diff options
| author |   Matthew Smith <mgsmith@netgate.com> | 2022-08-09 22:19:38 +0000 |
|---|---|---|
| committer | Matthew Smith <mgsmith@netgate.com> | 2022-08-19 14:13:36 +0000 |
| commit | 6f1eb484c85cfdb091cbef18252a02b3310b9aae (patch) | |
| tree | 5e2d31421dea41d774615aafe8cf96eedd67485a /src/vnet/ipsec/ipsec.h | |
| parent | 47c1b1c6338c2d46173f337cf69a4b0d7f27845e (diff) | |
ipsec: enable UDP encap for IPv6 ESP tun protect
Type: improvement
If an SA protecting an IPv6 tunnel interface has UDP encapsulation
enabled, the code in esp_encrypt_inline() inserts a UDP header but does
not set the next protocol or the UDP payload length, so the peer that
receives the packet drops it. Set the next protocol field and the UDP
payload length correctly.
The port(s) for UDP encapsulation of IPsec was not registered for IPv6.
Add this registration for IPv6 SAs when UDP encapsulation is enabled.
Add punt handling for IPv6 IKE on NAT-T port.
Add registration of linux-cp for the new punt reason.
Add unit tests of IPv6 ESP w/ UDP encapsulation on tun protect
Signed-off-by: Matthew Smith <mgsmith@netgate.com>
Change-Id: Ibb28e423ab8c7bcea2c1964782a788a0f4da5268
Diffstat (limited to 'src/vnet/ipsec/ipsec.h')
| -rw-r--r-- | src/vnet/ipsec/ipsec.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h index fc7b6cd2454..06bb299988b 100644 --- a/src/vnet/ipsec/ipsec.h +++ b/src/vnet/ipsec/ipsec.h @@ -364,8 +364,8 @@ int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx); clib_error_t *ipsec_rsc_in_use (ipsec_main_t * im); void ipsec_set_async_mode (u32 is_enabled); -extern void ipsec_register_udp_port (u16 udp_port); -extern void ipsec_unregister_udp_port (u16 udp_port); +extern void ipsec_register_udp_port (u16 udp_port, u8 is_ip4); +extern void ipsec_unregister_udp_port (u16 udp_port, u8 is_ip4); extern clib_error_t *ipsec_register_next_header (vlib_main_t *vm, u8 next_header, |