Skip to contentSkip to conversation

STATE: Allow non IPsec protocol.

PATCH In review Masahide NAKAMURA 2 participants 2 messages Jul 29, 2006 – Aug 2, 2006

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Masahide NAKAMURA

author
#0 lore raw

PATCH 15/23 STATE: Allow non IPsec protocol.

It will be added two more transformation protocols (routing header and destination options header) by Mobile IPv6. xfrm_id_proto_match() can be handle zero as all, IPSEC_PROTO_ANY as all IPsec and otherwise as exact one.

Based on MIPL2 kernel patch.

---
 include/net/xfrm.h   |    7 +++++++
 net/xfrm/xfrm_user.c |    4 ++++
 2 files changed, 11 insertions(+), 0 deletions(-)
include/net/xfrm.h +7 -0
index 67fe834..0b8edad 100644
@@ -881,7 +881,14 @@ static inline int xfrm_state_kern(struct
 
 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
 {
+#ifdef CONFIG_XFRM_ADVANCED
+	return (!userproto || proto == userproto ||
+		(userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
+						  proto == IPPROTO_ESP ||
+						  proto == IPPROTO_COMP)));
+#else
 	return (userproto == IPSEC_PROTO_ANY || proto == userproto);
+#endif
 }
 
 /*
net/xfrm/xfrm_user.c +4 -0
index 13fe172..a91367d 100644
@@ -598,7 +598,11 @@ static int xfrm_dump_sa(struct sk_buff *
 	info.nlmsg_flags = NLM_F_MULTI;
 	info.this_idx = 0;
 	info.start_idx = cb->args[0];
+#ifdef CONFIG_XFRM_ADVANCED
+	(void) xfrm_state_walk(0, dump_one_state, &info);
+#else
 	(void) xfrm_state_walk(IPSEC_PROTO_ANY, dump_one_state, &info);
+#endif
 	cb->args[0] = info.this_idx;
 
 	return skb->len;
Signature · 1 line
1.4.1
maintainer
#1 lore raw

From: Masahide NAKAMURA <[email protected]>
Date: Sat, 29 Jul 2006 18:30:40 +0900

include/net/xfrm.h static inline int xfrm_state_kern(struct · line 892

Quoted 11 lines

static inline int xfrm_id_proto_match(u8 proto, u8 userproto) {

include/net/xfrm.h +7 -0
+#ifdef CONFIG_XFRM_ADVANCED
+	return (!userproto || proto == userproto ||
+		(userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
+						  proto == IPPROTO_ESP ||
+						  proto == IPPROTO_COMP)));
+#else
 	return (userproto == IPSEC_PROTO_ANY || proto == userproto);
+#endif
 }

Now it makes sense. All the previous patches were hard to understand without this logic being seen first.

It is another argument for removing XFRM_ADVANCED config option.