[0/3] ipsec: Add ESP over TCP encapsulation
diff mbox

Message ID 20180111132112.GA9501@gondor.apana.org.au
State Awaiting Upstream, archived
Delegated to: David Miller
Headers show

Commit Message

Herbert Xu Jan. 11, 2018, 1:21 p.m. UTC
Hi:

This series of patches add basic support for ESP over TCP (RFC 8229).
Note that this does not include TLS support but it could be added in
future.

Here is an iproute patch to setup xfrm states with this:


Here is a sample program for setting up the TCP socket to use this.
Note that it doesn't do the magic word as required by RFC 8229 so
you'll need to add that for a real key manager.

#include <arpa/inet.h>
#include <errno.h>
#include <error.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <stdlib.h>
#include <sys/socket.h>

#define TCP_ENCAP 35

int main(int argc, char **argv)
{
	struct sockaddr_in addr = {
		.sin_family = AF_INET,
		.sin_port = htons(4500),
	};
	char buf[4096];
	int one = 1;
	int err;
	int s;

	s = socket(AF_INET, SOCK_STREAM, 0);
	if (s < 0)
		error(-1, errno, "socket");

	if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0)
		error(-1, errno, "bind");

	if (argc > 1) {
		addr.sin_addr.s_addr = inet_addr(argv[1]);
		if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) < 0)
			error(-1, errno, "connect");
	} else {
		if (listen(s, 0) < 0)
			error(-1, errno, "listen");

		s = accept(s, NULL, 0);
		if (s < 0)
			error(-1, errno, "accept");
	}

	if (setsockopt(s, SOL_TCP, TCP_NODELAY, &one, sizeof(one)) < 0)
		error(-1, errno, "TCP_NODELAY");

	if (setsockopt(s, SOL_TCP, TCP_ENCAP, NULL, 0) < 0)
		error(-1, errno, "TCP_ENCAP");

	while ((err = read(s, buf, sizeof(buf))) > 0)
		;

	if (err < 0)
		error(-1, errno, "read");

	return 0;
}


Cheers,

Patch
diff mbox

diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index 12c2f72..f3fb1e2 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -738,6 +738,9 @@  void xfrm_xfrma_print(struct rtattr *tb[], __u16 family,
 		case 2:
 			fprintf(fp, "espinudp ");
 			break;
+		case 6:
+			fprintf(fp, "espintcp ");
+			break;
 		default:
 			fprintf(fp, "%u ", e->encap_type);
 			break;
@@ -1182,6 +1185,8 @@  int xfrm_encap_type_parse(__u16 *type, int *argcp, char ***argvp)
 		*type = 1;
 	else if (strcmp(*argv, "espinudp") == 0)
 		*type = 2;
+	else if (strcmp(*argv, "espintcp") == 0)
+		*type = 6;
 	else
 		invarg("ENCAP-TYPE value is invalid", *argv);