From nobody Mon May 29 22:10:09 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4QVV824j75z4XFpx; Mon, 29 May 2023 22:10:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4QVV820Z8Jz3HwS; Mon, 29 May 2023 22:10:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1685398210; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mo5OTlSY5rjUTJKnW5BHUCu410ftoILU8FQi8Leoxh4=; b=Pur14gYAAjXByWnrw2yZXZ1ZI9IncHeFIZrnawjgeFwjWSimCo0055rnjw0iyUeG3E3fWB ytdGWM2d7pZX0MzIs87WFbWMWsUyk6GeO0Nzp/1Ttu3ehG6pIDOC8H+g28ELHdIlFCARWI dQQBBbEDoq9/EDfzM5g4B4hLEdVaCqKsTFH4XXkNIUzAp61X1ltVYhh9MP8ERRgqEtoJfq IGnlxjryHN5n6Gr1UNPwaQXcdrbFHxeUifGONyuzdOR0+uXS+gVA21B0jevmuKQ9PJ4b8s 8Lmuh/PJkMviC4Lhpxi5LdNZcHnUwLyEvXPOBCJKjX4fEN+WVEIQ5WCrMtqrhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1685398210; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mo5OTlSY5rjUTJKnW5BHUCu410ftoILU8FQi8Leoxh4=; b=GLzTn8f+Ts57gFz2D+mbj/Ag8FHJjoyswEsK5PKHLENitXBRetLwwZnDudSoMbdxv94Tuk tp1R6xy/dE6dSy7/8VDLmkfVMeIw33DewxgJBXusHAfGq+vlg3wUz8J3SUMP2QMN465rwn 62FRXqec99+YvbqbK/HVJqrlc52p5tSIsvCcYOTIiqwaUFQd2iDD2x8SUUy5suFQac/v3g 8TQW5zDrE/s4eeNtKLBw3MTqE3COsU0r7iKX3tyawQ1yzQ03vYUw3l/klP8DmvF8WWz9ea zLdOFknVjTqqp81Bjeqz93SbScyiAbsz7mNeRtcYb7ObhctZ6XAYEifF74Eshg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1685398210; a=rsa-sha256; cv=none; b=m7TmBzRAaQ02I2LfsLTUVTJfuz3dA/jAK/jnJDEkFIQQKUQ3654vjRiqw4AVJa1vSXfNeg sXENRGUr+mfvAe6TW3HTTgBbk6v/9B64rz07c/FnWJOCmR4kIIKeX0afG+p4MLQG+WpcIA mxA18N948uKpBKuVnj38L33ex86sExMTBXUY47jo+QhzmIjt/MURiETOZ5zUFxX36l5qXV Tiy2XIqi9+Aukw7jfq1jXkQ0cCyzsVLg3oQmFAFYyU+fnrlZf4hBI9M5hB+L+23FcSqrYA yhTb/zW9o2c906r1sz8OzqrDK4DDy+nx/gdb447SdwpEU9C/dhjt+CRaK4scKQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4QVV816SzpzSjy; Mon, 29 May 2023 22:10:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 34TMA96Y037199; Mon, 29 May 2023 22:10:09 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 34TMA9jM037193; Mon, 29 May 2023 22:10:09 GMT (envelope-from git) Date: Mon, 29 May 2023 22:10:09 GMT Message-Id: <202305292210.34TMA9jM037193@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: 2fa1b8617fdf - main - setkey(8): NAT-T manual configuration support List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2fa1b8617fdf68d0043efb7ae7c524702afba27c Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=2fa1b8617fdf68d0043efb7ae7c524702afba27c commit 2fa1b8617fdf68d0043efb7ae7c524702afba27c Author: Konstantin Belousov AuthorDate: 2023-05-25 10:41:15 +0000 Commit: Konstantin Belousov CommitDate: 2023-05-29 22:10:02 +0000 setkey(8): NAT-T manual configuration support This is needed for testing of offload capabilities. Reviewed by: ae Discussed with: bz Sponsored by: NVidia networking MFC after: 1 week Differential revision: https://reviews.freebsd.org/D40300 --- sbin/setkey/parse.y | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++++- sbin/setkey/token.l | 2 ++ 2 files changed, 88 insertions(+), 1 deletion(-) diff --git a/sbin/setkey/parse.y b/sbin/setkey/parse.y index d279546fada6..8e4866e7e848 100644 --- a/sbin/setkey/parse.y +++ b/sbin/setkey/parse.y @@ -43,6 +43,7 @@ #include #include #include +#include #include #include @@ -64,6 +65,10 @@ u_int32_t p_reqid; u_int p_key_enc_len, p_key_auth_len; caddr_t p_key_enc, p_key_auth; time_t p_lt_hard, p_lt_soft; +u_int p_natt_type; +struct addrinfo *p_natt_oai, *p_natt_oar; +int p_natt_sport, p_natt_dport; +int p_natt_fraglen; static int p_aiflags = 0, p_aifamily = PF_UNSPEC; @@ -110,7 +115,7 @@ extern void yyerror(const char *); /* SPD management */ %token SPDADD SPDDELETE SPDDUMP SPDFLUSH %token F_POLICY PL_REQUESTS -%token F_AIFLAGS +%token F_AIFLAGS F_NATT F_NATT_MTU %token TAGGED %type prefix protocol_spec upper_spec @@ -521,6 +526,20 @@ extension } | F_LIFETIME_HARD DECSTRING { p_lt_hard = $2; } | F_LIFETIME_SOFT DECSTRING { p_lt_soft = $2; } + | F_NATT ipaddr BLCL DECSTRING ELCL ipaddr BLCL DECSTRING ELCL + { + p_natt_type = UDP_ENCAP_ESPINUDP; + p_natt_oai = $2; + p_natt_oar = $6; + if (p_natt_oai == NULL || p_natt_oar == NULL) + return (-1); + p_natt_sport = $4; + p_natt_dport = $8; + } + | F_NATT_MTU DECSTRING + { + p_natt_fraglen = $2; + } ; /* definition about command for SPD management */ @@ -1019,6 +1038,9 @@ setkeymsg_add(unsigned type, unsigned satype, struct addrinfo *srcs, struct sadb_address m_addr; struct sadb_x_sa_replay m_replay; struct addrinfo *s, *d; + struct sadb_x_nat_t_type m_natt_type; + struct sadb_x_nat_t_port m_natt_port; + struct sadb_x_nat_t_frag m_natt_frag; int n; int plen; struct sockaddr *sa; @@ -1128,6 +1150,64 @@ setkeymsg_add(unsigned type, unsigned satype, struct addrinfo *srcs, memcpy(buf + l, &m_replay, len); l += len; } + + if (p_natt_type != 0) { + len = sizeof(m_natt_type); + memset(&m_natt_type, 0, sizeof(m_natt_type)); + m_natt_type.sadb_x_nat_t_type_len = PFKEY_UNIT64(len); + m_natt_type.sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE; + m_natt_type.sadb_x_nat_t_type_type = p_natt_type; + memcpy(buf + l, &m_natt_type, len); + l += len; + + memset(&m_addr, 0, sizeof(m_addr)); + m_addr.sadb_address_exttype = SADB_X_EXT_NAT_T_OAI; + sa = p_natt_oai->ai_addr; + salen = p_natt_oai->ai_addr->sa_len; + m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) + + PFKEY_ALIGN8(salen)); + m_addr.sadb_address_prefixlen = setkeymsg_plen(p_natt_oai); + setvarbuf(buf, &l, (struct sadb_ext *)&m_addr, + sizeof(m_addr), (caddr_t)sa, salen); + + len = sizeof(m_natt_port); + memset(&m_natt_port, 0, sizeof(m_natt_port)); + m_natt_port.sadb_x_nat_t_port_len = PFKEY_UNIT64(len); + m_natt_port.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT; + m_natt_port.sadb_x_nat_t_port_port = htons(p_natt_sport); + memcpy(buf + l, &m_natt_port, len); + l += len; + + memset(&m_addr, 0, sizeof(m_addr)); + m_addr.sadb_address_exttype = SADB_X_EXT_NAT_T_OAR; + sa = p_natt_oar->ai_addr; + salen = p_natt_oar->ai_addr->sa_len; + m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) + + PFKEY_ALIGN8(salen)); + m_addr.sadb_address_prefixlen = setkeymsg_plen(p_natt_oar); + setvarbuf(buf, &l, (struct sadb_ext *)&m_addr, + sizeof(m_addr), (caddr_t)sa, salen); + + len = sizeof(m_natt_port); + memset(&m_natt_port, 0, sizeof(m_natt_port)); + m_natt_port.sadb_x_nat_t_port_len = PFKEY_UNIT64(len); + m_natt_port.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT; + m_natt_port.sadb_x_nat_t_port_port = htons(p_natt_dport); + memcpy(buf + l, &m_natt_port, len); + l += len; + + if (p_natt_fraglen != -1) { + len = sizeof(m_natt_frag); + memset(&m_natt_port, 0, sizeof(m_natt_frag)); + m_natt_frag.sadb_x_nat_t_frag_len = PFKEY_UNIT64(len); + m_natt_frag.sadb_x_nat_t_frag_exttype = + SADB_X_EXT_NAT_T_FRAG; + m_natt_frag.sadb_x_nat_t_frag_fraglen = p_natt_fraglen; + memcpy(buf + l, &m_natt_frag, len); + l += len; + } + } + l0 = l; n = 0; @@ -1271,6 +1351,11 @@ parse_init(void) p_aiflags = 0; p_aifamily = PF_UNSPEC; + + p_natt_type = 0; + p_natt_oai = p_natt_oar = NULL; + p_natt_sport = p_natt_dport = 0; + p_natt_fraglen = -1; } void diff --git a/sbin/setkey/token.l b/sbin/setkey/token.l index 44b1ffbfaa32..ff15b959a585 100644 --- a/sbin/setkey/token.l +++ b/sbin/setkey/token.l @@ -186,6 +186,8 @@ nocyclic-seq { return(NOCYCLICSEQ); } {hyphen}r { return(F_REPLAY); } {hyphen}lh { return(F_LIFETIME_HARD); } {hyphen}ls { return(F_LIFETIME_SOFT); } +{hyphen}natt { return(F_NATT); } +{hyphen}natt_mtu { return(F_NATT_MTU); } /* ... */ any { return(ANY); }