linux-toradex.git/net/xfrm/xfrm_input.c, branch v3.4-rc2

xfrm: Perform a replay check after return from async codepaths

2011-09-21T19:20:57+00:00

When asyncronous crypto algorithms are used, there might be many
packets that passed the xfrm replay check, but the replay advance
function is not called yet for these packets. So the replay check
function would accept a replay of all of these packets. Also the
system might crash if there are more packets in async processing
than the size of the anti replay window, because the replay advance
function would try to update the replay window beyond the bounds.

This pach adds a second replay check after resuming from the async
processing to fix these issues.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: Move the test on replay window size into the replay check functions

2011-03-29T06:34:51+00:00

As it is, the replay check is just performed if the replay window of the
legacy implementation is nonzero. So we move the test on a nonzero replay
window inside the replay check functions to be sure we are testing for the
right implementation.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: Force a dst refcount before entering the xfrm type handlers

2011-03-28T00:55:01+00:00

Crypto requests might return asynchronous. In this case we leave
the rcu protected region, so force a refcount on the skb's
destination entry before we enter the xfrm type input/output
handlers.

This fixes a crash when a route is deleted whilst sending IPsec
data that is transformed by an asynchronous algorithm.

Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

xfrm: Add support for IPsec extended sequence numbers

2011-03-14T03:22:31+00:00

This patch adds support for IPsec extended sequence numbers (esn)
as defined in RFC 4303. The bits to manage the anti-replay window
are based on a patch from Alex Badea.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: Move IPsec replay detection functions to a separate file

2011-03-14T03:22:30+00:00

To support multiple versions of replay detection, we move the replay
detection functions to a separate file and make them accessible
via function pointers contained in the struct xfrm_replay.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: Use separate low and high order bits of the sequence numbers in xfrm_skb_cb

2011-03-14T03:22:28+00:00

To support IPsec extended sequence numbers, we split the
output sequence numbers of xfrm_skb_cb in low and high order 32 bits
and we add the high order 32 bits to the input sequence numbers.
All users are updated accordingly.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: SA lookups signature with mark

2010-02-23T00:20:22+00:00

pass mark to all SA lookups to prepare them for when we add code
to have them search.

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

net: skb->dst accessors

2009-06-03T09:51:04+00:00

Define three accessors to get/set dst attached to a skb

struct dst_entry *skb_dst(const struct sk_buff *skb)

void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)

void skb_dst_drop(struct sk_buff *skb)
This one should replace occurrences of :
dst_release(skb->dst)
skb->dst = NULL;

Delete skb->dst field

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Revert "xfrm: Accept ESP packets regardless of UDP encapsulation mode"

2008-12-19T06:27:37+00:00

This reverts commit e061b165c7f4ec5e2e160d990b49011b5b6e5c6a.

Signed-off-by: David S. Miller

xfrm: Accept ESP packets regardless of UDP encapsulation mode

2008-12-04T23:40:17+00:00

From: Martin Willi 

An IPsec node speaking IKEv2 MUST accept incoming UDP encapsulated
ESP packets, even if no NAT situation is detected. This is important
if MOBIKE is in use. Some implementation keep the encapsulation
mode if they move out of a NAT situation.

Signed-off-by: David S. Miller