Add '-p' command line option which allows to configure

the UDP encapsulation port, similar to isakmpd's '-N' flag.
Being able to change the UDP encapsulation port is useful in cases
where ESP and UDP ports 500 and 4500 are blocked or rate limited.

ok sthen@

1 files changed, 24 insertions, 1 deletions

diff --git a/sbin/iked/config.c b/sbin/iked/config.c
index 3cabdc3426f..71f01cb5d54 100644
--- a/sbin/iked/config.c
+++ b/sbin/iked/config.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: config.c,v 1.52 2020/01/07 15:08:28 tobhe Exp $	*/
+/*	$OpenBSD: config.c,v 1.53 2020/01/16 20:05:00 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -988,6 +988,29 @@ config_setkeys(struct iked *env)
 }
 
 int
+config_setnattport(struct iked *env)
+{
+	in_port_t nattport;
+
+	nattport = env->sc_nattport;
+	proc_compose(&env->sc_ps, PROC_IKEV2, IMSG_CTL_NATTPORT,
+	    &nattport, sizeof(nattport));
+	return (0);
+}
+
+int
+config_getnattport(struct iked *env, struct imsg *imsg)
+{
+	in_port_t nattport;
+
+	IMSG_SIZE_CHECK(imsg, &nattport);
+	memcpy(&nattport, imsg->data, sizeof(nattport));
+	env->sc_nattport = nattport;
+	log_debug("%s: nattport %u", __func__, env->sc_nattport);
+	return (0);
+}
+
+int
 config_getkey(struct iked *env, struct imsg *imsg)
 {
 	size_t		 len;