ipsec: fix udp-encap in transport mode

Now UDP enacapsulation doesn't work in transport mode with crypto
algorithms that have iv_sz=8 like AES GCM or 3DES CBC. That happens
because the inserted UDP header overlaps with the old IP header and
gets filled before the information from the old IP header can be
copied to a new IP header. The result is a broken packet:

00:03:39:620863: esp4-encrypt-tun
  esp: sa-index 3 spi 3464048590 (0xce792fce) seq 31 sa-seq-hi 0
    crypto aes-gcm-128 integrity none udp-encap-enabled
00:03:39:620867: adj-midchain-tx
  ...
00:03:39:620868: ip4-rewrite
  ...
00:03:39:620869: GigabitEthernet0/8/0-output
  GigabitEthernet0/8/0
  IP4: 08:00:27:a9:6b:d6 -> 08:00:27:5a:dd:0c
  UDP: 10.255.0.10 -> 10.255.0.20
    version 0, header length 0
    tos 0x80, ttl 63, length 0, checksum 0x653e (should be 0xffff)
      dscp CS4 ecn NON_ECN
    fragment id 0x0000
  UDP: 128 -> 0
    length 0, checksum 0x0000
00:03:39:620870: GigabitEthernet0/8/0-tx
  GigabitEthernet0/8/0 tx queue 0
  ...
  IP4: 08:00:27:a9:6b:d6 -> 08:00:27:5a:dd:0c
  UDP: 10.255.0.10 -> 10.255.0.20
    version 0, header length 0
    tos 0x80, ttl 63, length 0, checksum 0x653e (should be 0xffff)
      dscp CS4 ecn NON_ECN
    fragment id 0x0000
  UDP: 128 -> 0
    length 0, checksum 0x0000

With this commit, fill UDP header after copying the IP headers in
transport mode.

Type: fix

Change-Id: Ie9a6e562aa05a8378114329d6a9ff395189fa6a8
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>

0 files changed, 0 insertions, 0 deletions