linux-toradex.git/net/ipv6/xfrm6_output.c, branch v3.4.41

xfrm6: remove unneeded NULL check in __xfrm6_output()

2012-02-01T07:52:48+00:00

We don't check for NULL consistently in __xfrm6_output().  If "x" were
NULL here it would lead to an OOPs later.  I asked Steffen Klassert
about this and he suggested that we remove the NULL check.

On 10/29/11, Steffen Klassert  wrote:
>> net/ipv6/xfrm6_output.c
>>    148
>>    149		if ((x && x->props.mode == XFRM_MODE_TUNNEL) &&
>>                           ^
>
> x can't be null here. It would be a bug if __xfrm6_output() is called
> without a xfrm_state attached to the skb. I think we can just remove
> this null check.

Cc: Steffen Klassert 
Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller

net: remove ipv6_addr_copy()

2011-11-22T21:43:32+00:00

C assignment can handle struct in6_addr copying.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

xfrm6: Don't call icmpv6_send on local error

2011-10-19T03:53:10+00:00

Calling icmpv6_send() on a local message size error leads to
an incorrect update of the path mtu. So use xfrm6_local_rxpmtu()
to notify about the pmtu if the IPV6_DONTFRAG socket option is
set on an udp or raw socket, according RFC 3542 and use
ipv6_local_error() otherwise.

Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

xfrm: Assign the inner mode output function to the dst entry

2011-05-10T22:03:34+00:00

As it is, we assign the outer modes output function to the dst entry
when we create the xfrm bundle. This leads to two problems on interfamily
scenarios. We might insert ipv4 packets into ip6_fragment when called
from xfrm6_output. The system crashes if we try to fragment an ipv4
packet with ip6_fragment. This issue was introduced with git commit
ad0081e4 (ipv6: Fragment locally generated tunnel-mode IPSec6 packets
as needed). The second issue is, that we might insert ipv4 packets in
netfilter6 and vice versa on interfamily scenarios.

With this patch we assign the inner mode output function to the dst entry
when we create the xfrm bundle. So xfrm4_output/xfrm6_output from the inner
mode is used and the right fragmentation and netfilter functions are called.
We switch then to outer mode with the output_finish functions.

Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.

2010-12-20T04:22:23+00:00

This patch modifies IPsec6 to fragment IPv6 packets that are
locally generated as needed.

This version of the patch only fragments in tunnel mode, so that fragment
headers will not be obscured by ESP in transport mode.

Signed-off-by: David L Stevens 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

netfilter: ipv6: use NFPROTO values for NF_HOOK invocation

2010-03-25T15:00:49+00:00

The semantic patch that was used:
// 
@@
@@
(NF_HOOK
|NF_HOOK_THRESH
|nf_hook
)(
-PF_INET6,
+NFPROTO_IPV6,
 ...)
// 

Signed-off-by: Jan Engelhardt

ipv6: drop unused "dev" arg of icmpv6_send()

2010-02-18T22:30:17+00:00

Dunno, what was the idea, it wasn't used for a long time.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

net: skb->dst accessors

2009-06-03T09:51:04+00:00

Define three accessors to get/set dst attached to a skb

struct dst_entry *skb_dst(const struct sk_buff *skb)

void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)

void skb_dst_drop(struct sk_buff *skb)
This one should replace occurrences of :
dst_release(skb->dst)
skb->dst = NULL;

Delete skb->dst field

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

xfrm: fix fragmentation on inter family tunnels

2009-04-07T00:07:59+00:00

If an ipv4 packet (not locally generated with IP_DF flag not set) bigger
than mtu size is supposed to go via a xfrm ipv6 tunnel, the packetsize
check in xfrm4_tunnel_check_size() is omited and ipv6 drops the packet
without sending a notice to the original sender of the ipv4 packet.

Another issue is that ipv4 connection tracking does reassembling of
incomming fragmented packets. If such a reassembled packet is supposed to
go via a xfrm ipv6 tunnel it will be droped, even if the original sender
did proper fragmentation.

According to RFC 2473 (section 7) tunnel ipv6 packets resulting from the
encapsulation of an original packet are considered as locally generated
packets. If such a packet passed the checks in xfrm{4,6}_tunnel_check_size()
fragmentation is allowed according to RFC 2473 (section 7.1/7.2).

This patch sets skb->local_df in xfrm6_prepare_output() to achieve
fragmentation in this case.

Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

[IPSEC]: Fix inter address family IPsec tunnel handling.

2008-03-24T21:51:51+00:00

Signed-off-by: Kazunori MIYAZAWA 
Signed-off-by: David S. Miller