Re: iked(8): add transport mode for childsas
On Tue, Feb 18, 2020 at 12:09:10PM +0100, Tobias Heider wrote:
> here is an update of the last diff rebased onto current with minor fixes.
> There
> were some problems when multiple transport and non-transport policies were
> configured, which should now be fixed.
> I also have a test case for the new regression test which runs successfully.
Thanks, as already discussed off-list this is working as advertised.
This is useful for scenarios such as GRE over IPsec where double
encapsulation is neither necessary nor desired.
OK kn,
nits inline
> index d99d52ff77c..7b4c2075810 100644
> --- a/sbin/iked/iked.h
> +++ b/sbin/iked/iked.h
> - /* compression */
> + /* compression, transport mode */
I'd drop these useless comments.
> if ((pol->pol_flags & IKED_POLICY_IPCOMP) &&
> (len = ikev2_add_ipcompnotify(env, e, , len, sa, 1)) == -1)
> goto done;
> + if ((pol->pol_flags & IKED_POLICY_TRANSPORT) &&
> + (len = ikev2_add_transport_mode(env, e, , len, sa)) == -1)
> + goto done;
>
> if (ikev2_next_payload(pld, len, IKEV2_PAYLOAD_SA) == -1)
> goto done;
> @@ -1786,6 +1791,13 @@ ikev2_add_sighashnotify(struct ibuf *e, struct
> ikev2_payload **pld,
> return (len);
> }
> diff --git a/sbin/iked/parse.y b/sbin/iked/parse.y
> index fe052068922..3ca68e2fd7a 100644
> --- a/sbin/iked/parse.y
> +++ b/sbin/iked/parse.y
> @@ -426,7 +426,7 @@ typedef struct {
> %type id
> %type transforms
> %type filters
> -%type ikeflags ikematch ikemode ipcomp
> +%type ikeflags ikematch ikemode ipcomp tmode
> %type ikeauth
> %type keyspec
> %typeike_sas child_sas
> @@ -890,7 +890,7 @@ child_sa : CHILDSA {
> }
> ;
>
> -ikeflags : ikematch ikemode ipcomp { $$ = $1 | $2 | $3; }
> +ikeflags : ikematch ikemode ipcomp tmode { $$ = $1 | $2 | $3 | $4; }
> ;
>
> ikematch : /* empty */ { $$ = 0; }
> @@ -908,6 +908,11 @@ ipcomp : /* empty */ { $$ =
> 0; }
> | IPCOMP{ $$ = IKED_POLICY_IPCOMP; }
> ;
>
> +tmode: /* empty */ { $$ = 0; }
> + | TUNNEL{ $$ = 0; }
This should probably be explicit just like TRANSPORT.
Although unlikely, in the default for tmode changes this 0 for TUNNEL
would case an explicit `tunnel' in the config to change to the new
default as well.
> + | TRANSPORT { $$ = IKED_POLICY_TRANSPORT; }
> + ;
> +
> ikeauth : /* empty */ {
> $$.auth_method = IKEV2_AUTH_SIG_ANY;/* default */
> $$.auth_eap = 0;
> @@ -2465,6 +2470,9 @@ print_policy(struct iked_policy *pol)
> else
> print_verbose(" passive");
>
> + if (pol->pol_flags & IKED_POLICY_TRANSPORT)
> + print_verbose(" transport");
> +
What about printing "tunnel"? Omitting it makes existing config and
output stay the same with your diff, on the other hand we do have options
that are printed already even when being the default and/or omitted from
the config.
> print_verbose(" %s", print_xf(pol->pol_saproto, 0, saxfs));
>
> if (pol->pol_ipproto)
>
Re: iked(8): add transport mode for childsas
Hi,
here is an update of the last diff rebased onto current with minor fixes. There
were some problems when multiple transport and non-transport policies were
configured, which should now be fixed.
I also have a test case for the new regression test which runs successfully.
ok?
diff --git a/sbin/iked/iked.conf.5 b/sbin/iked/iked.conf.5
index 671cb5c7955..5af0a2e6d63 100644
--- a/sbin/iked/iked.conf.5
+++ b/sbin/iked/iked.conf.5
@@ -271,6 +271,15 @@ The optional compression is applied before packets are
encapsulated.
IPcomp must be enabled in the kernel:
.Pp
.Dl # sysctl net.inet.ipcomp.enable=1
+.It Op Ar tmode
+.Ar tmode
+describes the encapsulation mode to be used.
+Possible modes are
+.Ar tunnel
+and
+.Ar transport ;
+the default is
+.Ar tunnel .
.It Op Ar encap
.Ar encap
specifies the encapsulation protocol to be used.
@@ -280,15 +289,6 @@ and
.Ar ah ;
the default is
.Ar esp .
-.\" .It Op Ar tmode
-.\" .Ar tmode
-.\" describes the encapsulation mode to be used.
-.\" Possible modes are
-.\" .Ar tunnel
-.\" and
-.\" .Ar transport ;
-.\" the default is
-.\" .Ar tunnel .
.It Op Ar af
This policy only applies to endpoints of the specified address family
which can be either
diff --git a/sbin/iked/iked.h b/sbin/iked/iked.h
index d99d52ff77c..7b4c2075810 100644
--- a/sbin/iked/iked.h
+++ b/sbin/iked/iked.h
@@ -254,6 +254,7 @@ struct iked_policy {
#define IKED_POLICY_QUICK 0x08
#define IKED_POLICY_SKIP0x10
#define IKED_POLICY_IPCOMP 0x20
+#define IKED_POLICY_TRANSPORT 0x40
int pol_refcnt;
@@ -481,6 +482,9 @@ struct iked_sa {
int sa_mobike; /* MOBIKE */
int sa_frag; /* fragmentation */
+ int sa_use_transport_mode; /* peer
requested */
+ int sa_used_transport_mode; /* we enabled
*/
+
struct iked_timersa_timer; /* SA timeouts */
#define IKED_IKE_SA_EXCHANGE_TIMEOUT300/* 5 minutes */
#define IKED_IKE_SA_REKEY_TIMEOUT 120/* 2 minutes */
diff --git a/sbin/iked/ikev2.c b/sbin/iked/ikev2.c
index 842e8da110f..505cd31a204 100644
--- a/sbin/iked/ikev2.c
+++ b/sbin/iked/ikev2.c
@@ -142,15 +142,17 @@ intikev2_cp_setaddr(struct iked *, struct iked_sa
*, sa_family_t);
int ikev2_cp_fixaddr(struct iked_sa *, struct iked_addr *,
struct iked_addr *);
-ssize_tikev2_add_sighashnotify(struct ibuf *, struct ikev2_payload **,
+ssize_t ikev2_add_sighashnotify(struct ibuf *, struct ikev2_payload **,
ssize_t);
-ssize_t ikev2_add_nat_detection(struct iked *, struct ibuf *,
+ssize_t ikev2_add_nat_detection(struct iked *, struct ibuf *,
struct ikev2_payload **, struct iked_message *, ssize_t);
ssize_t ikev2_add_notify(struct ibuf *, struct ikev2_payload **,
ssize_t,
-uint16_t);
+ uint16_t);
ssize_t ikev2_add_mobike(struct ibuf *, struct ikev2_payload **,
ssize_t);
-ssize_t ikev2_add_fragmentation(struct ibuf *, struct ikev2_payload **,
-struct iked_message *, ssize_t);
+ssize_t ikev2_add_fragmentation(struct ibuf *, struct ikev2_payload **,
+ struct iked_message *, ssize_t);
+ssize_t ikev2_add_transport_mode(struct iked *, struct ibuf *,
+ struct ikev2_payload **, ssize_t, struct iked_sa *);
int ikev2_update_sa_addresses(struct iked *, struct iked_sa *);
int ikev2_resp_informational(struct iked *, struct iked_sa *,
struct iked_message *);
@@ -1246,10 +1248,13 @@ ikev2_init_ike_auth(struct iked *env, struct iked_sa
*sa)
goto done;
}
- /* compression */
+ /* compression, transport mode */
if ((pol->pol_flags & IKED_POLICY_IPCOMP) &&
(len = ikev2_add_ipcompnotify(env, e, , len, sa, 1)) == -1)
goto done;
+ if ((pol->pol_flags & IKED_POLICY_TRANSPORT) &&
+ (len = ikev2_add_transport_mode(env, e, , len, sa)) == -1)
+ goto done;
if (ikev2_next_payload(pld, len, IKEV2_PAYLOAD_SA) == -1)
goto done;
@@ -1786,6 +1791,13 @@ ikev2_add_sighashnotify(struct ibuf *e, struct
ikev2_payload **pld,
return (len);
}
+ssize_t
+ikev2_add_transport_mode(struct iked *env, struct ibuf *e,
+struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa)
+{
+ return ikev2_add_notify(e, pld, len, IKEV2_N_USE_TRANSPORT_MODE);
+}
+
int
ikev2_next_payload(struct ikev2_payload *pld, size_t length,
uint8_t nextpayload)
@@ -2990,10 +3002,13 @@ ikev2_resp_ike_auth(struct iked *env, struct iked_sa
*sa)
goto done;
}
- /* compression */
+ /* compression, transport mode */
if (sa->sa_ipcompr.ic_transform &&
(len = ikev2_add_ipcompnotify(env, e, , len,
Re: iked(8): add transport mode for childsas
Hello,
I have this patch in production for more than 2 weeks without any
problems. Please try to put it in.
- Joerg
On 13.08.2019 15:51, Tobias Heider wrote:
Update: Having the use_transport_mode flag attached to the SA is
not the best idea, so now it is given down to the child SA as soon as
possible and then only looked up from there (and cleared in the parent).
A simple setup looks as follows:
For A (/etc/iked.conf):
ikev2 "test" active transport esp from A to B \
peer B
For B (/etc/iked.conf):
ikev2 "test" active transport esp from B to A \
peer A
If successful ipsecctl -ssa (on both hosts) shows:
esp transport from A to B spi 0xedf7b2e6 auth hmac-sha2-256 enc aes-256
esp transport from B to A spi 0xedf7b2e6 auth hmac-sha2-256 enc aes-256
ok?
Here's the diff:
Index: iked.conf.5
===
RCS file: /mount/openbsd/cvs/src/sbin/iked/iked.conf.5,v
retrieving revision 1.55
diff -u -p -u -r1.55 iked.conf.5
--- iked.conf.5 11 May 2019 16:30:23 - 1.55
+++ iked.conf.5 13 Aug 2019 12:23:48 -
@@ -268,6 +268,15 @@ specifies that
.Xr ipcomp 4 ,
the IP Payload Compression protocol, is negotiated in addition to
encapsulation.
The optional compression is applied before packets are encapsulated.
+.It Op Ar tmode
+.Ar tmode
+describes the encapsulation mode to be used.
+Possible modes are
+.Ar tunnel
+and
+.Ar transport ;
+the default is
+.Ar tunnel .
.It Op Ar encap
.Ar encap
specifies the encapsulation protocol to be used.
@@ -277,15 +286,6 @@ and
.Ar ah ;
the default is
.Ar esp .
-.\" .It Op Ar tmode
-.\" .Ar tmode
-.\" describes the encapsulation mode to be used.
-.\" Possible modes are
-.\" .Ar tunnel
-.\" and
-.\" .Ar transport ;
-.\" the default is
-.\" .Ar tunnel .
.It Op Ar af
This policy only applies to endpoints of the specified address family
which can be either
Index: iked.h
===
RCS file: /mount/openbsd/cvs/src/sbin/iked/iked.h,v
retrieving revision 1.122
diff -u -p -u -r1.122 iked.h
--- iked.h 12 Aug 2019 07:40:45 - 1.122
+++ iked.h 13 Aug 2019 12:23:48 -
@@ -251,6 +251,7 @@ struct iked_policy {
#define IKED_POLICY_QUICK 0x08
#define IKED_POLICY_SKIP 0x10
#define IKED_POLICY_IPCOMP 0x20
+#define IKED_POLICY_TRANSPORT 0x40
int pol_refcnt;
@@ -465,6 +466,7 @@ struct iked_sa {
int sa_mobike; /* MOBIKE */
int sa_frag; /* fragmentation */
+ int sa_use_transport_mode; /* should be
reset */
struct iked_timer sa_timer; /* SA timeouts */
#define IKED_IKE_SA_EXCHANGE_TIMEOUT 300/* 5 minutes */
Index: ikev2.c
===
RCS file: /mount/openbsd/cvs/src/sbin/iked/ikev2.c,v
retrieving revision 1.172
diff -u -p -u -r1.172 ikev2.c
--- ikev2.c 12 Aug 2019 07:40:45 - 1.172
+++ ikev2.c 13 Aug 2019 12:47:49 -
@@ -148,8 +148,12 @@ ssize_t ikev2_add_nat_detection(struct i
ssize_t ikev2_add_fragmentation(struct iked *, struct ibuf *,
struct ikev2_payload **, struct iked_message *, ssize_t);
+ssize_t ikev2_add_notify(struct iked *, struct ibuf *,
+ struct ikev2_payload **, ssize_t, struct iked_sa *, uint16_t);
ssize_tikev2_add_mobike(struct iked *, struct ibuf *,
struct ikev2_payload **, ssize_t, struct iked_sa *);
+ssize_t ikev2_add_transport_mode(struct iked *, struct ibuf *,
+ struct ikev2_payload **, ssize_t, struct iked_sa *);
intikev2_update_sa_addresses(struct iked *, struct iked_sa *);
intikev2_resp_informational(struct iked *, struct iked_sa *,
struct iked_message *);
@@ -1238,10 +1242,13 @@ ikev2_init_ike_auth(struct iked *env, st
goto done;
}
- /* compression */
+ /* compression, transport mode */
if ((pol->pol_flags & IKED_POLICY_IPCOMP) &&
(len = ikev2_add_ipcompnotify(env, e, , len, sa)) == -1)
goto done;
+ if ((pol->pol_flags & IKED_POLICY_TRANSPORT) &&
+ (len = ikev2_add_transport_mode(env, e, , len, sa)) == -1)
+ goto done;
if (ikev2_next_payload(pld, len, IKEV2_PAYLOAD_SA) == -1)
goto done;
@@ -1685,8 +1692,9 @@ ikev2_add_ipcompnotify(struct iked *env,
}
ssize_t
-ikev2_add_mobike(struct iked *env, struct ibuf *e,
-struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa)
+ikev2_add_notify(struct iked *env, struct ibuf *e,
+struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa,
+uint16_t notify)
{
struct ikev2_notify *n;
uint8_t *ptr;
@@ -1702,13 +1710,27 @@ ikev2_add_mobike(struct iked *env, struc
n = (struct ikev2_notify *)ptr;
Re: iked(8): add transport mode for childsas
Update: Having the use_transport_mode flag attached to the SA is
not the best idea, so now it is given down to the child SA as soon as
possible and then only looked up from there (and cleared in the parent).
A simple setup looks as follows:
For A (/etc/iked.conf):
ikev2 "test" active transport esp from A to B \
peer B
For B (/etc/iked.conf):
ikev2 "test" active transport esp from B to A \
peer A
If successful ipsecctl -ssa (on both hosts) shows:
esp transport from A to B spi 0xedf7b2e6 auth hmac-sha2-256 enc aes-256
esp transport from B to A spi 0xedf7b2e6 auth hmac-sha2-256 enc aes-256
ok?
Here's the diff:
Index: iked.conf.5
===
RCS file: /mount/openbsd/cvs/src/sbin/iked/iked.conf.5,v
retrieving revision 1.55
diff -u -p -u -r1.55 iked.conf.5
--- iked.conf.5 11 May 2019 16:30:23 - 1.55
+++ iked.conf.5 13 Aug 2019 12:23:48 -
@@ -268,6 +268,15 @@ specifies that
.Xr ipcomp 4 ,
the IP Payload Compression protocol, is negotiated in addition to
encapsulation.
The optional compression is applied before packets are encapsulated.
+.It Op Ar tmode
+.Ar tmode
+describes the encapsulation mode to be used.
+Possible modes are
+.Ar tunnel
+and
+.Ar transport ;
+the default is
+.Ar tunnel .
.It Op Ar encap
.Ar encap
specifies the encapsulation protocol to be used.
@@ -277,15 +286,6 @@ and
.Ar ah ;
the default is
.Ar esp .
-.\" .It Op Ar tmode
-.\" .Ar tmode
-.\" describes the encapsulation mode to be used.
-.\" Possible modes are
-.\" .Ar tunnel
-.\" and
-.\" .Ar transport ;
-.\" the default is
-.\" .Ar tunnel .
.It Op Ar af
This policy only applies to endpoints of the specified address family
which can be either
Index: iked.h
===
RCS file: /mount/openbsd/cvs/src/sbin/iked/iked.h,v
retrieving revision 1.122
diff -u -p -u -r1.122 iked.h
--- iked.h 12 Aug 2019 07:40:45 - 1.122
+++ iked.h 13 Aug 2019 12:23:48 -
@@ -251,6 +251,7 @@ struct iked_policy {
#define IKED_POLICY_QUICK 0x08
#define IKED_POLICY_SKIP0x10
#define IKED_POLICY_IPCOMP 0x20
+#define IKED_POLICY_TRANSPORT 0x40
int pol_refcnt;
@@ -465,6 +466,7 @@ struct iked_sa {
int sa_mobike; /* MOBIKE */
int sa_frag; /* fragmentation */
+ int sa_use_transport_mode; /* should be
reset */
struct iked_timersa_timer; /* SA timeouts */
#define IKED_IKE_SA_EXCHANGE_TIMEOUT300/* 5 minutes */
Index: ikev2.c
===
RCS file: /mount/openbsd/cvs/src/sbin/iked/ikev2.c,v
retrieving revision 1.172
diff -u -p -u -r1.172 ikev2.c
--- ikev2.c 12 Aug 2019 07:40:45 - 1.172
+++ ikev2.c 13 Aug 2019 12:47:49 -
@@ -148,8 +148,12 @@ ssize_t ikev2_add_nat_detection(struct i
ssize_t ikev2_add_fragmentation(struct iked *, struct ibuf *,
struct ikev2_payload **, struct iked_message *, ssize_t);
+ssize_t ikev2_add_notify(struct iked *, struct ibuf *,
+ struct ikev2_payload **, ssize_t, struct iked_sa *, uint16_t);
ssize_t ikev2_add_mobike(struct iked *, struct ibuf *,
struct ikev2_payload **, ssize_t, struct iked_sa *);
+ssize_t ikev2_add_transport_mode(struct iked *, struct ibuf *,
+ struct ikev2_payload **, ssize_t, struct iked_sa *);
int ikev2_update_sa_addresses(struct iked *, struct iked_sa *);
int ikev2_resp_informational(struct iked *, struct iked_sa *,
struct iked_message *);
@@ -1238,10 +1242,13 @@ ikev2_init_ike_auth(struct iked *env, st
goto done;
}
- /* compression */
+ /* compression, transport mode */
if ((pol->pol_flags & IKED_POLICY_IPCOMP) &&
(len = ikev2_add_ipcompnotify(env, e, , len, sa)) == -1)
goto done;
+ if ((pol->pol_flags & IKED_POLICY_TRANSPORT) &&
+ (len = ikev2_add_transport_mode(env, e, , len, sa)) == -1)
+ goto done;
if (ikev2_next_payload(pld, len, IKEV2_PAYLOAD_SA) == -1)
goto done;
@@ -1685,8 +1692,9 @@ ikev2_add_ipcompnotify(struct iked *env,
}
ssize_t
-ikev2_add_mobike(struct iked *env, struct ibuf *e,
-struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa)
+ikev2_add_notify(struct iked *env, struct ibuf *e,
+struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa,
+uint16_t notify)
{
struct ikev2_notify *n;
uint8_t *ptr;
@@ -1702,13 +1710,27 @@ ikev2_add_mobike(struct iked *env, struc
n = (struct ikev2_notify *)ptr;
n->n_protoid = 0;
n->n_spisize = 0;
- n->n_type =
iked(8): add transport mode for childsas
This diff allows iked(8) to optionally negotiate Child SAs with IPsec transport
mode instead of tunnel mode.
Ok?
Index: iked.conf.5
===
RCS file: /cvs/src/sbin/iked/iked.conf.5,v
retrieving revision 1.55
diff -u -p -u -r1.55 iked.conf.5
--- iked.conf.5 11 May 2019 16:30:23 - 1.55
+++ iked.conf.5 17 Jul 2019 20:26:54 -
@@ -268,6 +268,15 @@ specifies that
.Xr ipcomp 4 ,
the IP Payload Compression protocol, is negotiated in addition to
encapsulation.
The optional compression is applied before packets are encapsulated.
+.It Op Ar tmode
+.Ar tmode
+describes the encapsulation mode to be used.
+Possible modes are
+.Ar tunnel
+and
+.Ar transport ;
+the default is
+.Ar tunnel .
.It Op Ar encap
.Ar encap
specifies the encapsulation protocol to be used.
@@ -277,15 +286,6 @@ and
.Ar ah ;
the default is
.Ar esp .
-.\" .It Op Ar tmode
-.\" .Ar tmode
-.\" describes the encapsulation mode to be used.
-.\" Possible modes are
-.\" .Ar tunnel
-.\" and
-.\" .Ar transport ;
-.\" the default is
-.\" .Ar tunnel .
.It Op Ar af
This policy only applies to endpoints of the specified address family
which can be either
Index: iked.h
===
RCS file: /cvs/src/sbin/iked/iked.h,v
retrieving revision 1.121
diff -u -p -u -r1.121 iked.h
--- iked.h 11 May 2019 16:30:23 - 1.121
+++ iked.h 17 Jul 2019 20:26:55 -
@@ -251,6 +251,7 @@ struct iked_policy {
#define IKED_POLICY_QUICK 0x08
#define IKED_POLICY_SKIP0x10
#define IKED_POLICY_IPCOMP 0x20
+#define IKED_POLICY_TRANSPORT 0x40
int pol_refcnt;
@@ -465,6 +466,7 @@ struct iked_sa {
int sa_mobike; /* MOBIKE */
int sa_frag; /* fragmentation */
+ int sa_use_transport_mode; /* should be
reset */
struct iked_timersa_timer; /* SA timeouts */
#define IKED_IKE_SA_EXCHANGE_TIMEOUT300/* 5 minutes */
Index: ikev2.c
===
RCS file: /cvs/src/sbin/iked/ikev2.c,v
retrieving revision 1.171
diff -u -p -u -r1.171 ikev2.c
--- ikev2.c 11 May 2019 16:30:23 - 1.171
+++ ikev2.c 17 Jul 2019 20:26:57 -
@@ -148,8 +148,12 @@ ssize_t ikev2_add_nat_detection(struct i
ssize_t ikev2_add_fragmentation(struct iked *, struct ibuf *,
struct ikev2_payload **, struct iked_message *, ssize_t);
+ssize_t ikev2_add_notify(struct iked *, struct ibuf *,
+ struct ikev2_payload **, ssize_t, struct iked_sa *, uint16_t);
ssize_t ikev2_add_mobike(struct iked *, struct ibuf *,
struct ikev2_payload **, ssize_t, struct iked_sa *);
+ssize_t ikev2_add_transport_mode(struct iked *, struct ibuf *,
+ struct ikev2_payload **, ssize_t, struct iked_sa *);
int ikev2_update_sa_addresses(struct iked *, struct iked_sa *);
int ikev2_resp_informational(struct iked *, struct iked_sa *,
struct iked_message *);
@@ -1670,8 +1674,9 @@ ikev2_add_ipcompnotify(struct iked *env,
}
ssize_t
-ikev2_add_mobike(struct iked *env, struct ibuf *e,
-struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa)
+ikev2_add_notify(struct iked *env, struct ibuf *e,
+struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa,
+uint16_t notify)
{
struct ikev2_notify *n;
uint8_t *ptr;
@@ -1687,13 +1692,27 @@ ikev2_add_mobike(struct iked *env, struc
n = (struct ikev2_notify *)ptr;
n->n_protoid = 0;
n->n_spisize = 0;
- n->n_type = htobe16(IKEV2_N_MOBIKE_SUPPORTED);
+ n->n_type = htobe16(notify);
log_debug("%s: done", __func__);
return (len);
}
ssize_t
+ikev2_add_mobike(struct iked *env, struct ibuf *e,
+struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa)
+{
+ return ikev2_add_notify(env, e, pld, len, sa,
IKEV2_N_MOBIKE_SUPPORTED);
+}
+
+ssize_t
+ikev2_add_transport_mode(struct iked *env, struct ibuf *e,
+struct ikev2_payload **pld, ssize_t len, struct iked_sa *sa)
+{
+ return ikev2_add_notify(env, e, pld, len, sa,
IKEV2_N_USE_TRANSPORT_MODE);
+}
+
+ssize_t
ikev2_add_fragmentation(struct iked *env, struct ibuf *buf,
struct ikev2_payload **pld, struct iked_message *msg, ssize_t len)
{
@@ -5209,6 +5228,7 @@ ikev2_childsa_negotiate(struct iked *env
csa->csa_spi.spi_protoid = prop->prop_protoid;
csa->csa_esn = esn;
csa->csa_acquired = acquired;
+ csa->csa_transport = sa->sa_use_transport_mode;
/* Set up responder's SPIs */
if (initiator) {
@@ -5295,6 +5315,7 @@ ikev2_childsa_negotiate(struct iked *env
ret = 0;
