linux-toradex.git/net/ipv4/esp4.c, branch v2.6.28

ipsec: Interfamily IPSec BEET

2008-08-06T09:39:30+00:00

Here's a revised version, based on Herbert's comments, of a fix for
the ipv6-inner, ipv4-outer interfamily ipsec beet mode. It fixes the
network header adjustment in interfamily, and doesn't reserve space
for the pseudo header anymore when we have ipv6 as the inner family.

Signed-off-by: Joakim Koskela 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

[ESP]: Ensure IV is in linear part of the skb to avoid BUG() due to OOB access

2008-03-27T23:08:03+00:00

ESP does not account for the IV size when calling pskb_may_pull() to
ensure everything it accesses directly is within the linear part of a
potential fragment. This results in a BUG() being triggered when the
both the IPv4 and IPv6 ESP stack is fed with an skb where the first
fragment ends between the end of the esp header and the end of the IV.

This bug was found by Dirk Nehring  .

Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

[IPV4]: esp_output() misannotations

2008-03-18T05:50:23+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller

[IPSEC]: Fix bogus usage of u64 on input sequence number

2008-02-13T06:50:35+00:00

Al Viro spotted a bogus use of u64 on the input sequence number which
is big-endian.  This patch fixes it by giving the input sequence number
its own member in the xfrm_skb_cb structure.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[XFRM]: constify 'struct xfrm_type'

2008-02-01T03:27:20+00:00

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

[IPSEC]: Add support for combined mode algorithms

2008-02-01T03:27:03+00:00

This patch adds support for combined mode algorithms with GCM being
the first algorithm supported.

Combined mode algorithms can be added through the xfrm_user interface
using the new algorithm payload type XFRMA_ALG_AEAD.  Each algorithms
is identified by its name and the ICV length.

For the purposes of matching algorithms in xfrm_tmpl structures,
combined mode algorithms occupy the same name space as encryption
algorithms.  This is in line with how they are negotiated using IKE.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[IPSEC]: Use crypto_aead and authenc in ESP

2008-02-01T03:27:02+00:00

This patch converts ESP to use the crypto_aead interface and in particular
the authenc algorithm.  This lays the foundations for future support of
combined mode algorithms.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[IPSEC]: Move all calls to xfrm_audit_state_icvfail to xfrm_input

2008-01-28T23:00:10+00:00

Let's nip the code duplication in the bud :)

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[XFRM]: RFC4303 compliant auditing

2008-01-28T23:00:01+00:00

This patch adds a number of new IPsec audit events to meet the auditing
requirements of RFC4303.  This includes audit hooks for the following events:

 * Could not find a valid SA [sections 2.1, 3.4.2]
   . xfrm_audit_state_notfound()
   . xfrm_audit_state_notfound_simple()

 * Sequence number overflow [section 3.3.3]
   . xfrm_audit_state_replay_overflow()

 * Replayed packet [section 3.4.3]
   . xfrm_audit_state_replay()

 * Integrity check failure [sections 3.4.4.1, 3.4.4.2]
   . xfrm_audit_state_icvfail()

While RFC4304 deals only with ESP most of the changes in this patch apply to
IPsec in general, i.e. both AH and ESP.  The one case, integrity check
failure, where ESP specific code had to be modified the same was done to the
AH code for the sake of consistency.

Signed-off-by: Paul Moore 
Acked-by: James Morris 
Signed-off-by: David S. Miller

[IPSEC]: Move state lock into x->type->input

2008-01-28T22:53:52+00:00

This patch releases the lock on the state before calling
x->type->input.  It also adds the lock to the spots where they're
currently needed.

Most of those places (all except mip6) are expected to disappear with
async crypto.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller