From patchwork Thu Jan 11 13:21:12 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 859107 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zHRNK5vDvz9sBW for ; Fri, 12 Jan 2018 00:21:21 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933094AbeAKNVS (ORCPT ); Thu, 11 Jan 2018 08:21:18 -0500 Received: from [128.1.224.119] ([128.1.224.119]:54282 "EHLO ringil.hmeau.com" rhost-flags-FAIL-FAIL-OK-OK) by vger.kernel.org with ESMTP id S932372AbeAKNVR (ORCPT ); Thu, 11 Jan 2018 08:21:17 -0500 Received: from gondolin.me.apana.org.au ([192.168.0.6] helo=gondolin.hengli.com.au) by norbury.hmeau.com with esmtp (Exim 4.80 #3 (Debian)) id 1eZcnD-0000Hf-KS; Fri, 12 Jan 2018 00:21:15 +1100 Received: from herbert by gondolin.hengli.com.au with local (Exim 4.80) (envelope-from ) id 1eZcnA-0002UO-8P; Fri, 12 Jan 2018 00:21:12 +1100 Date: Fri, 12 Jan 2018 00:21:12 +1100 From: Herbert Xu To: Steffen Klassert , netdev@vger.kernel.org Subject: [PATCH 0/3] ipsec: Add ESP over TCP encapsulation Message-ID: <20180111132112.GA9501@gondor.apana.org.au> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi: This series of patches add basic support for ESP over TCP (RFC 8229). Note that this does not include TLS support but it could be added in future. Here is an iproute patch to setup xfrm states with this: Here is a sample program for setting up the TCP socket to use this. Note that it doesn't do the magic word as required by RFC 8229 so you'll need to add that for a real key manager. #include #include #include #include #include #include #include #define TCP_ENCAP 35 int main(int argc, char **argv) { struct sockaddr_in addr = { .sin_family = AF_INET, .sin_port = htons(4500), }; char buf[4096]; int one = 1; int err; int s; s = socket(AF_INET, SOCK_STREAM, 0); if (s < 0) error(-1, errno, "socket"); if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) error(-1, errno, "bind"); if (argc > 1) { addr.sin_addr.s_addr = inet_addr(argv[1]); if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) error(-1, errno, "connect"); } else { if (listen(s, 0) < 0) error(-1, errno, "listen"); s = accept(s, NULL, 0); if (s < 0) error(-1, errno, "accept"); } if (setsockopt(s, SOL_TCP, TCP_NODELAY, &one, sizeof(one)) < 0) error(-1, errno, "TCP_NODELAY"); if (setsockopt(s, SOL_TCP, TCP_ENCAP, NULL, 0) < 0) error(-1, errno, "TCP_ENCAP"); while ((err = read(s, buf, sizeof(buf))) > 0) ; if (err < 0) error(-1, errno, "read"); return 0; } Cheers, diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 12c2f72..f3fb1e2 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -738,6 +738,9 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family, case 2: fprintf(fp, "espinudp "); break; + case 6: + fprintf(fp, "espintcp "); + break; default: fprintf(fp, "%u ", e->encap_type); break; @@ -1182,6 +1185,8 @@ int xfrm_encap_type_parse(__u16 *type, int *argcp, char ***argvp) *type = 1; else if (strcmp(*argv, "espinudp") == 0) *type = 2; + else if (strcmp(*argv, "espintcp") == 0) + *type = 6; else invarg("ENCAP-TYPE value is invalid", *argv);