Eric Lee / smarc-fsl-linux-kernel

14 Mar, 2011

1 commit

  • 9736acf39   xfrm: Add basic infrastructure to support IPsec extended sequence numbers ... Browse Code »

    This patch adds the struct xfrm_replay_state_esn which will be
    used to support IPsec extended sequence numbers and anti replay windows
    bigger than 32 packets. Also we add a function that returns the actual
    size of the xfrm_replay_state_esn, a xfrm netlink atribute and a xfrm state
    flag for the use of extended sequence numbers.

    Signed-off-by: Steffen Klassert
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Steffen Klassert
     

09 Feb, 2011

1 commit

  • fa9921e46   ipsec: allow to align IPv4 AH on 32 bits ... Browse Code »

    The Linux IPv4 AH stack aligns the AH header on a 64 bit boundary
    (like in IPv6). This is not RFC compliant (see RFC4302, Section
    3.3.3.2.1), it should be aligned on 32 bits.

    For most of the authentication algorithms, the ICV size is 96 bits.
    The AH header alignment on 32 or 64 bits gives the same results.

    However for SHA-256-128 for instance, the wrong 64 bit alignment results
    in adding useless padding in IPv4 AH, which is forbidden by the RFC.

    To avoid breaking backward compatibility, we use a new flag
    (XFRM_STATE_ALIGN4) do change original behavior.

    Initial patch from Dang Hongwu and
    Christophe Gouault .

    Signed-off-by: Nicolas Dichtel
    Signed-off-by: David S. Miller

    Nicolas Dichtel
     

11 Dec, 2010

1 commit

23 Feb, 2010

1 commit

26 Nov, 2009

1 commit

05 Nov, 2009

1 commit

  • d94d9fee9   net: cleanup include/linux ... Browse Code »

    This cleanup patch puts struct/union/enum opening braces,
    in first line to ease grep games.

    struct something
    {

    becomes :

    struct something {

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

27 Mar, 2009

1 commit

  • 85efde6f4   make exported headers use strict posix types ... Browse Code »

    A number of standard posix types are used in exported headers, which
    is not allowed if __STRICT_KERNEL_NAMES is defined. In order to
    get rid of the non-__STRICT_KERNEL_NAMES part and to make sane headers
    the default, we have to change them all to safe types.

    There are also still some leftovers in reiserfs_fs.h, elfcore.h
    and coda.h, but these files have not compiled in user space for
    a long time.

    This leaves out the various integer types ({u_,u,}int{8,16,32,64}_t),
    which we take care of separately.

    Signed-off-by: Arnd Bergmann
    Acked-by: Mauro Carvalho Chehab
    Cc: David Airlie
    Cc: Arnaldo Carvalho de Melo
    Cc: YOSHIFUJI Hideaki
    Cc: netdev@vger.kernel.org
    Cc: linux-ppp@vger.kernel.org
    Cc: Jaroslav Kysela
    Cc: Takashi Iwai
    Cc: David Woodhouse
    Signed-off-by: H. Peter Anvin
    Signed-off-by: Ingo Molnar

    Arnd Bergmann
     

29 Oct, 2008

1 commit

06 Oct, 2008

1 commit

11 Jul, 2008

1 commit

  • ccf9b3b83   xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info ... Browse Code »

    Add a XFRM_STATE_AF_UNSPEC flag to handle the AF_UNSPEC behavior for
    the selector family. Userspace applications can set this flag to leave
    the selector family of the xfrm_state unspecified. This can be used
    to to handle inter family tunnels if the selector is not set from
    userspace.

    Signed-off-by: Steffen Klassert
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Steffen Klassert
     

25 Apr, 2008

1 commit

  • 461e6c856   xfrm: alg_key_len & alg_icv_len should be unsigned ... Browse Code »

    In commit ba749ae98d5aa9d2ce9a7facde0deed454f92230 ([XFRM]: alg_key_len
    should be unsigned to avoid integer divides
    )
    alg_key_len field of struct xfrm_algo was converted to unsigned int to
    avoid integer divides.

    Then Herbert in commit 1a6509d991225ad210de54c63314fd9542922095
    ([IPSEC]: Add support for combined mode algorithms) added a new
    structure xfrm_algo_aead, that resurrected a signed int for alg_key_len
    and re-introduce integer divides.

    This patch avoids these divides and saves 64 bytes of text on i386.

    Signed-off-by: Eric Dumazet
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Eric Dumazet
     

29 Feb, 2008

1 commit

  • 4c563f766   [XFRM]: Speed up xfrm_policy and xfrm_state walking ... Browse Code »

    Change xfrm_policy and xfrm_state walking algorithm from O(n^2) to O(n).
    This is achieved adding the entries to one more list which is used
    solely for walking the entries.

    This also fixes some races where the dump can have duplicate or missing
    entries when the SPD/SADB is modified during an ongoing dump.

    Dumping SADB with 20000 entries using "time ip xfrm state" the sys
    time dropped from 1.012s to 0.080s.

    Signed-off-by: Timo Teras
    Signed-off-by: David S. Miller

    Timo Teras
     

01 Feb, 2008

1 commit

  • 1a6509d99   [IPSEC]: Add support for combined mode algorithms ... Browse Code »

    This patch adds support for combined mode algorithms with GCM being
    the first algorithm supported.

    Combined mode algorithms can be added through the xfrm_user interface
    using the new algorithm payload type XFRMA_ALG_AEAD. Each algorithms
    is identified by its name and the ICV length.

    For the purposes of matching algorithms in xfrm_tmpl structures,
    combined mode algorithms occupy the same name space as encryption
    algorithms. This is in line with how they are negotiated using IKE.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

29 Jan, 2008

4 commits

05 May, 2007

2 commits

29 Apr, 2007

1 commit

26 Apr, 2007

1 commit

  • 28d8909bc   [XFRM]: Export SAD info. ... Browse Code »

    On a system with a lot of SAs, counting SAD entries chews useful
    CPU time since you need to dump the whole SAD to user space;
    i.e something like ip xfrm state ls | grep -i src | wc -l
    I have seen taking literally minutes on a 40K SAs when the system
    is swapping.
    With this patch, some of the SAD info (that was already being tracked)
    is exposed to user space. i.e you do:
    ip xfrm state count
    And you get the count; you can also pass -s to the command line and
    get the hash info.

    Signed-off-by: Jamal Hadi Salim
    Signed-off-by: David S. Miller

    Jamal Hadi Salim
     

09 Feb, 2007

1 commit

  • 80c9abaab   [XFRM]: Extension for dynamic update of endpoint address(es) ... Browse Code »

    Extend the XFRM framework so that endpoint address(es) in the XFRM
    databases could be dynamically updated according to a request (MIGRATE
    message) from user application. Target XFRM policy is first identified
    by the selector in the MIGRATE message. Next, the endpoint addresses
    of the matching templates and XFRM states are updated according to
    the MIGRATE message.

    Signed-off-by: Shinta Sugimoto
    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Shinta Sugimoto
     

09 Dec, 2006

1 commit

03 Dec, 2006

2 commits

04 Oct, 2006

1 commit

  • 0a69452cb   [XFRM]: BEET mode ... Browse Code »

    This patch introduces the BEET mode (Bound End-to-End Tunnel) with as
    specified by the ietf draft at the following link:

    http://www.ietf.org/internet-drafts/draft-nikander-esp-beet-mode-06.txt

    The patch provides only single family support (i.e. inner family =
    outer family).

    Signed-off-by: Diego Beltrami
    Signed-off-by: Miika Komu
    Signed-off-by: Herbert Xu
    Signed-off-by: Abhinav Pathak
    Signed-off-by: Jeff Ahrenholz
    Signed-off-by: David S. Miller

    Diego Beltrami
     

29 Sep, 2006

4 commits

23 Sep, 2006

8 commits

  • f7b6983f0   [XFRM] POLICY: Support netlink socket interface for sub policy. ... Browse Code »

    Sub policy can be used through netlink socket.
    PF_KEY uses main only and it is TODO to support sub.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 4e81bb833   [XFRM] POLICY: sub policy support. ... Browse Code »

    Sub policy is introduced. Main and sub policy are applied the same flow.
    (Policy that current kernel uses is named as main.)
    It is required another transformation policy management to keep IPsec
    and Mobile IPv6 lives separate.
    Policy which lives shorter time in kernel should be a sub i.e. normally
    main is for IPsec and sub is for Mobile IPv6.
    (Such usage as two IPsec policies on different database can be used, too.)

    Limitation or TODOs:
    - Sub policy is not supported for per socket one (it is always inserted as main).
    - Current kernel makes cached outbound with flowi to skip searching database.
    However this patch makes it disabled only when "two policies are used and
    the first matched one is bypass case" because neither flowi nor bundle
    information knows about transformation template size.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki

    Masahide NAKAMURA
     
  • 97a64b457   [XFRM]: Introduce XFRM_MSG_REPORT. ... Browse Code »

    XFRM_MSG_REPORT is a message as notification of state protocol and
    selector from kernel to user-space.

    Mobile IPv6 will use it when inbound reject is occurred at route
    optimization to make user-space know a binding error requirement.

    Based on MIPL2 kernel patch.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 9afaca057   [XFRM] IPV6: Update outbound state timestamp for each sending. ... Browse Code »

    With this patch transformation state is updated last used time
    for each sending. Xtime is used for it like other state lifetime
    expiration.
    Mobile IPv6 enabled nodes will want to know traffic status of each
    binding (e.g. judgement to request binding refresh by correspondent node,
    or to keep home/care-of nonce alive by mobile node).
    The last used timestamp is an important hint about it.
    Based on MIPL2 kernel patch.

    This patch was also written by: Henrik Petander

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 060f02a3b   [XFRM] STATE: Introduce care-of address. ... Browse Code »

    Care-of address is carried by state as a transformation option like
    IPsec encryption/authentication algorithm.

    Based on MIPL2 kernel patch.

    Signed-off-by: Noriaki TAKAMIYA
    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki

    Noriaki TAKAMIYA
     
  • fbd9a5b47   [XFRM] STATE: Common receive function for route optimization extension headers. ... Browse Code »

    XFRM_STATE_WILDRECV flag is introduced; the last resort state is set
    it and receives packet which is not route optimized but uses such
    extension headers i.e. Mobile IPv6 signaling (binding update and
    acknowledgement). A node enabled Mobile IPv6 adds the state.

    Based on MIPL2 kernel patch.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • eb2971b68   [XFRM] STATE: Search by address using source address list. ... Browse Code »

    This is a support to search transformation states by its addresses
    by using source address list for Mobile IPv6 usage.
    To use it from user-space, it is also added a message type for
    source address as a xfrm state option.
    Based on MIPL2 kernel patch.

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     
  • 7e49e6de3   [XFRM]: Add XFRM_MODE_xxx for future use. ... Browse Code »

    Transformation mode is used as either IPsec transport or tunnel.
    It is required to add two more items, route optimization and inbound trigger
    for Mobile IPv6.
    Based on MIPL2 kernel patch.

    This patch was also written by: Ville Nuorvala

    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Masahide NAKAMURA
     

18 Jun, 2006

1 commit

  • b59f45d0b   [IPSEC] xfrm: Abstract out encapsulation modes ... Browse Code »

    This patch adds the structure xfrm_mode. It is meant to represent
    the operations carried out by transport/tunnel modes.

    By doing this we allow additional encapsulation modes to be added
    without clogging up the xfrm_input/xfrm_output paths.

    Candidate modes include 4-to-6 tunnel mode, 6-to-4 tunnel mode, and
    BEET modes.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

21 Mar, 2006

1 commit