diff options
| -rw-r--r-- | sbin/ipsecadm/ipsecadm.8 | 7 | ||||
| -rw-r--r-- | sbin/ipsecadm/ipsecadm.c | 30 | ||||
| -rw-r--r-- | sbin/ipsecadm/pfkdump.c | 12 | ||||
| -rw-r--r-- | sbin/sysctl/sysctl.8 | 4 | ||||
| -rw-r--r-- | sys/net/pfkeyv2.c | 29 | ||||
| -rw-r--r-- | sys/net/pfkeyv2.h | 15 | ||||
| -rw-r--r-- | sys/net/pfkeyv2_convert.c | 25 | ||||
| -rw-r--r-- | sys/net/pfkeyv2_parsemessage.c | 18 | ||||
| -rw-r--r-- | sys/netinet/ip_esp.h | 15 | ||||
| -rw-r--r-- | sys/netinet/ip_ipsp.c | 9 | ||||
| -rw-r--r-- | sys/netinet/ip_ipsp.h | 6 | ||||
| -rw-r--r-- | sys/netinet/ipsec_input.c | 32 | ||||
| -rw-r--r-- | sys/netinet/ipsec_output.c | 31 | ||||
| -rw-r--r-- | sys/netinet/udp_usrreq.c | 43 | ||||
| -rw-r--r-- | usr.bin/netstat/inet.c | 7 |
15 files changed, 250 insertions, 33 deletions
diff --git a/sbin/ipsecadm/ipsecadm.8 b/sbin/ipsecadm/ipsecadm.8 index 75a09c0fe88..948efd103d0 100644 --- a/sbin/ipsecadm/ipsecadm.8 +++ b/sbin/ipsecadm/ipsecadm.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ipsecadm.8,v 1.62 2003/07/24 08:03:19 itojun Exp $ +.\" $OpenBSD: ipsecadm.8,v 1.63 2003/12/02 23:16:29 markus Exp $ .\" .\" Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de> .\" All rights reserved. @@ -90,6 +90,7 @@ modifiers are: .Fl authkey , .Fl authkeyfile , .Fl forcetunnel , +.Fl udpencap , .Fl key , and .Fl keyfile . @@ -382,6 +383,10 @@ and options. Notice that the IPsec stack will perform IP-inside-IP encapsulation when deemed necessary, even if this flag has not been set. +.It Fl udpencap +Enable ESP-inside-UDP encapsulation. +The UDP destination port must be specified on the command line. +This port will be used for sending encapsulated UDP packets. .It Fl enc The encryption algorithm to be used with the SA. Possible values are: diff --git a/sbin/ipsecadm/ipsecadm.c b/sbin/ipsecadm/ipsecadm.c index 08e24e36d67..f12c49e0896 100644 --- a/sbin/ipsecadm/ipsecadm.c +++ b/sbin/ipsecadm/ipsecadm.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ipsecadm.c,v 1.70 2003/09/23 18:09:20 itojun Exp $ */ +/* $OpenBSD: ipsecadm.c,v 1.71 2003/12/02 23:16:29 markus Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), * Angelos D. Keromytis (kermit@csd.uch.gr) and @@ -286,6 +286,7 @@ usage(void) "\t -src <ip>\t\t\tsource address to be used\n" "\t -halfiv\t\t\tuse 4-byte IV in old ESP\n" "\t -forcetunnel\t\t\tforce IP-in-IP encapsulation\n" + "\t -udpencap <port>\t\tenable ESP-in-UDP encapsulation\n" "\t -dst <ip>\t\t\tdestination address to be used\n" "\t -proto <val>\t\t\tsecurity protocol\n" "\t -proxy <ip>\t\t\tproxy address to be used\n" @@ -309,7 +310,7 @@ usage(void) "\t -dontacq\t\t\trequire, without using key mgmt.\n" "\t -in\t\t\t\tspecify incoming-packet policy\n" "\t -out\t\t\t\tspecify outgoing-packet policy\n" - "\t -[ah|esp|ip4|ipcomp]\t\t\tflush a particular protocol\n" + "\t -[ah|esp|ip4|ipcomp]\t\tflush a particular protocol\n" "\t -srcid\t\t\tsource identity for flows\n" "\t -dstid\t\t\tdestination identity for flows\n" "\t -srcid_type\t\t\tsource identity type\n" @@ -345,6 +346,7 @@ main(int argc, char *argv[]) struct sadb_ident sid1, sid2; struct sadb_key skey1, skey2; struct sadb_protocol sprotocol, sprotocol2; + struct sadb_x_udpencap udpencap; /* Peer UDP Port */ u_char realkey[8192], realakey[8192]; struct iovec iov[30]; struct addrinfo hints, *res; @@ -375,6 +377,7 @@ main(int argc, char *argv[]) memset(realakey, 0, sizeof(realakey)); memset(&sid1, 0, sizeof(sid1)); memset(&sid2, 0, sizeof(sid2)); + memset(&udpencap, 0, sizeof(udpencap)); src = (union sockaddr_union *) srcbuf; dst = (union sockaddr_union *) dstbuf; @@ -921,6 +924,24 @@ main(int argc, char *argv[]) sa.sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL; continue; } + if (!strcmp(argv[i] + 1, "udpencap") && + udpencap.sadb_x_udpencap_port == 0 && (i + 1 < argc)) { + if (!(mode & ESP_NEW)) { + fprintf(stderr, "%s: option udpencap can " + "be used only with new ESP\n", argv[0]); + exit(1); + } + sa.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP; + udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP; + udpencap.sadb_x_udpencap_len = sizeof(udpencap) / 8; + udpencap.sadb_x_udpencap_port = + strtoul(argv[i + 1], NULL, 10); + udpencap.sadb_x_udpencap_port = + htons(udpencap.sadb_x_udpencap_port); + udpencap.sadb_x_udpencap_reserved = 0; + i++; + continue; + } if (!strcmp(argv[i] + 1, "halfiv")) { if (!(mode & ESP_OLD)) { fprintf(stderr, @@ -1520,6 +1541,11 @@ argfail: skey2.sadb_key_bits = 8 * alen; smsg.sadb_msg_len += skey2.sadb_key_len; } + if (sa.sadb_sa_flags & SADB_X_SAFLAGS_UDPENCAP) { + iov[cnt].iov_base = &udpencap; + iov[cnt++].iov_len = sizeof(udpencap); + smsg.sadb_msg_len += udpencap.sadb_x_udpencap_len; + } } else { switch (mode & CMD_MASK) { case GRP_SPI: diff --git a/sbin/ipsecadm/pfkdump.c b/sbin/ipsecadm/pfkdump.c index 08853fe3655..3e9532a936a 100644 --- a/sbin/ipsecadm/pfkdump.c +++ b/sbin/ipsecadm/pfkdump.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfkdump.c,v 1.8 2003/07/29 18:38:36 deraadt Exp $ */ +/* $OpenBSD: pfkdump.c,v 1.9 2003/12/02 23:16:29 markus Exp $ */ /* * Copyright (c) 2003 Markus Friedl. All rights reserved. @@ -52,6 +52,7 @@ void print_ident(struct sadb_ext *, struct sadb_msg *); void print_policy(struct sadb_ext *, struct sadb_msg *); void print_cred(struct sadb_ext *, struct sadb_msg *); void print_auth(struct sadb_ext *, struct sadb_msg *); +void print_udpenc(struct sadb_ext *, struct sadb_msg *); struct idname *lookup(struct idname [], u_int8_t); char *lookup_name(struct idname [], u_int8_t); @@ -104,6 +105,7 @@ struct idname ext_types[] = { { SADB_X_EXT_LOCAL_AUTH, "x_local_auth", print_auth }, { SADB_X_EXT_REMOTE_AUTH, "x_remote_auth", print_auth }, { SADB_X_EXT_SUPPORTED_COMP, "x_supported_comp", print_supp }, + { SADB_X_EXT_UDPENCAP, "x_udpencap", print_udpenc }, { 0, NULL, NULL } }; @@ -533,6 +535,14 @@ print_auth(struct sadb_ext *ext, struct sadb_msg *msg) } void +print_udpenc(struct sadb_ext *ext, struct sadb_msg *msg) +{ + struct sadb_x_udpencap *x_udpencap = (struct sadb_x_udpencap *) ext; + + printf("udpencap port %u\n", ntohs(x_udpencap->sadb_x_udpencap_port)); +} + +void msg_send(int pfkey, u_int8_t satype, u_int8_t mtype) { struct sadb_msg msg; diff --git a/sbin/sysctl/sysctl.8 b/sbin/sysctl/sysctl.8 index 32f748a6ee0..84737672388 100644 --- a/sbin/sysctl/sysctl.8 +++ b/sbin/sysctl/sysctl.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: sysctl.8,v 1.109 2003/10/17 21:04:57 mcbride Exp $ +.\" $OpenBSD: sysctl.8,v 1.110 2003/12/02 23:16:29 markus Exp $ .\" $NetBSD: sysctl.8,v 1.4 1995/09/30 07:12:49 thorpej Exp $ .\" .\" Copyright (c) 1993 @@ -240,6 +240,8 @@ privilege can change the value. .It net.inet.gre.allow integer yes .It net.inet.gre.wccp integer yes .It net.inet.esp.enable integer yes +.It net.inet.esp.udpencap integer yes +.It net.inet.esp.udpencap_port integer yes .It net.inet.ah.enable integer yes .It net.inet.mobileip.allow integer yes .It net.inet.etherip.allow integer yes diff --git a/sys/net/pfkeyv2.c b/sys/net/pfkeyv2.c index adb21e2f068..91ffab60299 100644 --- a/sys/net/pfkeyv2.c +++ b/sys/net/pfkeyv2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfkeyv2.c,v 1.89 2003/07/24 09:59:02 itojun Exp $ */ +/* $OpenBSD: pfkeyv2.c,v 1.90 2003/12/02 23:16:29 markus Exp $ */ /* * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 @@ -542,6 +542,9 @@ pfkeyv2_get(struct tdb *sa, void **headers, void **buffer) if (sa->tdb_emxkey) i+= PADUP(sa->tdb_emxkeylen) + sizeof(struct sadb_key); + if (sa->tdb_udpencap_port) + i+= sizeof(struct sadb_x_udpencap); + if (!(p = malloc(i, M_PFKEY, M_DONTWAIT))) { rval = ENOMEM; goto ret; @@ -630,6 +633,12 @@ pfkeyv2_get(struct tdb *sa, void **headers, void **buffer) export_key(&p, sa, PFKEYV2_ENCRYPTION_KEY); } + /* Export UDP encapsulation port, if present */ + if (sa->tdb_udpencap_port) { + headers[SADB_X_EXT_UDPENCAP] = p; + export_udpencap(&p, sa); + } + rval = 0; ret: @@ -895,6 +904,12 @@ pfkeyv2_send(struct socket *socket, void *message, int len) rval = EINVAL; goto ret; } + /* UDP encapsulation is only supported for ESP */ + if (smsg->sadb_msg_satype != SADB_SATYPE_ESP && + headers[SADB_X_EXT_UDPENCAP]) { + rval = EINVAL; + goto ret; + } s = spltdb(); @@ -965,6 +980,8 @@ pfkeyv2_send(struct socket *socket, void *message, int len) headers[SADB_X_EXT_DST_MASK], headers[SADB_X_EXT_PROTOCOL], headers[SADB_X_EXT_FLOW_TYPE]); + import_udpencap(newsa, + headers[SADB_X_EXT_UDPENCAP]); headers[SADB_EXT_KEY_AUTH] = NULL; headers[SADB_EXT_KEY_ENCRYPT] = NULL; @@ -1010,6 +1027,8 @@ pfkeyv2_send(struct socket *socket, void *message, int len) PFKEYV2_LIFETIME_SOFT); import_lifetime(sa2, headers[SADB_EXT_LIFETIME_HARD], PFKEYV2_LIFETIME_HARD); + import_udpencap(sa2, + headers[SADB_X_EXT_UDPENCAP]); } splx(s); @@ -1035,6 +1054,12 @@ pfkeyv2_send(struct socket *socket, void *message, int len) rval = EINVAL; goto ret; } + /* UDP encapsulation is only supported for ESP */ + if (smsg->sadb_msg_satype != SADB_SATYPE_ESP && + headers[SADB_X_EXT_UDPENCAP]) { + rval = EINVAL; + goto ret; + } s = spltdb(); @@ -1111,6 +1136,8 @@ pfkeyv2_send(struct socket *socket, void *message, int len) headers[SADB_X_EXT_DST_MASK], headers[SADB_X_EXT_PROTOCOL], headers[SADB_X_EXT_FLOW_TYPE]); + import_udpencap(newsa, + headers[SADB_X_EXT_UDPENCAP]); headers[SADB_EXT_KEY_AUTH] = NULL; headers[SADB_EXT_KEY_ENCRYPT] = NULL; diff --git a/sys/net/pfkeyv2.h b/sys/net/pfkeyv2.h index 152061fcc2b..91aed8ba4e5 100644 --- a/sys/net/pfkeyv2.h +++ b/sys/net/pfkeyv2.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pfkeyv2.h,v 1.48 2003/07/24 09:59:02 itojun Exp $ */ +/* $OpenBSD: pfkeyv2.h,v 1.49 2003/12/02 23:16:29 markus Exp $ */ /* * @(#)COPYRIGHT 1.1 (NRL) January 1998 * @@ -205,6 +205,13 @@ struct sadb_x_cred { uint16_t sadb_x_cred_reserved; }; +struct sadb_x_udpencap { + uint16_t sadb_x_udpencap_len; + uint16_t sadb_x_udpencap_exttype; + uint16_t sadb_x_udpencap_port; + uint16_t sadb_x_udpencap_reserved; +}; + #ifdef _KERNEL #define SADB_X_GETSPROTO(x) \ ( (x) == SADB_SATYPE_AH ? IPPROTO_AH :\ @@ -243,7 +250,8 @@ struct sadb_x_cred { #define SADB_X_EXT_LOCAL_AUTH 28 #define SADB_X_EXT_REMOTE_AUTH 29 #define SADB_X_EXT_SUPPORTED_COMP 30 -#define SADB_EXT_MAX 30 +#define SADB_X_EXT_UDPENCAP 31 +#define SADB_EXT_MAX 31 /* Fix pfkeyv2.c struct pfkeyv2_socket if SATYPE_MAX > 31 */ #define SADB_SATYPE_UNSPEC 0 @@ -304,6 +312,7 @@ struct sadb_x_cred { #define SADB_X_SAFLAGS_CHAINDEL 0x008 /* Delete whole SA chain */ #define SADB_X_SAFLAGS_RANDOMPADDING 0x080 /* Random ESP padding */ #define SADB_X_SAFLAGS_NOREPLAY 0x100 /* No replay counter */ +#define SADB_X_SAFLAGS_UDPENCAP 0x200 /* ESP in UDP */ #define SADB_X_POLICYFLAGS_POLICY 0x0001 /* This is a static policy */ @@ -421,6 +430,7 @@ void export_credentials(void **, struct tdb *, int); void export_sa(void **, struct tdb *); void export_key(void **, struct tdb *, int); void export_auth(void **, struct tdb *, int); +void export_udpencap(void **, struct tdb *); void import_auth(struct tdb *, struct sadb_x_cred *, int); void import_address(struct sockaddr *, struct sadb_address *); @@ -432,5 +442,6 @@ void import_sa(struct tdb *, struct sadb_sa *, struct ipsecinit *); void import_flow(struct sockaddr_encap *, struct sockaddr_encap *, struct sadb_address *, struct sadb_address *, struct sadb_address *, struct sadb_address *, struct sadb_protocol *, struct sadb_protocol *); +void import_udpencap(struct tdb *, struct sadb_x_udpencap *); #endif /* _KERNEL */ #endif /* _NET_PFKEY_V2_H_ */ diff --git a/sys/net/pfkeyv2_convert.c b/sys/net/pfkeyv2_convert.c index b0026c9fd9a..14415c99eca 100644 --- a/sys/net/pfkeyv2_convert.c +++ b/sys/net/pfkeyv2_convert.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfkeyv2_convert.c,v 1.17 2003/07/24 09:59:02 itojun Exp $ */ +/* $OpenBSD: pfkeyv2_convert.c,v 1.18 2003/12/02 23:16:29 markus Exp $ */ /* * The author of this code is Angelos D. Keromytis (angelos@keromytis.org) * @@ -135,6 +135,9 @@ import_sa(struct tdb *tdb, struct sadb_sa *sadb_sa, struct ipsecinit *ii) if (sadb_sa->sadb_sa_flags & SADB_X_SAFLAGS_NOREPLAY) tdb->tdb_flags |= TDBF_NOREPLAY; + + if (sadb_sa->sadb_sa_flags & SADB_X_SAFLAGS_UDPENCAP) + tdb->tdb_flags |= TDBF_UDPENCAP; } if (sadb_sa->sadb_sa_state != SADB_SASTATE_MATURE) @@ -794,3 +797,23 @@ export_key(void **p, struct tdb *tdb, int type) *p += PADUP(tdb->tdb_amxkeylen); } } + +/* Import/Export remote port for UDP Encapsulation */ +void +import_udpencap(struct tdb *tdb, struct sadb_x_udpencap *sadb_udpencap) +{ + if (sadb_udpencap) + tdb->tdb_udpencap_port = sadb_udpencap->sadb_x_udpencap_port; +} + +void +export_udpencap(void **p, struct tdb *tdb) +{ + struct sadb_x_udpencap *sadb_udpencap = (struct sadb_x_udpencap *) *p; + + sadb_udpencap->sadb_x_udpencap_port = tdb->tdb_udpencap_port; + sadb_udpencap->sadb_x_udpencap_reserved = 0; + sadb_udpencap->sadb_x_udpencap_len = + sizeof(struct sadb_x_udpencap) / sizeof(uint64_t); + *p += sizeof(struct sadb_x_udpencap); +} diff --git a/sys/net/pfkeyv2_parsemessage.c b/sys/net/pfkeyv2_parsemessage.c index 2659832b0d8..762d1159f75 100644 --- a/sys/net/pfkeyv2_parsemessage.c +++ b/sys/net/pfkeyv2_parsemessage.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfkeyv2_parsemessage.c,v 1.36 2003/02/16 21:30:13 deraadt Exp $ */ +/* $OpenBSD: pfkeyv2_parsemessage.c,v 1.37 2003/12/02 23:16:29 markus Exp $ */ /* * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 @@ -121,6 +121,7 @@ extern int encdebug; #define BITMAP_X_CREDENTIALS (BITMAP_X_LOCAL_CREDENTIALS | BITMAP_X_REMOTE_CREDENTIALS | BITMAP_X_LOCAL_AUTH | BITMAP_X_REMOTE_AUTH) #define BITMAP_X_FLOW (BITMAP_X_SRC_MASK | BITMAP_X_DST_MASK | BITMAP_X_PROTOCOL | BITMAP_X_SRC_FLOW | BITMAP_X_DST_FLOW | BITMAP_X_FLOW_TYPE) #define BITMAP_X_SUPPORTED_COMP (1 << SADB_X_EXT_SUPPORTED_COMP) +#define BITMAP_X_UDPENCAP (1 << SADB_X_EXT_UDPENCAP) uint32_t sadb_exts_allowed_in[SADB_MAX+1] = { @@ -129,9 +130,9 @@ uint32_t sadb_exts_allowed_in[SADB_MAX+1] = /* GETSPI */ BITMAP_ADDRESS_SRC | BITMAP_ADDRESS_DST | BITMAP_SPIRANGE, /* UPDATE */ - BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_KEY | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW, + BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_KEY | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW | BITMAP_X_UDPENCAP, /* ADD */ - BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_KEY | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW, + BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_KEY | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW | BITMAP_X_UDPENCAP, /* DELETE */ BITMAP_SA | BITMAP_ADDRESS_SRC | BITMAP_ADDRESS_DST, /* GET */ @@ -201,9 +202,9 @@ uint32_t sadb_exts_allowed_out[SADB_MAX+1] = /* GETSPI */ BITMAP_SA | BITMAP_ADDRESS_SRC | BITMAP_ADDRESS_DST, /* UPDATE */ - BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW, + BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW | BITMAP_X_UDPENCAP, /* ADD */ - BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW, + BITMAP_SA | BITMAP_LIFETIME | BITMAP_ADDRESS | BITMAP_IDENTITY | BITMAP_X_CREDENTIALS | BITMAP_X_FLOW | BITMAP_X_UDPENCAP, /* DELETE */ BITMAP_SA | BITMAP_ADDRESS_SRC | BITMAP_ADDRESS_DST, /* GET */ @@ -919,6 +920,13 @@ pfkeyv2_parsemessage(void *p, int len, void **headers) } } break; + case SADB_X_EXT_UDPENCAP: + if (i != sizeof(struct sadb_x_udpencap)) { + DPRINTF(("pfkeyv2_parsemessage: bad UDPENCAP " + "header length\n")); + return (EINVAL); + } + break; default: DPRINTF(("pfkeyv2_parsemessage: unknown extension " "header type %d\n", diff --git a/sys/netinet/ip_esp.h b/sys/netinet/ip_esp.h index 6be3aafcf23..ba1098adaf7 100644 --- a/sys/netinet/ip_esp.h +++ b/sys/netinet/ip_esp.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_esp.h,v 1.38 2003/02/12 14:41:07 jason Exp $ */ +/* $OpenBSD: ip_esp.h,v 1.39 2003/12/02 23:16:28 markus Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), * Angelos D. Keromytis (kermit@csd.uch.gr) and @@ -61,21 +61,30 @@ struct espstat u_int32_t esps_toobig; /* Packet got larger than IP_MAXPACKET */ u_int32_t esps_pdrops; /* Packet blocked due to policy */ u_int32_t esps_crypto; /* Crypto processing failure */ + u_int32_t esps_udpencin; /* Input ESP-in-UDP packets */ + u_int32_t esps_udpencout; /* Output ESP-in-UDP packets */ + u_int32_t esps_udpinval; /* Invalid input ESP-in-UDP packets */ }; /* * Names for ESP sysctl objects */ -#define ESPCTL_ENABLE 1 /* Enable ESP processing */ -#define ESPCTL_MAXID 2 +#define ESPCTL_ENABLE 1 /* Enable ESP processing */ +#define ESPCTL_UDPENCAP_ENABLE 2 /* Enable ESP over UDP */ +#define ESPCTL_UDPENCAP_PORT 3 /* UDP port for encapsulation */ +#define ESPCTL_MAXID 4 #define ESPCTL_NAMES { \ { 0, 0 }, \ { "enable", CTLTYPE_INT }, \ + { "udpencap", CTLTYPE_INT }, \ + { "udpencap_port", CTLTYPE_INT }, \ } #ifdef _KERNEL extern int esp_enable; +extern int udpencap_enable; +extern int udpencap_port; extern struct espstat espstat; #endif /* _KERNEL */ #endif /* _NETINET_IP_ESP_H_ */ diff --git a/sys/netinet/ip_ipsp.c b/sys/netinet/ip_ipsp.c index 74ce2e6af27..a8f7e85aea5 100644 --- a/sys/netinet/ip_ipsp.c +++ b/sys/netinet/ip_ipsp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_ipsp.c,v 1.152 2003/05/09 14:59:19 deraadt Exp $ */ +/* $OpenBSD: ip_ipsp.c,v 1.153 2003/12/02 23:16:28 markus Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), * Angelos D. Keromytis (kermit@csd.uch.gr), @@ -860,6 +860,7 @@ ipsp_print_tdb(struct tdb *tdb, char *buffer, size_t buflen) { "random padding", TDBF_RANDOMPADDING }, { "skipcrypto", TDBF_SKIPCRYPTO }, { "usedtunnel", TDBF_USEDTUNNEL }, + { "udpencap", TDBF_UDPENCAP }, }; int l, i, k; @@ -946,6 +947,12 @@ ipsp_print_tdb(struct tdb *tdb, char *buffer, size_t buflen) "\tCrypto ID: %llu\n", tdb->tdb_cryptoid); l += strlen(buffer + l); + if (tdb->tdb_udpencap_port) { + snprintf(buffer + l, buflen - l, + "\tudpencap_port = <%u>\n", ntohs(tdb->tdb_udpencap_port)); + l += strlen(buffer + l); + } + if (tdb->tdb_xform) { snprintf(buffer + l, buflen - l, "\txform = <%s>\n", diff --git a/sys/netinet/ip_ipsp.h b/sys/netinet/ip_ipsp.h index dddb531052e..da6d442f186 100644 --- a/sys/netinet/ip_ipsp.h +++ b/sys/netinet/ip_ipsp.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_ipsp.h,v 1.123 2003/07/24 08:03:20 itojun Exp $ */ +/* $OpenBSD: ip_ipsp.h,v 1.124 2003/12/02 23:16:29 markus Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), * Angelos D. Keromytis (kermit@csd.uch.gr), @@ -300,6 +300,7 @@ struct tdb { /* tunnel descriptor block */ #define TDBF_RANDOMPADDING 0x04000 /* Random data in the ESP padding */ #define TDBF_SKIPCRYPTO 0x08000 /* Skip actual crypto processing */ #define TDBF_USEDTUNNEL 0x10000 /* Appended a tunnel header in past */ +#define TDBF_UDPENCAP 0x20000 /* UDP encapsulation */ u_int32_t tdb_flags; /* Flags related to this TDB */ @@ -363,6 +364,8 @@ struct tdb { /* tunnel descriptor block */ u_int32_t tdb_mtu; /* MTU at this point in the chain */ u_int64_t tdb_mtutimeout; /* When to ignore this entry */ + u_int16_t tdb_udpencap_port; /* Peer UDP port */ + struct sockaddr_encap tdb_filter; /* What traffic is acceptable */ struct sockaddr_encap tdb_filtermask; /* And the mask */ @@ -646,6 +649,7 @@ extern struct tdb *ipsp_spd_lookup(struct mbuf *, int, int, int *, int, struct tdb *, struct inpcb *); extern struct tdb *ipsp_spd_inp(struct mbuf *, int, int, int *, int, struct tdb *, struct inpcb *, struct ipsec_policy *); +extern int ipsec_common_input(struct mbuf *, int, int, int, int, int); extern int ipsec_common_input_cb(struct mbuf *, struct tdb *, int, int, struct m_tag *); extern int ipsp_acquire_sa(struct ipsec_policy *, union sockaddr_union *, diff --git a/sys/netinet/ipsec_input.c b/sys/netinet/ipsec_input.c index d4282c826ab..39e7b157821 100644 --- a/sys/netinet/ipsec_input.c +++ b/sys/netinet/ipsec_input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ipsec_input.c,v 1.69 2003/07/28 10:10:16 markus Exp $ */ +/* $OpenBSD: ipsec_input.c,v 1.70 2003/12/02 23:16:29 markus Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), * Angelos D. Keromytis (kermit@csd.uch.gr) and @@ -74,7 +74,6 @@ #include "bpfilter.h" -int ipsec_common_input(struct mbuf *, int, int, int, int); void *ipsec_common_ctlinput(int, struct sockaddr *, void *, int); #ifdef ENCDEBUG @@ -100,7 +99,8 @@ extern u_char ip6_protox[]; * filtering). */ int -ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) +ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto, + int udpencap) { #define IPSEC_ISTAT(x,y,z) (sproto == IPPROTO_ESP ? (x)++ : \ sproto == IPPROTO_AH ? (y)++ : (z)++) @@ -210,6 +210,14 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) return EINVAL; } + if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) { + splx(s); + DPRINTF(("ipsec_common_input(): attempted to use non-udpencap SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); + m_freem(m); + espstat.esps_udpinval++; + return EINVAL; + } + if (tdbp->tdb_xform == NULL) { splx(s); DPRINTF(("ipsec_common_input(): attempted to use uninitialized SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto)); @@ -227,7 +235,7 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto) */ m->m_pkthdr.rcvif = &encif[0].sc_if; } - + /* Register first use, setup expiration timer. */ if (tdbp->tdb_first_use == 0) { int pri; @@ -642,6 +650,10 @@ esp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlen, void *newp, switch (name[0]) { case ESPCTL_ENABLE: return sysctl_int(oldp, oldlen, newp, newlen, &esp_enable); + case ESPCTL_UDPENCAP_ENABLE: + return sysctl_int(oldp, oldlen, newp, newlen, &udpencap_enable); + case ESPCTL_UDPENCAP_PORT: + return sysctl_int(oldp, oldlen, newp, newlen, &udpencap_port); default: return ENOPROTOOPT; } @@ -695,7 +707,7 @@ ah4_input(struct mbuf *m, ...) va_end(ap); ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, - IPPROTO_AH); + IPPROTO_AH, 0); return; } @@ -751,7 +763,7 @@ esp4_input(struct mbuf *m, ...) va_end(ap); ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, - IPPROTO_ESP); + IPPROTO_ESP, 0); } /* IPv4 ESP callback. */ @@ -793,7 +805,7 @@ ipcomp4_input(struct mbuf *m, ...) va_end(ap); ipsec_common_input(m, skip, offsetof(struct ip, ip_p), AF_INET, - IPPROTO_IPCOMP); + IPPROTO_IPCOMP, 0); } /* IPv4 IPCOMP callback */ @@ -940,7 +952,7 @@ ah6_input(struct mbuf **mp, int *offp, int proto) } protoff += offsetof(struct ip6_ext, ip6e_nxt); } - ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); + ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); return IPPROTO_DONE; } @@ -1026,7 +1038,7 @@ esp6_input(struct mbuf **mp, int *offp, int proto) } protoff += offsetof(struct ip6_ext, ip6e_nxt); } - ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); + ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); return IPPROTO_DONE; } @@ -1080,7 +1092,7 @@ ipcomp6_input(struct mbuf **mp, int *offp, int proto) protoff += offsetof(struct ip6_ext, ip6e_nxt); } - ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto); + ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto, 0); return IPPROTO_DONE; } diff --git a/sys/netinet/ipsec_output.c b/sys/netinet/ipsec_output.c index 95ea1b9a330..da7dcfb47b6 100644 --- a/sys/netinet/ipsec_output.c +++ b/sys/netinet/ipsec_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ipsec_output.c,v 1.27 2003/07/09 22:03:16 itojun Exp $ */ +/* $OpenBSD: ipsec_output.c,v 1.28 2003/12/02 23:16:29 markus Exp $ */ /* * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu) * @@ -44,6 +44,7 @@ #include <netinet6/in6_var.h> #endif /* INET6 */ +#include <netinet/udp.h> #include <netinet/ip_ipsp.h> #include <netinet/ip_ah.h> #include <netinet/ip_esp.h> @@ -56,6 +57,9 @@ #define DPRINTF(x) #endif +int udpencap_enable = 0; /* disabled by default */ +int udpencap_port = 4500; /* triggers decapsulation */ + /* * Loop over a tdb chain, taking into consideration protocol tunneling. The * fourth argument is set if the first encapsulation header is already in @@ -336,12 +340,35 @@ ipsp_process_done(struct mbuf *m, struct tdb *tdb) tdb->tdb_last_used = time.tv_sec; + if (udpencap_enable && udpencap_port && + (tdb->tdb_flags & TDBF_UDPENCAP) != 0) { + struct mbuf *mi; + struct udphdr *uh; + + mi = m_inject(m, sizeof(struct ip), sizeof(struct udphdr), + M_DONTWAIT); + if (mi == NULL) { + m_freem(m); + return ENOMEM; + } + uh = mtod(mi, struct udphdr *); + uh->uh_sport = uh->uh_dport = htons(udpencap_port); + if (tdb->tdb_udpencap_port) + uh->uh_dport = tdb->tdb_udpencap_port; + + uh->uh_ulen = htons(m->m_pkthdr.len - sizeof(struct ip)); + uh->uh_sum = 0; + espstat.esps_udpencout++; + } + switch (tdb->tdb_dst.sa.sa_family) { #ifdef INET case AF_INET: /* Fix the header length, for AH processing. */ ip = mtod(m, struct ip *); ip->ip_len = htons(m->m_pkthdr.len); + if ((tdb->tdb_flags & TDBF_UDPENCAP) != 0) + ip->ip_p = IPPROTO_UDP; break; #endif /* INET */ @@ -359,6 +386,8 @@ ipsp_process_done(struct mbuf *m, struct tdb *tdb) } ip6 = mtod(m, struct ip6_hdr *); ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6)); + if ((tdb->tdb_flags & TDBF_UDPENCAP) != 0) + ip6->ip6_nxt = IPPROTO_UDP; break; #endif /* INET6 */ diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index 6a36106dafc..2d5aed4bbec 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -1,4 +1,4 @@ -/* $OpenBSD: udp_usrreq.c,v 1.92 2003/11/04 21:43:16 markus Exp $ */ +/* $OpenBSD: udp_usrreq.c,v 1.93 2003/12/02 23:16:29 markus Exp $ */ /* $NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $ */ /* @@ -89,6 +89,11 @@ #include <netinet/udp.h> #include <netinet/udp_var.h> +#ifdef IPSEC +#include <netinet/ip_ipsp.h> +#include <netinet/ip_esp.h> +#endif + #ifdef INET6 #ifndef INET #include <netinet/in.h> @@ -299,6 +304,42 @@ udp_input(struct mbuf *m, ...) } else udpstat.udps_nosum++; +#ifdef IPSEC + if (udpencap_enable && udpencap_port && + uh->uh_dport == htons(udpencap_port)) { + u_int32_t spi; + int skip = iphlen + sizeof(struct udphdr); + + if (m->m_pkthdr.len - skip < sizeof(u_int32_t)) { + /* packet too short */ + m_freem(m); + return; + } + m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); + /* + * decapsulate if the SPI is not zero, otherwise pass + * to userland + */ + if (spi != 0) { + if ((m = m_pullup2(m, skip)) == NULL) { + udpstat.udps_hdrops++; + return; + } + + /* remove the UDP header */ + bcopy(mtod(m, u_char *), + mtod(m, u_char *) + sizeof(struct udphdr), iphlen); + m_adj(m, sizeof(struct udphdr)); + skip -= sizeof(struct udphdr); + + espstat.esps_udpencin++; + ipsec_common_input(m, skip, offsetof(struct ip, ip_p), + srcsa.sa.sa_family, IPPROTO_ESP, 1); + return; + } + } +#endif + switch (srcsa.sa.sa_family) { case AF_INET: bzero(&srcsa, sizeof(struct sockaddr_in)); diff --git a/usr.bin/netstat/inet.c b/usr.bin/netstat/inet.c index f21ac74069e..84b6ec9bd35 100644 --- a/usr.bin/netstat/inet.c +++ b/usr.bin/netstat/inet.c @@ -1,4 +1,4 @@ -/* $OpenBSD: inet.c,v 1.73 2003/11/07 23:38:48 mcbride Exp $ */ +/* $OpenBSD: inet.c,v 1.74 2003/12/02 23:16:29 markus Exp $ */ /* $NetBSD: inet.c,v 1.14 1995/10/03 21:42:37 thorpej Exp $ */ /* @@ -34,7 +34,7 @@ #if 0 static char sccsid[] = "from: @(#)inet.c 8.4 (Berkeley) 4/20/94"; #else -static char *rcsid = "$OpenBSD: inet.c,v 1.73 2003/11/07 23:38:48 mcbride Exp $"; +static char *rcsid = "$OpenBSD: inet.c,v 1.74 2003/12/02 23:16:29 markus Exp $"; #endif #endif /* not lint */ @@ -817,6 +817,9 @@ esp_stats(u_long off, char *name) p(esps_invalid, "\t%u packet%s attempted to use an invalid TDB\n"); p(esps_toobig, "\t%u packet%s got larger than max IP packet size\n"); p(esps_crypto, "\t%u packet%s that failed crypto processing\n"); + p(esps_udpencin, "\t%u input UDP encapsulated ESP packet%s\n"); + p(esps_udpencout, "\t%u output UDP encapsulated ESP packet%s\n"); + p(esps_udpinval, "\t%u UDP packet%s for non-encapsulating TDB received\n"); p(esps_ibytes, "\t%qu input byte%s\n"); p(esps_obytes, "\t%qu output byte%s\n"); |