Re: protect raw sockets

Hi Timo,

Thanks for your reply .
Yes i did explore this yesterday and i was successful in sending the IKE
messages unprotected after using the below code only for UDP sockets.

int setsockopt_bypass(int fd, int family)
{
        struct sadb_x_policy policy;
        int level, optname;

        switch (family) {
                case AF_INET:
                        level = IPPROTO_IP;
                        optname = IP_IPSEC_POLICY;
                        break;
                case AF_INET6:
                        level = IPPROTO_IPV6;
                        optname = IPV6_IPSEC_POLICY;
                        break;
                default:
                        return -1;
        }

        memset(&policy, 0, sizeof(policy));
        policy.sadb_x_policy_len = PFKEY_UNIT64(sizeof(policy));
        policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
        policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
        policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
        if (setsockopt(fd, level, optname, &policy, sizeof(policy)) == -1) {
                return -1;
        }
        policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
        if (setsockopt(fd, level, optname, &policy, sizeof(policy)) == -1) {
                return -1;
        }
        return 0;
}

But i did try the same on RAW socket by setting the policy has
policy.sadb_x_policy_type = IPSEC_POLICY_ENTRUST|IPSEC_POLICY_IPSEC;
But the packet is going unprotected .
Please show some light on how to protect RAW packets if there is a Policy
matching in the SPD saying it need to be protected.
I have checked the posting there is no help on this isues , could
you please give some options , if it is possible from Application.


Thanks and Regards
Naveen

On Thu, Aug 18, 2011 at 1:45 PM, Naveen B N (nbn) [off-list ref] wrote:

Hi All,
Is there a way to enforce IPsec protection for packets sent from
application using RAW_SOCKET.

My analysis is to add a code at the raw_sendmsg() & raw_v4_input() to
call xfrm_policy_check() ..
Is it a good method to proceed or is there a better and smart way to
achieve this .

Hoping for some guide lines ..

Thanks in advance ..

Thanks and Regards
Naveen
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html