summaryrefslogtreecommitdiffstats
path: root/net/xfrm
Commit message (Collapse)AuthorAgeFilesLines
* xfrm: spin_lock() should be spin_unlock() in xfrm_state.cChuck Ebbert2009-03-271-1/+1
| | | | | | | | | | | | spin_lock() should be spin_unlock() in xfrm_state_walk_done(). caused by: commit 12a169e7d8f4b1c95252d8b04ed0f1033ed7cfe2 "ipsec: Put dumpers on the dump list" Reported-by: Marc Milgram <mmilgram@redhat.com> Signed-off-by: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: Fix xfrm_state_find() wrt. wildcard source address.David S. Miller2009-03-131-32/+58
| | | | | | | | | | | The change to make xfrm_state objects hash on source address broke the case where such source addresses are wildcarded. Fix this by doing a two phase lookup, first with fully specified source address, next using saddr wildcarded. Reported-by: Nicolas Dichtel <nicolas.dichtel@dev.6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Revert "xfrm: For 32/64 compatability wrt. xfrm_usersa_info"David S. Miller2009-01-201-9/+2
| | | | | | | | | | This reverts commit fc8c7dc1b29560c016a67a34ccff32a712b5aa86. As indicated by Jiri Klimes, this won't work. These numbers are not only used the size validation, they are also used to locate attributes sitting after the message. Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: For 32/64 compatability wrt. xfrm_usersa_infoDavid S. Miller2009-01-141-2/+9
| | | | | | | | Reported by Jiri Klimes. Fix suggested by Patrick McHardy. Signed-off-by: David S. Miller <davem@davemloft.net>
* ipcomp: Remove spurious truesize increaseHerbert Xu2009-01-111-1/+0
| | | | | | | | | | | | When I made ipcomp use frags, I forgot to take out the original truesize update that was added for pskb_expand_head. As we no longer expand the head of skb, that update should have been removed. This bug is not related to the truesize warnings since we only made it bigger than what it should've been. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: make xfrm_statistics_seq_show use generic snmp_fold_fieldRusty Russell2008-12-291-15/+2
| | | | | | | No reason to roll our own here. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
* Revert "xfrm: Accept ESP packets regardless of UDP encapsulation mode"David S. Miller2008-12-181-0/+5
| | | | | | This reverts commit e061b165c7f4ec5e2e160d990b49011b5b6e5c6a. Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: join error pathsIlpo Järvinen2008-12-141-10/+12
| | | | | Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: Accept ESP packets regardless of UDP encapsulation modeMartin Willi2008-12-041-5/+0
| | | | | | | | | | | From: Martin Willi <martin@strongswan.org> An IPsec node speaking IKEv2 MUST accept incoming UDP encapsulated ESP packets, even if no NAT situation is detected. This is important if MOBIKE is in use. Some implementation keep the encapsulation mode if they move out of a NAT situation. Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: Accept XFRM_STATE_AF_UNSPEC SAs on IPv4/IPv6 only hostsMartin Willi2008-12-031-15/+11
| | | | | | | | | Installing SAs using the XFRM_STATE_AF_UNSPEC fails on hosts with support for one address family only. This patch accepts such SAs, even if the processing of not supported packets will fail. Signed-off-by: Martin Willi <martin@strongswan.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: Cleanup for unlink SPD entryWei Yongjun2008-12-031-25/+10
| | | | | | | | Used __xfrm_policy_unlink() to instead of the dup codes when unlink SPD entry. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'master' of ↵David S. Miller2008-12-031-0/+1
|\ | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
| * xfrm: Fix kernel panic when flush and dump SPD entriesWei Yongjun2008-12-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After flush the SPD entries, dump the SPD entries will cause kernel painc. Used the following commands to reproduct: - echo 'spdflush;' | setkey -c - echo 'spdadd 3ffe:501:ffff:ff01::/64 3ffe:501:ffff:ff04::/64 any -P out ipsec \ ah/tunnel/3ffe:501:ffff:ff00:200:ff:fe00:b0b0-3ffe:501:ffff:ff02:200:ff:fe00:a1a1/require;\ spddump;' | setkey -c - echo 'spdflush; spddump;' | setkey -c - echo 'spdadd 3ffe:501:ffff:ff01::/64 3ffe:501:ffff:ff04::/64 any -P out ipsec \ ah/tunnel/3ffe:501:ffff:ff00:200:ff:fe00:b0b0-3ffe:501:ffff:ff02:200:ff:fe00:a1a1/require;\ spddump;' | setkey -c This is because when flush the SPD entries, the SPD entry is not remove from the list. This patch fix the problem by remove the SPD entry from the list. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns sysctlsAlexey Dobriyan2008-11-255-19/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make net.core.xfrm_aevent_etime net.core.xfrm_acq_expires net.core.xfrm_aevent_rseqth net.core.xfrm_larval_drop sysctls per-netns. For that make net_core_path[] global, register it to prevent two /proc/net/core antries and change initcall position -- xfrm_init() is called from fs_initcall, so this one should be fs_initcall at least. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: /proc/net/xfrm_stat in netnsAlexey Dobriyan2008-11-252-18/+19
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns MIBsAlexey Dobriyan2008-11-254-54/+67
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: flush SA/SPDs on netns stopAlexey Dobriyan2008-11-252-0/+22
| | | | | | | | | | | | | | SA/SPD doesn't pin netns (and it shouldn't), so get rid of them by hand. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: ->get_saddr in netnsAlexey Dobriyan2008-11-251-3/+4
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: ->dst_lookup in netnsAlexey Dobriyan2008-11-251-3/+4
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: KM reporting in netnsAlexey Dobriyan2008-11-252-5/+4
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: pass netns with KM notificationsAlexey Dobriyan2008-11-251-2/+4
| | | | | | | | | | | | | | | | SA and SPD flush are executed with NULL SA and SPD respectively, for these cases pass netns explicitly from userspace socket. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: xfrm_user module in netnsAlexey Dobriyan2008-11-251-31/+45
| | | | | | | | | | | | | | | | | | | | Grab netns either from netlink socket, state or policy. SA and SPD flush are in init_net for now, this requires little attention, see below. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns NETLINK_XFRM socketAlexey Dobriyan2008-11-253-41/+77
| | | | | | | | | | | | | | Stub senders to init_net's one temporarily. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: xfrm_input() fixupAlexey Dobriyan2008-11-251-1/+2
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: dst garbage-collecting in netnsAlexey Dobriyan2008-11-251-2/+2
| | | | | | | | | | | | | | | | | | | | Pass netns pointer to struct xfrm_policy_afinfo::garbage_collect() [This needs more thoughts on what to do with dst_ops] [Currently stub to init_net] Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: flushing/pruning bundles in netnsAlexey Dobriyan2008-11-251-11/+8
| | | | | | | | | | | | | | Allow netdevice notifier as result. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: xfrm_route_forward() in netnsAlexey Dobriyan2008-11-251-1/+2
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: xfrm_policy_check in netnsAlexey Dobriyan2008-11-251-2/+3
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: lookup in netnsAlexey Dobriyan2008-11-251-18/+20
| | | | | | | | | | | | | | | | | | | | Pass netns to xfrm_lookup()/__xfrm_lookup(). For that pass netns to flow_cache_lookup() and resolver callback. Take it from socket or netdevice. Stub DECnet to init_net. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: policy walking in netnsAlexey Dobriyan2008-11-252-4/+4
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: finding policy in netnsAlexey Dobriyan2008-11-252-11/+11
| | | | | | | | | | | | | | Add netns parameter to xfrm_policy_bysel_ctx(), xfrm_policy_byidx(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: policy flushing in netnsAlexey Dobriyan2008-11-252-12/+12
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: policy insertion in netnsAlexey Dobriyan2008-11-251-22/+24
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: propagate netns into policy byidx hashAlexey Dobriyan2008-11-251-6/+6
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: state walking in netnsAlexey Dobriyan2008-11-252-4/+4
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: finding states in netnsAlexey Dobriyan2008-11-252-37/+40
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: fixup xfrm_alloc_spi()Alexey Dobriyan2008-11-251-2/+2
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: state lookup in netnsAlexey Dobriyan2008-11-253-22/+26
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: state flush in netnsAlexey Dobriyan2008-11-252-10/+10
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: trivial netns propagationsAlexey Dobriyan2008-11-252-31/+43
| | | | | | | | | | | | | | Take netns from xfrm_state or xfrm_policy. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: propagate netns into bydst/bysrc/byspi hash functionsAlexey Dobriyan2008-11-251-21/+23
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns policy hash resizing workAlexey Dobriyan2008-11-251-26/+26
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns policy countsAlexey Dobriyan2008-11-251-18/+16
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns xfrm_policy_bydst hashAlexey Dobriyan2008-11-251-24/+33
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns inexact policiesAlexey Dobriyan2008-11-251-8/+12
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns xfrm_policy_byidx hashmaskAlexey Dobriyan2008-11-251-8/+7
| | | | | | | | | | | | | | Per-netns hashes are independently resizeable. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns xfrm_policy_byidx hashAlexey Dobriyan2008-11-251-10/+18
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns policy listAlexey Dobriyan2008-11-251-6/+6
| | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: add struct xfrm_policy::xp_netAlexey Dobriyan2008-11-252-4/+5
| | | | | | | | | | | | | | | | Again, to avoid complications with passing netns when not necessary. Again, ->xp_net is set-once field, once set it never changes. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | netns xfrm: per-netns km_waitqAlexey Dobriyan2008-11-252-11/+9
| | | | | | | | | | | | | | Disallow spurious wakeups in __xfrm_lookup(). Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
OpenPOWER on IntegriCloud