On Wed, Jun 15, 2022 at 01:43:29PM +0200, Claudio Jeker wrote:
> So pfkeyv2.h defines managed to sneak into the portable part of bgpd.
> The fix was to just dump a pfkeyv2.h version into the -portable compat
> code and call it a day. This is bad since pfkeyv2.h is highly OS
> dependent.
>
> This diff cleans up the mess by introducing new enums for the various
> IPsec algorithms. With that the net/pfkeyv2.h include in bgpd.h can be
> removed. In session.h we just need to forward declare struct sadb_msg
> which is simple enough and no problem since the portable code only uses
> NULL as argument.
>
> In pfkey.c the BGPD algorithm defines need to be switched to SADB ones but
> that is done with simple helper functions.
ok tb
>
> Is anyone actively using the IPsec support in bgpd? Not many other systems
> seem to support BGP over IPsec. Also the supported algorithms are just aes
> and 3des-cbc which is probably no longer adequate.
> --
> :wq Claudio
>
> ? obj
> Index: bgpd.h
> ===================================================================
> RCS file: /cvs/src/usr.sbin/bgpd/bgpd.h,v
> retrieving revision 1.429
> diff -u -p -r1.429 bgpd.h
> --- bgpd.h 15 Jun 2022 10:10:03 -0000 1.429
> +++ bgpd.h 15 Jun 2022 10:56:34 -0000
> @@ -26,7 +26,6 @@
> #include <netinet/in.h>
> #include <arpa/inet.h>
> #include <net/if.h>
> -#include <net/pfkeyv2.h>
>
> #include <poll.h>
> #include <stdarg.h>
> @@ -329,6 +328,18 @@ enum auth_method {
> AUTH_IPSEC_IKE_AH
> };
>
> +enum auth_alg {
> + AUTH_AALG_NONE,
> + AUTH_AALG_SHA1HMAC,
> + AUTH_AALG_MD5HMAC,
> +};
> +
> +enum auth_enc_alg {
> + AUTH_EALG_NONE,
> + AUTH_EALG_3DESCBC,
> + AUTH_EALG_AES,
> +};
> +
> struct peer_auth {
> char md5key[TCP_MD5_KEY_LEN];
> char auth_key_in[IPSEC_AUTH_KEY_LEN];
> @@ -338,13 +349,13 @@ struct peer_auth {
> uint32_t spi_in;
> uint32_t spi_out;
> enum auth_method method;
> + enum auth_alg auth_alg_in;
> + enum auth_alg auth_alg_out;
> + enum auth_enc_alg enc_alg_in;
> + enum auth_enc_alg enc_alg_out;
> uint8_t md5key_len;
> - uint8_t auth_alg_in;
> - uint8_t auth_alg_out;
> uint8_t auth_keylen_in;
> uint8_t auth_keylen_out;
> - uint8_t enc_alg_in;
> - uint8_t enc_alg_out;
> uint8_t enc_keylen_in;
> uint8_t enc_keylen_out;
> };
> Index: parse.y
> ===================================================================
> RCS file: /cvs/src/usr.sbin/bgpd/parse.y,v
> retrieving revision 1.429
> diff -u -p -r1.429 parse.y
> --- parse.y 9 Jun 2022 17:33:47 -0000 1.429
> +++ parse.y 15 Jun 2022 10:56:35 -0000
> @@ -193,7 +193,7 @@ typedef struct {
> struct filter_prefixlen prefixlen;
> struct prefixset_item *prefixset_item;
> struct {
> - uint8_t enc_alg;
> + enum auth_enc_alg enc_alg;
> uint8_t enc_key_len;
> char enc_key[IPSEC_ENC_KEY_LEN];
> } encspec;
> @@ -1609,7 +1609,7 @@ peeropts : REMOTEAS as4number {
> curpeer->conf.auth.method = AUTH_IPSEC_IKE_AH;
> }
> | IPSEC espah inout SPI NUMBER STRING STRING encspec {
> - uint32_t auth_alg;
> + enum auth_alg auth_alg;
> uint8_t keylen;
>
> if (curpeer->conf.auth.method &&
> @@ -1626,10 +1626,10 @@ peeropts : REMOTEAS as4number {
> }
>
> if (!strcmp($6, "sha1")) {
> - auth_alg = SADB_AALG_SHA1HMAC;
> + auth_alg = AUTH_AALG_SHA1HMAC;
> keylen = 20;
> } else if (!strcmp($6, "md5")) {
> - auth_alg = SADB_AALG_MD5HMAC;
> + auth_alg = AUTH_AALG_MD5HMAC;
> keylen = 16;
> } else {
> yyerror("unknown auth algorithm \"%s\"", $6);
> @@ -1860,11 +1860,11 @@ encspec : /* nada */ {
> | STRING STRING {
> bzero(&$$, sizeof($$));
> if (!strcmp($1, "3des") || !strcmp($1, "3des-cbc")) {
> - $$.enc_alg = SADB_EALG_3DESCBC;
> + $$.enc_alg = AUTH_EALG_3DESCBC;
> $$.enc_key_len = 21; /* XXX verify */
> } else if (!strcmp($1, "aes") ||
> !strcmp($1, "aes-128-cbc")) {
> - $$.enc_alg = SADB_X_EALG_AES;
> + $$.enc_alg = AUTH_EALG_AES;
> $$.enc_key_len = 16;
> } else {
> yyerror("unknown enc algorithm \"%s\"", $1);
> Index: pfkey.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/bgpd/pfkey.c,v
> retrieving revision 1.62
> diff -u -p -r1.62 pfkey.c
> --- pfkey.c 6 Feb 2022 09:51:19 -0000 1.62
> +++ pfkey.c 15 Jun 2022 10:56:35 -0000
> @@ -590,6 +590,32 @@ fail:
> return (-1);
> }
>
> +static uint8_t
> +pfkey_auth_alg(enum auth_alg alg)
> +{
> + switch (alg) {
> + case AUTH_AALG_SHA1HMAC:
> + return SADB_AALG_SHA1HMAC;
> + case AUTH_AALG_MD5HMAC:
> + return SADB_AALG_MD5HMAC;
> + default:
> + return SADB_AALG_NONE;
> + }
> +}
> +
> +static uint8_t
> +pfkey_enc_alg(enum auth_enc_alg alg)
> +{
> + switch (alg) {
> + case AUTH_EALG_3DESCBC:
> + return SADB_EALG_3DESCBC;
> + case AUTH_EALG_AES:
> + return SADB_X_EALG_AES;
> + default:
> + return SADB_AALG_NONE;
> + }
> +}
> +
> static int
> pfkey_ipsec_establish(struct peer *p)
> {
> @@ -616,10 +642,10 @@ pfkey_ipsec_establish(struct peer *p)
> if (pfkey_send(pfkey_fd, satype, SADB_ADD, 0,
> local_addr, &p->conf.remote_addr,
> p->conf.auth.spi_out,
> - p->conf.auth.auth_alg_out,
> + pfkey_auth_alg(p->conf.auth.auth_alg_out),
> p->conf.auth.auth_keylen_out,
> p->conf.auth.auth_key_out,
> - p->conf.auth.enc_alg_out,
> + pfkey_enc_alg(p->conf.auth.enc_alg_out),
> p->conf.auth.enc_keylen_out,
> p->conf.auth.enc_key_out,
> 0, 0) == -1)
> @@ -629,10 +655,10 @@ pfkey_ipsec_establish(struct peer *p)
> if (pfkey_send(pfkey_fd, satype, SADB_ADD, 0,
> &p->conf.remote_addr, local_addr,
> p->conf.auth.spi_in,
> - p->conf.auth.auth_alg_in,
> + pfkey_auth_alg(p->conf.auth.auth_alg_in),
> p->conf.auth.auth_keylen_in,
> p->conf.auth.auth_key_in,
> - p->conf.auth.enc_alg_in,
> + pfkey_enc_alg(p->conf.auth.enc_alg_in),
> p->conf.auth.enc_keylen_in,
> p->conf.auth.enc_key_in,
> 0, 0) == -1)
> Index: printconf.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/bgpd/printconf.c,v
> retrieving revision 1.152
> diff -u -p -r1.152 printconf.c
> --- printconf.c 31 May 2022 09:45:33 -0000 1.152
> +++ printconf.c 15 Jun 2022 10:56:35 -0000
> @@ -45,8 +45,8 @@ void print_roa(struct roa_tree *);
> void print_rtrs(struct rtr_config_head *);
> void print_peer(struct peer_config *, struct bgpd_config *,
> const char *);
> -const char *print_auth_alg(uint8_t);
> -const char *print_enc_alg(uint8_t);
> +const char *print_auth_alg(enum auth_alg);
> +const char *print_enc_alg(enum auth_enc_alg);
> void print_announce(struct peer_config *, const char *);
> void print_as(struct filter_rule *);
> void print_rule(struct bgpd_config *, struct filter_rule *);
> @@ -751,12 +751,12 @@ print_peer(struct peer_config *p, struct
> }
>
> const char *
> -print_auth_alg(uint8_t alg)
> +print_auth_alg(enum auth_alg alg)
> {
> switch (alg) {
> - case SADB_AALG_SHA1HMAC:
> + case AUTH_AALG_SHA1HMAC:
> return ("sha1");
> - case SADB_AALG_MD5HMAC:
> + case AUTH_AALG_MD5HMAC:
> return ("md5");
> default:
> return ("???");
> @@ -764,12 +764,12 @@ print_auth_alg(uint8_t alg)
> }
>
> const char *
> -print_enc_alg(uint8_t alg)
> +print_enc_alg(enum auth_enc_alg alg)
> {
> switch (alg) {
> - case SADB_EALG_3DESCBC:
> + case AUTH_EALG_3DESCBC:
> return ("3des");
> - case SADB_X_EALG_AES:
> + case AUTH_EALG_AES:
> return ("aes");
> default:
> return ("???");
> Index: session.h
> ===================================================================
> RCS file: /cvs/src/usr.sbin/bgpd/session.h,v
> retrieving revision 1.154
> diff -u -p -r1.154 session.h
> --- session.h 6 Feb 2022 09:51:19 -0000 1.154
> +++ session.h 15 Jun 2022 10:56:35 -0000
> @@ -295,6 +295,7 @@ void mrt_dump_state(struct mrt *, uint1
> void mrt_done(struct mrt *);
>
> /* pfkey.c */
> +struct sadb_msg;
> int pfkey_read(int, struct sadb_msg *);
> int pfkey_establish(struct peer *);
> int pfkey_remove(struct peer *);
>
