| Message ID | 20180111132112.GA9501@gondor.apana.org.au |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 12c2f72..f3fb1e2 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -738,6 +738,9 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family, case 2: fprintf(fp, "espinudp "); break; + case 6: + fprintf(fp, "espintcp "); + break; default: fprintf(fp, "%u ", e->encap_type); break; @@ -1182,6 +1185,8 @@ int xfrm_encap_type_parse(__u16 *type, int *argcp, char ***argvp) *type = 1; else if (strcmp(*argv, "espinudp") == 0) *type = 2; + else if (strcmp(*argv, "espintcp") == 0) + *type = 6; else invarg("ENCAP-TYPE value is invalid", *argv);
Hi: This series of patches add basic support for ESP over TCP (RFC 8229). Note that this does not include TLS support but it could be added in future. Here is an iproute patch to setup xfrm states with this: Here is a sample program for setting up the TCP socket to use this. Note that it doesn't do the magic word as required by RFC 8229 so you'll need to add that for a real key manager. #include <arpa/inet.h> #include <errno.h> #include <error.h> #include <netinet/ip.h> #include <netinet/tcp.h> #include <stdlib.h> #include <sys/socket.h> #define TCP_ENCAP 35 int main(int argc, char **argv) { struct sockaddr_in addr = { .sin_family = AF_INET, .sin_port = htons(4500), }; char buf[4096]; int one = 1; int err; int s; s = socket(AF_INET, SOCK_STREAM, 0); if (s < 0) error(-1, errno, "socket"); if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) error(-1, errno, "bind"); if (argc > 1) { addr.sin_addr.s_addr = inet_addr(argv[1]); if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) error(-1, errno, "connect"); } else { if (listen(s, 0) < 0) error(-1, errno, "listen"); s = accept(s, NULL, 0); if (s < 0) error(-1, errno, "accept"); } if (setsockopt(s, SOL_TCP, TCP_NODELAY, &one, sizeof(one)) < 0) error(-1, errno, "TCP_NODELAY"); if (setsockopt(s, SOL_TCP, TCP_ENCAP, NULL, 0) < 0) error(-1, errno, "TCP_ENCAP"); while ((err = read(s, buf, sizeof(buf))) > 0) ; if (err < 0) error(-1, errno, "read"); return 0; } Cheers,