diff options
| author | ozaki-r <ozaki-r@NetBSD.org> | 2019-07-23 04:30:32 +0000 |
|---|---|---|
| committer | ozaki-r <ozaki-r@NetBSD.org> | 2019-07-23 04:30:32 +0000 |
| commit | 990b0c2dbc897419e0d245a3ec156ffc5308fbd7 (patch) | |
| tree | bb16ada69123b94ddc85ee27e0f04b29815057aa /crypto | |
| parent | 7074f6dd8a75d91dbffb65a7bd0bec61753b9c43 (diff) | |
setkey: enable to use the getspi API
If a specified SPI is not zero, tell the kernel to use the SPI by using
SADB_EXT_SPIRANGE. Otherwise, the kernel picks a random SPI.
It enables to mimic racoon.
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/dist/ipsec-tools/src/setkey/parse.y | 31 | ||||
| -rw-r--r-- | crypto/dist/ipsec-tools/src/setkey/token.l | 3 |
2 files changed, 31 insertions, 3 deletions
diff --git a/crypto/dist/ipsec-tools/src/setkey/parse.y b/crypto/dist/ipsec-tools/src/setkey/parse.y index dfcfbe28c3a..a6efada4e58 100644 --- a/crypto/dist/ipsec-tools/src/setkey/parse.y +++ b/crypto/dist/ipsec-tools/src/setkey/parse.y @@ -1,4 +1,4 @@ -/* $NetBSD: parse.y,v 1.22 2018/10/14 08:27:39 maxv Exp $ */ +/* $NetBSD: parse.y,v 1.23 2019/07/23 04:30:32 ozaki-r Exp $ */ /* $KAME: parse.y,v 1.81 2003/07/01 04:01:48 itojun Exp $ */ /* @@ -114,7 +114,7 @@ static int setkeymsg_add(unsigned int, unsigned int, } %token EOT SLASH BLCL ELCL -%token ADD UPDATE GET DELETE DELETEALL FLUSH DUMP EXIT +%token ADD UPDATE GET GETSPI DELETE DELETEALL FLUSH DUMP EXIT %token PR_ESP PR_AH PR_IPCOMP PR_ESPUDP PR_TCP %token F_PROTOCOL F_AUTH F_ENC F_REPLAY F_COMP F_RAWCPI %token F_MODE MODE F_REQID @@ -161,6 +161,7 @@ command : add_command | update_command | get_command + | getspi_command | delete_command | deleteall_command | flush_command @@ -260,6 +261,17 @@ get_command } ; + /* getspi command */ +getspi_command + : GETSPI ipaddropts ipandport ipandport protocol_spec spi extension_spec EOT + { + int status; + + status = setkeymsg_add(SADB_GETSPI, $5, $3, $4); + if (status < 0) + return -1; + } + /* flush */ flush_command : FLUSH protocol_spec EOT @@ -1389,6 +1401,21 @@ setkeymsg_add(unsigned int type, unsigned int satype, struct addrinfo *srcs, } #endif + /* SPI == 0 allows the kernel to pick a random SPI */ + if (type == SADB_GETSPI && p_spi != 0) { + struct sadb_spirange spirange; + u_int slen = sizeof(struct sadb_spirange); + + memset(&spirange, 0, sizeof(spirange)); + spirange.sadb_spirange_len = PFKEY_UNIT64(slen); + spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE; + spirange.sadb_spirange_min = p_spi; + spirange.sadb_spirange_max = p_spi; + + memcpy(buf + l, &spirange, slen); + l += slen; + } + len = sizeof(struct sadb_sa); m_sa.sadb_sa_len = PFKEY_UNIT64(len); m_sa.sadb_sa_exttype = SADB_EXT_SA; diff --git a/crypto/dist/ipsec-tools/src/setkey/token.l b/crypto/dist/ipsec-tools/src/setkey/token.l index 2e185bca337..73b8f6c805f 100644 --- a/crypto/dist/ipsec-tools/src/setkey/token.l +++ b/crypto/dist/ipsec-tools/src/setkey/token.l @@ -1,4 +1,4 @@ -/* $NetBSD: token.l,v 1.22 2018/10/14 08:27:39 maxv Exp $ */ +/* $NetBSD: token.l,v 1.23 2019/07/23 04:30:32 ozaki-r Exp $ */ /* $KAME: token.l,v 1.44 2003/10/21 07:20:58 itojun Exp $ */ /* @@ -119,6 +119,7 @@ update { return(UPDATE); } delete { return(DELETE); } deleteall { return(DELETEALL); } get { return(GET); } +getspi { return(GETSPI); } flush { return(FLUSH); } dump { return(DUMP); } exit { return(EXIT); } |
