ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec: Improve the handling of NAT-T keepalive messages

Browse Source 
Type: improvement

Ethernet frames on the wire are a minimum of 64 bytes, so use the length in the UDP header to determine if the ESP payload is one bytes of the special SPI, rather than the buffer's size (which will include the ethernet header's padding).
In the case of drop advance the packet back to the IP header so the ipx-drop node sees a sane packet.

Signed-off-by: Neale Ranns <neale@graphiant.com>
Change-Id: Ic3b75487919f0c77507d6f725bd11202bc5afee8
This commit is contained in:
Neale Ranns
2022-01-10 11:21:17 +00:00
committed by Matthew Smith
parent e2b15863f9
commit 992a4d0d4e
2 changed files with 34 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
test/template_ipsec.py
View File

@ -1293,10 +1293,13 @@ class IpsecTun4(object):
self.verify_counters4(p, count)
def verify_keepalive(self, p):
# the sizeof Raw is calculated to pad to the minimum ehternet
# frame size of 64 btyes
pkt = (Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac) /
IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4) /
UDP(sport=333, dport=4500) /
Raw(b'\xff'))
Raw(b'\xff') /
Padding(0 * 21))
self.send_and_assert_no_replies(self.tun_if, pkt*31)
self.assert_error_counter_equal(
'/err/%s/NAT Keepalive' % self.tun4_input_node, 31)
@ -1309,6 +1312,15 @@ class IpsecTun4(object):
self.assert_error_counter_equal(
'/err/%s/Too Short' % self.tun4_input_node, 31)
pkt = (Ether(src=self.tun_if.remote_mac, dst=self.tun_if.local_mac) /
IP(src=p.remote_tun_if_host, dst=self.tun_if.local_ip4) /
UDP(sport=333, dport=4500) /
Raw(b'\xfe') /
Padding(0 * 21))
self.send_and_assert_no_replies(self.tun_if, pkt*31)
self.assert_error_counter_equal(
'/err/%s/Too Short' % self.tun4_input_node, 62)
class IpsecTun4Tests(IpsecTun4):
""" UT test methods for Tunnel v4 """