linux-toradex.git/net/ipv6/xfrm6_input.c, branch v3.4.30 Linux kernel for Apalis and Colibri modules netfilter: ipv6: use NFPROTO values for NF_HOOK invocation 2010-03-25T15:00:49+00:00 Jan Engelhardt jengelh@medozas.de 2010-03-23T03:09:07+00:00 b2e0b385d77069031edb957839aaaa8441b47287 The semantic patch that was used: // <smpl> @@ @@ (NF_HOOK |NF_HOOK_THRESH |nf_hook )( -PF_INET6, +NFPROTO_IPV6, ...) // </smpl> Signed-off-by: Jan Engelhardt <jengelh@medozas.de> 
The semantic patch that was used:
// <smpl>
@@
@@
(NF_HOOK
|NF_HOOK_THRESH
|nf_hook
)(
-PF_INET6,
+NFPROTO_IPV6,
 ...)
// </smpl>

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
xfrm: SA lookups signature with mark 2010-02-23T00:20:22+00:00 Jamal Hadi Salim hadi@cyberus.ca 2010-02-23T00:20:22+00:00 bd55775c8dd656fc69b3a42a1c4ab32abb7e8af9 pass mark to all SA lookups to prepare them for when we add code to have them search. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net> 
pass mark to all SA lookups to prepare them for when we add code
to have them search.

Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
netns xfrm: per-netns MIBs 2008-11-26T01:59:52+00:00 Alexey Dobriyan adobriyan@gmail.com 2008-11-26T01:59:52+00:00 59c9940ed0ef026673cac52f2eaed77af7d486da Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
netns xfrm: state lookup in netns 2008-11-26T01:30:50+00:00 Alexey Dobriyan adobriyan@gmail.com 2008-11-26T01:30:50+00:00 221df1ed33c9284fc7a6f6e47ca7f8d5f3665d43 Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[XFRM] IPV6: Optimize xfrm6_input_addr(). 2008-03-25T01:23:56+00:00 YOSHIFUJI Hideaki yoshfuji@linux-ipv6.org 2008-02-19T08:24:33+00:00 a002c6fd714b1710aaf64e26db3f3f18bf8e8384 | % size old/net/ipv6/xfrm6_input.o new/net/ipv6/xfrm6_input.o | text data bss dec hex filename | 1026 0 0 1026 402 old/net/ipv6/xfrm6_input.o | 947 0 0 947 3b3 new/net/ipv6/xfrm6_input.o Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> 
| % size old/net/ipv6/xfrm6_input.o new/net/ipv6/xfrm6_input.o
|    text	   data	    bss	    dec	    hex	filename
|    1026	      0	      0	   1026	    402	old/net/ipv6/xfrm6_input.o
|     947	      0	      0	    947	    3b3	new/net/ipv6/xfrm6_input.o

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
[IPSEC]: Fix transport-mode async resume on intput without netfilter 2008-01-28T23:00:10+00:00 Herbert Xu herbert@gondor.apana.org.au 2007-12-31T05:10:14+00:00 0883ae0e5599656b5f3b0e9ce474e01dee7dfee4 When netfilter is off the transport-mode async resumption doesn't work because we don't push back the IP header. This patch fixes that by moving most of the code outside of ifdef NETFILTER since the only part that's not common is the short-circuit in the protocol handler. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 
When netfilter is off the transport-mode async resumption doesn't work
because we don't push back the IP header.  This patch fixes that by
moving most of the code outside of ifdef NETFILTER since the only part
that's not common is the short-circuit in the protocol handler.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[XFRM]: RFC4303 compliant auditing 2008-01-28T23:00:01+00:00 Paul Moore paul.moore@hp.com 2007-12-21T22:58:11+00:00 afeb14b49098ba7a51c96e083a4105a0301f94c4 This patch adds a number of new IPsec audit events to meet the auditing requirements of RFC4303. This includes audit hooks for the following events: * Could not find a valid SA [sections 2.1, 3.4.2] . xfrm_audit_state_notfound() . xfrm_audit_state_notfound_simple() * Sequence number overflow [section 3.3.3] . xfrm_audit_state_replay_overflow() * Replayed packet [section 3.4.3] . xfrm_audit_state_replay() * Integrity check failure [sections 3.4.4.1, 3.4.4.2] . xfrm_audit_state_icvfail() While RFC4304 deals only with ESP most of the changes in this patch apply to IPsec in general, i.e. both AH and ESP. The one case, integrity check failure, where ESP specific code had to be modified the same was done to the AH code for the sake of consistency. Signed-off-by: Paul Moore <paul.moore@hp.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: David S. Miller <davem@davemloft.net> 
This patch adds a number of new IPsec audit events to meet the auditing
requirements of RFC4303.  This includes audit hooks for the following events:

 * Could not find a valid SA [sections 2.1, 3.4.2]
   . xfrm_audit_state_notfound()
   . xfrm_audit_state_notfound_simple()

 * Sequence number overflow [section 3.3.3]
   . xfrm_audit_state_replay_overflow()

 * Replayed packet [section 3.4.3]
   . xfrm_audit_state_replay()

 * Integrity check failure [sections 3.4.4.1, 3.4.4.2]
   . xfrm_audit_state_icvfail()

While RFC4304 deals only with ESP most of the changes in this patch apply to
IPsec in general, i.e. both AH and ESP.  The one case, integrity check
failure, where ESP specific code had to be modified the same was done to the
AH code for the sake of consistency.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
[XFRM]: Support to increment packet dropping statistics. 2008-01-28T22:59:39+00:00 Masahide NAKAMURA nakam@linux-ipv6.org 2007-12-21T04:43:36+00:00 0aa647746e5602e608220c10e51f49709a030f5d Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net> 
Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
[XFRM] MIPv6: Fix to input RO state correctly. 2008-01-28T22:59:37+00:00 Masahide NAKAMURA nakam@linux-ipv6.org 2007-12-21T04:41:57+00:00 9473e1f631de339c50bde1e3bd09e1045fe90fd5 Disable spin_lock during xfrm_type.input() function. Follow design as IPsec inbound does. Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net> 
Disable spin_lock during xfrm_type.input() function.
Follow design as IPsec inbound does.

Signed-off-by: Masahide NAKAMURA <nakam@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
[IPSEC]: Use the correct family for input state lookup 2008-01-28T22:55:49+00:00 Herbert Xu herbert@gondor.apana.org.au 2007-12-04T06:54:12+00:00 2fcb45b6b87914f072314e5b5d9c196f45984683 When merging the input paths of IPsec I accidentally left a hard-coded AF_INET for the state lookup call. This broke IPv6 obviously. This patch fixes by getting the input callers to specify the family through skb->cb. Credit goes to Kazunori Miyazawa for diagnosing this and providing an initial patch. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> 
When merging the input paths of IPsec I accidentally left a hard-coded
AF_INET for the state lookup call.  This broke IPv6 obviously.  This
patch fixes by getting the input callers to specify the family through
skb->cb.

Credit goes to Kazunori Miyazawa for diagnosing this and providing an
initial patch.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>