[PATCH 0/3] ipsec: Add ESP over TCP encapsulation

[Herbert Xu]

Hi:

This series of patches add basic support for ESP over TCP (RFC 8229).
Note that this does not include TLS support but it could be added in
future.

Here is an iproute patch to setup xfrm states with this:

diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index 12c2f72..f3fb1e2 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -738,6 +738,9 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family,
                case 2:
                        fprintf(fp, "espinudp ");
                        break;
+               case 6:
+                       fprintf(fp, "espintcp ");
+                       break;
                default:
                        fprintf(fp, "%u ", e->encap_type);
                        break;
@@ -1182,6 +1185,8 @@ int xfrm_encap_type_parse(__u16 *type, int *argcp, char 
***argvp)
                *type = 1;
        else if (strcmp(*argv, "espinudp") == 0)
                *type = 2;
+       else if (strcmp(*argv, "espintcp") == 0)
+               *type = 6;
        else
                invarg("ENCAP-TYPE value is invalid", *argv);
 

Here is a sample program for setting up the TCP socket to use this.
Note that it doesn't do the magic word as required by RFC 8229 so
you'll need to add that for a real key manager.

#include <arpa/inet.h>
#include <errno.h>
#include <error.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <stdlib.h>
#include <sys/socket.h>

#define TCP_ENCAP 35

int main(int argc, char **argv)
{
        struct sockaddr_in addr = {
                .sin_family = AF_INET,
                .sin_port = htons(4500),
        };
        char buf[4096];
        int one = 1;
        int err;
        int s;

        s = socket(AF_INET, SOCK_STREAM, 0);
        if (s < 0)
                error(-1, errno, "socket");

        if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0)
                error(-1, errno, "bind");

        if (argc > 1) {
                addr.sin_addr.s_addr = inet_addr(argv[1]);
                if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) < 0)
                        error(-1, errno, "connect");
        } else {
                if (listen(s, 0) < 0)
                        error(-1, errno, "listen");

                s = accept(s, NULL, 0);
                if (s < 0)
                        error(-1, errno, "accept");
        }

        if (setsockopt(s, SOL_TCP, TCP_NODELAY, &one, sizeof(one)) < 0)
                error(-1, errno, "TCP_NODELAY");

        if (setsockopt(s, SOL_TCP, TCP_ENCAP, NULL, 0) < 0)
                error(-1, errno, "TCP_ENCAP");

        while ((err = read(s, buf, sizeof(buf))) > 0)
                ;

        if (err < 0)
                error(-1, errno, "read");

        return 0;
}


Cheers,
-- 
Email: Herbert Xu <herb...@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt