11 Jul, 2007

1 commit


26 Apr, 2007

6 commits


15 Feb, 2007

1 commit

  • After Al Viro (finally) succeeded in removing the sched.h #include in module.h
    recently, it makes sense again to remove other superfluous sched.h includes.
    There are quite a lot of files which include it but don't actually need
    anything defined in there. Presumably these includes were once needed for
    macros that used to live in sched.h, but moved to other header files in the
    course of cleaning it up.

    To ease the pain, this time I did not fiddle with any header files and only
    removed #includes from .c-files, which tend to cause less trouble.

    Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
    arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
    allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
    configs in arch/arm/configs on arm. I also checked that no new warnings were
    introduced by the patch (actually, some warnings are removed that were emitted
    by unnecessarily included header files).

    Signed-off-by: Tim Schmielau
    Acked-by: Russell King
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tim Schmielau
     

14 Feb, 2007

1 commit


11 Feb, 2007

1 commit


09 Feb, 2007

1 commit


03 Dec, 2006

1 commit


23 Sep, 2006

1 commit

  • Handling of ipip and ip_gre ICMP error relaying is b0rken; it accesses
    8bit field + 3 reserved octets as host-endian 32bit, does comparison,
    subtraction and stuffs the result back. That breaks on big-endian.

    Fixed, made endian-clean.

    [ Note that this effected code is permanently commented out with
    and ifdef, so this error couldn't actually cause problems for
    anyone. -DaveM ]

    Signed-off-by: Al Viro
    Signed-off-by: David S. Miller

    Al Viro
     

22 Jul, 2006

1 commit


01 Jul, 2006

1 commit


10 Apr, 2006

1 commit

  • This patch moves the sending of ICMP messages when there are no IPv4/IPv6
    tunnels present to tunnel4/tunnel6 respectively. Please note that for now
    if xfrm4_tunnel/xfrm6_tunnel is loaded then no ICMP messages will ever be
    sent. This is similar to how we handle AH/ESP/IPCOMP.

    This move fixes the bug where we always send an ICMP message when there is
    no ip6_tunnel device present for a given packet even if it is later handled
    by IPsec. It also causes ICMP messages to be sent when no IPIP tunnel is
    present.

    I've decided to use the "port unreachable" ICMP message over the current
    value of "address unreachable" (and "protocol unreachable" by GRE) because
    it is not ambiguous unlike the other ones which can be triggered by other
    conditions. There seems to be no standard specifying what value must be
    used so this change should be OK. In fact we should change GRE to use
    this value as well.

    Incidentally, this patch also fixes a fairly serious bug in xfrm6_tunnel
    where we don't check whether the embedded IPv6 header is present before
    dereferencing it for the inside source address.

    This patch is inspired by a previous patch by Hugo Santos .

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

29 Mar, 2006

1 commit

  • Basically this patch moves the generic tunnel protocol stuff out of
    xfrm4_tunnel/xfrm6_tunnel and moves it into the new files of tunnel4.c
    and tunnel6 respectively.

    The reason for this is that the problem that Hugo uncovered is only
    the tip of the iceberg. The real problem is that when we removed the
    dependency of ipip on xfrm4_tunnel we didn't really consider the module
    case at all.

    For instance, as it is it's possible to build both ipip and xfrm4_tunnel
    as modules and if the latter is loaded then ipip simply won't load.

    After considering the alternatives I've decided that the best way out of
    this is to restore the dependency of ipip on the non-xfrm-specific part
    of xfrm4_tunnel. This is acceptable IMHO because the intention of the
    removal was really to be able to use ipip without the xfrm subsystem.
    This is still preserved by this patch.

    So now both ipip/xfrm4_tunnel depend on the new tunnel4.c which handles
    the arbitration between the two. The order of processing is determined
    by a simple integer which ensures that ipip gets processed before
    xfrm4_tunnel.

    The situation for ICMP handling is a little bit more complicated since
    we may not have enough information to determine who it's for. It's not
    a big deal at the moment since the xfrm ICMP handlers are basically
    no-ops. In future we can deal with this when we look at ICMP caching
    in general.

    The user-visible change to this is the removal of the TUNNEL Kconfig
    prompts. This makes sense because it can only be used through IPCOMP
    as it stands.

    The addition of the new modules shouldn't introduce any problems since
    module dependency will cause them to be loaded.

    Oh and I also turned some unnecessary pskb's in IPv6 related to this
    patch to skb's.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

16 Feb, 2006

1 commit

  • When a packet matching an IPsec policy is SNATed so it doesn't match any
    policy anymore it looses its xfrm bundle, which makes xfrm4_output_finish
    crash because of a NULL pointer dereference.

    This patch directs these packets to the original output path instead. Since
    the packets have already passed the POST_ROUTING hook, but need to start at
    the beginning of the original output path which includes another
    POST_ROUTING invocation, a flag is added to the IPCB to indicate that the
    packet was rerouted and doesn't need to pass the POST_ROUTING hook again.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

12 Jan, 2006

1 commit


10 Jan, 2006

1 commit


08 Jan, 2006

2 commits

  • ip_route_me_harder doesn't use the port numbers of the xfrm lookup and
    uses ip_route_input for non-local addresses which doesn't do a xfrm
    lookup, ip6_route_me_harder doesn't do a xfrm lookup at all.

    Use xfrm_decode_session and do the lookup manually, make sure both
    only do the lookup if the packet hasn't been transformed already.

    Makeing sure the lookup only happens once needs a new field in the
    IP6CB, which exceeds the size of skb->cb. The size of skb->cb is
    increased to 48b. Apparently the IPv6 mobile extensions need some
    more room anyway.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Reset IPSKB_XFRM_TUNNEL_SIZE flags in ipip and ip_gre hard_start_xmit
    function before the packet reenters IP. This is neccessary so the
    encapsulated packets are checked not to be oversized in xfrm4_output.c
    again. Reset all flags in sit when a packet changes its address family.

    Also remove some obsolete IPSKB flags.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

06 Jan, 2006

1 commit


31 Jul, 2005

1 commit

  • Tunnel modules used to obtain module refcount each time when
    some tunnel was created, which meaned that tunnel could be unloaded
    only after all the tunnels are deleted.

    Since killing old MOD_*_USE_COUNT macros this protection has gone.
    It is possible to return it back as module_get/put, but it looks
    more natural and practically useful to force destruction of all
    the child tunnels on module unload.

    Signed-off-by: Alexey Kuznetsov
    Signed-off-by: David S. Miller

    Alexey Kuznetsov
     

20 Jul, 2005

1 commit


17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds