linux-toradex.git/include/net/xfrm.h, branch v3.4.99

xfrm: Workaround incompatibility of ESN and async crypto

2012-10-12T20:38:40+00:00

[ Upstream commit 3b59df46a449ec9975146d71318c4777ad086744 ]

ESN for esp is defined in RFC 4303. This RFC assumes that the
sequence number counters are always up to date. However,
this is not true if an async crypto algorithm is employed.

If the sequence number counters are not up to date on sequence
number check, we may incorrectly update the upper 32 bit of
the sequence number. This leads to a DOS.

We workaround this by comparing the upper sequence number,
(used for authentication) with the upper sequence number
computed after the async processing. We drop the packet
if these numbers are different.

To do this, we introduce a recheck function that does this
check in the ESN case.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xfrm: remove unneeded method typedef declaration in net/xfrm.h.

2012-02-26T01:19:24+00:00

The patch removes unneeded method typedef declaration (icv_update_fn_t
) and the two struct declarations which appear in its prototype
(struct hash_desc and struct scatterlist) in net/xfrm.h.

Signed-off-by: Rami Rosen 
Signed-off-by: David S. Miller

net: remove ipv6_addr_copy()

2011-11-22T21:43:32+00:00

C assignment can handle struct in6_addr copying.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

xfrm: optimize ipv4 selector matching

2011-11-22T20:27:18+00:00

Current addr_match() is errh, under-optimized.

Compiler doesn't know that memcmp() branch doesn't trigger for IPv4.
Also, pass addresses by value -- they fit into register.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-3.6

2011-05-11T18:26:58+00:00

Conflicts:
	drivers/net/benet/be_main.c

xfrm: Assign the inner mode output function to the dst entry

2011-05-10T22:03:34+00:00

As it is, we assign the outer modes output function to the dst entry
when we create the xfrm bundle. This leads to two problems on interfamily
scenarios. We might insert ipv4 packets into ip6_fragment when called
from xfrm6_output. The system crashes if we try to fragment an ipv4
packet with ip6_fragment. This issue was introduced with git commit
ad0081e4 (ipv6: Fragment locally generated tunnel-mode IPSec6 packets
as needed). The second issue is, that we might insert ipv4 packets in
netfilter6 and vice versa on interfamily scenarios.

With this patch we assign the inner mode output function to the dst entry
when we create the xfrm bundle. So xfrm4_output/xfrm6_output from the inner
mode is used and the right fragmentation and netfilter functions are called.
We switch then to outer mode with the output_finish functions.

Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

inet: constify ip headers and in6_addr

2011-04-22T18:04:14+00:00

Add const qualifiers to structs iphdr, ipv6hdr and in6_addr pointers
where possible, to make code intention more obvious.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Disable rp_filter for IPsec packets

2011-04-11T01:50:59+00:00

The reverse path filter interferes with IPsec subnet-to-subnet tunnels,
especially when the link to the IPsec peer is on an interface other than
the one hosting the default route.

With dynamic routing, where the peer might be reachable through eth0
today and eth1 tomorrow, it's difficult to keep rp_filter enabled unless
fake routes to the remote subnets are configured on the interface
currently used to reach the peer.

IPsec provides a much stronger anti-spoofing policy than rp_filter, so
this patch disables the rp_filter for packets with a security path.

Signed-off-by: Michael Smith 
Signed-off-by: David S. Miller

xfrm: Assign esn pointers when cloning a state

2011-03-29T06:34:52+00:00

When we clone a xfrm state we have to assign the replay_esn
and the preplay_esn pointers to the state if we use the
new replay detection method. To this end, we add a
xfrm_replay_clone() function that allocates memory for
the replay detection and takes over the necessary values
from the original state.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: Fix initialize repl field of struct xfrm_state

2011-03-22T01:08:28+00:00

Commit 'xfrm: Move IPsec replay detection functions to a separate file'
  (9fdc4883d92d20842c5acea77a4a21bb1574b495)
introduce repl field to struct xfrm_state, and only initialize it
under SA's netlink create path, the other path, such as pf_key,
ipcomp/ipcomp6 etc, the repl field remaining uninitialize. So if
the SA is created by pf_key, any input packet with SA's encryption
algorithm will cause panic.

    int xfrm_input()
    {
        ...
        x->repl->advance(x, seq);
        ...
    }

This patch fixed it by introduce new function __xfrm_init_state().

Pid: 0, comm: swapper Not tainted 2.6.38-next+ #14 Bochs Bochs
EIP: 0060:[] EFLAGS: 00010206 CPU: 0
EIP is at xfrm_input+0x31c/0x4cc
EAX: dd839c00 EBX: 00000084 ECX: 00000000 EDX: 01000000
ESI: dd839c00 EDI: de3a0780 EBP: dec1de88 ESP: dec1de64
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process swapper (pid: 0, ti=dec1c000 task=c09c0f20 task.ti=c0992000)
Stack:
 00000000 00000000 00000002 c0ba27c0 00100000 01000000 de3a0798 c0ba27c0
 00000033 dec1de98 c0786848 00000000 de3a0780 dec1dea4 c0786868 00000000
 dec1debc c074ee56 e1da6b8c de3a0780 c074ed44 de3a07a8 dec1decc c074ef32
Call Trace:
 [] xfrm4_rcv_encap+0x22/0x27
 [] xfrm4_rcv+0x1b/0x1d
 [] ip_local_deliver_finish+0x112/0x1b1
 [] ? ip_local_deliver_finish+0x0/0x1b1
 [] NF_HOOK.clone.1+0x3d/0x44
 [] ip_local_deliver+0x3e/0x44
 [] ? ip_local_deliver_finish+0x0/0x1b1
 [] ip_rcv_finish+0x30a/0x332
 [] ? ip_rcv_finish+0x0/0x332
 [] NF_HOOK.clone.1+0x3d/0x44
 [] ip_rcv+0x20b/0x247
 [] ? ip_rcv_finish+0x0/0x332
 [] __netif_receive_skb+0x373/0x399
 [] netif_receive_skb+0x4b/0x51
 [] cp_rx_poll+0x210/0x2c4 [8139cp]
 [] net_rx_action+0x9a/0x17d
 [] __do_softirq+0xa1/0x149
 [] ? __do_softirq+0x0/0x149

Signed-off-by: Wei Yongjun 
Signed-off-by: David S. Miller