Re: [PATCH net-next,v3] xfrm: allow to enable udp encapsulation without userspace socket

[Steffen Klassert <steffen.klassert@secunet.com>]

On Fri, Jul 17, 2026 at 01:01:17PM +0200, Pablo Neira Ayuso wrote:
> It is currently not possible to enable UDP encapsulation in xfrm without
> a userspace process that listens on the specified UDP listener port in
> the SA.
> 
> People have work around this by creating dummy userspace daemons such as
> the one in the smallish perl program (see the script at the bottom of
> this link):
> 
> http://techblog.newsnow.co.uk/2011/11/simple-udp-esp-encapsulation-nat-t-for.html
> 
> This patch adds XFRM_SA_XFLAG_UDP_ENCAP_SOCK to create the UDP socket
> from the kernel.
> 
> Use a hole in net->xfrm to place the new encap_socket list.
> 
> The following example shows how to enable the standalone UDP
> encapsulation:
> 
>     ip xfrm state add src 192.168.10.10 dst 192.168.10.11 proto esp spi 1 \
>             encap espinudp 9999 9999 0.0.0.0 \
>             if_id 0x1 reqid 1 replay-window 0 mode tunnel aead 'rfc4106(gcm(aes))' \
>             0x1111111111111111111111111111111111111111 96 \
>             sel src 10.141.10.0/24 dst 10.141.11.0/24 dir out
> 
> and the receiving side uses 'extra-flag udp-encap-sock':
> 
>     ip xfrm state add src 192.168.10.11 dst 192.168.10.10 proto esp spi 2 \
>             encap espinudp 9999 0 0.0.0.0 extra-flag udp-encap-sock \
>             if_id 0x1 reqid 2 replay-window 10 mode tunnel aead 'rfc4106(gcm(aes))' \
>             0x2222222222222222222222222222222222222222 96 dir in
> 
> This allows for multiple SAs using the same listener udp port.
> 
> This is useful for testing scenarios where UDP encapsulation is
> required.
> 
> Note this patch exports xfrm6_udp_encap_rcv() just like
> xfrm4_udp_encap_rcv() otherwise linker complains due to unreachable
> symbol.
> 
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Sashiko found some issues that look valid, can you please check this:

https://patchwork.kernel.org/project/netdevbpf/patch/20260717110118.251866-1-pablo@netfilter.org/

Thanks!