Feature #2213
Add support for SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR PF_KEY messages
Description
Hi,
I reworked NAT-T support in FreeBSD.
Now I'm looking how to modify strongswan to add SADB_X_EXT_NAT_T_OAI and
SADB_X_EXT_NAT_T_OAR messages support.
The kernel uses this information to adjust UDP/TCP checksum for decapsulation procedure
in transport mode as described in https://tools.ietf.org/html/rfc3948#section-3.1.2
There is related code:
https://svnweb.freebsd.org/base/projects/ipsec/sys/netipsec/key.c?annotate=309808#l5207
History
#1 Updated by Tobias Brunner over 8 years ago
- Status changed from New to Feedback
Why not just ignore the checksum for decrypted packets as the Linux kernel does (as described in point 3 in section 3.1.2 of RFC 3948)? We currently don't store the original traffic selectors (IKEv2 has no mechanism to exchange the private addresses explicitly as IKEv1 did, however, for IKEv1 we ignore NAT-OA payloads).
#2 Updated by Andrey Elsukov over 8 years ago
Tobias Brunner wrote:
Why not just ignore the checksum for decrypted packets as the Linux kernel does (as described in point 3 in section 3.1.2 of RFC 3948)? We currently don't store the original traffic selectors
It is possible, I added sysctl net.inet.ipsec.natt_cksum_policy variable to control the behavior:
0 - incrementally recompute.
1 - fully recompute TCP/UDP checksum.
2 - for UDP reset checksum to zero; for TCP mark csum_flags as valid.
(IKEv2 has no mechanism to exchange the private addresses explicitly as IKEv1 did, however, for IKEv1 we ignore NAT-OA payloads).
Ok, if so, I think this issue can be closed. Thanks for clarification.
#3 Updated by Tobias Brunner over 8 years ago
- Tracker changed from Issue to Feature
Why not just ignore the checksum for decrypted packets as the Linux kernel does (as described in point 3 in section 3.1.2 of RFC 3948)? We currently don't store the original traffic selectors
It is possible, I added sysctl net.inet.ipsec.natt_cksum_policy variable to control the behavior:
0 - incrementally recompute.
1 - fully recompute TCP/UDP checksum.
2 - for UDP reset checksum to zero; for TCP mark csum_flags as valid.
Ah, neat. What's the default value?
(IKEv2 has no mechanism to exchange the private addresses explicitly as IKEv1 did, however, for IKEv1 we ignore NAT-OA payloads).
Ok, if so, I think this issue can be closed. Thanks for clarification.
Adding support for configuring NAT-OA would certainly be possible, but it would require quite some changes all over the place (as mentioned the payloads and TS are currently ignored and there is no facility to pass them to the CHILD_SA or the kernel interfaces). Since there is a workaround (as mentioned above) for users who want to use transport mode via NAT, it's probably not worth implementing it at this time.
#4 Updated by Andrey Elsukov over 8 years ago
It is possible, I added sysctl net.inet.ipsec.natt_cksum_policy variable to control the behavior:
0 - incrementally recompute.
1 - fully recompute TCP/UDP checksum.
2 - for UDP reset checksum to zero; for TCP mark csum_flags as valid.Ah, neat. What's the default value?
The default value is 0, but I think 2 is more appropriate value given the current situation.
#5 Updated by Andrey Elsukov over 8 years ago
Andrey Elsukov wrote:
It is possible, I added sysctl net.inet.ipsec.natt_cksum_policy variable to control the behavior:
0 - incrementally recompute.
1 - fully recompute TCP/UDP checksum.
2 - for UDP reset checksum to zero; for TCP mark csum_flags as valid.
I finally committed the changes in the FreeBSD 12.0-CURRENT. I changed this behavior. By default this variable has zero value, that means "incrementally recompute checksums if NAT-OA information was specified by IKE", otherwise "reset UDP checksum to zero and ignore for TCP". The value 1 means "fully recompute TCP and UDP checksums".
#6 Updated by Tobias Brunner over 8 years ago
- Category set to kernel-interface
- Status changed from Feedback to Closed
- Assignee set to Tobias Brunner
- Resolution set to Won't fix
By default this variable has zero value, that means "incrementally recompute checksums if NAT-OA information was specified by IKE", otherwise "reset UDP checksum to zero and ignore for TCP". The value 1 means "fully recompute TCP and UDP checksums".
Makes sense. Thanks for the update.