Eric Lee / smarc-fsl-linux-kernel

14 Apr, 2017

2 commits

  • f1bd7d659   xfrm: Add encapsulation header offsets while SKB is not encrypted ... Browse Code »

    Both esp4 and esp6 used to assume that the SKB payload is encrypted
    and therefore the inner_network and inner_transport offsets are
    not relevant.
    When doing crypto offload in the NIC, this is no longer the case
    and the NIC driver needs these offsets so it can do TX TCP checksum
    offloading.
    This patch sets the inner_network and inner_transport members of
    the SKB, as well as encapsulation, to reflect the actual positions
    of these headers, and removes them only once encryption is done
    on the payload.

    Signed-off-by: Ilan Tayari
    Signed-off-by: Steffen Klassert

    Ilan Tayari
     
  • c35fe4106   xfrm: Add mode handlers for IPsec on layer 2 ... Browse Code »

    This patch adds a gso_segment and xmit callback for the
    xfrm_mode and implement these functions for tunnel and
    transport mode.

    Signed-off-by: Steffen Klassert

    Steffen Klassert
     

16 Jan, 2016

1 commit

  • 34ae6a1aa   ipv6: update skb->csum when CE mark is propagated ... Browse Code »

    When a tunnel decapsulates the outer header, it has to comply
    with RFC 6080 and eventually propagate CE mark into inner header.

    It turns out IP6_ECN_set_ce() does not correctly update skb->csum
    for CHECKSUM_COMPLETE packets, triggering infamous "hw csum failure"
    messages and stack traces.

    Signed-off-by: Eric Dumazet
    Acked-by: Herbert Xu
    Signed-off-by: David S. Miller

    Eric Dumazet
     

11 Aug, 2015

1 commit

  • eae8dee99   xfrm6: Fix IPv6 ECN decapsulation ... Browse Code »

    Using ipv6_get_dsfield on the outer IP header implies that inner and
    outer header are of the the same address family. For interfamily
    tunnels, particularly 646, the code reading the DSCP field obtains the
    wrong values (IHL and the upper four bits of the DSCP field).
    This can cause the code to detect a congestion encoutered state in the
    outer header and enable the corresponding bits in the inner header, too.

    Since the DSCP field is stored in the xfrm mode common buffer
    independently from the IP version of the outer header, it's safe (and
    correct) to take this value from there.

    Signed-off-by: Thomas Egerer
    Signed-off-by: Steffen Klassert

    Thomas Egerer
     

14 Mar, 2014

1 commit

09 Oct, 2013

1 commit

06 Mar, 2013

1 commit

  • a947b0a93   xfrm: allow to avoid copying DSCP during encapsulation ... Browse Code »

    By default, DSCP is copying during encapsulation.
    Copying the DSCP in IPsec tunneling may be a bit dangerous because packets with
    different DSCP may get reordered relative to each other in the network and then
    dropped by the remote IPsec GW if the reordering becomes too big compared to the
    replay window.

    It is possible to avoid this copy with netfilter rules, but it's very convenient
    to be able to configure it for each SA directly.

    This patch adds a toogle for this purpose. By default, it's not set to maintain
    backward compatibility.

    Field flags in struct xfrm_usersa_info is full, hence I add a new attribute.

    Signed-off-by: Nicolas Dichtel
    Signed-off-by: Steffen Klassert

    Nicolas Dichtel
     

19 Feb, 2013

1 commit

  • 0d4bfa297   ipv6: fix warning in xfrm6_mode_tunnel_input ... Browse Code »

    Should not use assignment in conditional:
    warning: suggest parentheses around assignment used as truth value [-Wparentheses]

    Problem introduced by:
    commit 14bbd6a565e1bcdc240d44687edb93f721cfdf99
    Author: Pravin B Shelar
    Date: Thu Feb 14 09:44:49 2013 +0000

    net: Add skb_unclone() helper function.

    Signed-off-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    stephen hemminger
     

16 Feb, 2013

1 commit

24 Feb, 2012

1 commit

  • 03606895c   ipsec: be careful of non existing mac headers ... Browse Code »
    1

    Niccolo Belli reported ipsec crashes in case we handle a frame without
    mac header (atm in his case)

    Before copying mac header, better make sure it is present.

    Bugzilla reference: https://bugzilla.kernel.org/show_bug.cgi?id=42809

    Reported-by: Niccolò Belli
    Tested-by: Niccolò Belli
    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

23 Nov, 2011

1 commit

23 Apr, 2011

1 commit

13 Dec, 2010

1 commit

30 Mar, 2010

1 commit

  • 5a0e3ad6a   include cleanup: Update gfp.h and slab.h includes to prepare for breaking implic… ... Browse Code »

    …it slab.h inclusion from percpu.h

    percpu.h is included by sched.h and module.h and thus ends up being
    included when building most .c files. percpu.h includes slab.h which
    in turn includes gfp.h making everything defined by the two files
    universally available and complicating inclusion dependencies.

    percpu.h -> slab.h dependency is about to be removed. Prepare for
    this change by updating users of gfp and slab facilities include those
    headers directly instead of assuming availability. As this conversion
    needs to touch large number of source files, the following script is
    used as the basis of conversion.

    http://userweb.kernel.org/~tj/misc/slabh-sweep.py

    The script does the followings.

    * Scan files for gfp and slab usages and update includes such that
    only the necessary includes are there. ie. if only gfp is used,
    gfp.h, if slab is used, slab.h.

    * When the script inserts a new include, it looks at the include
    blocks and try to put the new include such that its order conforms
    to its surrounding. It's put in the include block which contains
    core kernel includes, in the same order that the rest are ordered -
    alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
    doesn't seem to be any matching order.

    * If the script can't find a place to put a new include (mostly
    because the file doesn't have fitting include block), it prints out
    an error message indicating which .h file needs to be added to the
    file.

    The conversion was done in the following steps.

    1. The initial automatic conversion of all .c files updated slightly
    over 4000 files, deleting around 700 includes and adding ~480 gfp.h
    and ~3000 slab.h inclusions. The script emitted errors for ~400
    files.

    2. Each error was manually checked. Some didn't need the inclusion,
    some needed manual addition while adding it to implementation .h or
    embedding .c file was more appropriate for others. This step added
    inclusions to around 150 files.

    3. The script was run again and the output was compared to the edits
    from #2 to make sure no file was left behind.

    4. Several build tests were done and a couple of problems were fixed.
    e.g. lib/decompress_*.c used malloc/free() wrappers around slab
    APIs requiring slab.h to be added manually.

    5. The script was run on all .h files but without automatically
    editing them as sprinkling gfp.h and slab.h inclusions around .h
    files could easily lead to inclusion dependency hell. Most gfp.h
    inclusion directives were ignored as stuff from gfp.h was usually
    wildly available and often used in preprocessor macros. Each
    slab.h inclusion directive was examined and added manually as
    necessary.

    6. percpu.h was updated not to include slab.h.

    7. Build test were done on the following configurations and failures
    were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
    distributed build env didn't work with gcov compiles) and a few
    more options had to be turned off depending on archs to make things
    build (like ipr on powerpc/64 which failed due to missing writeq).

    * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
    * powerpc and powerpc64 SMP allmodconfig
    * sparc and sparc64 SMP allmodconfig
    * ia64 SMP allmodconfig
    * s390 SMP allmodconfig
    * alpha SMP allmodconfig
    * um on x86_64 SMP allmodconfig

    8. percpu.h modifications were reverted so that it could be applied as
    a separate patch and serve as bisection point.

    Given the fact that I had only a couple of failures from tests on step
    6, I'm fairly confident about the coverage of this conversion patch.
    If there is a breakage, it's likely to be something in one of the arch
    headers which should be easily discoverable easily on most builds of
    the specific arch.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>

    Tejun Heo
     

03 Jun, 2009

1 commit

  • adf30907d   net: skb->dst accessors ... Browse Code »

    Define three accessors to get/set dst attached to a skb

    struct dst_entry *skb_dst(const struct sk_buff *skb)

    void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)

    void skb_dst_drop(struct sk_buff *skb)
    This one should replace occurrences of :
    dst_release(skb->dst)
    skb->dst = NULL;

    Delete skb->dst field

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     

25 Mar, 2008

1 commit

29 Jan, 2008

4 commits

  • 195ad6a3a   [IPSEC]: Rename tunnel-mode functions to avoid collisions with tunnels ... Browse Code »

    It appears that I've managed to create two different functions both
    called xfrm6_tunnel_output. This is because we have the plain tunnel
    encapsulation named xfrmX_tunnel as well as the tunnel-mode encapsulation
    which lives in the files xfrmX_mode_tunnel.c.

    This patch renames functions from the latter to use the xfrmX_mode_tunnel
    prefix to avoid name-space conflicts.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 227620e29   [IPSEC]: Separate inner/outer mode processing on input ... Browse Code »

    With inter-family transforms the inner mode differs from the outer
    mode. Attempting to handle both sides from the same function means
    that it needs to handle both IPv4 and IPv6 which creates duplication
    and confusion.

    This patch separates the two parts on the input path so that each
    function deals with one family only.

    In particular, the functions xfrm4_extract_inut/xfrm6_extract_inut
    moves the pertinent fields from the IPv4/IPv6 IP headers into a
    neutral format stored in skb->cb. This is then used by the inner mode
    input functions to modify the inner IP header. In this way the input
    function no longer has to know about the outer address family.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 36cf9acf9   [IPSEC]: Separate inner/outer mode processing on output ... Browse Code »

    With inter-family transforms the inner mode differs from the outer
    mode. Attempting to handle both sides from the same function means
    that it needs to handle both IPv4 and IPv6 which creates duplication
    and confusion.

    This patch separates the two parts on the output path so that each
    function deals with one family only.

    In particular, the functions xfrm4_extract_output/xfrm6_extract_output
    moves the pertinent fields from the IPv4/IPv6 IP headers into a
    neutral format stored in skb->cb. This is then used by the outer mode
    output functions to write the outer IP header. In this way the output
    function no longer has to know about the inner address family.

    Since the extract functions are only called by tunnel modes (the only
    modes that can support inter-family transforms), I've also moved the
    xfrm*_tunnel_check_size calls into them. This allows the correct ICMP
    message to be sent as opposed to now where you might call icmp_send
    with an IPv6 packet and vice versa.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 29bb43b4e   [INET]: Give outer DSCP directly to ip*_copy_dscp ... Browse Code »

    This patch changes the prototype of ipv4_copy_dscp and ipv6_copy_dscp so
    that they directly take the outer DSCP rather than the outer IP header.
    This will help us to unify the code for inter-family tunnels.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

18 Oct, 2007

1 commit

  • 1bfcb10f6   [IPSEC]: Add missing BEET checks ... Browse Code »

    Currently BEET mode does not reinject the packet back into the stack
    like tunnel mode does. Since BEET should behave just like tunnel mode
    this is incorrect.

    This patch fixes this by introducing a flags field to xfrm_mode that
    tells the IPsec code whether it should terminate and reinject the packet
    back into the stack.

    It then sets the flag for BEET and tunnel mode.

    I've also added a number of missing BEET checks elsewhere where we check
    whether a given mode is a tunnel or not.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

11 Oct, 2007

4 commits

  • ceb1eec82   [IPSEC]: Move IP length/checksum setting out of transforms ... Browse Code »

    This patch moves the setting of the IP length and checksum fields out of
    the transforms and into the xfrmX_output functions. This would help future
    efforts in merging the transforms themselves.

    It also adds an optimisation to ipcomp due to the fact that the transport
    offset is guaranteed to be zero.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 37fedd3aa   [IPSEC]: Use IPv6 calling convention as the convention for x->mode->output ... Browse Code »

    The IPv6 calling convention for x->mode->output is more general and could
    help an eventual protocol-generic x->type->output implementation. This
    patch adopts it for IPv4 as well and modifies the IPv4 type output functions
    accordingly.

    It also rewrites the IPv6 mac/transport header calculation to be based off
    the network header where practical.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 7b277b1a5   [IPSEC]: Set skb->data to payload in x->mode->output ... Browse Code »

    This patch changes the calling convention so that on entry from
    x->mode->output and before entry into x->type->output skb->data
    will point to the payload instead of the IP header.

    This is essentially a redistribution of skb_push/skb_pull calls
    with the aim of minimising them on the common path of tunnel +
    ESP.

    It'll also let us use the same calling convention between IPv4
    and IPv6 with the next patch.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 007f0211a   [IPSEC]: Store IPv6 nh pointer in mac_header on output ... Browse Code »

    Current the x->mode->output functions store the IPv6 nh pointer in the
    skb network header. This is inconvenient because the network header then
    has to be fixed up before the packet can leave the IPsec stack. The mac
    header field is unused on output so we can use that to store this instead.

    This patch does that and removes the network header fix-up in xfrm_output.

    It also uses ipv6_hdr where appropriate in the x->type->output functions.

    There is also a minor clean-up in esp4 to make it use the same code as
    esp6 to help any subsequent effort to merge the two.

    Lastly it kills two redundant skb_set_* statements in BEET that were
    simply copied over from transport mode.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

31 May, 2007

1 commit

26 Apr, 2007

8 commits

09 Feb, 2007

1 commit

23 Sep, 2006

1 commit

18 Jun, 2006

1 commit

  • b59f45d0b   [IPSEC] xfrm: Abstract out encapsulation modes ... Browse Code »

    This patch adds the structure xfrm_mode. It is meant to represent
    the operations carried out by transport/tunnel modes.

    By doing this we allow additional encapsulation modes to be added
    without clogging up the xfrm_input/xfrm_output paths.

    Candidate modes include 4-to-6 tunnel mode, 6-to-4 tunnel mode, and
    BEET modes.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu