linux-toradex.git/net/ipv4/esp4.c, branch v2.6.19.2

[XFRM]: BEET mode

2006-10-04T07:31:09+00:00

This patch introduces the BEET mode (Bound End-to-End Tunnel) with as
specified by the ietf draft at the following link:

http://www.ietf.org/internet-drafts/draft-nikander-esp-beet-mode-06.txt

The patch provides only single family support (i.e. inner family =
outer family).

Signed-off-by: Diego Beltrami 
Signed-off-by: Miika Komu     
Signed-off-by: Herbert Xu     
Signed-off-by: Abhinav Pathak 
Signed-off-by: Jeff Ahrenholz 
Signed-off-by: David S. Miller

[IPSEC] esp: Defer output IV initialization to first use.

2006-09-22T22:17:35+00:00

First of all, if the xfrm_state only gets used for input
packets this entropy is a complete waste.

Secondly, it is often the case that a configuration loads
many rules (perhaps even dynamically) and they don't all
necessarily ever get used.

This get_random_bytes() call was showing up in the profiles
for xfrm_state inserts which is how I noticed this.

Signed-off-by: David S. Miller

[XFRM]: Add XFRM_MODE_xxx for future use.

2006-09-22T22:05:15+00:00

Transformation mode is used as either IPsec transport or tunnel.
It is required to add two more items, route optimization and inbound trigger
for Mobile IPv6.
Based on MIPL2 kernel patch.

This patch was also written by: Ville Nuorvala 

Signed-off-by: Masahide NAKAMURA 
Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

[IPSEC]: Use HMAC template and hash interface

2006-09-21T01:46:18+00:00

This patch converts IPsec to use the new HMAC template.  The names of
existing simple digest algorithms may still be used to refer to their
HMAC composites.

The same structure can be used by other MACs such as AES-XCBC-MAC.

This patch also switches from the digest interface to hash.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[IPSEC] ESP: Use block ciphers where applicable

2006-09-21T01:46:14+00:00

This patch converts IPSec/ESP to use the new block cipher type where
applicable.  Similar to the HMAC conversion, existing algorithm names
have been kept for compatibility.

Signed-off-by: Herbert Xu

[NET]: Conversions from kmalloc+memset to k(z|c)alloc.

2006-07-21T21:51:30+00:00

Signed-off-by: Panagiotis Issaris 
Signed-off-by: David S. Miller

Remove obsolete #include

2006-06-30T17:25:36+00:00

Signed-off-by: Jörn Engel 
Signed-off-by: Adrian Bunk

[IPSEC] proto: Move transport mode input path into xfrm_mode_transport

2006-06-18T04:28:41+00:00

Now that we have xfrm_mode objects we can move the transport mode specific
input decapsulation code into xfrm_mode_transport.  This removes duplicate
code as well as unnecessary header movement in case of tunnel mode SAs
since we will discard the original IP header immediately.

This also fixes a minor bug for transport-mode ESP where the IP payload
length is set to the correct value minus the header length (with extension
headers for IPv6).

Of course the other neat thing is that we no longer have to allocate
temporary buffers to hold the IP headers for ESP and IPComp.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[IPSEC]: Kill unused decap state argument

2006-04-01T08:52:46+00:00

This patch removes the decap_state argument from the xfrm input hook.
Previously this function allowed the input hook to share state with
the post_input hook.  The latter has since been removed.

The only purpose for it now is to check the encap type.  However, it
is easier and better to move the encap type check to the generic
xfrm_rcv function.  This allows us to get rid of the decap state
argument altogether.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[IPSEC]: Sync series - fast path

2006-03-21T03:15:29+00:00

Fast path sequence updates that will generate ipsec async
events

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller