linux-toradex.git/net/ipv6/xfrm6_mode_tunnel.c, branch v4.9.97

ipv6: update skb->csum when CE mark is propagated

2016-01-15T20:07:23+00:00

When a tunnel decapsulates the outer header, it has to comply
with RFC 6080 and eventually propagate CE mark into inner header.

It turns out IP6_ECN_set_ce() does not correctly update skb->csum
for CHECKSUM_COMPLETE packets, triggering infamous "hw csum failure"
messages and stack traces.

Signed-off-by: Eric Dumazet 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm6: Fix IPv6 ECN decapsulation

2015-08-11T10:41:34+00:00

Using ipv6_get_dsfield on the outer IP header implies that inner and
outer header are of the the same address family. For interfamily
tunnels, particularly 646, the code reading the DSCP field obtains the
wrong values (IHL and the upper four bits of the DSCP field).
This can cause the code to detect a congestion encoutered state in the
outer header and enable the corresponding bits in the inner header, too.

Since the DSCP field is stored in the xfrm mode common buffer
independently from the IP version of the outer header, it's safe (and
correct) to take this value from there.

Signed-off-by: Thomas Egerer 
Signed-off-by: Steffen Klassert

xfrm6: Remove xfrm_tunnel_notifier

2014-03-14T06:28:08+00:00

This was used from vti and is replaced by the IPsec protocol
multiplexer hooks. It is now unused, so remove it.

Signed-off-by: Steffen Klassert

ipv6: Add a receive path hook for vti6 in xfrm6_mode_tunnel.

2013-10-09T11:16:36+00:00

Add a receive path hook for the IPsec vritual tunnel interface.

Signed-off-by: Steffen Klassert

xfrm: allow to avoid copying DSCP during encapsulation

2013-03-06T06:02:45+00:00

By default, DSCP is copying during encapsulation.
Copying the DSCP in IPsec tunneling may be a bit dangerous because packets with
different DSCP may get reordered relative to each other in the network and then
dropped by the remote IPsec GW if the reordering becomes too big compared to the
replay window.

It is possible to avoid this copy with netfilter rules, but it's very convenient
to be able to configure it for each SA directly.

This patch adds a toogle for this purpose. By default, it's not set to maintain
backward compatibility.

Field flags in struct xfrm_usersa_info is full, hence I add a new attribute.

Signed-off-by: Nicolas Dichtel 
Signed-off-by: Steffen Klassert

ipv6: fix warning in xfrm6_mode_tunnel_input

2013-02-18T17:42:47+00:00

Should not use assignment in conditional:
 warning: suggest parentheses around assignment used as truth value [-Wparentheses]

Problem introduced by:
commit 14bbd6a565e1bcdc240d44687edb93f721cfdf99
Author: Pravin B Shelar 
Date:   Thu Feb 14 09:44:49 2013 +0000

    net: Add skb_unclone() helper function.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

net: Add skb_unclone() helper function.

2013-02-15T20:10:37+00:00

This function will be used in next GRE_GSO patch. This patch does
not change any functionality.

Signed-off-by: Pravin B Shelar 
Acked-by: Eric Dumazet

ipsec: be careful of non existing mac headers

2012-02-23T21:50:45+00:00

Niccolo Belli reported ipsec crashes in case we handle a frame without
mac header (atm in his case)

Before copying mac header, better make sure it is present.

Bugzilla reference:  https://bugzilla.kernel.org/show_bug.cgi?id=42809

Reported-by: Niccolò Belli 
Tested-by: Niccolò Belli 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: remove ipv6_addr_copy()

2011-11-22T21:43:32+00:00

C assignment can handle struct in6_addr copying.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

inet: constify ip headers and in6_addr

2011-04-22T18:04:14+00:00

Add const qualifiers to structs iphdr, ipv6hdr and in6_addr pointers
where possible, to make code intention more obvious.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller