On 2019/02/26 16:34, Tobias Heider wrote:
> Hi,
>
> this diff adds support for IKEv2 Message Fragmentation as defined in
> RFC 7383 (https://tools.ietf.org/html/rfc7383) to iked(8).
Thank you, I know there are quite a few additions in the genua tree and
splitting them out is not easy. I'm running this in a few places now,
have tested both with and without fragmentation, no problems seen.
A couple of nits - manpage part is missing, I propose this:
Index: iked.conf.5
===================================================================
RCS file: /cvs/src/sbin/iked/iked.conf.5,v
retrieving revision 1.53
diff -u -p -r1.53 iked.conf.5
--- iked.conf.5 31 Jan 2018 13:25:55 -0000 1.53
+++ iked.conf.5 27 Feb 2019 12:45:46 -0000
@@ -136,6 +136,12 @@ This is the default.
.It Ic set decouple
Don't load the negotiated SAs and flows from the kernel.
This mode is only useful for testing and debugging.
+.It Ic set fragmentation
+Enable IKEv2 Message Fragmentation (RFC 7383) support.
+This allows IKEv2 to operate in environments that might block IP fragments.
+.It Ic set nofragmentation
+Disables IKEv2 Message Fragmentation support.
+This is the default.
.It Ic set mobike
Enable MOBIKE (RFC 4555) support.
This is the default.
There are some over-long lines - it's not fair to require <=80 for
everything in this diff when big parts of iked already exceed this,
but some of the longer ones need reining in e.g.
> Index: sbin/iked/iked.h
..
|------------------------------------------------------------------------------|
> +#define IKED_FRAG_TOTAL_MAX 111 /* upper limit of
> frag_total (64kB / 576B) */
...#define IKED_FRAG_TOTAL_MAX 111 /* upper limit of frag_total (64kB /
576B) */
> struct iked_message *
> ikev2_msg_lookup(struct iked *, struct iked_msgqueue *,
> struct iked_message *, struct ike_header *);
> +void ikev2_msg_lookup_dispose_all(struct iked *env, struct iked_msgqueue
> *queue,
> + struct iked_message *msg, struct ike_header *hdr);
> +int ikev2_msg_lookup_retransmit_all(struct iked *env, struct iked_msgqueue
> *queue,
> + struct iked_message *msg, struct ike_header *hdr, struct iked_sa
> *sa);
...(split onto another line)
> Index: sbin/iked/ikev2.c
..
> - if ((m = ikev2_msg_lookup(env, &sa->sa_responses, msg, hdr))) {
> - if (ikev2_msg_retransmit_response(env, sa, m)) {
> + if ((r = ikev2_msg_lookup_retransmit_all(env,
> &sa->sa_responses, msg, hdr, sa)) != 0) {
> + if (r == -1) {
...(and here)
I've done that in my tree.
Are there comments from anyone else?
