Skip to content

Commit 2746fc1

Browse files
philljjphilljj
committed
IPsec transport support, and misc cleanup.
1 parent f5dd378 commit 2746fc1

29 files changed

+1589
-131
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*.dis
66
*.uf2
77
*.bin
8+
*.swp
89
CMakeCache.txt
910
CMakeFiles
1011
CMakeScripts

‎Makefile‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,23 @@ CFLAGS:=-Wall -Werror -Wextra -I. -D_GNU_SOURCE
33
CFLAGS+=-g -ggdb
44
LDFLAGS+=-pthread
55

6+
# Debug flags:
7+
# CFLAGS+=-DDEBUG_TAP
8+
# print ethernet headers
9+
# CFLAGS+=-DDEBUG_ETH
10+
# print ip headers
11+
CFLAGS+=-DDEBUG_IP
12+
# print tcp headers
13+
# CFLAGS+=-DDEBUG_TCP
14+
# print esp header data
15+
CFLAGS+=-DWOLFIP_DEBUG_ESP
16+
#CFLAGS+=-DWOLFIP_DEBUG_ESP_VERBOSE
17+
18+
# ESP support
19+
CFLAGS+=-DWOLFIP_ESP
20+
CFLAGS+=-DWOLFSSL_WOLFIP
21+
LDFLAGS+=-lwolfssl
22+
623
CPPCHECK=cppcheck
724
CPPCHECK_FLAGS=--enable=all --suppress=missingIncludeSystem \
825
--suppress=unusedFunction --suppress=unusedVariable \

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22

33
## Description and project goals
44

5-
wolfIP is a TCP/IP stack with no dynamic memory allocations, designed to be
5+
wolfIP is a TCP/IP stack with no dynamic memory allocations, designed to be
66
used in resource-constrained embedded systems.
77

8-
Endpoint only mode is supported, which means that wolfip can be used to
8+
Endpoint only mode is supported, which means that wolfip can be used to
99
establish network connections but it does not route traffic between different
1010
network interfaces.
1111

@@ -19,7 +19,7 @@ A single network interface can be associated with the device.
1919
- DHCP (RFC 2131): client only
2020
- DNS (RFC 1035): client only
2121
- UDP (RFC 768): unicast only
22-
- TCP (RFC 793)
22+
- TCP (RFC 793)
2323
- TCP options supported: Timestamps, Maximum Segment Size
2424
- BSD-like, non blocking socket API, with custom callbacks
2525
- No dynamic memory allocation

‎core.md‎

Lines changed: 37 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -24,19 +24,19 @@
2424

2525
```
2626
+---------------------------------------------------------------------------------------------------------------------------+
27-
| +-----+---+----+-----+------------------+-----+---+----+-----+------------------+ |
27+
| +-----+---+----+-----+------------------+-----+---+----+-----+------------------+ |
2828
| | De | E | IP | TCP | Payload | De | E | IP | TCP | Payload | |
2929
| | sc | T | | | | sc | T | | | | |
3030
|* FREE SPACE * | ri | H | | | | ri | H | | | | * FREE SPACE* |
3131
| | pt | | | | | pt | | | | | |
3232
| | or | | | | | or | | | | | |
3333
| +-----+---+----+-----+------------------+-----+---+----+-----+------------------+ |
3434
+---------------------------------------------------------------------------------------------------------------------------+
35-
^ ^
36-
| |
37-
| |
38-
| |
39-
|Tail Head|
35+
^ ^
36+
| |
37+
| |
38+
| |
39+
|Tail Head|
4040
4141
```
4242

@@ -54,11 +54,11 @@
5454
| || || |
5555
| |*------------------------------------------*| |
5656
+--------------+--------------------------------------------+---------------------------------------------------------------+
57-
^ ^
58-
| |
59-
| |
60-
| |
61-
|Tail Head|
57+
^ ^
58+
| |
59+
| |
60+
| |
61+
|Tail Head|
6262
```
6363

6464

@@ -71,37 +71,32 @@
7171
+-------------+
7272
|Main loop TX |
7373
+-------------+
74-
^
75-
+----------------------------------+ |
76-
| | +------+
77-
| TCP Socket | |
78-
| | |
79-
| | |
80-
| | |
81-
| +-----------------------+
82-
| +---------------+ | |
83-
>DATA OUT==>>|socket send() |-->| TX buffer (fifo) |
84-
| +---------------+ | |
85-
| +-----------------------+
86-
| |
87-
| |
88-
| |
89-
| +-----------------------+
90-
| +-------------+ | |
91-
<DATA IN<<====|socket recv()|<---| RX buffer (queue) |
92-
| +-------------+ | |
93-
| +-----------------------+
94-
+----------------------------------+ ^
95-
|
96-
|
97-
|
98-
+--------------+
99-
| tcp_recv() |
74+
^
75+
+----------------------------------+ |
76+
| | +------+
77+
| TCP Socket | |
78+
| | |
79+
| | |
80+
| | |
81+
| +-----------------------+
82+
| +---------------+ | |
83+
>DATA OUT==>>|socket send() |-->| TX buffer (fifo) |
84+
| +---------------+ | |
85+
| +-----------------------+
86+
| |
87+
| |
88+
| |
89+
| +-----------------------+
90+
| +-------------+ | |
91+
<DATA IN<<====|socket recv()|<---| RX buffer (queue) |
92+
| +-------------+ | |
93+
| +-----------------------+
94+
+----------------------------------+ ^
95+
|
96+
|
97+
|
98+
+--------------+
99+
| tcp_recv() |
100100
+--------------+
101101
```
102102

103-
104-
105-
106-
107-

‎scripts/ip-xfrm/README.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# IPsec ESP and ip xfrm support
2+
3+
Some convience scripts and config for testing IPsec with wolfIP:
4+
5+
- delete_all (delete all ip xfrm state and policies)
6+
- hmac_auth (set auth only state and policies)
7+
- show (show ip xfrm state and policies)
8+
- esp_sa.txt (ESP SA config to use in Wireshark)
9+
10+
# Build
11+
12+
## wolfssl
13+
14+
Build wolfssl with:
15+
16+
```sh
17+
./configure --enable-cryptonly --enable-sha --enable-sha256 --enable-md5 --enable-des3
18+
make
19+
sudo make install
20+
```
21+
22+
# wolfip
23+
24+
Build wolfip with:
25+
```sh
26+
-DWOLFIP_ESP -DWOLFSSL_WOLFIP
27+
```
28+
29+
# testing
30+
31+
Use `scripts/ip-xfrm` convenience scripts:
32+
33+
```
34+
./scripts/ip-xfrm/delete_all && ./scripts/ip-xfrm/cbc_auth sha256 128
35+
```
36+
37+
Use this to show what is set:
38+
39+
```
40+
./scripts/ip-xfrm/show
41+
ip xfrm policy show
42+
src 0.0.0.0/0 dst 10.10.10.2/32 proto tcp
43+
dir out priority 0 ptype main
44+
tmpl src 0.0.0.0 dst 0.0.0.0
45+
proto esp spi 0x764f47c9 reqid 0 mode transport
46+
47+
ip xfrm state show
48+
src 10.10.10.2 dst 10.10.10.1
49+
proto esp spi 0x49ebfdd4 reqid 0 mode transport
50+
replay-window 0
51+
auth-trunc hmac(sha256) 0x02020202020202020202020202020202 128
52+
enc cbc(aes) 0x04040404040404040404040404040404
53+
...etc...
54+
```
55+
56+
Use `./scripts/ip-xfrm/watch_stat` to troubleshoot XfrmIn/Out errors.
57+
58+
# wireshark
59+
60+
Use this for your wireshark `esp_sa` file, and wireshark will be able to
61+
decrypt and verify all ESP traffic:
62+
- `scripts/ip-xfrm/esp_sa.txt`

‎scripts/ip-xfrm/cbc_auth‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/bash
2+
#
3+
# aes-cbc (rfc3602) + hmac-[md5,sha1,sha256]-96,128 example.
4+
#
5+
6+
print_usage_and_die() {
7+
echo "usage:"
8+
echo " cbc_auth [auth]"
9+
echo ""
10+
echo " auth = md5, sha1, sha256"
11+
echo ""
12+
echo "examples:"
13+
echo " ./scripts/ip-xfrm/hmac_auth sha256 128"
14+
echo " ./scripts/ip-xfrm/hmac_auth sha256 96"
15+
echo " ./scripts/ip-xfrm/hmac_auth sha1"
16+
echo " ./scripts/ip-xfrm/hmac_auth md5"
17+
exit 1
18+
}
19+
20+
alg=sha1
21+
ip_proto=tcp
22+
len=96
23+
24+
if [ $# -eq 0 ]; then
25+
print_usage_and_die
26+
fi
27+
28+
if [ $# -eq 1 ]; then
29+
alg=$1
30+
fi
31+
32+
if [ $# -eq 2 ]; then
33+
alg=$1
34+
len=$2
35+
fi
36+
37+
# State
38+
# ipv4
39+
sudo ip xfrm state add \
40+
src 10.10.10.1 dst 10.10.10.2 \
41+
proto esp \
42+
spi 0x764f47c9 \
43+
mode transport \
44+
replay-window 64 \
45+
auth-trunc $alg 0x01010101010101010101010101010101 $len \
46+
enc aes 0x03030303030303030303030303030303 \
47+
sel src 10.10.10.1 dst 10.10.10.2
48+
49+
sudo ip xfrm state add \
50+
src 10.10.10.2 dst 10.10.10.1 \
51+
proto esp \
52+
spi 0x49ebfdd4 \
53+
mode transport \
54+
replay-window 64 \
55+
auth-trunc $alg 0x02020202020202020202020202020202 $len \
56+
enc aes 0x04040404040404040404040404040404 \
57+
sel src 10.10.10.2 dst 10.10.10.1
58+
59+
# Policies
60+
# ipv4
61+
sudo ip xfrm policy add \
62+
dst 10.10.10.2 proto $ip_proto dir out tmpl proto esp spi 0x764f47c9 mode transport
63+

‎scripts/ip-xfrm/delete_all‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
sudo ip xfrm policy deleteall
3+
sudo ip xfrm state deleteall

‎scripts/ip-xfrm/esp_sa.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# This file is automatically generated, DO NOT MODIFY.
2+
"IPv4","10.10.10.2","10.10.10.1","0xf6e9b80d","NULL","","HMAC-SHA-256-128 [RFC4868]","0x02020202020202020202020202020202","32-bit","0"
3+
"IPv4","10.10.10.1","10.10.10.2","0x2fa9d8c8","NULL","","HMAC-SHA-256-128 [RFC4868]","0x01010101010101010101010101010101","32-bit","0"
4+
"IPv4","10.10.10.1","10.10.10.2","0x764f47c9","AES-CBC [RFC3602]","0x03030303030303030303030303030303","HMAC-SHA-256-128 [RFC4868]","0x01010101010101010101010101010101","32-bit","0"
5+
"IPv4","10.10.10.2","10.10.10.1","0x49ebfdd4","AES-CBC [RFC3602]","0x04040404040404040404040404040404","HMAC-SHA-256-128 [RFC4868]","0x02020202020202020202020202020202","32-bit","0"

‎scripts/ip-xfrm/gcm‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
#
3+
#
4+
# rfc4106(gcm(aes)) example: aes-gcm encryption + auth.
5+
#
6+
# The 4 byte nonce is placed at end of key, forming 20 bytes
7+
# of key material.
8+
#
9+
10+
alg="rfc4106(gcm(aes))"
11+
12+
print_usage_and_die() {
13+
echo "usage:"
14+
echo " gcm"
15+
echo ""
16+
echo "examples:"
17+
echo " ./scripts/ip-xfrm/gcm"
18+
exit 1
19+
}
20+
21+
ip_proto=tcp
22+
nonce=bdc5448a
23+
24+
# State
25+
# ipv4
26+
sudo ip xfrm state add \
27+
src 10.10.10.1 dst 10.10.10.2 \
28+
proto esp \
29+
spi 0xcd65bc5d \
30+
mode transport \
31+
replay-window 64 \
32+
aead $alg 0x03030303030303030303030303030303$nonce 128 \
33+
sel src 10.10.10.1 dst 10.10.10.2
34+
35+
sudo ip xfrm state add \
36+
src 10.10.10.2 dst 10.10.10.1 \
37+
proto esp \
38+
spi 0xe99bab7e \
39+
mode transport \
40+
replay-window 64 \
41+
aead $alg 0x03030303030303030303030303030303$nonce 128 \
42+
sel src 10.10.10.2 dst 10.10.10.1
43+
44+
# Policies
45+
# ipv4
46+
sudo ip xfrm policy add \
47+
dst 10.10.10.2 proto $ip_proto dir out tmpl proto esp spi 0xcd65bc5d mode transport
48+

0 commit comments

Comments
 (0)