linux-toradex.git/include/net/flow.h, branch v2.6.23.12

[IPV6] MIP6: Kill unnecessary ifdefs.

2007-07-11T05:15:41+00:00

Kill unnecessary CONFIG_IPV6_MIP6.

o It is redundant for RAW socket to keep MH out with the config then
  it can handle any protocol.
o Clean-up at AH.

Signed-off-by: Masahide NAKAMURA 
Signed-off-by: David S. Miller

[XFRM]: Restrict upper layer information by bundle.

2007-04-30T07:58:09+00:00

On MIPv6 usage, XFRM sub policy is enabled.
When main (IPsec) and sub (MIPv6) policy selectors have the same
address set but different upper layer information (i.e. protocol
number and its ports or type/code), multiple bundle should be created.
However, currently we have issue to use the same bundle created for
the first time with all flows covered by the case.

It is useful for the bundle to have the upper layer information
to be restructured correctly if it does not match with the flow.

1. Bundle was created by two policies
Selector from another policy is added to xfrm_dst.
If the flow does not match the selector, it goes to slow path to
restructure new bundle by single policy.

2. Bundle was created by one policy
Flow cache is added to xfrm_dst as originated one. If the flow does
not match the cache, it goes to slow path to try searching another
policy.

Signed-off-by: Masahide NAKAMURA 
Signed-off-by: David S. Miller

[NET]: Rethink mark field in struct flowi

2006-12-03T05:21:39+00:00

Now that all protocols have been made aware of the mark
field it can be moved out of the union thus simplyfing
its usage.

The config options in the IPv4/IPv6/DECnet subsystems
to enable respectively disable mark based routing only
obfuscate the code with ifdefs, the cost for the
additional comparison in the flow key is insignificant,
and most distributions have all these options enabled
by default anyway. Therefore it makes sense to remove
the config options and enable mark based routing by
default.

Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

[IPV6]: flowlabels are net-endian

2006-12-03T05:21:21+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller

[NET]: Reduce sizeof(struct flowi) by 20 bytes.

2006-10-22T03:24:01+00:00

As suggested by David, just kill off some unused fields in dnports to
reduce sizef(struct flowi). If they come back, they should be moved to
nl_u.dn_u in order not to enlarge again struct flowi

[ Modified to really delete this stuff instead of using #if 0. -DaveM ]

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

IPsec: propagate security module errors up from flow_cache_lookup

2006-10-12T06:59:34+00:00

When a security module is loaded (in this case, SELinux), the
security_xfrm_policy_lookup() hook can return an access denied permission
(or other error).  We were not handling that correctly, and in fact
inverting the return logic and propagating a false "ok" back up to
xfrm_lookup(), which then allowed packets to pass as if they were not
associated with an xfrm policy.

The way I was seeing the problem was when connecting via IPsec to a
confined service on an SELinux box (vsftpd), which did not have the
appropriate SELinux policy permissions to send packets via IPsec.

The first SYNACK would be blocked, because of an uncached lookup via
flow_cache_lookup(), which would fail to resolve an xfrm policy because
the SELinux policy is checked at that point via the resolver.

However, retransmitted SYNACKs would then find a cached flow entry when
calling into flow_cache_lookup() with a null xfrm policy, which is
interpreted by xfrm_lookup() as the packet not having any associated
policy and similarly to the first case, allowing it to pass without
transformation.

The solution presented here is to first ensure that errno values are
correctly propagated all the way back up through the various call chains
from security_xfrm_policy_lookup(), and handled correctly.

Then, flow_cache_lookup() is modified, so that if the policy resolver
fails (typically a permission denied via the security module), the flow
cache entry is killed rather than having a null policy assigned (which
indicates that the packet can pass freely).  This also forces any future
lookups for the same flow to consult the security module (e.g. SELinux)
for current security policy (rather than, say, caching the error on the
flow cache entry).

Signed-off-by: James Morris

[XFRM]: fl_ipsec_spi is net-endian

2006-09-29T01:02:43+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller

[NET]: ip ports in struct flowi are net-endian

2006-09-29T01:02:07+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller

[IPV4]: annotate ipv4 addresses in struct rtable and struct flowi

2006-09-29T00:54:05+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller

[IPV6] ROUTE: Routing by FWMARK.

2006-09-22T22:18:00+00:00

Based on patch by Jean Lorchat .

Signed-off-by: YOSHIFUJI Hideaki