Skip to content

Conversation

@philljj
Copy link
Contributor

@philljj philljj commented Aug 21, 2025

Description

  • Add IPsec ESP transport mode support.
  • Add debug packet print functions for: eth, ip, tcp, esp.
  • misc cleanup: macro refactors, overlong lines, trailing whitespace, gitignore, gcc15 build error (error: initializer-string for array).

Testing

rfc4106 gcm example

Added github workflow for standalone IPsec esp test using rfc4106 gcm:

      - name: Run standalone "IPsec esp" test                                   
        run: |                                                                  
          sudo ./scripts/ip-xfrm/rfc4106 128                                    
          sudo ./build/test-esp                                                 
          sudo killall tcpdump || true                                          
          sudo ./scripts/ip-xfrm/delete_all

The ip-xfrm script sets up IPsec on linux host side, and wolfIP handles the other half of IPsec.

cbc hmac auth example

Set ip xfrm state / policy with script:

./scripts/ip-xfrm/cbc_auth sha256 128 

DEBUG_IP + DEBUG_ESP output from ./build/test-evloop

ip hdr:
+-----------------------------+
| 0x04 | 0x45 | 0x00 |    108 | (ipv, hdr_len, tos, ip_len)
+-----------------------------+
|    0xc625    |    0x4000    | (id, flags_fo)
+-----------------------------+
|   64  | 0x32 |    0x4c24    | (ttl, proto, chksum)
+-----------------------------+
|                10.10.10.1   | (src)
+-----------------------------+
|                10.10.10.2   | (dst)
+-----------------------------+

info: found sa: 0x764f47c9
info: aes cbc dec
esp packet: (88 bytes)
+------------------+
|  76  4f  47  c9  | (spi, 4 bytes)
+------------------+
|  00  00  00  02  | (seq, 4 bytes)
+------------------+
|  1e  ae  19  4d  | (iv, 16 bytes)
|  9c  c9  86  95  |
|  82  e2  bc  c7  |
|  f7  0f  17  d7  |
+------------------+
|  b7  98  00  08  | (payload, 56 bytes)
|  bd  45  e2  28  |
|  00  00  00  00  |
|  a0  02  fa  f0  |
|  76  73  00  00  |
|  ..  ..  ..  ..  |
+------------------+
| 0506 | 06 | 0x06 | (padding last 2 bytes, pad len, nxt hdr)
+------------------+
|  5e  eb  f7  c9  | (icv, 16 bytes)
|  b0  a9  7d  78  |
|  e8  b2  06  20  |
|  32  ea  82  9e  |
+------------------+

@philljj philljj self-assigned this Aug 21, 2025
@philljj philljj marked this pull request as draft August 25, 2025 02:12
@philljj philljj changed the title cleanup: add packet print debug functions, and small cleanup. cleanup: add packet print debug functions, ESP auth support, and small cleanup. Aug 25, 2025
@philljj philljj changed the title cleanup: add packet print debug functions, ESP auth support, and small cleanup. cleanup: add IPsec ESP transport support, packet print debug functions, and misc cleanup. Sep 21, 2025
@philljj philljj marked this pull request as ready for review February 1, 2026 00:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant