linux-toradex.git/include/linux/xfrm.h, branch v2.6.29 Linux kernel for Apalis and Colibri modules xfrm: Notify changes in UDP encapsulation via netlink 2008-10-28T23:01:07+00:00 Martin Willi martin@strongswan.org 2008-10-28T23:01:07+00:00 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Add new_mapping() implementation to the netlink xfrm_mgr to notify address/port changes detected in UDP encapsulated ESP packets. Signed-off-by: Martin Willi <martin@strongswan.org> Signed-off-by: David S. Miller <davem@davemloft.net> 
Add new_mapping() implementation to the netlink xfrm_mgr to notify
address/port changes detected in UDP encapsulated ESP packets.

Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm: MIGRATE enhancements (draft-ebalard-mext-pfkey-enhanced-migrate) 2008-10-05T20:33:42+00:00 Arnaud Ebalard arno@natisbad.org 2008-10-05T20:33:42+00:00 13c1d18931ebb5cf407cb348ef2cd6284d68902d Provides implementation of the enhancements of XFRM/PF_KEY MIGRATE mechanism specified in draft-ebalard-mext-pfkey-enhanced-migrate-00. Defines associated PF_KEY SADB_X_EXT_KMADDRESS extension and XFRM/netlink XFRMA_KMADDRESS attribute. Signed-off-by: Arnaud Ebalard <arno@natisbad.org> Signed-off-by: David S. Miller <davem@davemloft.net> 
Provides implementation of the enhancements of XFRM/PF_KEY MIGRATE mechanism
specified in draft-ebalard-mext-pfkey-enhanced-migrate-00. Defines associated
PF_KEY SADB_X_EXT_KMADDRESS extension and XFRM/netlink XFRMA_KMADDRESS
attribute.

Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info 2008-07-10T23:55:37+00:00 Steffen Klassert steffen.klassert@secunet.com 2008-07-10T23:55:37+00:00 ccf9b3b83d0e56fbf20c00a08b15031ce13204a7 Add a XFRM_STATE_AF_UNSPEC flag to handle the AF_UNSPEC behavior for the selector family. Userspace applications can set this flag to leave the selector family of the xfrm_state unspecified. This can be used to to handle inter family tunnels if the selector is not set from userspace. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 
Add a XFRM_STATE_AF_UNSPEC flag to handle the AF_UNSPEC behavior for
the selector family. Userspace applications can set this flag to leave
the selector family of the xfrm_state unspecified.  This can be used
to to handle inter family tunnels if the selector is not set from
userspace.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm: alg_key_len & alg_icv_len should be unsigned 2008-04-25T07:29:34+00:00 Eric Dumazet dada1@cosmosbay.com 2008-04-25T07:29:00+00:00 461e6c856faf9cdd8862fa4d0785974a64e39dba In commit ba749ae98d5aa9d2ce9a7facde0deed454f92230 ([XFRM]: alg_key_len should be unsigned to avoid integer divides <http://git2.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commitdiff;h=ba749ae98d5aa9d2ce9a7facde0deed454f92230>) alg_key_len field of struct xfrm_algo was converted to unsigned int to avoid integer divides. Then Herbert in commit 1a6509d991225ad210de54c63314fd9542922095 ([IPSEC]: Add support for combined mode algorithms) added a new structure xfrm_algo_aead, that resurrected a signed int for alg_key_len and re-introduce integer divides. This patch avoids these divides and saves 64 bytes of text on i386. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 
In commit ba749ae98d5aa9d2ce9a7facde0deed454f92230 ([XFRM]: alg_key_len
should be unsigned to avoid integer divides
<http://git2.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commitdiff;h=ba749ae98d5aa9d2ce9a7facde0deed454f92230>)
alg_key_len field of struct xfrm_algo was converted to unsigned int to
avoid integer divides.

Then Herbert in commit 1a6509d991225ad210de54c63314fd9542922095
([IPSEC]: Add support for combined mode algorithms) added a new
structure xfrm_algo_aead, that resurrected a signed int for alg_key_len
and re-introduce integer divides.

This patch avoids these divides and saves 64 bytes of text on i386.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[XFRM]: Speed up xfrm_policy and xfrm_state walking 2008-02-29T05:31:08+00:00 Timo Teras timo.teras@iki.fi 2008-02-29T05:31:08+00:00 4c563f7669c10a12354b72b518c2287ffc6ebfb3 Change xfrm_policy and xfrm_state walking algorithm from O(n^2) to O(n). This is achieved adding the entries to one more list which is used solely for walking the entries. This also fixes some races where the dump can have duplicate or missing entries when the SPD/SADB is modified during an ongoing dump. Dumping SADB with 20000 entries using "time ip xfrm state" the sys time dropped from 1.012s to 0.080s. Signed-off-by: Timo Teras <timo.teras@iki.fi> Signed-off-by: David S. Miller <davem@davemloft.net> 
Change xfrm_policy and xfrm_state walking algorithm from O(n^2) to O(n).
This is achieved adding the entries to one more list which is used
solely for walking the entries.

This also fixes some races where the dump can have duplicate or missing
entries when the SPD/SADB is modified during an ongoing dump.

Dumping SADB with 20000 entries using "time ip xfrm state" the sys
time dropped from 1.012s to 0.080s.

Signed-off-by: Timo Teras <timo.teras@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
[IPSEC]: Add support for combined mode algorithms 2008-02-01T03:27:03+00:00 Herbert Xu herbert@gondor.apana.org.au 2008-01-29T03:37:29+00:00 1a6509d991225ad210de54c63314fd9542922095 This patch adds support for combined mode algorithms with GCM being the first algorithm supported. Combined mode algorithms can be added through the xfrm_user interface using the new algorithm payload type XFRMA_ALG_AEAD. Each algorithms is identified by its name and the ICV length. For the purposes of matching algorithms in xfrm_tmpl structures, combined mode algorithms occupy the same name space as encryption algorithms. This is in line with how they are negotiated using IKE. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 
This patch adds support for combined mode algorithms with GCM being
the first algorithm supported.

Combined mode algorithms can be added through the xfrm_user interface
using the new algorithm payload type XFRMA_ALG_AEAD.  Each algorithms
is identified by its name and the ICV length.

For the purposes of matching algorithms in xfrm_tmpl structures,
combined mode algorithms occupy the same name space as encryption
algorithms.  This is in line with how they are negotiated using IKE.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[XFRM]: Fix struct xfrm_algo code formatting. 2008-01-28T23:02:01+00:00 David S. Miller davem@davemloft.net 2008-01-13T05:31:29+00:00 3f4afb6443aaa1d69b2d8f0461c8191e40d54c3c Realign struct members. Signed-off-by: David S. Miller <davem@davemloft.net> 
Realign struct members.

Signed-off-by: David S. Miller <davem@davemloft.net>
[XFRM]: alg_key_len should be unsigned to avoid integer divides 2008-01-28T23:02:00+00:00 Eric Dumazet dada1@cosmosbay.com 2008-01-13T05:30:23+00:00 ba749ae98d5aa9d2ce9a7facde0deed454f92230 alg_key_len is currently defined as 'signed int'. This unfortunatly leads to integer divides in several paths. Converting it to unsigned is safe and saves 208 bytes of text on i386. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
alg_key_len is currently defined as 'signed int'. This unfortunatly
leads to integer divides in several paths.

Converting it to unsigned is safe and saves 208 bytes of text on i386.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[IPSEC]: Add ICMP host relookup support 2008-01-28T22:57:23+00:00 Herbert Xu herbert@gondor.apana.org.au 2007-12-12T18:44:43+00:00 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 RFC 4301 requires us to relookup ICMP traffic that does not match any policies using the reverse of its payload. This patch implements this for ICMP traffic that originates from or terminates on localhost. This is activated on outbound with the new policy flag XFRM_POLICY_ICMP, and on inbound by the new state flag XFRM_STATE_ICMP. On inbound the policy check is now performed by the ICMP protocol so that it can repeat the policy check where necessary. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 
RFC 4301 requires us to relookup ICMP traffic that does not match any
policies using the reverse of its payload.  This patch implements this
for ICMP traffic that originates from or terminates on localhost.

This is activated on outbound with the new policy flag XFRM_POLICY_ICMP,
and on inbound by the new state flag XFRM_STATE_ICMP.

On inbound the policy check is now performed by the ICMP protocol so
that it can repeat the policy check where necessary.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[IPSEC]: Added xfrm_decode_session_reverse and xfrmX_policy_check_reverse 2008-01-28T22:57:22+00:00 Herbert Xu herbert@gondor.apana.org.au 2007-12-12T18:44:16+00:00 d5422efe680fc55010c6ddca2370ca9548a96355 RFC 4301 requires us to relookup ICMP traffic that does not match any policies using the reverse of its payload. This patch adds the functions xfrm_decode_session_reverse and xfrmX_policy_check_reverse so we can get the reverse flow to perform such a lookup. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 
RFC 4301 requires us to relookup ICMP traffic that does not match any
policies using the reverse of its payload.  This patch adds the functions
xfrm_decode_session_reverse and xfrmX_policy_check_reverse so we can get
the reverse flow to perform such a lookup.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>