So pfkeyv2.h defines managed to sneak into the portable part of bgpd.
The fix was to just dump a pfkeyv2.h version into the -portable compat
code and call it a day. This is bad since pfkeyv2.h is highly OS
dependent.
This diff cleans up the mess by introducing new enums for the various
IPsec algorithms. With that the net/pfkeyv2.h include in bgpd.h can be
removed. In session.h we just need to forward declare struct sadb_msg
which is simple enough and no problem since the portable code only uses
NULL as argument.
In pfkey.c the BGPD algorithm defines need to be switched to SADB ones but
that is done with simple helper functions.
Is anyone actively using the IPsec support in bgpd? Not many other systems
seem to support BGP over IPsec. Also the supported algorithms are just aes
and 3des-cbc which is probably no longer adequate.
--
:wq Claudio
? obj
Index: bgpd.h
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/bgpd.h,v
retrieving revision 1.429
diff -u -p -r1.429 bgpd.h
--- bgpd.h 15 Jun 2022 10:10:03 -0000 1.429
+++ bgpd.h 15 Jun 2022 10:56:34 -0000
@@ -26,7 +26,6 @@
#include <netinet/in.h>
#include <arpa/inet.h>
#include <net/if.h>
-#include <net/pfkeyv2.h>
#include <poll.h>
#include <stdarg.h>
@@ -329,6 +328,18 @@ enum auth_method {
AUTH_IPSEC_IKE_AH
};
+enum auth_alg {
+ AUTH_AALG_NONE,
+ AUTH_AALG_SHA1HMAC,
+ AUTH_AALG_MD5HMAC,
+};
+
+enum auth_enc_alg {
+ AUTH_EALG_NONE,
+ AUTH_EALG_3DESCBC,
+ AUTH_EALG_AES,
+};
+
struct peer_auth {
char md5key[TCP_MD5_KEY_LEN];
char auth_key_in[IPSEC_AUTH_KEY_LEN];
@@ -338,13 +349,13 @@ struct peer_auth {
uint32_t spi_in;
uint32_t spi_out;
enum auth_method method;
+ enum auth_alg auth_alg_in;
+ enum auth_alg auth_alg_out;
+ enum auth_enc_alg enc_alg_in;
+ enum auth_enc_alg enc_alg_out;
uint8_t md5key_len;
- uint8_t auth_alg_in;
- uint8_t auth_alg_out;
uint8_t auth_keylen_in;
uint8_t auth_keylen_out;
- uint8_t enc_alg_in;
- uint8_t enc_alg_out;
uint8_t enc_keylen_in;
uint8_t enc_keylen_out;
};
Index: parse.y
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/parse.y,v
retrieving revision 1.429
diff -u -p -r1.429 parse.y
--- parse.y 9 Jun 2022 17:33:47 -0000 1.429
+++ parse.y 15 Jun 2022 10:56:35 -0000
@@ -193,7 +193,7 @@ typedef struct {
struct filter_prefixlen prefixlen;
struct prefixset_item *prefixset_item;
struct {
- uint8_t enc_alg;
+ enum auth_enc_alg enc_alg;
uint8_t enc_key_len;
char enc_key[IPSEC_ENC_KEY_LEN];
} encspec;
@@ -1609,7 +1609,7 @@ peeropts : REMOTEAS as4number {
curpeer->conf.auth.method = AUTH_IPSEC_IKE_AH;
}
| IPSEC espah inout SPI NUMBER STRING STRING encspec {
- uint32_t auth_alg;
+ enum auth_alg auth_alg;
uint8_t keylen;
if (curpeer->conf.auth.method &&
@@ -1626,10 +1626,10 @@ peeropts : REMOTEAS as4number {
}
if (!strcmp($6, "sha1")) {
- auth_alg = SADB_AALG_SHA1HMAC;
+ auth_alg = AUTH_AALG_SHA1HMAC;
keylen = 20;
} else if (!strcmp($6, "md5")) {
- auth_alg = SADB_AALG_MD5HMAC;
+ auth_alg = AUTH_AALG_MD5HMAC;
keylen = 16;
} else {
yyerror("unknown auth algorithm \"%s\"", $6);
@@ -1860,11 +1860,11 @@ encspec : /* nada */ {
| STRING STRING {
bzero(&$$, sizeof($$));
if (!strcmp($1, "3des") || !strcmp($1, "3des-cbc")) {
- $$.enc_alg = SADB_EALG_3DESCBC;
+ $$.enc_alg = AUTH_EALG_3DESCBC;
$$.enc_key_len = 21; /* XXX verify */
} else if (!strcmp($1, "aes") ||
!strcmp($1, "aes-128-cbc")) {
- $$.enc_alg = SADB_X_EALG_AES;
+ $$.enc_alg = AUTH_EALG_AES;
$$.enc_key_len = 16;
} else {
yyerror("unknown enc algorithm \"%s\"", $1);
Index: pfkey.c
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/pfkey.c,v
retrieving revision 1.62
diff -u -p -r1.62 pfkey.c
--- pfkey.c 6 Feb 2022 09:51:19 -0000 1.62
+++ pfkey.c 15 Jun 2022 10:56:35 -0000
@@ -590,6 +590,32 @@ fail:
return (-1);
}
+static uint8_t
+pfkey_auth_alg(enum auth_alg alg)
+{
+ switch (alg) {
+ case AUTH_AALG_SHA1HMAC:
+ return SADB_AALG_SHA1HMAC;
+ case AUTH_AALG_MD5HMAC:
+ return SADB_AALG_MD5HMAC;
+ default:
+ return SADB_AALG_NONE;
+ }
+}
+
+static uint8_t
+pfkey_enc_alg(enum auth_enc_alg alg)
+{
+ switch (alg) {
+ case AUTH_EALG_3DESCBC:
+ return SADB_EALG_3DESCBC;
+ case AUTH_EALG_AES:
+ return SADB_X_EALG_AES;
+ default:
+ return SADB_AALG_NONE;
+ }
+}
+
static int
pfkey_ipsec_establish(struct peer *p)
{
@@ -616,10 +642,10 @@ pfkey_ipsec_establish(struct peer *p)
if (pfkey_send(pfkey_fd, satype, SADB_ADD, 0,
local_addr, &p->conf.remote_addr,
p->conf.auth.spi_out,
- p->conf.auth.auth_alg_out,
+ pfkey_auth_alg(p->conf.auth.auth_alg_out),
p->conf.auth.auth_keylen_out,
p->conf.auth.auth_key_out,
- p->conf.auth.enc_alg_out,
+ pfkey_enc_alg(p->conf.auth.enc_alg_out),
p->conf.auth.enc_keylen_out,
p->conf.auth.enc_key_out,
0, 0) == -1)
@@ -629,10 +655,10 @@ pfkey_ipsec_establish(struct peer *p)
if (pfkey_send(pfkey_fd, satype, SADB_ADD, 0,
&p->conf.remote_addr, local_addr,
p->conf.auth.spi_in,
- p->conf.auth.auth_alg_in,
+ pfkey_auth_alg(p->conf.auth.auth_alg_in),
p->conf.auth.auth_keylen_in,
p->conf.auth.auth_key_in,
- p->conf.auth.enc_alg_in,
+ pfkey_enc_alg(p->conf.auth.enc_alg_in),
p->conf.auth.enc_keylen_in,
p->conf.auth.enc_key_in,
0, 0) == -1)
Index: printconf.c
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/printconf.c,v
retrieving revision 1.152
diff -u -p -r1.152 printconf.c
--- printconf.c 31 May 2022 09:45:33 -0000 1.152
+++ printconf.c 15 Jun 2022 10:56:35 -0000
@@ -45,8 +45,8 @@ void print_roa(struct roa_tree *);
void print_rtrs(struct rtr_config_head *);
void print_peer(struct peer_config *, struct bgpd_config *,
const char *);
-const char *print_auth_alg(uint8_t);
-const char *print_enc_alg(uint8_t);
+const char *print_auth_alg(enum auth_alg);
+const char *print_enc_alg(enum auth_enc_alg);
void print_announce(struct peer_config *, const char *);
void print_as(struct filter_rule *);
void print_rule(struct bgpd_config *, struct filter_rule *);
@@ -751,12 +751,12 @@ print_peer(struct peer_config *p, struct
}
const char *
-print_auth_alg(uint8_t alg)
+print_auth_alg(enum auth_alg alg)
{
switch (alg) {
- case SADB_AALG_SHA1HMAC:
+ case AUTH_AALG_SHA1HMAC:
return ("sha1");
- case SADB_AALG_MD5HMAC:
+ case AUTH_AALG_MD5HMAC:
return ("md5");
default:
return ("???");
@@ -764,12 +764,12 @@ print_auth_alg(uint8_t alg)
}
const char *
-print_enc_alg(uint8_t alg)
+print_enc_alg(enum auth_enc_alg alg)
{
switch (alg) {
- case SADB_EALG_3DESCBC:
+ case AUTH_EALG_3DESCBC:
return ("3des");
- case SADB_X_EALG_AES:
+ case AUTH_EALG_AES:
return ("aes");
default:
return ("???");
Index: session.h
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/session.h,v
retrieving revision 1.154
diff -u -p -r1.154 session.h
--- session.h 6 Feb 2022 09:51:19 -0000 1.154
+++ session.h 15 Jun 2022 10:56:35 -0000
@@ -295,6 +295,7 @@ void mrt_dump_state(struct mrt *, uint1
void mrt_done(struct mrt *);
/* pfkey.c */
+struct sadb_msg;
int pfkey_read(int, struct sadb_msg *);
int pfkey_establish(struct peer *);
int pfkey_remove(struct peer *);
