Re: [PATCH net-next,v3] xfrm: allow to enable udp encapsulation without userspace socket

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jul 27, 2026 at 02:03:22PM +0200, Steffen Klassert wrote:
> On Fri, Jul 17, 2026 at 01:01:17PM +0200, Pablo Neira Ayuso wrote:
> > It is currently not possible to enable UDP encapsulation in xfrm without
> > a userspace process that listens on the specified UDP listener port in
> > the SA.
> > 
> > People have work around this by creating dummy userspace daemons such as
> > the one in the smallish perl program (see the script at the bottom of
> > this link):
> > 
> > http://techblog.newsnow.co.uk/2011/11/simple-udp-esp-encapsulation-nat-t-for.html
> > 
> > This patch adds XFRM_SA_XFLAG_UDP_ENCAP_SOCK to create the UDP socket
> > from the kernel.
> > 
> > Use a hole in net->xfrm to place the new encap_socket list.
> > 
> > The following example shows how to enable the standalone UDP
> > encapsulation:
> > 
> >     ip xfrm state add src 192.168.10.10 dst 192.168.10.11 proto esp spi 1 \
> >             encap espinudp 9999 9999 0.0.0.0 \
> >             if_id 0x1 reqid 1 replay-window 0 mode tunnel aead 'rfc4106(gcm(aes))' \
> >             0x1111111111111111111111111111111111111111 96 \
> >             sel src 10.141.10.0/24 dst 10.141.11.0/24 dir out
> > 
> > and the receiving side uses 'extra-flag udp-encap-sock':
> > 
> >     ip xfrm state add src 192.168.10.11 dst 192.168.10.10 proto esp spi 2 \
> >             encap espinudp 9999 0 0.0.0.0 extra-flag udp-encap-sock \
> >             if_id 0x1 reqid 2 replay-window 10 mode tunnel aead 'rfc4106(gcm(aes))' \
> >             0x2222222222222222222222222222222222222222 96 dir in
> > 
> > This allows for multiple SAs using the same listener udp port.
> > 
> > This is useful for testing scenarios where UDP encapsulation is
> > required.
> > 
> > Note this patch exports xfrm6_udp_encap_rcv() just like
> > xfrm4_udp_encap_rcv() otherwise linker complains due to unreachable
> > symbol.
> > 
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> Sashiko found some issues that look valid, can you please check this:
> 
> https://patchwork.kernel.org/project/netdevbpf/patch/20260717110118.251866-1-pablo@netfilter.org/

Yes, I will follow up with v4.

Thanks!