netdev - [PATCH 0/3] ipsec: Add ESP over TCP encapsulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180111132112.GA9501@gondor.apana.org.au>
Date:   Fri, 12 Jan 2018 00:21:12 +1100
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Steffen Klassert <steffen.klassert@...unet.com>,
        netdev@...r.kernel.org
Subject: [PATCH 0/3] ipsec: Add ESP over TCP encapsulation

Hi:

This series of patches add basic support for ESP over TCP (RFC 8229).
Note that this does not include TLS support but it could be added in
future.

Here is an iproute patch to setup xfrm states with this:

diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index 12c2f72..f3fb1e2 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -738,6 +738,9 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family,
 		case 2:
 			fprintf(fp, "espinudp ");
 			break;
+		case 6:
+			fprintf(fp, "espintcp ");
+			break;
 		default:
 			fprintf(fp, "%u ", e->encap_type);
 			break;
@@ -1182,6 +1185,8 @@ int xfrm_encap_type_parse(__u16 *type, int *argcp, char ***argvp)
 		*type = 1;
 	else if (strcmp(*argv, "espinudp") == 0)
 		*type = 2;
+	else if (strcmp(*argv, "espintcp") == 0)
+		*type = 6;
 	else
 		invarg("ENCAP-TYPE value is invalid", *argv);
 

Here is a sample program for setting up the TCP socket to use this.
Note that it doesn't do the magic word as required by RFC 8229 so
you'll need to add that for a real key manager.

#include <arpa/inet.h>
#include <errno.h>
#include <error.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <stdlib.h>
#include <sys/socket.h>

#define TCP_ENCAP 35

int main(int argc, char **argv)
{
	struct sockaddr_in addr = {
		.sin_family = AF_INET,
		.sin_port = htons(4500),
	};
	char buf[4096];
	int one = 1;
	int err;
	int s;

	s = socket(AF_INET, SOCK_STREAM, 0);
	if (s < 0)
		error(-1, errno, "socket");

	if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0)
		error(-1, errno, "bind");

	if (argc > 1) {
		addr.sin_addr.s_addr = inet_addr(argv[1]);
		if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) < 0)
			error(-1, errno, "connect");
	} else {
		if (listen(s, 0) < 0)
			error(-1, errno, "listen");

		s = accept(s, NULL, 0);
		if (s < 0)
			error(-1, errno, "accept");
	}

	if (setsockopt(s, SOL_TCP, TCP_NODELAY, &one, sizeof(one)) < 0)
		error(-1, errno, "TCP_NODELAY");

	if (setsockopt(s, SOL_TCP, TCP_ENCAP, NULL, 0) < 0)
		error(-1, errno, "TCP_ENCAP");

	while ((err = read(s, buf, sizeof(buf))) > 0)
		;

	if (err < 0)
		error(-1, errno, "read");

	return 0;
}


Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt