Eric Lee / smarc-fsl-linux-kernel

23 Apr, 2011

1 commit

06 Aug, 2008

1 commit

  • abf5cdb89   ipsec: Interfamily IPSec BEET, ipv4-inner ipv6-outer ... Browse Code »

    Here's a revised version, based on Herbert's comments, of a fix for
    the ipv4-inner, ipv6-outer interfamily ipsec beet mode. It fixes the
    network header adjustment during interfamily, as well as makes sure
    that we reserve enough room for the new ipv6 header if we might have
    something else as the inner family. Also, the ipv4 pseudo header
    construction was added.

    Signed-off-by: Joakim Koskela
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Joakim Koskela
     

27 Mar, 2008

1 commit

  • 732c8bd59   [IPSEC]: Fix BEET output ... Browse Code »

    The IPv6 BEET output function is incorrectly including the inner
    header in the payload to be protected. This causes a crash as
    the packet doesn't actually have that many bytes for a second
    header.

    The IPv4 BEET output on the other hand is broken when it comes
    to handling an inner IPv6 header since it always assumes an
    inner IPv4 header.

    This patch fixes both by making sure that neither BEET output
    function touches the inner header at all. All access is now
    done through the protocol-independent cb structure. Two new
    attributes are added to make this work, the IP header length
    and the IPv4 option length. They're filled in by the inner
    mode's output function.

    Thanks to Joakim Koskela for finding this problem.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

29 Jan, 2008

2 commits

  • 227620e29   [IPSEC]: Separate inner/outer mode processing on input ... Browse Code »

    With inter-family transforms the inner mode differs from the outer
    mode. Attempting to handle both sides from the same function means
    that it needs to handle both IPv4 and IPv6 which creates duplication
    and confusion.

    This patch separates the two parts on the input path so that each
    function deals with one family only.

    In particular, the functions xfrm4_extract_inut/xfrm6_extract_inut
    moves the pertinent fields from the IPv4/IPv6 IP headers into a
    neutral format stored in skb->cb. This is then used by the inner mode
    input functions to modify the inner IP header. In this way the input
    function no longer has to know about the outer address family.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 36cf9acf9   [IPSEC]: Separate inner/outer mode processing on output ... Browse Code »

    With inter-family transforms the inner mode differs from the outer
    mode. Attempting to handle both sides from the same function means
    that it needs to handle both IPv4 and IPv6 which creates duplication
    and confusion.

    This patch separates the two parts on the output path so that each
    function deals with one family only.

    In particular, the functions xfrm4_extract_output/xfrm6_extract_output
    moves the pertinent fields from the IPv4/IPv6 IP headers into a
    neutral format stored in skb->cb. This is then used by the outer mode
    output functions to write the outer IP header. In this way the output
    function no longer has to know about the inner address family.

    Since the extract functions are only called by tunnel modes (the only
    modes that can support inter-family transforms), I've also moved the
    xfrm*_tunnel_check_size calls into them. This allows the correct ICMP
    message to be sent as opposed to now where you might call icmp_send
    with an IPv6 packet and vice versa.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

18 Oct, 2007

1 commit

  • 1bfcb10f6   [IPSEC]: Add missing BEET checks ... Browse Code »

    Currently BEET mode does not reinject the packet back into the stack
    like tunnel mode does. Since BEET should behave just like tunnel mode
    this is incorrect.

    This patch fixes this by introducing a flags field to xfrm_mode that
    tells the IPsec code whether it should terminate and reinject the packet
    back into the stack.

    It then sets the flag for BEET and tunnel mode.

    I've also added a number of missing BEET checks elsewhere where we check
    whether a given mode is a tunnel or not.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

11 Oct, 2007

5 commits

  • ceb1eec82   [IPSEC]: Move IP length/checksum setting out of transforms ... Browse Code »

    This patch moves the setting of the IP length and checksum fields out of
    the transforms and into the xfrmX_output functions. This would help future
    efforts in merging the transforms themselves.

    It also adds an optimisation to ipcomp due to the fact that the transport
    offset is guaranteed to be zero.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 37fedd3aa   [IPSEC]: Use IPv6 calling convention as the convention for x->mode->output ... Browse Code »

    The IPv6 calling convention for x->mode->output is more general and could
    help an eventual protocol-generic x->type->output implementation. This
    patch adopts it for IPv4 as well and modifies the IPv4 type output functions
    accordingly.

    It also rewrites the IPv6 mac/transport header calculation to be based off
    the network header where practical.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 7b277b1a5   [IPSEC]: Set skb->data to payload in x->mode->output ... Browse Code »

    This patch changes the calling convention so that on entry from
    x->mode->output and before entry into x->type->output skb->data
    will point to the payload instead of the IP header.

    This is essentially a redistribution of skb_push/skb_pull calls
    with the aim of minimising them on the common path of tunnel +
    ESP.

    It'll also let us use the same calling convention between IPv4
    and IPv6 with the next patch.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • bee0b40c0   [IPSEC] beet: Fix extension header support on output ... Browse Code »

    The beet output function completely kills any extension headers by replacing
    them with the IPv6 header. This is because it essentially ignores the
    result of ip6_find_1stfragopt by simply acting as if there aren't any
    extension headers.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 007f0211a   [IPSEC]: Store IPv6 nh pointer in mac_header on output ... Browse Code »

    Current the x->mode->output functions store the IPv6 nh pointer in the
    skb network header. This is inconvenient because the network header then
    has to be fixed up before the packet can leave the IPsec stack. The mac
    header field is unused on output so we can use that to store this instead.

    This patch does that and removes the network header fix-up in xfrm_output.

    It also uses ipv6_hdr where appropriate in the x->type->output functions.

    There is also a minor clean-up in esp4 to make it use the same code as
    esp6 to help any subsequent effort to merge the two.

    Lastly it kills two redundant skb_set_* statements in BEET that were
    simply copied over from transport mode.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

26 Apr, 2007

9 commits

04 Oct, 2006

1 commit

  • 0a69452cb   [XFRM]: BEET mode ... Browse Code »

    This patch introduces the BEET mode (Bound End-to-End Tunnel) with as
    specified by the ietf draft at the following link:

    http://www.ietf.org/internet-drafts/draft-nikander-esp-beet-mode-06.txt

    The patch provides only single family support (i.e. inner family =
    outer family).

    Signed-off-by: Diego Beltrami
    Signed-off-by: Miika Komu
    Signed-off-by: Herbert Xu
    Signed-off-by: Abhinav Pathak
    Signed-off-by: Jeff Ahrenholz
    Signed-off-by: David S. Miller

    Diego Beltrami