Eric Lee / linux-smarc-t335x-v3.2

11 Dec, 2010

1 commit

23 Feb, 2010

1 commit

26 Nov, 2009

1 commit

05 Nov, 2009

1 commit

  • d94d9fee9   net: cleanup include/linux ... Browse Code »

    This cleanup patch puts struct/union/enum opening braces,
    in first line to ease grep games.

    struct something
    {

    becomes :

    struct something {

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

27 Mar, 2009

1 commit

  • 85efde6f4   make exported headers use strict posix types ... Browse Code »

    A number of standard posix types are used in exported headers, which
    is not allowed if __STRICT_KERNEL_NAMES is defined. In order to
    get rid of the non-__STRICT_KERNEL_NAMES part and to make sane headers
    the default, we have to change them all to safe types.

    There are also still some leftovers in reiserfs_fs.h, elfcore.h
    and coda.h, but these files have not compiled in user space for
    a long time.

    This leaves out the various integer types ({u_,u,}int{8,16,32,64}_t),
    which we take care of separately.

    Signed-off-by: Arnd Bergmann
    Acked-by: Mauro Carvalho Chehab
    Cc: David Airlie
    Cc: Arnaldo Carvalho de Melo
    Cc: YOSHIFUJI Hideaki
    Cc: netdev@vger.kernel.org
    Cc: linux-ppp@vger.kernel.org
    Cc: Jaroslav Kysela
    Cc: Takashi Iwai
    Cc: David Woodhouse
    Signed-off-by: H. Peter Anvin
    Signed-off-by: Ingo Molnar

    Arnd Bergmann
     

29 Oct, 2008

1 commit

06 Oct, 2008

1 commit

11 Jul, 2008

1 commit

  • ccf9b3b83   xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info ... Browse Code »

    Add a XFRM_STATE_AF_UNSPEC flag to handle the AF_UNSPEC behavior for
    the selector family. Userspace applications can set this flag to leave
    the selector family of the xfrm_state unspecified. This can be used
    to to handle inter family tunnels if the selector is not set from
    userspace.

    Signed-off-by: Steffen Klassert
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Steffen Klassert
     

25 Apr, 2008

1 commit

  • 461e6c856   xfrm: alg_key_len & alg_icv_len should be unsigned ... Browse Code »

    In commit ba749ae98d5aa9d2ce9a7facde0deed454f92230 ([XFRM]: alg_key_len
    should be unsigned to avoid integer divides
    )
    alg_key_len field of struct xfrm_algo was converted to unsigned int to
    avoid integer divides.

    Then Herbert in commit 1a6509d991225ad210de54c63314fd9542922095
    ([IPSEC]: Add support for combined mode algorithms) added a new
    structure xfrm_algo_aead, that resurrected a signed int for alg_key_len
    and re-introduce integer divides.

    This patch avoids these divides and saves 64 bytes of text on i386.

    Signed-off-by: Eric Dumazet
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Eric Dumazet
     

29 Feb, 2008

1 commit

  • 4c563f766   [XFRM]: Speed up xfrm_policy and xfrm_state walking ... Browse Code »

    Change xfrm_policy and xfrm_state walking algorithm from O(n^2) to O(n).
    This is achieved adding the entries to one more list which is used
    solely for walking the entries.

    This also fixes some races where the dump can have duplicate or missing
    entries when the SPD/SADB is modified during an ongoing dump.

    Dumping SADB with 20000 entries using "time ip xfrm state" the sys
    time dropped from 1.012s to 0.080s.

    Signed-off-by: Timo Teras
    Signed-off-by: David S. Miller

    Timo Teras
     

01 Feb, 2008

1 commit

  • 1a6509d99   [IPSEC]: Add support for combined mode algorithms ... Browse Code »

    This patch adds support for combined mode algorithms with GCM being
    the first algorithm supported.

    Combined mode algorithms can be added through the xfrm_user interface
    using the new algorithm payload type XFRMA_ALG_AEAD. Each algorithms
    is identified by its name and the ICV length.

    For the purposes of matching algorithms in xfrm_tmpl structures,
    combined mode algorithms occupy the same name space as encryption
    algorithms. This is in line with how they are negotiated using IKE.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

29 Jan, 2008

4 commits

05 May, 2007

2 commits

29 Apr, 2007

1 commit

26 Apr, 2007

1 commit

  • 28d8909bc   [XFRM]: Export SAD info. ... Browse Code »

    On a system with a lot of SAs, counting SAD entries chews useful
    CPU time since you need to dump the whole SAD to user space;
    i.e something like ip xfrm state ls | grep -i src | wc -l
    I have seen taking literally minutes on a 40K SAs when the system
    is swapping.
    With this patch, some of the SAD info (that was already being tracked)
    is exposed to user space. i.e you do:
    ip xfrm state count
    And you get the count; you can also pass -s to the command line and
    get the hash info.

    Signed-off-by: Jamal Hadi Salim
    Signed-off-by: David S. Miller

    Jamal Hadi Salim
     

09 Feb, 2007

1 commit

  • 80c9abaab   [XFRM]: Extension for dynamic update of endpoint address(es) ... Browse Code »

    Extend the XFRM framework so that endpoint address(es) in the XFRM
    databases could be dynamically updated according to a request (MIGRATE
    message) from user application. Target XFRM policy is first identified
    by the selector in the MIGRATE message. Next, the endpoint addresses
    of the matching templates and XFRM states are updated according to
    the MIGRATE message.

    Signed-off-by: Shinta Sugimoto
    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Shinta Sugimoto
     

09 Dec, 2006

1 commit

03 Dec, 2006

2 commits

04 Oct, 2006

1 commit

  • 0a69452cb   [XFRM]: BEET mode ... Browse Code »

    This patch introduces the BEET mode (Bound End-to-End Tunnel) with as
    specified by the ietf draft at the following link:

    http://www.ietf.org/internet-drafts/draft-nikander-esp-beet-mode-06.txt

    The patch provides only single family support (i.e. inner family =
    outer family).

    Signed-off-by: Diego Beltrami
    Signed-off-by: Miika Komu
    Signed-off-by: Herbert Xu
    Signed-off-by: Abhinav Pathak
    Signed-off-by: Jeff Ahrenholz
    Signed-off-by: David S. Miller

    Diego Beltrami
     

29 Sep, 2006

4 commits

23 Sep, 2006

8 commits

  • f7b6983f0   [XFRM] POLICY: Support netlink socket interface for sub policy. ... Browse Code »

    Sub policy can be used through netlink socket.
    PF_KEY uses main only and it is TODO to support sub.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 4e81bb833   [XFRM] POLICY: sub policy support. ... Browse Code »

    Sub policy is introduced. Main and sub policy are applied the same flow.
    (Policy that current kernel uses is named as main.)
    It is required another transformation policy management to keep IPsec
    and Mobile IPv6 lives separate.
    Policy which lives shorter time in kernel should be a sub i.e. normally
    main is for IPsec and sub is for Mobile IPv6.
    (Such usage as two IPsec policies on different database can be used, too.)

    Limitation or TODOs:
    - Sub policy is not supported for per socket one (it is always inserted as main).
    - Current kernel makes cached outbound with flowi to skip searching database.
    However this patch makes it disabled only when "two policies are used and
    the first matched one is bypass case" because neither flowi nor bundle
    information knows about transformation template size.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki

    Masahide NAKAMURA
     
  • 97a64b457   [XFRM]: Introduce XFRM_MSG_REPORT. ... Browse Code »

    XFRM_MSG_REPORT is a message as notification of state protocol and
    selector from kernel to user-space.

    Mobile IPv6 will use it when inbound reject is occurred at route
    optimization to make user-space know a binding error requirement.

    Based on MIPL2 kernel patch.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 9afaca057   [XFRM] IPV6: Update outbound state timestamp for each sending. ... Browse Code »

    With this patch transformation state is updated last used time
    for each sending. Xtime is used for it like other state lifetime
    expiration.
    Mobile IPv6 enabled nodes will want to know traffic status of each
    binding (e.g. judgement to request binding refresh by correspondent node,
    or to keep home/care-of nonce alive by mobile node).
    The last used timestamp is an important hint about it.
    Based on MIPL2 kernel patch.

    This patch was also written by: Henrik Petander

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 060f02a3b   [XFRM] STATE: Introduce care-of address. ... Browse Code »

    Care-of address is carried by state as a transformation option like
    IPsec encryption/authentication algorithm.

    Based on MIPL2 kernel patch.

    Signed-off-by: Noriaki TAKAMIYA
    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki

    Noriaki TAKAMIYA
     
  • fbd9a5b47   [XFRM] STATE: Common receive function for route optimization extension headers. ... Browse Code »

    XFRM_STATE_WILDRECV flag is introduced; the last resort state is set
    it and receives packet which is not route optimized but uses such
    extension headers i.e. Mobile IPv6 signaling (binding update and
    acknowledgement). A node enabled Mobile IPv6 adds the state.

    Based on MIPL2 kernel patch.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • eb2971b68   [XFRM] STATE: Search by address using source address list. ... Browse Code »

    This is a support to search transformation states by its addresses
    by using source address list for Mobile IPv6 usage.
    To use it from user-space, it is also added a message type for
    source address as a xfrm state option.
    Based on MIPL2 kernel patch.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 7e49e6de3   [XFRM]: Add XFRM_MODE_xxx for future use. ... Browse Code »

    Transformation mode is used as either IPsec transport or tunnel.
    It is required to add two more items, route optimization and inbound trigger
    for Mobile IPv6.
    Based on MIPL2 kernel patch.

    This patch was also written by: Ville Nuorvala

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     

18 Jun, 2006

1 commit

  • b59f45d0b   [IPSEC] xfrm: Abstract out encapsulation modes ... Browse Code »

    This patch adds the structure xfrm_mode. It is meant to represent
    the operations carried out by transport/tunnel modes.

    By doing this we allow additional encapsulation modes to be added
    without clogging up the xfrm_input/xfrm_output paths.

    Candidate modes include 4-to-6 tunnel mode, 6-to-4 tunnel mode, and
    BEET modes.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

21 Mar, 2006

2 commits

04 Jan, 2006

1 commit

  • df71837d5   [LSM-IPSec]: Security association restriction. ... Browse Code »

    This patch series implements per packet access control via the
    extension of the Linux Security Modules (LSM) interface by hooks in
    the XFRM and pfkey subsystems that leverage IPSec security
    associations to label packets. Extensions to the SELinux LSM are
    included that leverage the patch for this purpose.

    This patch implements the changes necessary to the XFRM subsystem,
    pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
    socket to use only authorized security associations (or no security
    association) to send/receive network packets.

    Patch purpose:

    The patch is designed to enable access control per packets based on
    the strongly authenticated IPSec security association. Such access
    controls augment the existing ones based on network interface and IP
    address. The former are very coarse-grained, and the latter can be
    spoofed. By using IPSec, the system can control access to remote
    hosts based on cryptographic keys generated using the IPSec mechanism.
    This enables access control on a per-machine basis or per-application
    if the remote machine is running the same mechanism and trusted to
    enforce the access control policy.

    Patch design approach:

    The overall approach is that policy (xfrm_policy) entries set by
    user-level programs (e.g., setkey for ipsec-tools) are extended with a
    security context that is used at policy selection time in the XFRM
    subsystem to restrict the sockets that can send/receive packets via
    security associations (xfrm_states) that are built from those
    policies.

    A presentation available at
    www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
    from the SELinux symposium describes the overall approach.

    Patch implementation details:

    On output, the policy retrieved (via xfrm_policy_lookup or
    xfrm_sk_policy_lookup) must be authorized for the security context of
    the socket and the same security context is required for resultant
    security association (retrieved or negotiated via racoon in
    ipsec-tools). This is enforced in xfrm_state_find.

    On input, the policy retrieved must also be authorized for the socket
    (at __xfrm_policy_check), and the security context of the policy must
    also match the security association being used.

    The patch has virtually no impact on packets that do not use IPSec.
    The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
    before.

    Also, if IPSec is used without security contexts, the impact is
    minimal. The LSM must allow such policies to be selected for the
    combination of socket and remote machine, but subsequent IPSec
    processing proceeds as in the original case.

    Testing:

    The pfkey interface is tested using the ipsec-tools. ipsec-tools have
    been modified (a separate ipsec-tools patch is available for version
    0.5) that supports assignment of xfrm_policy entries and security
    associations with security contexts via setkey and the negotiation
    using the security contexts via racoon.

    The xfrm_user interface is tested via ad hoc programs that set
    security contexts. These programs are also available from me, and
    contain programs for setting, getting, and deleting policy for testing
    this interface. Testing of sa functions was done by tracing kernel
    behavior.

    Signed-off-by: Trent Jaeger
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Trent Jaeger