DragonFlyBSD

	case IPPROTO_TCP:

		proto = "tcp";

		break;

static struct sadb_supported *ipsec_supported[] = { NULL, NULL, NULL, NULL};

	SADB_X_SATYPE_TCPSIGNATURE,

	case SADB_X_SATYPE_TCPSIGNATURE:

		if (e_type != SADB_EALG_NONE) {

			__ipsec_errcode = EIPSEC_INVAL_ALGS;

			return -1;

		}

		if (a_type != SADB_X_AALG_TCP_MD5) {

			__ipsec_errcode = EIPSEC_INVAL_ALGS;

			return -1;

		}

		break;

		case SADB_X_SATYPE_TCPSIGNATURE:

	case SADB_X_SATYPE_TCPSIGNATURE:

	"policy",

	"tcp",

	{ SADB_X_AALG_TCP_MD5, "tcp-md5", },

tcp		{ yylval.num = IPPROTO_TCP; return(PROTOCOL); }

.It Dv TCP_SIGNATURE_ENABLE

This option enables the use of MD5 digests (also known as TCP-MD5)

on writes to the specified socket.

In the current release, only outgoing traffic is digested;

digests on incoming traffic are not verified.

The current default behavior for the system is to respond to a system

advertising this option with TCP-MD5; this may change.

.Pp

One common use for this in a DragonFlyBSD router deployment is to enable

based routers to interwork with Cisco equipment at peering points.

Support for this feature conforms to RFC 2385.

Only IPv4 (AF_INET) sessions are supported.

.Pp

In order for this option to function correctly, it is necessary for the

administrator to add a tcp-md5 key entry to the system's security

associations database (SADB) using the

.Xr setkey 8

utility.

This entry must have an SPI of 0x1000 and can therefore only be specified

on a per-host basis at this time.

.Pp

If an SADB entry cannot be found for the destination, the outgoing traffic

will have an invalid digest option prepended, and the following error message

will be visible on the system console:

.Em "tcpsignature_compute: SADB lookup failed for %d.%d.%d.%d" .

.Xr setkey 8,

.Rs

.%A "A. Heffernan"

.%T "Protection of BGP Sessions via the TCP MD5 Signature Option"

.%O "RFC 2385"

.Re

TCP_SIGNATURE		opt_inet.h

# TCP_SIGNATURE adds support for RFC 2385 (TCP-MD5) digests. These are

# carried in TCP option 19. This option is commonly used to protect

# TCP sessions (e.g. BGP) where IPSEC is not available nor desirable.

# This is enabled on a per-socket basis using the TCP_MD5SIG socket option.

# This requires the use of 'device crypto', 'options IPSEC'

# or 'device cryptodev'.

options   TCP_SIGNATURE   #include support for RFC 2385

/*

 * This is the real IPv4 pseudo header, used for computing the TCP and UDP

 * checksums. For the Internet checksum, struct ipovly can be used instead.

 * For stronger checksums, the real thing must be used.

 */

struct ippseudo {

	struct	in_addr	ippseudo_src;	/* source internet address */

	struct	in_addr	ippseudo_dst;	/* destination internet address */

	u_int8_t	ippseudo_pad;	/* pad, must be zero */

	u_int8_t	ippseudo_p;	/* protocol */

	u_int16_t	ippseudo_len;	/* protocol length */

} __packed;

	case IPSEC_POLICY_TCP:

#define TCPOPT_SIGNATURE		19      /* Keyed MD5: RFC 2385 */

#define TCPOLEN_SIGNATURE		18

#define TCP_SIGNATURE_ENABLE    0x10    /* use MD5 digests (RFC2385) */

#include "opt_inet.h"

	int tlen, off;

	int len = 0;

#ifdef TCP_SIGNATURE

		/*

		 * XXX In order to reply to a host which has set the

		 * TCP_SIGNATURE option in its initial SYN, we have to

		 * record the fact that the option was observed here

		 * for the syncache code to perform the correct response.

		 */

		case TCPOPT_SIGNATURE:

			if (optlen != TCPOLEN_SIGNATURE)

				continue;

			to->to_flags |= (TOF_SIGNATURE | TOF_SIGLEN);

			break;

#endif /* TCP_SIGNATURE */

#include "opt_inet.h"

	int sigoff = 0;

#ifdef TCP_SIGNATURE

	if (!isipv6)

		if (tp->t_flags & TF_SIGNATURE) {

			int i;

			u_char *bp;

			/*

			 * Initialize TCP-MD5 option (RFC2385)

			 */

			bp = (u_char *)opt + optlen;

			*bp++ = TCPOPT_SIGNATURE;

			*bp++ = TCPOLEN_SIGNATURE;

			sigoff = optlen + 2;

			for (i = 0; i < TCP_SIGLEN; i++)

				*bp++ = 0;

			optlen += TCPOLEN_SIGNATURE;

			/*

			 * Terminate options list and maintain 32-bit alignment.

			 */

			*bp++ = TCPOPT_NOP;

			*bp++ = TCPOPT_EOL;

			optlen += 2;

		}

#endif /* TCP_SIGNATURE */

#ifdef TCP_SIGNATURE

	if (!isipv6)

		if (tp->t_flags & TF_SIGNATURE)

			tcpsignature_compute(m, sizeof(struct ip), len, optlen,

					(u_char *)(th + 1) + sigoff, IPSEC_DIR_OUTBOUND);

#endif /* TCP_SIGNATURE */

#include "opt_inet.h"

#include <netproto/key/key.h>

#ifdef TCP_SIGNATURE

/*

 * Compute TCP-MD5 hash of a TCPv4 segment. (RFC2385)

 *

 * We do this over ip, tcphdr, segment data, and the key in the SADB.

 * When called from tcp_input(), we can be sure that th_sum has been

 * zeroed out and verified already.

 *

 * This function is for IPv4 use only. Calling this function with an

 * IPv6 packet in the mbuf chain will yield undefined results.

 *

 * Return 0 if successful, otherwise return -1.

 *

 * XXX The key is retrieved from the system's PF_KEY SADB, by keying a

 * search with the destination IP address, and a 'magic SPI' to be

 * determined by the application. This is hardcoded elsewhere to 1179

 * right now. Another branch of this code exists which uses the SPD to

 * specify per-application flows but it is unstable.

 */

int

tcpsignature_compute(

	struct mbuf *m,		/* mbuf chain */

	int off0,		/* offset to TCP header */

	int len,		/* length of TCP data */

	int optlen,		/* length of TCP options */

	u_char *buf,		/* storage for MD5 digest */

	u_int direction)	/* direction of flow */

{

	struct ippseudo ippseudo;

	MD5_CTX ctx;

	int doff;

	struct ip *ip;

	struct ipovly *ipovly;

	struct secasvar *sav;

	struct tcphdr *th;

	u_short savecsum;

	KASSERT(m != NULL, ("passed NULL mbuf. Game over."));

	KASSERT(buf != NULL, ("passed NULL storage pointer for MD5 signature"));

	/*

	 * Extract the destination from the IP header in the mbuf.

	 */

	ip = mtod(m, struct ip *);

	/*

	 * Look up an SADB entry which matches the address found in

	 * the segment.

	 */

	sav = key_allocsa(AF_INET, (caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst,

			IPPROTO_TCP, htonl(TCP_SIG_SPI));

	if (sav == NULL) {

		kprintf("%s: SADB lookup failed\n", __func__);

		return (EINVAL);

	}

	MD5Init(&ctx);

	ipovly = (struct ipovly *)ip;

	th = (struct tcphdr *)((u_char *)ip + off0);

	doff = off0 + sizeof(struct tcphdr) + optlen;

	/*

	 * Step 1: Update MD5 hash with IP pseudo-header.

	 *

	 * XXX The ippseudo header MUST be digested in network byte order,

	 * or else we'll fail the regression test. Assume all fields we've

	 * been doing arithmetic on have been in host byte order.

	 * XXX One cannot depend on ipovly->ih_len here. When called from

	 * tcp_output(), the underlying ip_len member has not yet been set.

	 */

	ippseudo.ippseudo_src = ipovly->ih_src;

	ippseudo.ippseudo_dst = ipovly->ih_dst;

	ippseudo.ippseudo_pad = 0;

	ippseudo.ippseudo_p = IPPROTO_TCP;

	ippseudo.ippseudo_len = htons(len + sizeof(struct tcphdr) + optlen);

	MD5Update(&ctx, (char *)&ippseudo, sizeof(struct ippseudo));

	/*

	 * Step 2: Update MD5 hash with TCP header, excluding options.

	 * The TCP checksum must be set to zero.

	 */

	savecsum = th->th_sum;

	th->th_sum = 0;

	MD5Update(&ctx, (char *)th, sizeof(struct tcphdr));

	th->th_sum = savecsum;

	/*

	 * Step 3: Update MD5 hash with TCP segment data.

	 *         Use m_apply() to avoid an early m_pullup().

	 */

	if (len > 0)

		m_apply(m, doff, len, tcpsignature_apply, &ctx);

	/*

	 * Step 4: Update MD5 hash with shared secret.

	 */

	MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));

	MD5Final(buf, &ctx);

	key_sa_recordxfer(sav, m);

	key_freesav(sav);

	return (0);

}

int

tcpsignature_apply(void *fstate, void *data, unsigned int len)

{

	MD5Update((MD5_CTX *)fstate, (unsigned char *)data, len);

	return (0);

}

#endif /* TCP_SIGNATURE */

#include "opt_inet.h"

#ifdef TCP_SIGNATURE

	if (sc->sc_flags & SCF_SIGNATURE)

		tp->t_flags |= TF_SIGNATURE;

#endif /* TCP_SIGNATURE */

#ifdef TCP_SIGNATURE

	/*

	 * If listening socket requested TCP digests, and received SYN

	 * contains the option, flag this in the syncache so that

	 * syncache_respond() will do the right thing with the SYN+ACK.

	 * XXX Currently we always record the option by default and will

	 * attempt to use it in syncache_respond().

	 */

	if (to->to_flags & TOF_SIGNATURE)

		sc->sc_flags = SCF_SIGNATURE;

#endif /* TCP_SIGNATURE */

#ifdef TCP_SIGNATURE

				optlen += ((sc->sc_flags & SCF_SIGNATURE) ?

						(TCPOLEN_SIGNATURE + 2) : 0);

#endif /* TCP_SIGNATURE */

#ifdef TCP_SIGNATURE

	/*

	 * Handle TCP-MD5 passive opener response.

	 */

	if (sc->sc_flags & SCF_SIGNATURE) {

		u_int8_t *bp = optp;

		int i;

		*bp++ = TCPOPT_SIGNATURE;

		*bp++ = TCPOLEN_SIGNATURE;

		for (i = 0; i < TCP_SIGLEN; i++)

			*bp++ = 0;

		tcpsignature_compute(m, sizeof(struct ip), 0, optlen,

				optp + 2, IPSEC_DIR_OUTBOUND);

		*bp++ = TCPOPT_NOP;

		*bp++ = TCPOPT_EOL;

		optp += TCPOLEN_SIGNATURE + 2;

}

#endif /* TCP_SIGNATURE */

#include "opt_inet.h"

#ifdef TCP_SIGNATURE

		case TCP_SIGNATURE_ENABLE:

			if (optval > 0)

				tp->t_flags |= TF_SIGNATURE;

			else

				tp->t_flags &= ~TF_SIGNATURE;

			break;

#endif /* TCP_SIGNATURE */

#ifdef TCP_SIGNATURE

		case TCP_SIGNATURE_ENABLE:

			optval = (tp->t_flags & TF_SIGNATURE) ? 1 : 0;

			break;

#endif /* TCP_SIGNATURE */

#define TF_SIGNATURE 0x00004000  /* require MD5 digests (RFC2385) */

#ifdef TCP_SIGNATURE

/*

 * Defines which are needed by the xform_tcp module and tcp_[in|out]put

 * for SADB verification and lookup.

 */

#define TCP_SIGLEN      16      /* length of computed digest in bytes */

#define TCP_KEYLEN_MIN  1       /* minimum length of TCP-MD5 key */

#define TCP_KEYLEN_MAX  80      /* maximum length of TCP-MD5 key */

/*

 * Only a single SA per host may be specified at this time. An SPI is

 * needed in order for the KEY_ALLOCSA() lookup to work.

 */

#define TCP_SIG_SPI     0x1000

#endif /* TCP_SIGNATURE */

#define TOF_SIGNATURE   0x0100          /* signature option present */

#define TOF_SIGLEN      0x0200          /* sigature length valid (RFC2385) */

#define SCF_SIGNATURE   0x40    /* send MD5 digests */

#ifdef TCP_SIGNATURE

int tcpsignature_apply(void *fstate, void *data, unsigned int len);

int tcpsignature_compute(struct mbuf *m, int off0, int len, int tcpoptlen,

		u_char *buf, u_int direction);

#endif /* TCP_SIGNATURE */

#define IPSEC_MODE_TCPMD5 3  /* TCP MD5 mode */

#define IPSEC_POLICY_TCP 5 /* TCP MD5 policy */

		case SADB_X_SATYPE_TCPSIGNATURE:

		case SADB_X_SATYPE_TCPSIGNATURE:

	case SADB_X_SATYPE_TCPSIGNATURE:

	case IPPROTO_TCP:

		if (sav->alg_auth != SADB_X_AALG_TCP_MD5) {

			ipseclog((LOG_DEBUG, "key_mature: "

				"protocol and algorithm mismated.\n"));

			return(EINVAL);

		}

		checkmask = 0;

		mustmask = 0;

		break;

	case SADB_X_SATYPE_TCPSIGNATURE:

		return IPPROTO_TCP;

	case IPPROTO_TCP:

		return SADB_X_SATYPE_TCPSIGNATURE;

	case SADB_X_SATYPE_TCPSIGNATURE:

%token UP_PROTO PR_ESP PR_AH PR_IPCOMP PR_TCP

%type <num> UP_PROTO PR_ESP PR_AH PR_IPCOMP PR_TCP

	|	PR_TCP

		{

			p_satype = SADB_X_SATYPE_TCPSIGNATURE;

		}

			if (p_alg_auth == SADB_X_AALG_TCP_MD5) {

				if ((p_key_auth_len < 1) || (p_key_auth_len >

					80))

					return -1;

			} else if (ipsec_check_keylen(SADB_EXT_SUPPORTED_AUTH,

.It Li tcp

TCP-MD5 based on rfc2385

TCP-MD5 associations must use 0x1000 and therefore only have per-host

granularity at this time.

tcp-md5		8 to 640	tcp: rfc2385

add 10.1.10.34 10.1.10.36 tcp 0x1000 -A tcp-md5 "TCP-MD5 BGP secret" ;

tcp		{ PREPROC; yylval.num = 0; return(PR_TCP); }

tcp-md5	{ PREPROC; yylval.num = SADB_X_AALG_TCP_MD5; return(ALG_AUTH); }