Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 20 Jan 2017 17:03:45 +0000 (UTC)
From:      "Andrey V. Elsukov" <ae@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-projects@freebsd.org
Subject:   svn commit: r312542 - projects/ipsec/lib/libipsec
Message-ID:  <201701201703.v0KH3joM034995@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: ae
Date: Fri Jan 20 17:03:44 2017
New Revision: 312542
URL: https://svnweb.freebsd.org/changeset/base/312542

Log:
  Since NAT-T support is now always enabled, add related information
  to the `setkey -D` output.

Modified:
  projects/ipsec/lib/libipsec/pfkey.c
  projects/ipsec/lib/libipsec/pfkey_dump.c

Modified: projects/ipsec/lib/libipsec/pfkey.c
==============================================================================
--- projects/ipsec/lib/libipsec/pfkey.c	Fri Jan 20 16:52:34 2017	(r312541)
+++ projects/ipsec/lib/libipsec/pfkey.c	Fri Jan 20 17:03:44 2017	(r312542)
@@ -1776,21 +1776,15 @@ pfkey_align(msg, mhp)
 		case SADB_EXT_SPIRANGE:
 		case SADB_X_EXT_POLICY:
 		case SADB_X_EXT_SA2:
-		case SADB_X_EXT_SA_REPLAY:
-			mhp[ext->sadb_ext_type] = (caddr_t)ext;
-			break;
 		case SADB_X_EXT_NAT_T_TYPE:
 		case SADB_X_EXT_NAT_T_SPORT:
 		case SADB_X_EXT_NAT_T_DPORT:
-		/* case SADB_X_EXT_NAT_T_OA: is OAI */
 		case SADB_X_EXT_NAT_T_OAI:
 		case SADB_X_EXT_NAT_T_OAR:
 		case SADB_X_EXT_NAT_T_FRAG:
-			if (feature_present("ipsec_natt")) {
-				mhp[ext->sadb_ext_type] = (caddr_t)ext;
-				break;
-			}
-			/* FALLTHROUGH */
+		case SADB_X_EXT_SA_REPLAY:
+			mhp[ext->sadb_ext_type] = (caddr_t)ext;
+			break;
 		default:
 			__ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
 			return -1;

Modified: projects/ipsec/lib/libipsec/pfkey_dump.c
==============================================================================
--- projects/ipsec/lib/libipsec/pfkey_dump.c	Fri Jan 20 16:52:34 2017	(r312541)
+++ projects/ipsec/lib/libipsec/pfkey_dump.c	Fri Jan 20 17:03:44 2017	(r312542)
@@ -220,6 +220,9 @@ pfkey_sadump(m)
 	struct sadb_ident *m_sid, *m_did;
 	struct sadb_sens *m_sens;
 	struct sadb_x_sa_replay *m_sa_replay;
+	struct sadb_x_nat_t_type *natt_type;
+	struct sadb_x_nat_t_port *natt_sport, *natt_dport;
+	struct sadb_address *natt_oai, *natt_oar;
 
 	/* check pfkey message. */
 	if (pfkey_align(m, mhp)) {
@@ -245,33 +248,46 @@ pfkey_sadump(m)
 	m_did = (struct sadb_ident *)mhp[SADB_EXT_IDENTITY_DST];
 	m_sens = (struct sadb_sens *)mhp[SADB_EXT_SENSITIVITY];
 	m_sa_replay = (struct sadb_x_sa_replay *)mhp[SADB_X_EXT_SA_REPLAY];
+	natt_type = (struct sadb_x_nat_t_type *)mhp[SADB_X_EXT_NAT_T_TYPE];
+	natt_sport = (struct sadb_x_nat_t_port *)mhp[SADB_X_EXT_NAT_T_SPORT];
+	natt_dport = (struct sadb_x_nat_t_port *)mhp[SADB_X_EXT_NAT_T_DPORT];
+	natt_oai = (struct sadb_address *)mhp[SADB_X_EXT_NAT_T_OAI];
+	natt_oar = (struct sadb_address *)mhp[SADB_X_EXT_NAT_T_OAR];
+
 
 	/* source address */
 	if (m_saddr == NULL) {
 		printf("no ADDRESS_SRC extension.\n");
 		return;
 	}
-	printf("%s ", str_ipaddr((struct sockaddr *)(m_saddr + 1)));
+	printf("%s", str_ipaddr((struct sockaddr *)(m_saddr + 1)));
+	if (natt_type != NULL && natt_sport != NULL)
+		printf("[%u]", ntohs(natt_sport->sadb_x_nat_t_port_port));
 
 	/* destination address */
 	if (m_daddr == NULL) {
-		printf("no ADDRESS_DST extension.\n");
+		printf("\nno ADDRESS_DST extension.\n");
 		return;
 	}
-	printf("%s ", str_ipaddr((struct sockaddr *)(m_daddr + 1)));
+	printf(" %s", str_ipaddr((struct sockaddr *)(m_daddr + 1)));
+	if (natt_type != NULL && natt_dport != NULL)
+		printf("[%u]", ntohs(natt_dport->sadb_x_nat_t_port_port));
 
 	/* SA type */
 	if (m_sa == NULL) {
-		printf("no SA extension.\n");
+		printf("\nno SA extension.\n");
 		return;
 	}
 	if (m_sa2 == NULL) {
-		printf("no SA2 extension.\n");
+		printf("\nno SA2 extension.\n");
 		return;
 	}
 	printf("\n\t");
 
-	GETMSGSTR(str_satype, m->sadb_msg_satype);
+	if (m->sadb_msg_satype == SADB_SATYPE_ESP && natt_type != NULL)
+		printf("esp-udp ");
+	else
+		GETMSGSTR(str_satype, m->sadb_msg_satype);
 
 	printf("mode=");
 	GETMSGSTR(str_mode, m_sa2->sadb_x_sa2_mode);
@@ -282,6 +298,18 @@ pfkey_sadump(m)
 		(u_int32_t)m_sa2->sadb_x_sa2_reqid,
 		(u_int32_t)m_sa2->sadb_x_sa2_reqid);
 
+	/* other NAT-T information */
+	if (natt_type != NULL && (natt_oai != NULL || natt_oar != NULL)) {
+		printf("\tNAT:");
+		if (natt_oai != NULL)
+			printf(" OAI=%s",
+			    str_ipaddr((struct sockaddr *)(natt_oai + 1)));
+		if (natt_oar != NULL)
+			printf(" OAR=%s",
+			    str_ipaddr((struct sockaddr *)(natt_oar + 1)));
+		printf("\n");
+	}
+
 	/* encryption key */
 	if (m->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
 		printf("\tC: ");

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201701201703.v0KH3joM034995>