1,4 @@
-/* $NetBSD: if_wg.c,v 1.101 2024/07/28 14:45:33 riastradh Exp $ */
+/* $NetBSD: if_wg.c,v 1.102 2024/07/28 14:45:51 riastradh Exp $ */
/*
* Copyright (C) Ryota Ozaki <ozaki.ry...@gmail.com>
@@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.101 2024/07/28 14:45:33 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.102 2024/07/28 14:45:51 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_altq_enabled.h"
@@ -2863,7 +2863,7 @@ wg_handle_msg_data(struct wg_softc *wg,
ok = wg_validate_inner_packet(decrypted_buf, decrypted_len, &af);
if (!ok) {
m_freem(n);
- goto out;
+ goto update_state;
}
/*
@@ -2903,6 +2903,7 @@ wg_handle_msg_data(struct wg_softc *wg,
}
n = NULL;
+update_state:
/* Update the state machine if necessary. */
if (__predict_false(state == WGS_STATE_INIT_PASSIVE)) {
/*
