From e869c9b7b582737d4a38db681561ac831d0a0409 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 2 Dec 2024 17:26:50 +0900 Subject: [PATCH] Update libreswan-4.15-whack-fd-refcount.patch to be more complete Resolves: RHEL-61461 Signed-off-by: Daiki Ueno --- libreswan-4.15-whack-fd-refcount.patch | 168 ++++++++++++++++++++++--- 1 file changed, 149 insertions(+), 19 deletions(-) diff --git a/libreswan-4.15-whack-fd-refcount.patch b/libreswan-4.15-whack-fd-refcount.patch index 79d0b28..3966554 100644 --- a/libreswan-4.15-whack-fd-refcount.patch +++ b/libreswan-4.15-whack-fd-refcount.patch @@ -1,32 +1,162 @@ -From b09f6edd9148cb08d70f8bad604efa064c9188e0 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 21 Oct 2024 09:25:06 +0900 -Subject: [PATCH] pluto: fix refcounting of whack FD at CREATE_CHILD_SA request +From efc9b61f59844a255e97afdb0f2128529ade6cc2 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Sat, 30 Nov 2024 18:44:29 +0900 +Subject: [PATCH] pluto: make sure to release whack FD after CREATE_CHILD_SA -After commit 6341e0d0257f26a7883bc5d1abff50ac362c625b, whack FD copied -to a larval Child SA in submit_v2_CREATE_CHILD_SA_new_child is not -properly closed at the completion of the CREATE_CHILD_SA exchange, as -new_v2_child_state increases the reference count of the whack FD -before sharing it with the IKE SA. +When a Child SA is created with "ipsec auto --add --asynchronous", do +not share the logging with the parent IKE SA in +submit_v2_CREATE_CHILD_SA_new_child, as well as make sure to release +whack FD after a successful completion of the async task. -Signed-off-by: Daiki Ueno +Signed-off-by: Daiki Ueno --- - programs/pluto/ikev2_create_child_sa.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) + programs/pluto/crypt_ke.c | 12 ++++++++++++ + programs/pluto/crypt_ke.h | 4 ++++ + programs/pluto/ikev2_create_child_sa.c | 16 ++++++++++------ + programs/pluto/ikev2_create_child_sa.h | 3 ++- + programs/pluto/initiate.c | 3 ++- + programs/pluto/pending.c | 3 ++- + 6 files changed, 32 insertions(+), 9 deletions(-) +diff --git a/programs/pluto/crypt_ke.c b/programs/pluto/crypt_ke.c +index 46c05b8aed..1117a684ec 100644 +--- a/programs/pluto/crypt_ke.c ++++ b/programs/pluto/crypt_ke.c +@@ -59,6 +59,7 @@ struct task { + chunk_t nonce; + struct dh_local_secret *local_secret; + ke_and_nonce_cb *cb; ++ bool detach_whack; + }; + + static void compute_ke_and_nonce(struct logger *logger, +@@ -92,6 +93,9 @@ static stf_status complete_ke_and_nonce(struct state *st, + stf_status status = task->cb(st, md, + task->local_secret, + &task->nonce); ++ if (task->detach_whack) { ++ release_whack(st->st_logger, HERE); ++ } + return status; + } + +@@ -104,10 +108,18 @@ static const struct task_handler ke_and_nonce_handler = { + + void submit_ke_and_nonce(struct state *st, const struct dh_desc *dh, + ke_and_nonce_cb *cb, where_t where) ++{ ++ submit_ke_and_nonce_detach_whack(st, dh, cb, where, false); ++} ++ ++void submit_ke_and_nonce_detach_whack(struct state *st, const struct dh_desc *dh, ++ ke_and_nonce_cb *cb, where_t where, ++ bool detach_whack) + { + struct task *task = alloc_thing(struct task, "dh"); + task->dh = dh; + task->cb = cb; ++ task->detach_whack = detach_whack; + submit_task(st->st_logger, st, task, &ke_and_nonce_handler, where); + } + +diff --git a/programs/pluto/crypt_ke.h b/programs/pluto/crypt_ke.h +index 806dc7bbdb..74f2eff09d 100644 +--- a/programs/pluto/crypt_ke.h ++++ b/programs/pluto/crypt_ke.h +@@ -38,6 +38,10 @@ typedef stf_status (ke_and_nonce_cb)(struct state *st, struct msg_digest *md, + void submit_ke_and_nonce(struct state *st, const struct dh_desc *dh, + ke_and_nonce_cb *cb, where_t where); + ++void submit_ke_and_nonce_detach_whack(struct state *st, const struct dh_desc *dh, ++ ke_and_nonce_cb *cb, where_t where, ++ bool detach_whack); ++ + /* + * KE and NONCE + */ diff --git a/programs/pluto/ikev2_create_child_sa.c b/programs/pluto/ikev2_create_child_sa.c -index 034266e7a6..951485d063 100644 +index ff2cf3a016..9e0824d918 100644 --- a/programs/pluto/ikev2_create_child_sa.c +++ b/programs/pluto/ikev2_create_child_sa.c -@@ -710,7 +710,7 @@ void submit_v2_CREATE_CHILD_SA_new_child(struct ike_sa *ike, +@@ -714,7 +714,8 @@ stf_status process_v2_CREATE_CHILD_SA_rekey_child_request(struct ike_sa *ike, + void submit_v2_CREATE_CHILD_SA_new_child(struct ike_sa *ike, + struct connection *c, /* for child */ + lset_t policy, int try, +- struct fd *whackfd) ++ struct fd *whackfd, ++ bool background) + { struct child_sa *larval_child = new_v2_child_state(c, ike, IPSEC_SA, SA_INITIATOR, - STATE_V2_NEW_CHILD_I0, -- whackfd); -+ null_fd); - - free_chunk_content(&larval_child->sa.st_ni); /* this is from the parent. */ +@@ -725,9 +726,11 @@ void submit_v2_CREATE_CHILD_SA_new_child(struct ike_sa *ike, free_chunk_content(&larval_child->sa.st_nr); /* this is from the parent. */ + larval_child->sa.st_try = try; + +- /* share the love; XXX: something better? */ +- fd_delref(&ike->sa.st_logger->object_whackfd); +- ike->sa.st_logger->object_whackfd = fd_addref(whackfd); ++ if (!background) { ++ /* share the love; XXX: something better? */ ++ fd_delref(&ike->sa.st_logger->object_whackfd); ++ ike->sa.st_logger->object_whackfd = fd_addref(whackfd); ++ } + larval_child->sa.st_policy = policy; + + llog_sa(RC_LOG, larval_child, +@@ -752,8 +755,9 @@ void submit_v2_CREATE_CHILD_SA_new_child(struct ike_sa *ike, + str_policy(policy, &pb), + larval_child->sa.st_pfs_group == NULL ? "no-pfs" : larval_child->sa.st_pfs_group->common.fqn); + +- submit_ke_and_nonce(&larval_child->sa, larval_child->sa.st_pfs_group /*possibly-null*/, +- queue_v2_CREATE_CHILD_SA_new_child_request, HERE); ++ submit_ke_and_nonce_detach_whack(&larval_child->sa, larval_child->sa.st_pfs_group /*possibly-null*/, ++ queue_v2_CREATE_CHILD_SA_new_child_request, HERE, ++ background); + } + + static void llog_v2_success_new_child_request(struct ike_sa *ike) +diff --git a/programs/pluto/ikev2_create_child_sa.h b/programs/pluto/ikev2_create_child_sa.h +index bd9c0d6505..b032738e86 100644 +--- a/programs/pluto/ikev2_create_child_sa.h ++++ b/programs/pluto/ikev2_create_child_sa.h +@@ -31,7 +31,8 @@ extern ikev2_state_transition_fn process_v2_CREATE_CHILD_SA_rekey_ike_response; + extern void submit_v2_CREATE_CHILD_SA_new_child(struct ike_sa *ike, + struct connection *c, /*child*/ + lset_t policy, int try, +- struct fd *whackfd); ++ struct fd *whackfd, ++ bool background); + extern ikev2_state_transition_fn initiate_v2_CREATE_CHILD_SA_new_child_request; + extern ikev2_state_transition_fn process_v2_CREATE_CHILD_SA_new_child_request; + +diff --git a/programs/pluto/initiate.c b/programs/pluto/initiate.c +index 21821400d1..e9529247ad 100644 +--- a/programs/pluto/initiate.c ++++ b/programs/pluto/initiate.c +@@ -367,7 +367,8 @@ void ipsecdoi_initiate(struct connection *c, + cc = c; + } + submit_v2_CREATE_CHILD_SA_new_child(ike, cc, policy, try, +- logger->global_whackfd); ++ logger->global_whackfd, ++ background); + } + break; + } +diff --git a/programs/pluto/pending.c b/programs/pluto/pending.c +index b022740c3e..120a196e65 100644 +--- a/programs/pluto/pending.c ++++ b/programs/pluto/pending.c +@@ -325,7 +325,8 @@ void unpend(struct ike_sa *ike, struct connection *cc) + } else if (!already_has_larval_v2_child(ike, p->connection)) { + submit_v2_CREATE_CHILD_SA_new_child(ike, p->connection, + p->policy, p->try, +- p->whack_sock); ++ p->whack_sock, ++ /*background*/false); + } + break; + case IKEv1: -- 2.47.0