Mobile IPv6 Platform, Take 2 (for net-2.6.19)
Subsystems (4)
cover Mobile IPv6 Platform, Take 2 (for net-2.6.19)
From: Hideaki YOSHIFUJI <[email protected]>
This is the update of the "MIPv6 CN introduction" and "MIPv6 CN" based on the MIPL2 kernel patch.
Major difference from the last reviewed patches are:
o Updates from netdev comments
- Remove CONFIG_XFRM_ADVANCED
- Make more inline functions for readability
- Reorder patch by the point of not files but features
- Use new netlink attribute message type instead of changing public structure for user-space
o New patch
- [PATCH 16/44] [XFRM] IPV6: Restrict bundle reusing
Transformation mode is used like IPsec transport or tunnel. It is required to add two more items, route optimization and inbound trigger for Mobile IPv6.
It is also available at:
git://git.skbuff.net/gitroot/yoshfuji/net-2.6.19-20060821-mip6cn-20060823
P.S.
we have another discussion about improvement of XFRM state hash. Our patches (about source address list part) will conflict with that work, but we did not take that into account so far because it was not in the tree.
PATCH 1/44 : Add XFRM_MODE_xxx for future use.
From: Masahide NAKAMURA <[email protected]>
Transformation mode is used as either IPsec transport or tunnel. It is required to add two more items, route optimization and inbound trigger for Mobile IPv6.
Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
--- include/linux/xfrm.h | 6 ++++-- include/net/xfrm.h | 2 +- net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 6 +++--- net/ipv4/ipcomp.c | 8 ++++---- net/ipv4/xfrm4_input.c | 2 +- net/ipv4/xfrm4_output.c | 4 ++-- net/ipv4/xfrm4_policy.c | 2 +- net/ipv4/xfrm4_state.c | 2 +- net/ipv4/xfrm4_tunnel.c | 2 +- net/ipv6/ah6.c | 2 +- net/ipv6/esp6.c | 4 ++-- net/ipv6/ipcomp6.c | 6 +++--- net/ipv6/xfrm6_input.c | 2 +- net/ipv6/xfrm6_output.c | 4 ++-- net/ipv6/xfrm6_policy.c | 2 +- net/ipv6/xfrm6_state.c | 2 +- net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 6 +++--- net/xfrm/xfrm_policy.c | 11 ++++++----- net/xfrm/xfrm_user.c | 4 ++-- 21 files changed, 42 insertions(+), 39 deletions(-)
include/linux/xfrm.h +4 -2
@@ -120,7 +120,9 @@ enum#define XFRM_MODE_TRANSPORT 0#define XFRM_MODE_TUNNEL 1 -#define XFRM_MODE_MAX 2 +#define XFRM_MODE_ROUTEOPTIMIZATION 2 +#define XFRM_MODE_IN_TRIGGER 3 +#define XFRM_MODE_MAX 4/* Netlink configuration messages. */ enum {
@@ -247,7 +249,7 @@ struct xfrm_usersa_info {__u32 seq;__u32 reqid;__u16 family; -__u8 mode;/* 0=transport,1=tunnel */ +__u8 mode;/* XFRM_MODE_xxx */ __u8 replay_window;__u8 flags;#define XFRM_STATE_NOECN 1
include/net/xfrm.h +1 -1
@@ -299,7 +299,7 @@ struct xfrm_tmpl__u32 reqid; -/* Mode: transport/tunnel */ +/* Mode: transport, tunnel etc. */ __u8 mode;/* Sharing mode: unique, this session only, this user only etc. */
net/ipv4/ah4.c +1 -1
@@ -253,7 +253,7 @@ static int ah_init_state(struct xfrm_sta goto error; x->props.header_len =XFRM_ALIGN8 (sizeof (struct ip_auth_hdr ) + ahp->icv_trunc_len); -if (x->props.mode) +if (x->props.mode ==XFRM_MODE_TUNNEL ) x->props.header_len +=sizeof (struct iphdr ); x->data = ahp;
net/ipv4/esp4.c +3 -3
@@ -237,7 +237,7 @@ static int esp_input(struct xfrm_state ** as per draft-ietf-ipsec-udp-encaps-06, * section 3.1.2 */ -if (!x->props.mode) +if (x->props.mode ==XFRM_MODE_TRANSPORT ) skb->ip_summed =CHECKSUM_UNNECESSARY ; }
@@ -256,7 +256,7 @@ static u32 esp4_get_max_size(struct xfrmstruct esp_data *esp = x->data;u32 blksize =ALIGN (crypto_tfm_alg_blocksize (esp->conf.tfm),4 ); -if (x->props.mode) { +if (x->props.mode ==XFRM_MODE_TUNNEL ) { mtu =ALIGN (mtu +2 , blksize); }else {/* The worst case. */
@@ -368,7 +368,7 @@ static int esp_init_state(struct xfrm_stif (crypto_cipher_setkey (esp->conf.tfm, esp->conf.key, esp->conf.key_len)) goto error; x->props.header_len =sizeof (struct ip_esp_hdr ) + esp->conf.ivlen; -if (x->props.mode) +if (x->props.mode ==XFRM_MODE_TUNNEL ) x->props.header_len +=sizeof (struct iphdr );if (x->encap) {struct xfrm_encap_tmpl *encap = x->encap;
net/ipv4/ipcomp.c +4 -4
@@ -176,7 +176,7 @@ static int ipcomp_output(struct xfrm_stareturn 0 ; out_ok: -if (x->props.mode) +if (x->props.mode ==XFRM_MODE_TUNNEL )ip_send_check (iph);return 0 ; }
@@ -216,7 +216,7 @@ static struct xfrm_state *ipcomp_tunnel_ t->id.daddr.a4 = x->id.daddr.a4;memcpy (&t->sel, &x->sel,sizeof (t->sel)); t->props.family =AF_INET ; - t->props.mode =1 ; + t->props.mode =XFRM_MODE_TUNNEL ; t->props.saddr.a4 = x->props.saddr.a4; t->props.flags = x->props.flags;
@@ -415,7 +415,7 @@ static int ipcomp_init_state(struct xfrm goto out; x->props.header_len =0 ; -if (x->props.mode) +if (x->props.mode ==XFRM_MODE_TUNNEL ) x->props.header_len +=sizeof (struct iphdr );mutex_lock (&ipcomp_resource_mutex);
@@ -427,7 +427,7 @@ static int ipcomp_init_state(struct xfrm goto error;mutex_unlock (&ipcomp_resource_mutex); -if (x->props.mode) { +if (x->props.mode ==XFRM_MODE_TUNNEL ) { err =ipcomp_tunnel_attach (x);if (err) goto error_tunnel;
net/ipv4/xfrm4_input.c +1 -1
@@ -106,7 +106,7 @@ int xfrm4_rcv_encap(struct sk_buff *skb,if (x->mode->input (x, skb)) goto drop; -if (x->props.mode) { +if (x->props.mode ==XFRM_MODE_TUNNEL ) { decaps =1 ;break ; }
net/ipv4/xfrm4_output.c +2 -2
@@ -54,7 +54,7 @@ static int xfrm4_output_one(struct sk_bu goto error_nolock; } -if (x->props.mode) { +if (x->props.mode ==XFRM_MODE_TUNNEL ) { err =xfrm4_tunnel_check_size (skb);if (err) goto error_nolock;
@@ -85,7 +85,7 @@ static int xfrm4_output_one(struct sk_bu } dst = skb->dst; x = dst->xfrm; - }while (x && !x->props.mode); + }while (x && (x->props.mode !=XFRM_MODE_TUNNEL ));IPCB (skb)->flags |=IPSKB_XFRM_TRANSFORMED ; err =0 ;
net/ipv4/xfrm4_policy.c +1 -1
@@ -96,7 +96,7 @@ __xfrm4_bundle_create(struct xfrm_policy dst1->next = dst_prev; dst_prev = dst1; -if (xfrm[i]->props.mode) { +if (xfrm[i]->props.mode !=XFRM_MODE_TRANSPORT ) { remote = xfrm[i]->id.daddr.a4; local = xfrm[i]->props.saddr.a4; tunnel =1 ;
net/ipv4/xfrm4_state.c +1 -1
@@ -42,7 +42,7 @@ __xfrm4_init_tempsel(struct xfrm_state * x->props.saddr = tmpl->saddr;if (x->props.saddr.a4 ==0 ) x->props.saddr.a4 = saddr->a4; -if (tmpl->mode && x->props.saddr.a4 ==0 ) { +if (tmpl->mode ==XFRM_MODE_TUNNEL && x->props.saddr.a4 ==0 ) {struct rtable *rt;struct flowi fl_tunnel = { .nl_u = {
net/ipv4/xfrm4_tunnel.c +1 -1
@@ -28,7 +28,7 @@ static int ipip_xfrm_rcv(struct xfrm_stastatic int ipip_init_state (struct xfrm_state *x) { -if (!x->props.mode) +if (x->props.mode !=XFRM_MODE_TUNNEL )return -EINVAL ;if (x->encap)
net/ipv6/ah6.c +1 -1
@@ -387,7 +387,7 @@ static int ah6_init_state(struct xfrm_st goto error; x->props.header_len =XFRM_ALIGN8 (sizeof (struct ipv6_auth_hdr ) + ahp->icv_trunc_len); -if (x->props.mode) +if (x->props.mode ==XFRM_MODE_TUNNEL ) x->props.header_len +=sizeof (struct ipv6hdr ); x->data = ahp;
net/ipv6/esp6.c +2 -2
@@ -227,7 +227,7 @@ static u32 esp6_get_max_size(struct xfrmstruct esp_data *esp = x->data;u32 blksize =ALIGN (crypto_tfm_alg_blocksize (esp->conf.tfm),4 ); -if (x->props.mode) { +if (x->props.mode ==XFRM_MODE_TUNNEL ) { mtu =ALIGN (mtu +2 , blksize); }else {/* The worst case. */
@@ -344,7 +344,7 @@ static int esp6_init_state(struct xfrm_sif (crypto_cipher_setkey (esp->conf.tfm, esp->conf.key, esp->conf.key_len)) goto error; x->props.header_len =sizeof (struct ipv6_esp_hdr ) + esp->conf.ivlen; -if (x->props.mode) +if (x->props.mode ==XFRM_MODE_TUNNEL ) x->props.header_len +=sizeof (struct ipv6hdr ); x->data = esp;return 0 ;
net/ipv6/ipcomp6.c +3 -3
@@ -212,7 +212,7 @@ static struct xfrm_state *ipcomp6_tunnelmemcpy (t->id.daddr.a6, x->id.daddr.a6,sizeof (struct in6_addr ));memcpy (&t->sel, &x->sel,sizeof (t->sel)); t->props.family =AF_INET6 ; - t->props.mode =1 ; + t->props.mode =XFRM_MODE_TUNNEL ;memcpy (t->props.saddr.a6, x->props.saddr.a6,sizeof (struct in6_addr ));if (xfrm_init_state (t))
@@ -416,7 +416,7 @@ static int ipcomp6_init_state(struct xfr goto out; x->props.header_len =0 ; -if (x->props.mode) +if (x->props.mode ==XFRM_MODE_TUNNEL ) x->props.header_len +=sizeof (struct ipv6hdr );mutex_lock (&ipcomp6_resource_mutex);
@@ -428,7 +428,7 @@ static int ipcomp6_init_state(struct xfr goto error;mutex_unlock (&ipcomp6_resource_mutex); -if (x->props.mode) { +if (x->props.mode ==XFRM_MODE_TUNNEL ) { err =ipcomp6_tunnel_attach (x);if (err) goto error_tunnel;
net/ipv6/xfrm6_input.c +1 -1
@@ -72,7 +72,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, uif (x->mode->input (x, skb)) goto drop; -if (x->props.mode) {/* XXX */ +if (x->props.mode ==XFRM_MODE_TUNNEL ) {/* XXX */ decaps =1 ;break ; }
net/ipv6/xfrm6_output.c +2 -2
@@ -47,7 +47,7 @@ static int xfrm6_output_one(struct sk_bu goto error_nolock; } -if (x->props.mode) { +if (x->props.mode ==XFRM_MODE_TUNNEL ) { err =xfrm6_tunnel_check_size (skb);if (err) goto error_nolock;
@@ -80,7 +80,7 @@ static int xfrm6_output_one(struct sk_bu } dst = skb->dst; x = dst->xfrm; - }while (x && !x->props.mode); + }while (x && (x->props.mode !=XFRM_MODE_TUNNEL ));IP6CB (skb)->flags |=IP6SKB_XFRM_TRANSFORMED ; err =0 ;
net/ipv6/xfrm6_policy.c +1 -1
@@ -114,7 +114,7 @@ __xfrm6_bundle_create(struct xfrm_policy dst1->next = dst_prev; dst_prev = dst1; -if (xfrm[i]->props.mode) { +if (xfrm[i]->props.mode !=XFRM_MODE_TRANSPORT ) { remote = (struct in6_addr *)&xfrm[i]->id.daddr; local = (struct in6_addr *)&xfrm[i]->props.saddr; tunnel =1 ;
net/ipv6/xfrm6_state.c +1 -1
@@ -42,7 +42,7 @@ __xfrm6_init_tempsel(struct xfrm_state *memcpy (&x->props.saddr, &tmpl->saddr,sizeof (x->props.saddr));if (ipv6_addr_any ((struct in6_addr *)&x->props.saddr))memcpy (&x->props.saddr, saddr,sizeof (x->props.saddr)); -if (tmpl->mode &&ipv6_addr_any ((struct in6_addr *)&x->props.saddr)) { +if (tmpl->mode ==XFRM_MODE_TUNNEL &&ipv6_addr_any ((struct in6_addr *)&x->props.saddr)) {struct rt6_info *rt;struct flowi fl_tunnel = { .nl_u = {
net/ipv6/xfrm6_tunnel.c +1 -1
@@ -307,7 +307,7 @@ static int xfrm6_tunnel_err(struct sk_bustatic int xfrm6_tunnel_init_state (struct xfrm_state *x) { -if (!x->props.mode) +if (x->props.mode !=XFRM_MODE_TUNNEL )return -EINVAL ;if (x->encap)
net/key/af_key.c +3 -3
@@ -1765,7 +1765,7 @@ #endif }/* addresses present only in tunnel mode */ -if (t->mode) { +if (t->mode ==XFRM_MODE_TUNNEL ) {switch (xp->family) {case AF_INET : sin = (void *)(rq+1 );
@@ -1997,7 +1997,7 @@ #endifint req_size; req_size =sizeof (struct sadb_x_ipsecrequest ); -if (t->mode) +if (t->mode ==XFRM_MODE_TUNNEL ) req_size +=2 *socklen;else size -=2 *socklen;
@@ -2013,7 +2013,7 @@ #endifif (t->optional) rq->sadb_x_ipsecrequest_level =IPSEC_LEVEL_USE ; rq->sadb_x_ipsecrequest_reqid = t->reqid; -if (t->mode) { +if (t->mode ==XFRM_MODE_TUNNEL ) {switch (xp->family) {case AF_INET : sin = (void *)(rq+1 );
net/xfrm/xfrm_policy.c +6 -5
@@ -779,7 +779,7 @@ xfrm_tmpl_resolve(struct xfrm_policy *poxfrm_address_t *local = saddr;struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i]; -if (tmpl->mode) { +if (tmpl->mode ==XFRM_MODE_TUNNEL ) { remote = &tmpl->id.daddr; local = &tmpl->saddr; }
@@ -1005,7 +1005,8 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, st (x->props.reqid == tmpl->reqid || !tmpl->reqid) && x->props.mode == tmpl->mode && (tmpl->aalgos & (1 <<x->props.aalgo)) && - !(x->props.mode &&xfrm_state_addr_cmp (tmpl, x, family)); + !(x->props.mode !=XFRM_MODE_TRANSPORT && +xfrm_state_addr_cmp (tmpl, x, family)); } static inline int
@@ -1015,14 +1016,14 @@ xfrm_policy_ok(struct xfrm_tmpl *tmpl, sint idx = start;if (tmpl->optional) { -if (!tmpl->mode) +if (tmpl->mode ==XFRM_MODE_TRANSPORT )return start; }else start =-1 ;for (; idx < sp->len; idx++) {if (xfrm_state_ok (tmpl, sp->xvec[idx], family))return ++idx; -if (sp->xvec[idx]->props.mode) +if (sp->xvec[idx]->props.mode !=XFRM_MODE_TRANSPORT )break ; }return start;
@@ -1047,7 +1048,7 @@ EXPORT_SYMBOL(xfrm_decode_session);static inline int secpath_has_tunnel (struct sec_path *sp,int k) {for (; k < sp->len; k++) { -if (sp->xvec[k]->props.mode) +if (sp->xvec[k]->props.mode !=XFRM_MODE_TRANSPORT )return 1 ; }
net/xfrm/xfrm_user.c +2 -2
@@ -173,8 +173,8 @@ #endif err = -EINVAL ;switch (p->mode) { -case 0 : -case 1 : +case XFRM_MODE_TRANSPORT : +case XFRM_MODE_TUNNEL :break ;default :
Signature · 1 line
1.4.0
PATCH 2/44 : Introduce a helper to compare id protocol.
From: Masahide NAKAMURA <[email protected]>
Put the helper to header for future use.
Based on MIPL2 kernel patch.
--- include/net/xfrm.h | 6 ++++++ net/xfrm/xfrm_state.c | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-)
include/net/xfrm.h +6 -0
@@ -10,6 +10,7 @@ #include <linux/skbuff.h>#include <linux/socket.h> #include <linux/crypto.h> #include <linux/pfkeyv2.h> +#include <linux/ipsec.h> #include <linux/in6.h> #include <linux/mutex.h>
@@ -836,6 +837,11 @@ static inline int xfrm_state_kern(structreturn atomic_read (&x->tunnel_users); } +static inline int xfrm_id_proto_match (u8 proto,u8 userproto) +{ +return (userproto ==IPSEC_PROTO_ANY || proto == userproto); +} +/* * xfrm algorithm information */
net/xfrm/xfrm_state.c +3 -3
@@ -294,7 +294,7 @@ void xfrm_state_flush(u8 proto) restart:list_for_each_entry (x, xfrm_state_bydst+i, bydst) {if (!xfrm_state_kern (x) && - (proto ==IPSEC_PROTO_ANY || x->id.proto == proto)) { +xfrm_id_proto_match (x->id.proto, proto)) {xfrm_state_hold (x);spin_unlock_bh (&xfrm_state_lock);
@@ -772,7 +772,7 @@ int xfrm_state_walk(u8 proto, int (*funcspin_lock_bh (&xfrm_state_lock);for (i =0 ; i <XFRM_DST_HSIZE ; i++) {list_for_each_entry (x, xfrm_state_bydst+i, bydst) { -if (proto ==IPSEC_PROTO_ANY || x->id.proto == proto) +if (xfrm_id_proto_match (x->id.proto, proto)) count++; } }
@@ -783,7 +783,7 @@ int xfrm_state_walk(u8 proto, int (*funcfor (i =0 ; i <XFRM_DST_HSIZE ; i++) {list_for_each_entry (x, xfrm_state_bydst+i, bydst) { -if (proto !=IPSEC_PROTO_ANY && x->id.proto != proto) +if (!xfrm_id_proto_match (x->id.proto, proto))continue ; err =func (x, --count, data);if (err)
Signature · 1 line
1.4.0
PATCH 3/44 STATE: Allow non IPsec protocol.
From: Masahide NAKAMURA <[email protected]>
It will be added two more transformation protocols (routing header and destination options header) for Mobile IPv6. xfrm_id_proto_match() can be handle zero as all, IPSEC_PROTO_ANY as all IPsec and otherwise as exact one.
Based on MIPL2 kernel patch.
--- include/net/xfrm.h | 5 ++++- net/xfrm/xfrm_user.c | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-)
include/net/xfrm.h +4 -1
@@ -839,7 +839,10 @@ static inline int xfrm_state_kern(structstatic inline int xfrm_id_proto_match (u8 proto,u8 userproto) { -return (userproto ==IPSEC_PROTO_ANY || proto == userproto); +return (!userproto || proto == userproto || + (userproto ==IPSEC_PROTO_ANY && (proto ==IPPROTO_AH || + proto ==IPPROTO_ESP || + proto ==IPPROTO_COMP ))); }/*
net/xfrm/xfrm_user.c +1 -1
@@ -540,7 +540,7 @@ static int xfrm_dump_sa(struct sk_buff * info.nlmsg_flags =NLM_F_MULTI ; info.this_idx =0 ; info.start_idx = cb->args[0 ]; - (void )xfrm_state_walk (IPSEC_PROTO_ANY , dump_one_state, &info); + (void )xfrm_state_walk (0 , dump_one_state, &info); cb->args[0 ] = info.this_idx;return skb->len;
Signature · 1 line
1.4.0
PATCH 4/44 : Expand XFRM_MAX_DEPTH for route optimization.
From: Masahide NAKAMURA <[email protected]>
XFRM_MAX_DEPTH is a limit of transformation states to be applied to the same flow. Two more extension headers are used by Mobile IPv6 transformation. Based on MIPL2 kernel patch.
--- include/net/xfrm.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
include/net/xfrm.h +1 -1
@@ -315,7 +315,7 @@ struct xfrm_tmpl__u32 calgos; }; -#define XFRM_MAX_DEPTH 4 +#define XFRM_MAX_DEPTH 6struct xfrm_policy {
Signature · 1 line
1.4.0
PATCH 5/44 STATE: Add source address list.
From: Masahide NAKAMURA <[email protected]>
Support source address based searching.
Mobile IPv6 will use it.
Based on MIPL2 kernel patch.
--- include/net/xfrm.h | 26 ++++++++++++++++++++++++++ net/ipv4/xfrm4_state.c | 3 +++ net/ipv6/xfrm6_state.c | 3 +++ net/xfrm/xfrm_state.c | 21 +++++++++++++++++++-- 4 files changed, 51 insertions(+), 2 deletions(-)
include/net/xfrm.h +26 -0
@@ -96,6 +96,7 @@ struct xfrm_state {/* Note: bydst is re-used during gc */ struct list_head bydst; +struct list_head bysrc;struct list_head byspi;atomic_t refcnt;
@@ -237,6 +238,7 @@ extern int __xfrm_state_delete(struct xfstruct xfrm_state_afinfo {unsigned short family;struct list_head *state_bydst; +struct list_head *state_bysrc;struct list_head *state_byspi;int (*init_flags)(struct xfrm_state *x); void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
@@ -422,6 +424,30 @@ unsigned xfrm_dst_hash(xfrm_address_t *a }static __inline__ +unsigned __xfrm4_src_hash (xfrm_address_t *addr) +{ +return __xfrm4_dst_hash (addr); +} + +static __inline__ +unsigned __xfrm6_src_hash (xfrm_address_t *addr) +{ +return __xfrm6_dst_hash (addr); +} + +static __inline__ +unsigned xfrm_src_hash (xfrm_address_t *addr,unsigned short family) +{ +switch (family) { +case AF_INET : +return __xfrm4_src_hash (addr); +case AF_INET6 : +return __xfrm6_src_hash (addr); + } +return 0 ; +} + +static __inline__unsigned __xfrm4_spi_hash (xfrm_address_t *addr,u32 spi,u8 proto) {unsigned h;
net/ipv4/xfrm4_state.c +3 -0
@@ -122,6 +122,9 @@ __xfrm4_find_acq(u8 mode, u32 reqid, u8add_timer (&x0->timer);xfrm_state_hold (x0);list_add_tail (&x0->bydst, xfrm4_state_afinfo.state_bydst+h); + h =__xfrm4_src_hash (saddr); +xfrm_state_hold (x0); +list_add_tail (&x0->bysrc, xfrm4_state_afinfo.state_bysrc+h);wake_up (&km_waitq); }if (x0)
net/ipv6/xfrm6_state.c +3 -0
@@ -126,6 +126,9 @@ __xfrm6_find_acq(u8 mode, u32 reqid, u8add_timer (&x0->timer);xfrm_state_hold (x0);list_add_tail (&x0->bydst, xfrm6_state_afinfo.state_bydst+h); + h =__xfrm6_src_hash (saddr); +xfrm_state_hold (x0); +list_add_tail (&x0->bysrc, xfrm6_state_afinfo.state_bysrc+h);wake_up (&km_waitq); }if (x0)
net/xfrm/xfrm_state.c +19 -2
@@ -45,6 +45,7 @@ static DEFINE_SPINLOCK(xfrm_state_lock);* Also, it can be used by ah/esp icmp error handler to find offending SA. */ static struct list_head xfrm_state_bydst[XFRM_DST_HSIZE ]; +static struct list_head xfrm_state_bysrc[XFRM_DST_HSIZE ];static struct list_head xfrm_state_byspi[XFRM_DST_HSIZE ];DECLARE_WAIT_QUEUE_HEAD (km_waitq);
@@ -200,6 +201,7 @@ struct xfrm_state *xfrm_state_alloc(voidatomic_set (&x->refcnt,1 );atomic_set (&x->tunnel_users,0 );INIT_LIST_HEAD (&x->bydst); +INIT_LIST_HEAD (&x->bysrc);INIT_LIST_HEAD (&x->byspi);init_timer (&x->timer); x->timer.function = xfrm_timer_handler;
@@ -240,6 +242,8 @@ int __xfrm_state_delete(struct xfrm_statspin_lock (&xfrm_state_lock);list_del (&x->bydst);__xfrm_state_put (x); +list_del (&x->bysrc); +__xfrm_state_put (x);if (x->id.spi) {list_del (&x->byspi);__xfrm_state_put (x);
@@ -415,6 +419,8 @@ xfrm_state_find(xfrm_address_t *daddr, x x->km.state =XFRM_STATE_ACQ ;list_add_tail (&x->bydst, xfrm_state_bydst+h);xfrm_state_hold (x); +list_add_tail (&x->bysrc, xfrm_state_bysrc+h); +xfrm_state_hold (x);if (x->id.spi) { h =xfrm_spi_hash (&x->id.daddr, x->id.spi, x->id.proto, family);list_add (&x->byspi, xfrm_state_byspi+h);
@@ -448,11 +454,19 @@ static void __xfrm_state_insert(struct xlist_add (&x->bydst, xfrm_state_bydst+h);xfrm_state_hold (x); - h =xfrm_spi_hash (&x->id.daddr, x->id.spi, x->id.proto, x->props.family); + h =xfrm_src_hash (&x->props.saddr, x->props.family); -list_add (&x->byspi, xfrm_state_byspi+h); +list_add (&x->bysrc, xfrm_state_bysrc+h);xfrm_state_hold (x); +if (xfrm_id_proto_match (x->id.proto,IPSEC_PROTO_ANY )) { + h =xfrm_spi_hash (&x->id.daddr, x->id.spi, x->id.proto, + x->props.family); + +list_add (&x->byspi, xfrm_state_byspi+h); +xfrm_state_hold (x); + } +if (!mod_timer (&x->timer, jiffies +HZ ))xfrm_state_hold (x);
@@ -1075,6 +1089,7 @@ int xfrm_state_register_afinfo(struct xf err = -ENOBUFS ; else { afinfo->state_bydst = xfrm_state_bydst; + afinfo->state_bysrc = xfrm_state_bysrc; afinfo->state_byspi = xfrm_state_byspi; xfrm_state_afinfo[afinfo->family] = afinfo; }
@@ -1097,6 +1112,7 @@ int xfrm_state_unregister_afinfo(structelse { xfrm_state_afinfo[afinfo->family] =NULL ; afinfo->state_byspi =NULL ; + afinfo->state_bysrc =NULL ; afinfo->state_bydst =NULL ; } }
@@ -1218,6 +1234,7 @@ void __init xfrm_state_init(void)for (i=0 ; i<XFRM_DST_HSIZE ; i++) {INIT_LIST_HEAD (&xfrm_state_bydst[i]); +INIT_LIST_HEAD (&xfrm_state_bysrc[i]);INIT_LIST_HEAD (&xfrm_state_byspi[i]); }INIT_WORK (&xfrm_state_gc_work, xfrm_state_gc_task,NULL );
Signature · 1 line
1.4.0
PATCH 6/44 STATE: Search by address using source address list.
From: Masahide NAKAMURA <[email protected]>
This is a support to search transformation states by its addresses by using source address list for Mobile IPv6 usage.
To use it from user-space, it is also added a message type for source address as a xfrm state option.
Based on MIPL2 kernel patch.
--- include/linux/xfrm.h | 1 + include/net/xfrm.h | 2 ++ net/ipv4/xfrm4_state.c | 9 +++++++ net/ipv6/xfrm6_state.c | 21 +++++++++++++++++ net/xfrm/xfrm_state.c | 37 +++++++++++++++++++++++++++--- net/xfrm/xfrm_user.c | 59 +++++++++++++++++++++++++++++++++++++++++++----- 6 files changed, 119 insertions(+), 10 deletions(-)
include/linux/xfrm.h +1 -0
@@ -234,6 +234,7 @@ enum xfrm_attr_type_t {XFRMA_REPLAY_VAL ,XFRMA_REPLAY_THRESH ,XFRMA_ETIMER_THRESH , +XFRMA_SRCADDR ,/* xfrm_address_t */ __XFRMA_MAX#define XFRMA_MAX (__XFRMA_MAX - 1)
include/net/xfrm.h +2 -0
@@ -245,6 +245,7 @@ struct xfrm_state_afinfo {struct xfrm_tmpl *tmpl, xfrm_address_t *daddr, xfrm_address_t *saddr);struct xfrm_state *(*state_lookup)(xfrm_address_t *daddr,u32 spi,u8 proto); +struct xfrm_state *(*state_lookup_byaddr)(xfrm_address_t *daddr,xfrm_address_t *saddr,u8 proto);struct xfrm_state *(*find_acq)(u8 mode,u32 reqid,u8 proto,xfrm_address_t *daddr,xfrm_address_t *saddr,int create);
@@ -937,6 +938,7 @@ extern void xfrm_state_insert(struct xfrextern int xfrm_state_add (struct xfrm_state *x);extern int xfrm_state_update (struct xfrm_state *x);extern struct xfrm_state *xfrm_state_lookup (xfrm_address_t *daddr,u32 spi,u8 proto,unsigned short family); +extern struct xfrm_state *xfrm_state_lookup_byaddr (xfrm_address_t *daddr,xfrm_address_t *saddr,u8 proto,unsigned short family);extern struct xfrm_state *xfrm_find_acq_byseq (u32 seq);extern int xfrm_state_delete (struct xfrm_state *x);extern void xfrm_state_flush (u8 proto);
net/ipv4/xfrm4_state.c +9 -0
@@ -80,6 +80,14 @@ __xfrm4_state_lookup(xfrm_address_t *dadreturn NULL ; } +/* placeholder until ipv4's code is written */ +static struct xfrm_state * +__xfrm4_state_lookup_byaddr (xfrm_address_t *daddr,xfrm_address_t *saddr, +u8 proto) +{ +return NULL ; +} +static struct xfrm_state * __xfrm4_find_acq(u8 mode, u32 reqid, u8 proto, xfrm_address_t *daddr, xfrm_address_t *saddr,
@@ -137,6 +145,7 @@ static struct xfrm_state_afinfo xfrm4_st .init_flags = xfrm4_init_flags, .init_tempsel = __xfrm4_init_tempsel, .state_lookup = __xfrm4_state_lookup, + .state_lookup_byaddr = __xfrm4_state_lookup_byaddr, .find_acq = __xfrm4_find_acq, };
net/ipv6/xfrm6_state.c +21 -0
@@ -64,6 +64,26 @@ __xfrm6_init_tempsel(struct xfrm_state * }static struct xfrm_state * +__xfrm6_state_lookup_byaddr (xfrm_address_t *daddr,xfrm_address_t *saddr, +u8 proto) +{ +struct xfrm_state *x =NULL ; +unsigned h; + + h =__xfrm6_src_hash (saddr); +list_for_each_entry (x, xfrm6_state_afinfo.state_bysrc+h, bysrc) { +if (x->props.family ==AF_INET6 && +ipv6_addr_equal ((struct in6_addr *)daddr, (struct in6_addr *)x->id.daddr.a6) && +ipv6_addr_equal ((struct in6_addr *)saddr, (struct in6_addr *)x->props.saddr.a6) && + proto == x->id.proto) { +xfrm_state_hold (x); +return x; + } + } +return NULL ; +} + +static struct xfrm_state *__xfrm6_state_lookup (xfrm_address_t *daddr,u32 spi,u8 proto) {unsigned h =__xfrm6_spi_hash (daddr, spi, proto);
@@ -140,6 +160,7 @@ static struct xfrm_state_afinfo xfrm6_st .family = AF_INET6, .init_tempsel = __xfrm6_init_tempsel, .state_lookup = __xfrm6_state_lookup, + .state_lookup_byaddr = __xfrm6_state_lookup_byaddr, .find_acq = __xfrm6_find_acq, };
net/xfrm/xfrm_state.c +33 -4
@@ -487,6 +487,16 @@ void xfrm_state_insert(struct xfrm_state }EXPORT_SYMBOL (xfrm_state_insert); +static inline struct xfrm_state * +__xfrm_state_locate (struct xfrm_state_afinfo *afinfo,struct xfrm_state *x, +int use_spi) +{ +if (use_spi) +return afinfo->state_lookup (&x->id.daddr, x->id.spi, x->id.proto); +else +return afinfo->state_lookup_byaddr (&x->id.daddr, &x->props.saddr, x->id.proto); +} +static struct xfrm_state *__xfrm_find_acq_byseq (u32 seq);int xfrm_state_add (struct xfrm_state *x)
@@ -495,6 +505,7 @@ int xfrm_state_add(struct xfrm_state *x)struct xfrm_state *x1;int family;int err; +int use_spi =xfrm_id_proto_match (x->id.proto,IPSEC_PROTO_ANY ); family = x->props.family; afinfo =xfrm_state_get_afinfo (family);
@@ -503,7 +514,7 @@ int xfrm_state_add(struct xfrm_state *x)spin_lock_bh (&xfrm_state_lock); - x1 = afinfo->state_lookup (&x->id.daddr, x->id.spi, x->id.proto); + x1 =__xfrm_state_locate (afinfo, x, use_spi);if (x1) {xfrm_state_put (x1); x1 =NULL ;
@@ -511,7 +522,7 @@ int xfrm_state_add(struct xfrm_state *x) goto out; } -if (x->km.seq) { +if (use_spi && x->km.seq) { x1 =__xfrm_find_acq_byseq (x->km.seq);if (x1 &&xfrm_addr_cmp (&x1->id.daddr, &x->id.daddr, family)) {xfrm_state_put (x1);
@@ -519,7 +530,7 @@ int xfrm_state_add(struct xfrm_state *x) } } -if (!x1) +if (use_spi && !x1) x1 = afinfo->find_acq ( x->props.mode, x->props.reqid, x->id.proto, &x->id.daddr, &x->props.saddr,0 );
@@ -548,13 +559,14 @@ int xfrm_state_update(struct xfrm_statestruct xfrm_state_afinfo *afinfo;struct xfrm_state *x1;int err; +int use_spi =xfrm_id_proto_match (x->id.proto,IPSEC_PROTO_ANY ); afinfo =xfrm_state_get_afinfo (x->props.family);if (unlikely (afinfo ==NULL ))return -EAFNOSUPPORT ;spin_lock_bh (&xfrm_state_lock); - x1 = afinfo->state_lookup (&x->id.daddr, x->id.spi, x->id.proto); + x1 =__xfrm_state_locate (afinfo, x, use_spi); err = -ESRCH ;if (!x1)
@@ -675,6 +687,23 @@ xfrm_state_lookup(xfrm_address_t *daddr,EXPORT_SYMBOL (xfrm_state_lookup);struct xfrm_state * +xfrm_state_lookup_byaddr (xfrm_address_t *daddr,xfrm_address_t *saddr, +u8 proto,unsigned short family) +{ +struct xfrm_state *x; +struct xfrm_state_afinfo *afinfo =xfrm_state_get_afinfo (family); +if (!afinfo) +return NULL ; + +spin_lock_bh (&xfrm_state_lock); + x = afinfo->state_lookup_byaddr (daddr, saddr, proto); +spin_unlock_bh (&xfrm_state_lock); +xfrm_state_put_afinfo (afinfo); +return x; +} +EXPORT_SYMBOL (xfrm_state_lookup_byaddr); + +struct xfrm_state *xfrm_find_acq (u8 mode,u32 reqid,u8 proto,xfrm_address_t *daddr,xfrm_address_t *saddr,int create,unsigned short family)
net/xfrm/xfrm_user.c +53 -6
85 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 7/44 STATE: Add a hook to find offset to be inserted header in outbound.
From: Masahide NAKAMURA <[email protected]>
On current kernel, ip6_find_1stfragopt() is used by IPv6 IPsec to find offset to be inserted header in outbound for transport mode. (BTW, no usage may be needed for IPv4 case.)
Mobile IPv6 requires another logic for routing header and destination options header respectively. This patch is common platform for the offset and adopts it to IPsec.
Based on MIPL2 kernel patch.
--- include/net/xfrm.h | 3 +++ net/ipv6/ah6.c | 3 ++- net/ipv6/esp6.c | 3 ++- net/ipv6/ipcomp6.c | 1 + net/ipv6/ipv6_syms.c | 1 + net/ipv6/xfrm6_mode_transport.c | 2 +- net/ipv6/xfrm6_output.c | 6 ++++++ 7 files changed, 16 insertions(+), 3 deletions(-)
include/net/xfrm.h +3 -0
@@ -266,6 +266,7 @@ struct xfrm_typevoid (*destructor)(struct xfrm_state *);int (*input)(struct xfrm_state *,struct sk_buff *skb);int (*output)(struct xfrm_state *,struct sk_buff *pskb); +int (*hdr_offset)(struct xfrm_state *,struct sk_buff *,u8 **);/* Estimate maximal size of result of transformation of a dgram */ u32 (*get_max_size)(struct xfrm_state *,int size); };
@@ -960,6 +961,8 @@ extern u32 xfrm6_tunnel_alloc_spi(xfrm_aextern void xfrm6_tunnel_free_spi (xfrm_address_t *saddr);extern u32 xfrm6_tunnel_spi_lookup (xfrm_address_t *saddr);extern int xfrm6_output (struct sk_buff *skb); +extern int xfrm6_find_1stfragopt (struct xfrm_state *x,struct sk_buff *skb, +u8 **prevhdr);#ifdef CONFIG_XFRM extern int xfrm4_rcv_encap (struct sk_buff *skb,__u16 encap_type);
net/ipv6/ah6.c +2 -1
@@ -424,7 +424,8 @@ static struct xfrm_type ah6_type = .init_state = ah6_init_state, .destructor = ah6_destroy, .input = ah6_input, - .output = ah6_output + .output = ah6_output, + .hdr_offset = xfrm6_find_1stfragopt, };static struct inet6_protocol ah6_protocol = {
net/ipv6/esp6.c +2 -1
@@ -365,7 +365,8 @@ static struct xfrm_type esp6_type = .destructor = esp6_destroy, .get_max_size = esp6_get_max_size, .input = esp6_input, - .output = esp6_output + .output = esp6_output, + .hdr_offset = xfrm6_find_1stfragopt, };static struct inet6_protocol esp6_protocol = {
net/ipv6/ipcomp6.c +1 -0
@@ -460,6 +460,7 @@ static struct xfrm_type ipcomp6_type = .destructor = ipcomp6_destroy, .input = ipcomp6_input, .output = ipcomp6_output, + .hdr_offset = xfrm6_find_1stfragopt, }; static struct inet6_protocol ipcomp6_protocol =
net/ipv6/ipv6_syms.c +1 -0
@@ -31,6 +31,7 @@ EXPORT_SYMBOL(ipv6_chk_addr);EXPORT_SYMBOL (in6_dev_finish_destroy);#ifdef CONFIG_XFRM EXPORT_SYMBOL (xfrm6_rcv); +EXPORT_SYMBOL (xfrm6_find_1stfragopt);#endif EXPORT_SYMBOL (rt6_lookup);EXPORT_SYMBOL (ipv6_push_nfrag_opts);
net/ipv6/xfrm6_mode_transport.c +1 -1
@@ -35,7 +35,7 @@ static int xfrm6_transport_output(structskb_push (skb, x->props.header_len); iph = skb->nh.ipv6h; - hdr_len =ip6_find_1stfragopt (skb, &prevhdr); + hdr_len = x->type->hdr_offset (x, skb, &prevhdr); skb->nh.raw = prevhdr - x->props.header_len; skb->h.raw = skb->data + hdr_len;memmove (skb->data, iph, hdr_len);
net/ipv6/xfrm6_output.c +6 -0
@@ -17,6 +17,12 @@ #include <linux/netfilter_ipv6.h>#include <net/ipv6.h> #include <net/xfrm.h> +int xfrm6_find_1stfragopt (struct xfrm_state *x,struct sk_buff *skb, +u8 **prevhdr) +{ +return ip6_find_1stfragopt (skb, prevhdr); +} +static int xfrm6_tunnel_check_size (struct sk_buff *skb) {int mtu, ret =0 ;
Signature · 1 line
1.4.0
PATCH 8/44 STATE: Introduce route optimization mode.
From: Masahide NAKAMURA <[email protected]>
Route optimization is used with routing header and destination options header for Mobile IPv6.
At outbound it makes header space like IPsec transport. At inbound it does nothing because exhdrs.c functions have responsibility to update skbuff information for these headers.
--- net/ipv6/Kconfig | 7 +++ net/ipv6/Makefile | 1 net/ipv6/xfrm6_mode_ro.c | 94 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 102 insertions(+), 0 deletions(-)
net/ipv6/Kconfig +7 -0
@@ -126,6 +126,13 @@ config INET6_XFRM_MODE_TUNNEL If unsure, say Y. +config INET6_XFRM_MODE_ROUTEOPTIMIZATION + tristate "IPv6: MIPv6 route optimization mode (EXPERIMENTAL)" + depends on IPV6 && EXPERIMENTAL + select XFRM + ---help--- + Support for MIPv6 route optimization mode. + config IPV6_TUNNEL tristate "IPv6: IPv6-in-IPv6 tunnel" select INET6_TUNNEL
net/ipv6/Makefile +1 -0
@@ -23,6 +23,7 @@ obj-$(CONFIG_INET6_XFRM_TUNNEL) += xfrm6 obj-$(CONFIG_INET6_TUNNEL) += tunnel6.o obj-$(CONFIG_INET6_XFRM_MODE_TRANSPORT) += xfrm6_mode_transport.o obj-$(CONFIG_INET6_XFRM_MODE_TUNNEL) += xfrm6_mode_tunnel.o +obj-$(CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION) += xfrm6_mode_ro.o obj-$(CONFIG_NETFILTER) += netfilter/ obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
net/ipv6/xfrm6_mode_ro.c new file +94 -0
94 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 9/44 : Restrict authentication algorithm only when inbound transformation protocol is IPsec.
From: Masahide NAKAMURA <[email protected]>
For Mobile IPv6 usage, routing header or destination options header is used and it doesn't require this comparison. It is checked only for IPsec template. Based on MIPL2 kernel patch.
--- net/xfrm/xfrm_policy.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
net/xfrm/xfrm_policy.c +2 -1
@@ -1004,7 +1004,8 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, st (x->id.spi == tmpl->id.spi || !tmpl->id.spi) && (x->props.reqid == tmpl->reqid || !tmpl->reqid) && x->props.mode == tmpl->mode && - (tmpl->aalgos & (1 <<x->props.aalgo)) && + ((tmpl->aalgos & (1 <<x->props.aalgo)) || + !(xfrm_id_proto_match (tmpl->id.proto,IPSEC_PROTO_ANY ))) && !(x->props.mode !=XFRM_MODE_TRANSPORT &&xfrm_state_addr_cmp (tmpl, x, family)); }
Signature · 1 line
1.4.0
PATCH 10/44 STATE: Common receive function for route optimization extension headers.
From: Masahide NAKAMURA <[email protected]>
XFRM_STATE_WILDRECV flag is introduced; the last resort state is set it and receives packet which is not route optimized but uses such extension headers i.e. Mobile IPv6 signaling (binding update and acknowledgement). A node enabled Mobile IPv6 adds the state.
Based on MIPL2 kernel patch.
--- include/linux/xfrm.h | 1 include/net/xfrm.h | 2 + net/ipv6/ipv6_syms.c | 1 net/ipv6/xfrm6_input.c | 108 ++++++++++++++++++++++++++++++++++++++++++++++++ net/xfrm/xfrm_state.c | 1 5 files changed, 113 insertions(+), 0 deletions(-)
include/linux/xfrm.h +1 -0
@@ -256,6 +256,7 @@ struct xfrm_usersa_info {#define XFRM_STATE_NOECN 1#define XFRM_STATE_DECAP_DSCP 2#define XFRM_STATE_NOPMTUDISC 4 +#define XFRM_STATE_WILDRECV 8 };struct xfrm_usersa_id {
include/net/xfrm.h +2 -0
@@ -955,6 +955,8 @@ extern int xfrm4_tunnel_register(structextern int xfrm4_tunnel_deregister (struct xfrm_tunnel *handler);extern int xfrm6_rcv_spi (struct sk_buff *skb,u32 spi);extern int xfrm6_rcv (struct sk_buff **pskb); +extern int xfrm6_input_addr (struct sk_buff *skb,xfrm_address_t *daddr, +xfrm_address_t *saddr,u8 proto);extern int xfrm6_tunnel_register (struct xfrm6_tunnel *handler);extern int xfrm6_tunnel_deregister (struct xfrm6_tunnel *handler);extern u32 xfrm6_tunnel_alloc_spi (xfrm_address_t *saddr);
net/ipv6/ipv6_syms.c +1 -0
@@ -31,6 +31,7 @@ EXPORT_SYMBOL(ipv6_chk_addr);EXPORT_SYMBOL (in6_dev_finish_destroy);#ifdef CONFIG_XFRM EXPORT_SYMBOL (xfrm6_rcv); +EXPORT_SYMBOL (xfrm6_input_addr);EXPORT_SYMBOL (xfrm6_find_1stfragopt);#endif EXPORT_SYMBOL (rt6_lookup);
net/ipv6/xfrm6_input.c +108 -0
111 lines not on this page · raw message
net/xfrm/xfrm_state.c +1 -0
@@ -352,6 +352,7 @@ xfrm_state_find(xfrm_address_t *daddr, xlist_for_each_entry (x, xfrm_state_bydst+h, bydst) { if (x->props.family == family && x->props.reqid == tmpl->reqid && + !(x->props.flags & XFRM_STATE_WILDRECV) && xfrm_state_addr_check(x, daddr, saddr, family) && tmpl->mode == x->props.mode && tmpl->id.proto == x->id.proto &&
Signature · 1 line
1.4.0
PATCH 11/44 : Rename secpath_has_tunnel to secpath_has_nontransport.
From: Masahide NAKAMURA <[email protected]>
On current kernel inbound transformation state is allowed transport and disallowed tunnel mode when mismatch is occurred between tempates and states. As the result of adding two more modes by Mobile IPv6, this function name is misleading. Inbound transformation can allow only transport mode when mismatch is occurred between template and secpath.
Based on MIPL2 kernel patch.
--- net/xfrm/xfrm_policy.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)
net/xfrm/xfrm_policy.c +3 -3
@@ -1046,7 +1046,7 @@ xfrm_decode_session(struct sk_buff *skb, }EXPORT_SYMBOL (xfrm_decode_session); -static inline int secpath_has_tunnel (struct sec_path *sp,int k) +static inline int secpath_has_nontransport (struct sec_path *sp,int k) {for (; k < sp->len; k++) {if (sp->xvec[k]->props.mode !=XFRM_MODE_TRANSPORT )
@@ -1087,7 +1087,7 @@ int __xfrm_policy_check(struct sock *sk, xfrm_policy_lookup);if (!pol) -return !skb->sp || !secpath_has_tunnel (skb->sp,0 ); +return !skb->sp || !secpath_has_nontransport (skb->sp,0 ); pol->curlft.use_time = (unsigned long )xtime.tv_sec;
@@ -1111,7 +1111,7 @@ int __xfrm_policy_check(struct sock *sk, goto reject; } -if (secpath_has_tunnel (sp, k)) +if (secpath_has_nontransport (sp, k)) goto reject;xfrm_pol_put (pol);
Signature · 1 line
1.4.0
PATCH 12/44 STATE: Add a hook to obtain local/remote outbound address.
From: Masahide NAKAMURA <[email protected]>
Outbound transformation replaces both source and destination address with state's end-point addresses at the same time when IPsec tunnel mode. It is also required to change them for Mobile IPv6 route optimization, but we should care about the following differences:
- changing result is not end-point but care-of address
- either source or destination is replaced for each state
This hook is a common platform to change outbound address.
Based on MIPL2 kernel patch.
--- include/net/xfrm.h | 2 ++ net/ipv6/xfrm6_policy.c | 20 ++++++++++++++++++-- 2 files changed, 20 insertions(+), 2 deletions(-)
include/net/xfrm.h +2 -0
@@ -267,6 +267,8 @@ struct xfrm_typeint (*input)(struct xfrm_state *,struct sk_buff *skb);int (*output)(struct xfrm_state *,struct sk_buff *pskb);int (*hdr_offset)(struct xfrm_state *,struct sk_buff *,u8 **); +xfrm_address_t *(*local_addr)(struct xfrm_state *,xfrm_address_t *); +xfrm_address_t *(*remote_addr)(struct xfrm_state *,xfrm_address_t *);/* Estimate maximal size of result of transformation of a dgram */ u32 (*get_max_size)(struct xfrm_state *,int size); };
net/ipv6/xfrm6_policy.c +18 -2
@@ -59,6 +59,22 @@ __xfrm6_find_bundle(struct flowi *fl, streturn dst; } +static inline struct in6_addr * +__xfrm6_bundle_addr_remote (struct xfrm_state *x,struct in6_addr *addr) +{ +return (x->type->remote_addr) ? + (struct in6_addr *)x->type->remote_addr (x, (xfrm_address_t *)addr) : + (struct in6_addr *)&x->id.daddr; +} + +static inline struct in6_addr * +__xfrm6_bundle_addr_local (struct xfrm_state *x,struct in6_addr *addr) +{ +return (x->type->local_addr) ? + (struct in6_addr *)x->type->local_addr (x, (xfrm_address_t *)addr) : + (struct in6_addr *)&x->props.saddr; +} +/* Allocate chain of dst_entry's, attach known xfrm's, calculate * all the metrics... Shortly, bundle a bundle. */
@@ -115,8 +131,8 @@ __xfrm6_bundle_create(struct xfrm_policy dst1->next = dst_prev; dst_prev = dst1;if (xfrm[i]->props.mode !=XFRM_MODE_TRANSPORT ) { - remote = (struct in6_addr *)&xfrm[i]->id.daddr; - local = (struct in6_addr *)&xfrm[i]->props.saddr; + remote =__xfrm6_bundle_addr_remote (xfrm[i], remote); + local =__xfrm6_bundle_addr_local (xfrm[i], local); tunnel =1 ; } header_len += xfrm[i]->props.header_len;
Signature · 1 line
1.4.0
PATCH 13/44 STATE: Support non-fragment outbound transformation headers.
From: Masahide NAKAMURA <[email protected]>
For originated outbound IPv6 packets which will fragment, ip6_append_data() should know length of extension headers before sending them and the length is carried by dst_entry.
IPv6 IPsec headers fragment then transformation was
designed to place all headers after fragment header.
OTOH Mobile IPv6 extension headers do not fragment then
it is a good idea to make dst_entry have non-fragment length to tell it to ip6_append_data().
--- include/net/dst.h | 1 + include/net/xfrm.h | 2 ++ net/ipv4/xfrm4_policy.c | 1 + net/ipv6/ip6_output.c | 2 +- net/ipv6/xfrm6_policy.c | 24 ++++++++++++++++++++++-- 5 files changed, 27 insertions(+), 3 deletions(-)
include/net/dst.h +1 -0
@@ -54,6 +54,7 @@ #define DST_BALANCED 0x10unsigned long expires;unsigned short header_len;/* more space at head required */ +unsigned short nfheader_len;/* more non-fragment space at head required */ unsigned short trailer_len;/* space to reserve at tail */ u32 metrics[RTAX_MAX ];
include/net/xfrm.h +2 -0
@@ -261,6 +261,8 @@ struct xfrm_typechar *description;struct module *owner;__u8 proto; +__u8 flags; +#define XFRM_TYPE_NON_FRAGMENT 1int (*init_state)(struct xfrm_state *x);void (*destructor)(struct xfrm_state *);
net/ipv4/xfrm4_policy.c +1 -0
@@ -135,6 +135,7 @@ __xfrm4_bundle_create(struct xfrm_policy dst_prev->flags |=DST_HOST ; dst_prev->lastuse = jiffies; dst_prev->header_len = header_len; + dst_prev->nfheader_len =0 ; dst_prev->trailer_len = trailer_len;memcpy (&dst_prev->metrics, &x->route->metrics,sizeof (dst_prev->metrics));
net/ipv6/ip6_output.c +1 -1
@@ -963,7 +963,7 @@ int ip6_append_data(struct sock *sk, int hh_len =LL_RESERVED_SPACE (rt->u.dst.dev); - fragheaderlen =sizeof (struct ipv6hdr ) + (opt ? opt->opt_nflen :0 ); + fragheaderlen =sizeof (struct ipv6hdr ) + rt->u.dst.nfheader_len + (opt ? opt->opt_nflen :0 ); maxfraglen = ((mtu - fragheaderlen) & ~7 ) + fragheaderlen -sizeof (struct frag_hdr );if (mtu <=sizeof (struct ipv6hdr ) +IPV6_MAXPLEN ) {
net/ipv6/xfrm6_policy.c +22 -2
@@ -75,6 +75,24 @@ __xfrm6_bundle_addr_local(struct xfrm_st (struct in6_addr *)&x->props.saddr; } +static inline void +__xfrm6_bundle_len_inc (int *len,int *nflen,struct xfrm_state *x) +{ +if (x->type->flags &XFRM_TYPE_NON_FRAGMENT ) + *nflen += x->props.header_len; +else + *len += x->props.header_len; +} + +static inline void +__xfrm6_bundle_len_dec (int *len,int *nflen,struct xfrm_state *x) +{ +if (x->type->flags &XFRM_TYPE_NON_FRAGMENT ) + *nflen -= x->props.header_len; +else + *len -= x->props.header_len; +} +/* Allocate chain of dst_entry's, attach known xfrm's, calculate * all the metrics... Shortly, bundle a bundle. */
@@ -99,6 +117,7 @@ __xfrm6_bundle_create(struct xfrm_policyint i;int err =0 ;int header_len =0 ; +int nfheader_len =0 ;int trailer_len =0 ; dst = dst_prev =NULL ;
@@ -135,7 +154,7 @@ __xfrm6_bundle_create(struct xfrm_policy local =__xfrm6_bundle_addr_local (xfrm[i], local); tunnel =1 ; } - header_len += xfrm[i]->props.header_len; +__xfrm6_bundle_len_inc (&header_len, &nfheader_len, xfrm[i]); trailer_len += xfrm[i]->props.trailer_len;if (tunnel) {
@@ -170,6 +189,7 @@ __xfrm6_bundle_create(struct xfrm_policy dst_prev->flags |=DST_HOST ; dst_prev->lastuse = jiffies; dst_prev->header_len = header_len; + dst_prev->nfheader_len = nfheader_len; dst_prev->trailer_len = trailer_len;memcpy (&dst_prev->metrics, &x->route->metrics,sizeof (dst_prev->metrics));
@@ -188,7 +208,7 @@ __xfrm6_bundle_create(struct xfrm_policy x->u.rt6.rt6i_src = rt0->rt6i_src; x->u.rt6.rt6i_idev = rt0->rt6i_idev;in6_dev_hold (rt0->rt6i_idev); - header_len -= x->u.dst.xfrm->props.header_len; +__xfrm6_bundle_len_dec (&header_len, &nfheader_len, x->u.dst.xfrm); trailer_len -= x->u.dst.xfrm->props.trailer_len; }
Signature · 1 line
1.4.0
PATCH 14/44 STATE: Introduce care-of address.
From: Masahide NAKAMURA <[email protected]>
Care-of address is carried by state as a transformation option like IPsec encryption/authentication algorithm.
Based on MIPL2 kernel patch.
--- include/linux/xfrm.h | 1 + include/net/xfrm.h | 3 +++ net/xfrm/xfrm_state.c | 6 ++++++ net/xfrm/xfrm_user.c | 28 +++++++++++++++++++++++++++- 4 files changed, 37 insertions(+), 1 deletions(-)
include/linux/xfrm.h +1 -0
@@ -235,6 +235,7 @@ enum xfrm_attr_type_t {XFRMA_REPLAY_THRESH ,XFRMA_ETIMER_THRESH ,XFRMA_SRCADDR ,/* xfrm_address_t */ +XFRMA_COADDR ,/* xfrm_address_t */ __XFRMA_MAX#define XFRMA_MAX (__XFRMA_MAX - 1)
include/net/xfrm.h +3 -0
@@ -135,6 +135,9 @@ struct xfrm_state/* Data for encapsulator */ struct xfrm_encap_tmpl *encap; +/* Data for care-of address */ +xfrm_address_t *coaddr; +/* IPComp needs an IPIP tunnel for handling uncompressed packets */ struct xfrm_state *tunnel;
net/xfrm/xfrm_state.c +6 -0
@@ -78,6 +78,7 @@ static void xfrm_state_gc_destroy(structkfree (x->ealg);kfree (x->calg);kfree (x->encap); +kfree (x->coaddr);if (x->mode)xfrm_put_mode (x->mode);if (x->type) {
@@ -603,6 +604,11 @@ out:if (likely (x1->km.state ==XFRM_STATE_VALID )) {if (x->encap && x1->encap)memcpy (x1->encap, x->encap,sizeof (*x1->encap)); +if (x->coaddr && x1->coaddr) { +memcpy (x1->coaddr, x->coaddr,sizeof (*x1->coaddr)); + } +if (!use_spi &&memcmp (&x1->sel, &x->sel,sizeof (x1->sel))) +memcpy (&x1->sel, &x->sel,sizeof (x1->sel));memcpy (&x1->lft, &x->lft,sizeof (x1->lft)); x1->km.dying =0 ;
net/xfrm/xfrm_user.c +27 -1
@@ -186,11 +186,14 @@ #endif goto out;if ((err =verify_sec_ctx_len (xfrma))) goto out; +if ((err =verify_one_addr (xfrma,XFRMA_COADDR ,NULL ))) + goto out; err = -EINVAL ;switch (p->mode) {case XFRM_MODE_TRANSPORT :case XFRM_MODE_TUNNEL : +case XFRM_MODE_ROUTEOPTIMIZATION :break ;default :
@@ -274,6 +277,24 @@ static int attach_sec_ctx(struct xfrm_streturn security_xfrm_state_alloc (x, uctx); } +static int attach_one_addr (xfrm_address_t **addrpp,struct rtattr *u_arg) +{ +struct rtattr *rta = u_arg; +xfrm_address_t *p, *uaddrp; + +if (!rta) +return 0 ; + + uaddrp =RTA_DATA (rta); + p =kmalloc (sizeof (*p),GFP_KERNEL ); +if (!p) +return -ENOMEM ; + +memcpy (p, uaddrp,sizeof (*p)); + *addrpp = p; +return 0 ; +} +static void copy_from_user_state (struct xfrm_state *x,struct xfrm_usersa_info *p) {memcpy (&x->id, &p->id,sizeof (x->id));
@@ -363,7 +384,8 @@ static struct xfrm_state *xfrm_state_con goto error;if ((err =attach_encap_tmpl (&x->encap, xfrma[XFRMA_ENCAP -1 ]))) goto error; - +if ((err =attach_one_addr (&x->coaddr, xfrma[XFRMA_COADDR -1 ]))) + goto error; err =xfrm_init_state (x);if (err) goto error;
@@ -567,6 +589,10 @@ static int dump_one_state(struct xfrm_st uctx->ctx_len = x->security->ctx_len;memcpy (uctx +1 , x->security->ctx_str, x->security->ctx_len); } + +if (x->coaddr) +RTA_PUT (skb,XFRMA_COADDR ,sizeof (*x->coaddr), x->coaddr); + nlh->nlmsg_len = skb->tail - b; out: sp->this_idx++;
Signature · 1 line
1.4.0
PATCH 15/44 IPV6: Update outbound state timestamp for each sending.
From: Masahide NAKAMURA <[email protected]>
With this patch transformation state is updated last used time for each sending. Xtime is used for it like other state lifetime expiration.
Mobile IPv6 enabled nodes will want to know traffic status of each binding (e.g. judgement to request binding refresh by correspondent node, or to keep home/care-of nonce alive by mobile node).
The last used timestamp is an important hint about it.
Based on MIPL2 kernel patch.
This patch was also written by: Henrik Petander <[email protected]>
--- include/linux/xfrm.h | 1 + include/net/xfrm.h | 3 +++ net/ipv6/xfrm6_output.c | 2 ++ net/xfrm/xfrm_user.c | 3 +++ 4 files changed, 9 insertions(+), 0 deletions(-)
include/linux/xfrm.h +1 -0
@@ -236,6 +236,7 @@ enum xfrm_attr_type_t {XFRMA_ETIMER_THRESH ,XFRMA_SRCADDR ,/* xfrm_address_t */ XFRMA_COADDR ,/* xfrm_address_t */ +XFRMA_LASTUSED , __XFRMA_MAX#define XFRMA_MAX (__XFRMA_MAX - 1)
include/net/xfrm.h +3 -0
@@ -168,6 +168,9 @@ struct xfrm_statestruct xfrm_lifetime_cur curlft;struct timer_list timer; +/* Last used time */ +u64 lastused; +/* Reference to data common to all the instances of this * transformer. */ struct xfrm_type *type;
net/ipv6/xfrm6_output.c +2 -0
@@ -75,6 +75,8 @@ static int xfrm6_output_one(struct sk_bu x->curlft.bytes += skb->len; x->curlft.packets++; +if (x->props.mode ==XFRM_MODE_ROUTEOPTIMIZATION ) + x->lastused = (u64 )xtime.tv_sec;spin_unlock_bh (&x->lock);
net/xfrm/xfrm_user.c +3 -0
@@ -593,6 +593,9 @@ static int dump_one_state(struct xfrm_stif (x->coaddr)RTA_PUT (skb,XFRMA_COADDR ,sizeof (*x->coaddr), x->coaddr); +if (x->lastused) +RTA_PUT (skb,XFRMA_LASTUSED ,sizeof (x->lastused), &x->lastused); + nlh->nlmsg_len = skb->tail - b; out: sp->this_idx++;
Signature · 1 line
1.4.0
PATCH 16/44 IPV6: Restrict bundle reusing
From: Masahide NAKAMURA <[email protected]>
For outbound transformation, bundle is checked whether it is suitable for current flow to be reused or not. In such IPv6 case as below, transformation may apply incorrect bundle for the flow instead of creating another bundle:
- The policy selector has destination prefix length < 128 (Two or more addresses can be matched it)
- Its bundle holds dst entry of default route whose prefix length < 128 (Previous traffic was used such route as next hop)
- The policy and the bundle were used a transport mode state and this time flow address is not matched the bundled state.
This issue is found by Mobile IPv6 usage to protect mobility signaling by IPsec, but it is not a Mobile IPv6 specific.
This patch adds strict check to xfrm_bundle_ok() for each state mode and address when prefix length is less than 128.
--- include/net/xfrm.h | 19 ++++++++++++++++++- net/ipv4/xfrm4_policy.c | 2 +- net/ipv6/xfrm6_policy.c | 4 +++- net/xfrm/xfrm_policy.c | 8 ++++++-- 4 files changed, 28 insertions(+), 5 deletions(-)
include/net/xfrm.h +18 -1
@@ -870,6 +870,23 @@ xfrm_state_addr_check(struct xfrm_statereturn 0 ; } +static __inline__int +xfrm_state_addr_flow_check (struct xfrm_state *x,struct flowi *fl, +unsigned short family) +{ +switch (family) { +case AF_INET : +return __xfrm4_state_addr_check (x, + (xfrm_address_t *)&fl->fl4_dst, + (xfrm_address_t *)&fl->fl4_src); +case AF_INET6 : +return __xfrm6_state_addr_check (x, + (xfrm_address_t *)&fl->fl6_dst, + (xfrm_address_t *)&fl->fl6_src); + } +return 0 ; +} +static inline int xfrm_state_kern (struct xfrm_state *x) {return atomic_read (&x->tunnel_users);
@@ -1014,7 +1031,7 @@ extern void xfrm_policy_flush(void);extern int xfrm_sk_policy_insert (struct sock *sk,int dir,struct xfrm_policy *pol);extern int xfrm_flush_bundles (void );extern void xfrm_flush_all_bundles (void ); -extern int xfrm_bundle_ok (struct xfrm_dst *xdst,struct flowi *fl,int family); +extern int xfrm_bundle_ok (struct xfrm_dst *xdst,struct flowi *fl,int family,int strict);extern void xfrm_init_pmtu (struct dst_entry *dst);extern wait_queue_head_t km_waitq;
net/ipv4/xfrm4_policy.c +1 -1
@@ -33,7 +33,7 @@ __xfrm4_find_bundle(struct flowi *fl, st xdst->u.rt.fl.fl4_dst == fl->fl4_dst && xdst->u.rt.fl.fl4_src == fl->fl4_src && xdst->u.rt.fl.fl4_tos == fl->fl4_tos && - xfrm_bundle_ok(xdst, fl, AF_INET)) { + xfrm_bundle_ok(xdst, fl, AF_INET, 0)) {dst_clone (dst);break ; }
net/ipv6/xfrm6_policy.c +3 -1
@@ -50,7 +50,9 @@ __xfrm6_find_bundle(struct flowi *fl, st xdst->u.rt6.rt6i_src.plen);if (ipv6_addr_equal (&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&ipv6_addr_equal (&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) && -xfrm_bundle_ok (xdst, fl,AF_INET6 )) { +xfrm_bundle_ok (xdst, fl,AF_INET6 , + (xdst->u.rt6.rt6i_dst.plen !=128 || + xdst->u.rt6.rt6i_src.plen !=128 ))) {dst_clone (dst);break ; }
net/xfrm/xfrm_policy.c +6 -2
@@ -1147,7 +1147,7 @@ static struct dst_entry *xfrm_dst_check(static int stale_bundle (struct dst_entry *dst) { -return !xfrm_bundle_ok ((struct xfrm_dst *)dst,NULL ,AF_UNSPEC ); +return !xfrm_bundle_ok ((struct xfrm_dst *)dst,NULL ,AF_UNSPEC ,0 ); }void xfrm_dst_ifdown (struct dst_entry *dst,struct net_device *dev)
@@ -1262,7 +1262,7 @@ EXPORT_SYMBOL(xfrm_init_pmtu);* still valid. */ -int xfrm_bundle_ok (struct xfrm_dst *first,struct flowi *fl,int family) +int xfrm_bundle_ok (struct xfrm_dst *first,struct flowi *fl,int family,int strict) {struct dst_entry *dst = &first->u.dst;struct xfrm_dst *last;
@@ -1284,6 +1284,10 @@ int xfrm_bundle_ok(struct xfrm_dst *firsif (dst->xfrm->km.state !=XFRM_STATE_VALID )return 0 ; +if (strict && fl && dst->xfrm->props.mode !=XFRM_MODE_TUNNEL && + !xfrm_state_addr_flow_check (dst->xfrm, fl, family)) +return 0 ; + mtu =dst_mtu (dst->child);if (xdst->child_mtu_cached != mtu) { last = xdst;
Signature · 1 line
1.4.0
PATCH 17/44 : Fix message about transformation user interface.
From: Masahide NAKAMURA <[email protected]>
Transformation user interface is not only for IPsec. Based on MIPL2 kernel patch.
--- net/xfrm/Kconfig | 6 +++--- net/xfrm/xfrm_user.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
net/xfrm/Kconfig +3 -3
@@ -6,11 +6,11 @@ config XFRM depends on NET config XFRM_USER - tristate "IPsec user configuration interface" + tristate "Transformation user configuration interface" depends on INET && XFRM ---help--- - Support for IPsec user configuration interface used - by native Linux tools. + Support for Transformation(XFRM) user configuration interface + like IPsec used by native Linux tools. If unsure, say Y.
net/xfrm/xfrm_user.c +1 -1
@@ -2052,7 +2052,7 @@ static int __init xfrm_user_init(void) {struct sock *nlsk; -printk (KERN_INFO "Initializing IPsec netlink socket\n" ); +printk (KERN_INFO "Initializing XFRM netlink socket\n" ); nlsk =netlink_kernel_create (NETLINK_XFRM ,XFRMNLGRP_MAX , xfrm_netlink_rcv,THIS_MODULE );
Signature · 1 line
1.4.0
PATCH 18/44 : Add Kconfig to enable Mobile IPv6.
From: Masahide NAKAMURA <[email protected]>
Add Kconfig to enable Mobile IPv6.
Based on MIPL2 kernel patch.
--- net/ipv6/Kconfig | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-)
net/ipv6/Kconfig +9 -0
@@ -97,6 +97,15 @@ config INET6_IPCOMP If unsure, say Y. +config IPV6_MIP6 + bool "IPv6: Mobility (EXPERIMENTAL)" + depends on IPV6 && EXPERIMENTAL + select XFRM + ---help--- + Support for IPv6 Mobility described in RFC 3775. + + If unsure, say N. + config INET6_XFRM_TUNNEL tristate select INET6_TUNNEL
Signature · 1 line
1.4.0
PATCH 19/44 MIP6: Add routing header type 2 definition.
From: Masahide NAKAMURA <[email protected]>
Add routing header type 2 definition for Mobile IPv6. Based on MIPL2 kernel patch.
--- include/linux/ipv6.h | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-)
include/linux/ipv6.h +13 -0
@@ -29,6 +29,7 @@ struct in6_ifreq {#define IPV6_SRCRT_STRICT 0x01/* this hop must be a neighbor */ #define IPV6_SRCRT_TYPE_0 0/* IPv6 type 0 Routing Header */ +#define IPV6_SRCRT_TYPE_2 2/* IPv6 type 2 Routing Header */ /* * routing header
@@ -73,6 +74,18 @@ struct rt0_hdr {#define rt0_type rt_hdr.type }; +/* +* routing header type 2 +*/ + +struct rt2_hdr { +struct ipv6_rt_hdr rt_hdr; +__u32 reserved; +struct in6_addr addr; + +#define rt2_type rt_hdr.type +}; +struct ipv6_auth_hdr {__u8 nexthdr;__u8 hdrlen;/* This one is measured in 32 bit units! */
Signature · 1 line
1.4.0
PATCH 20/44 MIP6: Add inbound interface of routing header type 2.
From: Masahide NAKAMURA <[email protected]>
Add inbound interface of routing header type 2 for Mobile IPv6. Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
--- include/net/addrconf.h | 7 +++++ net/ipv6/exthdrs.c | 69 ++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 68 insertions(+), 8 deletions(-)
include/net/addrconf.h +7 -0
@@ -61,6 +61,13 @@ extern int addrconf_set_dstaddr(void _extern int ipv6_chk_addr (struct in6_addr *addr,struct net_device *dev,int strict); +/* XXX: this is a placeholder till addrconf supports */ +#ifdef CONFIG_IPV6_MIP6 +static inline int ipv6_chk_home_addr (struct in6_addr *addr) +{ +return 0 ; +} +#endif extern struct inet6_ifaddr *ipv6_get_ifaddr (struct in6_addr *addr,struct net_device *dev,int strict);
net/ipv6/exthdrs.c +61 -8
103 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 21/44 MIP6: Add socket option and ancillary data interface of routing header type 2.
From: Masahide NAKAMURA <[email protected]>
Add socket option and ancillary data interface of routing header type 2. Mobile IPv6 application will use this to send binding acknowledgement with the header without relation of confirmed route optimization (binding). Based on MIPL2 kernel patch.
--- net/ipv6/datagram.c | 11 +++++++---- net/ipv6/ipv6_sockglue.c | 10 +++++++++- 2 files changed, 16 insertions(+), 5 deletions(-)
net/ipv6/datagram.c +7 -4
@@ -643,10 +643,13 @@ int datagram_send_ctl(struct msghdr *msg rthdr = (struct ipv6_rt_hdr *)CMSG_DATA (cmsg); -/* -* TYPE 0 -*/ -if (rthdr->type) { +switch (rthdr->type) { +case IPV6_SRCRT_TYPE_0 : +#ifdef CONFIG_IPV6_MIP6 +case IPV6_SRCRT_TYPE_2 : +#endif +break ; +default : err = -EINVAL ; goto exit_f; }
net/ipv6/ipv6_sockglue.c +9 -1
@@ -407,8 +407,16 @@ static int do_ipv6_setsockopt(struct soc/* routing header option needs extra check */ if (optname ==IPV6_RTHDR && opt->srcrt) {struct ipv6_rt_hdr *rthdr = opt->srcrt; -if (rthdr->type) +switch (rthdr->type) { +case IPV6_SRCRT_TYPE_0 : +#ifdef CONFIG_IPV6_MIP6 +case IPV6_SRCRT_TYPE_2 : +#endif +break ; +default : goto sticky_done; + } +if ((rthdr->hdrlen &1 ) || (rthdr->hdrlen >>1 ) != rthdr->segments_left) goto sticky_done;
Signature · 1 line
1.4.0
PATCH 22/44 : Find option offset by type.
From: Masahide NAKAMURA <[email protected]>
This is a helper to search option offset from extension header which can carry TLV option like destination options header. Mobile IPv6 home address option will use it.
Based on MIPL2 kernel patch.
--- include/net/ipv6.h | 2 ++ net/ipv6/exthdrs.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+), 0 deletions(-)
include/net/ipv6.h +2 -0
@@ -506,6 +506,8 @@ extern int ipv6_skip_exthdr(const struextern int ipv6_ext_hdr (u8 nexthdr); +extern int ipv6_find_tlv (struct sk_buff *skb,int offset,int type); +extern struct ipv6_txoptions *ipv6_invert_rthdr (struct sock *sk,struct ipv6_rt_hdr *hdr);
net/ipv6/exthdrs.c +43 -0
49 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 23/44 : Allow to replace skbuff by TLV parser.
From: Masahide NAKAMURA <[email protected]>
In receiving Mobile IPv6 home address option which is a TLV carried by destination options header, kernel will try to mangle source adderss of packet. Think of cloned skbuff it is required to replace it by the parser just like routing header case.
This is a framework to achieve that to allow TLV parser to replace inbound skbuff pointer.
--- include/net/ipv6.h | 2 +- net/ipv6/exthdrs.c | 29 +++++++++++++++++++---------- net/ipv6/ip6_input.c | 2 +- 3 files changed, 21 insertions(+), 12 deletions(-)
include/net/ipv6.h +1 -1
@@ -229,7 +229,7 @@ extern int ip6_ra_control(struct sock void (*destructor)(struct sock *)); -extern int ipv6_parse_hopopts (struct sk_buff *skb); +extern int ipv6_parse_hopopts (struct sk_buff **skbp);extern struct ipv6_txoptions *ipv6_dup_options (struct sock *sk,struct ipv6_txoptions *opt); extern struct ipv6_txoptions * ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
net/ipv6/exthdrs.c +19 -10
@@ -102,7 +102,7 @@ int ipv6_find_tlv(struct sk_buff *skb, istruct tlvtype_proc {int type; -int (*func)(struct sk_buff *skb,int offset); +int (*func)(struct sk_buff **skbp,int offset); };/*********************
@@ -111,8 +111,10 @@ struct tlvtype_proc {/* An unknown option is detected, decide what to do */ -static int ip6_tlvopt_unknown (struct sk_buff *skb,int optoff) +static int ip6_tlvopt_unknown (struct sk_buff **skbp,int optoff) { +struct sk_buff *skb = *skbp; +switch ((skb->nh.raw[optoff] &0xC0 ) >>6 ) {case 0 :/* ignore */ return 1 ;
@@ -137,8 +139,9 @@ static int ip6_tlvopt_unknown(struct sk_/* Parse tlv encoded option header (hop-by-hop or destination) */ -static int ip6_parse_tlv (struct tlvtype_proc *procs,struct sk_buff *skb) +static int ip6_parse_tlv (struct tlvtype_proc *procs,struct sk_buff **skbp) { +struct sk_buff *skb = *skbp;struct tlvtype_proc *curr;int off = skb->h.raw - skb->nh.raw;int len = ((skb->h.raw[1 ]+1 )<<3 );
@@ -168,13 +171,13 @@ static int ip6_parse_tlv(struct tlvtype_/* type specific length/alignment checks will be performed in the func(). */ -if (curr->func (skb, off) ==0 ) +if (curr->func (skbp, off) ==0 )return 0 ;break ; } }if (curr->type <0 ) { -if (ip6_tlvopt_unknown (skb, off) ==0 ) +if (ip6_tlvopt_unknown (skbp, off) ==0 )return 0 ; }break ;
@@ -213,7 +216,8 @@ static int ipv6_destopt_rcv(struct sk_bu opt->lastopt = skb->h.raw - skb->nh.raw; opt->dst1 = skb->h.raw - skb->nh.raw; -if (ip6_parse_tlv (tlvprocdestopt_lst, skb)) { +if (ip6_parse_tlv (tlvprocdestopt_lst, skbp)) { + skb = *skbp; skb->h.raw += ((skb->h.raw[1 ]+1 )<<3 ); opt->nhoff = opt->dst1;return 1 ;
@@ -517,8 +521,10 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);/* Router Alert as of RFC 2711 */ -static int ipv6_hop_ra (struct sk_buff *skb,int optoff) +static int ipv6_hop_ra (struct sk_buff **skbp,int optoff) { +struct sk_buff *skb = *skbp; +if (skb->nh.raw[optoff+1 ] ==2 ) {IP6CB (skb)->ra = optoff;return 1 ;
@@ -531,8 +537,9 @@ static int ipv6_hop_ra(struct sk_buff *s/* Jumbo payload */ -static int ipv6_hop_jumbo (struct sk_buff *skb,int optoff) +static int ipv6_hop_jumbo (struct sk_buff **skbp,int optoff) { +struct sk_buff *skb = *skbp;u32 pkt_len;if (skb->nh.raw[optoff+1 ] !=4 || (optoff&3 ) !=2 ) {
@@ -581,8 +588,9 @@ static struct tlvtype_proc tlvprochopopt { -1, } }; -int ipv6_parse_hopopts (struct sk_buff *skb) +int ipv6_parse_hopopts (struct sk_buff **skbp) { +struct sk_buff *skb = *skbp;struct inet6_skb_parm *opt =IP6CB (skb);/*
@@ -598,7 +606,8 @@ int ipv6_parse_hopopts(struct sk_buff *s } opt->hop =sizeof (struct ipv6hdr ); -if (ip6_parse_tlv (tlvprochopopt_lst, skb)) { +if (ip6_parse_tlv (tlvprochopopt_lst, skbp)) { + skb = *skbp; skb->h.raw += (skb->h.raw[1 ]+1 )<<3 ; opt->nhoff =sizeof (struct ipv6hdr );return 1 ;
net/ipv6/ip6_input.c +1 -1
@@ -111,7 +111,7 @@ int ipv6_rcv(struct sk_buff *skb, struct }if (hdr->nexthdr ==NEXTHDR_HOP ) { -if (ipv6_parse_hopopts (skb) <0 ) { +if (ipv6_parse_hopopts (&skb) <0 ) {IP6_INC_STATS_BH (IPSTATS_MIB_INHDRERRORS );return 0 ; }
Signature · 1 line
1.4.0
PATCH 24/44 MIP6: Add home address option definition.
From: Masahide NAKAMURA <[email protected]>
Add home address option definition for Mobile IPv6. Based on MIPL2 kernel patch.
--- include/linux/in6.h | 1 + include/linux/ipv6.h | 10 ++++++++++ 2 files changed, 11 insertions(+), 0 deletions(-)
include/linux/in6.h +1 -0
@@ -142,6 +142,7 @@ #define IPV6_TLV_PAD0 0#define IPV6_TLV_PADN 1#define IPV6_TLV_ROUTERALERT 5#define IPV6_TLV_JUMBO 194 +#define IPV6_TLV_HAO 201/* home address option */ /* * IPV6 socket options
include/linux/ipv6.h +10 -0
@@ -86,6 +86,16 @@ struct rt2_hdr {#define rt2_type rt_hdr.type }; +/* +* home address option in destination options header +*/ + +struct ipv6_destopt_hao { +__u8 type; +__u8 length; +struct in6_addr addr; +} __attribute__ ((__packed__ )); +struct ipv6_auth_hdr {__u8 nexthdr;__u8 hdrlen;/* This one is measured in 32 bit units! */
Signature · 1 line
1.4.0
PATCH 25/44 MIP6: Add inbound interface of home address option.
From: Masahide NAKAMURA <[email protected]>
Add inbound function of home address option by registering it to TLV table for destination options header.
Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
--- include/linux/ipv6.h | 3 ++ net/ipv6/exthdrs.c | 84 +++++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 86 insertions(+), 1 deletions(-)
include/linux/ipv6.h +3 -0
@@ -226,6 +226,9 @@ struct inet6_skb_parm {__u16 dst0;__u16 srcrt;__u16 dst1; +#ifdef CONFIG_IPV6_MIP6 +__u16 dsthao; +#endif __u16 lastopt;__u32 nhoff;__u16 flags;
net/ipv6/exthdrs.c +83 -1
108 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 26/44 MIP6: Revert address to send ICMPv6 error.
From: Masahide NAKAMURA <[email protected]>
IPv6 source address is replaced in receiving packet
with home address option carried by destination options header. To send ICMPv6 error back, original address which is received one on wire should be used. This function checks such header is included and reverts them.
Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
--- net/ipv6/icmp.c | 25 +++++++++++++++++++++++++ 1 files changed, 25 insertions(+), 0 deletions(-)
net/ipv6/icmp.c +25 -0
@@ -273,6 +273,29 @@ static int icmpv6_getfrag(void *from, chreturn 0 ; } +#ifdef CONFIG_IPV6_MIP6 +static void mip6_addr_swap (struct sk_buff *skb) +{ +struct ipv6hdr *iph = skb->nh.ipv6h; +struct inet6_skb_parm *opt =IP6CB (skb); +struct ipv6_destopt_hao *hao; +struct in6_addr tmp; +int off; + +if (opt->dsthao) { + off =ipv6_find_tlv (skb, opt->dsthao,IPV6_TLV_HAO ); +if (likely (off >=0 )) { + hao = (struct ipv6_destopt_hao *)(skb->nh.raw + off); +ipv6_addr_copy (&tmp, &iph->saddr); +ipv6_addr_copy (&iph->saddr, &hao->addr); +ipv6_addr_copy (&hao->addr, &tmp); + } + } +} +#else +static inline void mip6_addr_swap (struct sk_buff *skb) {} +#endif +/* * Send an ICMP message in response to a packet in error */
@@ -350,6 +373,8 @@ void icmpv6_send(struct sk_buff *skb, inreturn ; } +mip6_addr_swap (skb); +memset (&fl,0 ,sizeof (fl)); fl.proto =IPPROTO_ICMPV6 ;ipv6_addr_copy (&fl.fl6_dst, &hdr->saddr);
Signature · 1 line
1.4.0
PATCH 27/44 IPSEC: Support sending with Mobile IPv6 extension headers.
From: Masahide NAKAMURA <[email protected]>
Mobile IPv6 defines home address option as an option of destination options header. It is placed before fragment header then ip6_find_1stfragopt() is fixed to know about it.
Home address option also carries final source address of the flow, then outbound AH calculation should take care of it like routing header case. Based on MIPL2 kernel patch.
--- net/ipv6/ah6.c | 109 +++++++++++++++++++++++++++++++++++++++++++++++++ net/ipv6/ip6_output.c | 18 ++++++-- 2 files changed, 122 insertions(+), 5 deletions(-)
net/ipv6/ah6.c +109 -0
@@ -74,6 +74,68 @@ bad:return 0 ; } +#ifdef CONFIG_IPV6_MIP6 +/** +* ipv6_rearrange_destopt - rearrange IPv6 destination options header +* @iph: IPv6 header +* @destopt: destionation options header +*/ +static void ipv6_rearrange_destopt (struct ipv6hdr *iph,struct ipv6_opt_hdr *destopt) +{ +u8 *opt = (u8 *)destopt; +int len =ipv6_optlen (destopt); +int off =0 ; +int optlen =0 ; + + off +=2 ; + len -=2 ; + +while (len >0 ) { + +switch (opt[off]) { + +case IPV6_TLV_PAD0 : + optlen =1 ; +break ; +default : +if (len <2 ) + goto bad; + optlen = opt[off+1 ]+2 ; +if (len < optlen) + goto bad; + +/* Rearrange the source address in @iph and the +* addresses in home address option for final source. +* See 11.3.2 of RFC 3775 for details. +*/ +if (opt[off] ==IPV6_TLV_HAO ) { +struct in6_addr final_addr; +struct ipv6_destopt_hao *hao; + + hao = (struct ipv6_destopt_hao *)&opt[off]; +if (hao->length !=sizeof (hao->addr)) { +if (net_ratelimit ()) +printk (KERN_WARNING "destopt hao: invalid header length: %u\n" , hao->length); + goto bad; + } +ipv6_addr_copy (&final_addr, &hao->addr); +ipv6_addr_copy (&hao->addr, &iph->saddr); +ipv6_addr_copy (&iph->saddr, &final_addr); + } +break ; + } + + off += optlen; + len -= optlen; + } +if (len ==0 ) +return ; + +bad: +return ; +} +#endif +/** * ipv6_rearrange_rthdr - rearrange IPv6 routing header * @iph: IPv6 header
@@ -113,7 +175,11 @@ static void ipv6_rearrange_rthdr(structipv6_addr_copy (&iph->daddr, &final_addr); } +#ifdef CONFIG_IPV6_MIP6 +static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir) +#else static int ipv6_clear_mutable_options (struct ipv6hdr *iph,int len) +#endif {union {struct ipv6hdr *iph;
@@ -128,6 +194,28 @@ static int ipv6_clear_mutable_options(stwhile (exthdr.raw < end) {switch (nexthdr) { +#ifdef CONFIG_IPV6_MIP6 +case NEXTHDR_HOP : +if (!zero_out_mutable_opts (exthdr.opth)) { +LIMIT_NETDEBUG ( +KERN_WARNING "overrun %sopts\n" , + nexthdr ==NEXTHDR_HOP ? +"hop" :"dest" ); +return -EINVAL ; + } +break ; +case NEXTHDR_DEST : +if (dir ==XFRM_POLICY_OUT ) +ipv6_rearrange_destopt (iph, exthdr.opth); +if (!zero_out_mutable_opts (exthdr.opth)) { +LIMIT_NETDEBUG ( +KERN_WARNING "overrun %sopts\n" , + nexthdr ==NEXTHDR_HOP ? +"hop" :"dest" ); +return -EINVAL ; + } +break ; +#else case NEXTHDR_HOP :case NEXTHDR_DEST :if (!zero_out_mutable_opts (exthdr.opth)) {
@@ -138,6 +226,7 @@ static int ipv6_clear_mutable_options(st return -EINVAL; }break ; +#endif case NEXTHDR_ROUTING :ipv6_rearrange_rthdr (iph, exthdr.rth);
@@ -164,6 +253,9 @@ static int ah6_output(struct xfrm_stateu8 nexthdr;char tmp_base[8 ];struct { +#ifdef CONFIG_IPV6_MIP6 +struct in6_addr saddr; +#endif struct in6_addr daddr;char hdrs[0 ]; } *tmp_ext;
@@ -188,10 +280,18 @@ static int ah6_output(struct xfrm_state err = -ENOMEM ; goto error; } +#ifdef CONFIG_IPV6_MIP6 +memcpy (tmp_ext, &top_iph->saddr, extlen); + err =ipv6_clear_mutable_options (top_iph, + extlen -sizeof (*tmp_ext) + +sizeof (*top_iph), +XFRM_POLICY_OUT ); +#else memcpy (tmp_ext, &top_iph->daddr, extlen); err =ipv6_clear_mutable_options (top_iph, extlen -sizeof (*tmp_ext) +sizeof (*top_iph)); +#endif if (err) goto error_free_iph; }
@@ -219,7 +319,11 @@ static int ah6_output(struct xfrm_statememcpy (top_iph, tmp_base,sizeof (tmp_base));if (tmp_ext) { +#ifdef CONFIG_IPV6_MIP6 +memcpy (&top_iph->saddr, tmp_ext, extlen); +#else memcpy (&top_iph->daddr, tmp_ext, extlen); +#endif error_free_iph:kfree (tmp_ext); }
@@ -278,8 +382,13 @@ static int ah6_input(struct xfrm_state *if (!tmp_hdr) goto out;memcpy (tmp_hdr, skb->nh.raw, hdr_len); +#ifdef CONFIG_IPV6_MIP6 +if (ipv6_clear_mutable_options (skb->nh.ipv6h, hdr_len,XFRM_POLICY_IN )) + goto out; +#else if (ipv6_clear_mutable_options (skb->nh.ipv6h, hdr_len)) goto free_out; +#endif skb->nh.ipv6h->priority =0 ; skb->nh.ipv6h->flow_lbl[0 ] =0 ; skb->nh.ipv6h->flow_lbl[1 ] =0 ;
net/ipv6/ip6_output.c +13 -5
@@ -475,17 +475,25 @@ int ip6_find_1stfragopt(struct sk_buff *switch (**nexthdr) {case NEXTHDR_HOP : +break ;case NEXTHDR_ROUTING : + found_rhdr =1 ; +break ;case NEXTHDR_DEST : -if (**nexthdr ==NEXTHDR_ROUTING ) found_rhdr =1 ; -if (**nexthdr ==NEXTHDR_DEST && found_rhdr)return offset; - offset +=ipv6_optlen (exthdr); - *nexthdr = &exthdr->nexthdr; - exthdr = (struct ipv6_opt_hdr *)(skb->nh.raw + offset); +#ifdef CONFIG_IPV6_MIP6 +if (ipv6_find_tlv (skb, offset,IPV6_TLV_HAO ) >=0 ) +break ; +#endif +if (found_rhdr) +return offset;break ;default :return offset; } + + offset +=ipv6_optlen (exthdr); + *nexthdr = &exthdr->nexthdr; + exthdr = (struct ipv6_opt_hdr *)(skb->nh.raw + offset); }return offset;
Signature · 1 line
1.4.0
PATCH 28/44 MIP6: Add routing header type 2 transformation.
From: Masahide NAKAMURA <[email protected]>
Add routing header type 2 transformation for Mobile IPv6. Based on MIPL2 kernel patch.
--- include/net/mip6.h | 31 +++++++++ net/ipv6/Makefile | 2 + net/ipv6/af_inet6.c | 9 +++ net/ipv6/mip6.c | 181 +++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 223 insertions(+), 0 deletions(-)
include/net/mip6.h new file +31 -0
@@ -0,0 +1,31 @@ +/* +* Copyright (C)2003-2006 Helsinki University of Technology +* Copyright (C)2003-2006 USAGI/WIDE Project +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of the GNU General Public License as published by +* the Free Software Foundation; either version 2 of the License, or +* (at your option) any later version. +* +* This program is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +* GNU General Public License for more details. +* +* You should have received a copy of the GNU General Public License +* along with this program; if not, write to the Free Software +* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +*/ +/* +* Authors: +* Noriaki TAKAMIYA @USAGI +* Masahide NAKAMURA @USAGI +* YOSHIFUJI Hideaki @USAGI +*/ +#ifndef _NET_MIP6_H +#define _NET_MIP6_H + +extern int mip6_init (void ); +extern void mip6_fini (void ); + +#endif
net/ipv6/Makefile +2 -0
@@ -14,6 +14,8 @@ ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xf xfrm6_output.o ipv6-$(CONFIG_NETFILTER) += netfilter.o ipv6-$(CONFIG_IPV6_MULTIPLE_TABLES) += fib6_rules.o +ipv6-$(CONFIG_IPV6_MIP6) += mip6.o + ipv6-objs += $(ipv6-y) obj-$(CONFIG_INET6_AH) += ah6.o
net/ipv6/af_inet6.c +9 -0
@@ -59,6 +59,9 @@ #include <net/addrconf.h>#ifdef CONFIG_IPV6_TUNNEL #include <net/ip6_tunnel.h> #endif +#ifdef CONFIG_IPV6_MIP6 +#include <net/mip6.h> +#endif #include <asm/uaccess.h> #include <asm/system.h>
@@ -857,6 +860,9 @@ #endifipv6_frag_init ();ipv6_nodata_init ();ipv6_destopt_init (); +#ifdef CONFIG_IPV6_MIP6 +mip6_init (); +#endif /* Init v6 transport protocols. */ udpv6_init ();
@@ -920,6 +926,9 @@ #ifdef CONFIG_PROC_FStcp6_proc_exit ();raw6_proc_exit ();#endif +#ifdef CONFIG_IPV6_MIP6 +mip6_fini (); +#endif /* Cleanup code parts. */ sit_cleanup ();ip6_flowlabel_cleanup ();
net/ipv6/mip6.c new file +181 -0
181 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 29/44 MIP6: Add destination options header transformation.
From: Masahide NAKAMURA <[email protected]>
Add destination options header transformation for Mobile IPv6. Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
--- include/net/mip6.h | 3 + net/ipv6/mip6.c | 167 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 170 insertions(+), 0 deletions(-)
include/net/mip6.h +3 -0
@@ -25,6 +25,9 @@#ifndef _NET_MIP6_H#define _NET_MIP6_H +#define MIP6_OPT_PAD_1 0 +#define MIP6_OPT_PAD_N 1 +extern int mip6_init (void );extern void mip6_fini (void );
net/ipv6/mip6.c +167 -0
189 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 30/44 STATE: Add Mobile IPv6 route optimization protocols to netlink interface.
From: Masahide NAKAMURA <[email protected]>
Add Mobile IPv6 route optimization protocols to netlink interface. Route optimization states carry care-of address.
Based on MIPL2 kernel patch.
--- net/xfrm/xfrm_user.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-)
net/xfrm/xfrm_user.c +16 -0
@@ -27,6 +27,9 @@ #include <net/sock.h>#include <net/xfrm.h> #include <net/netlink.h> #include <asm/uaccess.h> +#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE ) +#include <linux/in6.h> +#endif static int verify_one_alg (struct rtattr **xfrma,enum xfrm_attr_type_t type) {
@@ -172,6 +175,19 @@ #endif goto out;break ; +#if defined(CONFIG_IPV6 ) || defined(CONFIG_IPV6_MODULE ) +case IPPROTO_DSTOPTS : +case IPPROTO_ROUTING : +if (xfrma[XFRMA_ALG_COMP -1 ] || + xfrma[XFRMA_ALG_AUTH -1 ] || + xfrma[XFRMA_ALG_CRYPT -1 ] || + xfrma[XFRMA_ENCAP -1 ] || + xfrma[XFRMA_SEC_CTX -1 ] || + !xfrma[XFRMA_COADDR -1 ]) + goto out; +break ; +#endif +default : goto out; };
Signature · 1 line
1.4.0
PATCH 31/44 MIP6: Add Mobility header definition.
From: Masahide NAKAMURA <[email protected]>
Add Mobility header definition for Mobile IPv6.
Based on MIPL2 kernel patch.
This patch was also written by: Antti Tuominen <[email protected]>
--- include/linux/in6.h | 1 + include/net/flow.h | 9 +++++++++ include/net/ipv6.h | 1 + include/net/mip6.h | 23 +++++++++++++++++++++++ 4 files changed, 34 insertions(+), 0 deletions(-)
include/linux/in6.h +1 -0
@@ -134,6 +134,7 @@ #define IPPROTO_FRAGMENT 44 /* IPv6 frag#define IPPROTO_ICMPV6 58/* ICMPv6 */ #define IPPROTO_NONE 59/* IPv6 no next header */ #define IPPROTO_DSTOPTS 60/* IPv6 destination options */ +#define IPPROTO_MH 135/* IPv6 mobility header */ /* * IPv6 TLV options.
include/net/flow.h +9 -0
@@ -72,12 +72,21 @@ #define FLOWI_FLAG_MULTIPATHOLDROUTE 0x0 } dnports;__u32 spi; + +#ifdef CONFIG_IPV6_MIP6 +struct { +__u8 type; + } mht; +#endif } uli_u;#define fl_ip_sport uli_u.ports.sport#define fl_ip_dport uli_u.ports.dport#define fl_icmp_type uli_u.icmpt.type#define fl_icmp_code uli_u.icmpt.code#define fl_ipsec_spi uli_u.spi +#ifdef CONFIG_IPV6_MIP6 +#define fl_mh_type uli_u.mht.type +#endif __u32 secid;/* used by xfrm; see secid.txt */ } __attribute__((__aligned__(BITS_PER_LONG/8)));
include/net/ipv6.h +1 -0
@@ -40,6 +40,7 @@ #define NEXTHDR_AUTH 51 /* Authenticati#define NEXTHDR_ICMP 58/* ICMP for IPv6. */ #define NEXTHDR_NONE 59/* No next header */ #define NEXTHDR_DEST 60/* Destination options header. */ +#define NEXTHDR_MOBILITY 135/* Mobility header. */ #define NEXTHDR_MAX 255
include/net/mip6.h +23 -0
@@ -28,6 +28,29 @@ #define _NET_MIP6_H#define MIP6_OPT_PAD_1 0#define MIP6_OPT_PAD_N 1 +/* +* Mobility Header +*/ +struct ip6_mh { +__u8 ip6mh_proto; +__u8 ip6mh_hdrlen; +__u8 ip6mh_type; +__u8 ip6mh_reserved; +__u16 ip6mh_cksum; +/* Followed by type specific messages */ +__u8 data[0 ]; +} __attribute__ ((__packed__ )); + +#define IP6_MH_TYPE_BRR 0/* Binding Refresh Request */ +#define IP6_MH_TYPE_HOTI 1/* HOTI Message */ +#define IP6_MH_TYPE_COTI 2/* COTI Message */ +#define IP6_MH_TYPE_HOT 3/* HOT Message */ +#define IP6_MH_TYPE_COT 4/* COT Message */ +#define IP6_MH_TYPE_BU 5/* Binding Update */ +#define IP6_MH_TYPE_BACK 6/* Binding ACK */ +#define IP6_MH_TYPE_BERROR 7/* Binding Error */ +#define IP6_MH_TYPE_MAX IP6_MH_TYPE_BERROR +extern int mip6_init (void );extern void mip6_fini (void );
Signature · 1 line
1.4.0
PATCH 32/44 MIP6: Add receiving mobility header functions through raw socket.
From: Masahide NAKAMURA <[email protected]>
Like ICMPv6, mobility header is handled through raw socket.
In inbound case, check only whether ICMPv6 error should be sent as a reply or not by kernel.
Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]> This patch was also written by: Antti Tuominen <[email protected]>
--- include/net/mip6.h | 4 +++ net/ipv6/mip6.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++++ net/ipv6/raw.c | 29 ++++++++++++++++++ 3 files changed, 115 insertions(+), 1 deletions(-)
include/net/mip6.h +4 -0
@@ -25,6 +25,9 @@#ifndef _NET_MIP6_H#define _NET_MIP6_H +#include <linux/skbuff.h> +#include <net/sock.h> +#define MIP6_OPT_PAD_1 0#define MIP6_OPT_PAD_N 1
@@ -53,5 +56,6 @@ #define IP6_MH_TYPE_MAX IP6_MH_TYPE_BERextern int mip6_init (void );extern void mip6_fini (void ); +extern int mip6_mh_filter (struct sock *sk,struct sk_buff *skb);#endif
net/ipv6/mip6.c +83 -0
96 lines not on this page · raw message
net/ipv6/raw.c +28 -1
@@ -50,6 +50,9 @@ #include <net/transp_v6.h>#include <net/udp.h> #include <net/inet_common.h> #include <net/tcp_states.h> +#ifdef CONFIG_IPV6_MIP6 +#include <net/mip6.h> +#endif #include <net/rawv6.h> #include <net/xfrm.h>
@@ -169,8 +172,32 @@ int ipv6_raw_deliver(struct sk_buff *skb sk =__raw_v6_lookup (sk, nexthdr, daddr, saddr,IP6CB (skb)->iif);while (sk) { +int filtered; + delivered =1 ; -if (nexthdr !=IPPROTO_ICMPV6 || !icmpv6_filter (sk, skb)) { +switch (nexthdr) { +case IPPROTO_ICMPV6 : + filtered =icmpv6_filter (sk, skb); +break ; +#ifdef CONFIG_IPV6_MIP6 +case IPPROTO_MH : +/* XXX: To validate MH only once for each packet, +* this is placed here. It should be after checking +* xfrm policy, however it doesn't. The checking xfrm +* policy is placed in rawv6_rcv() because it is +* required for each socket. +*/ + filtered =mip6_mh_filter (sk, skb); +break ; +#endif +default : + filtered =0 ; +break ; + } + +if (filtered <0 ) +break ; +if (filtered ==0 ) {struct sk_buff *clone =skb_clone (skb,GFP_ATOMIC );/* Not releasing hash table! */
Signature · 1 line
1.4.0
PATCH 33/44 MIP6: Add sending mobility header functions through raw socket.
From: Masahide NAKAMURA <[email protected]>
Mobility header is built by user-space and sent through raw socket. Kernel just extracts its type to flow.
Based on MIPL2 kernel patch.
--- net/ipv6/raw.c | 17 +++++++++++++++++ 1 files changed, 17 insertions(+), 0 deletions(-)
net/ipv6/raw.c +17 -0
@@ -609,6 +609,9 @@ static void rawv6_probe_proto_opt(structstruct iovec *iov;u8 __user *type =NULL ;u8 __user *code =NULL ; +#ifdef CONFIG_IPV6_MIP6 +u8 len =0 ; +#endif int probed =0 ;int i;
@@ -640,6 +643,20 @@ static void rawv6_probe_proto_opt(struct probed =1 ; }break ; +#ifdef CONFIG_IPV6_MIP6 +case IPPROTO_MH : +if (iov->iov_base && iov->iov_len <1 ) +break ; +/* check if type field is readable or not. */ +if (iov->iov_len >2 - len) { +u8 __user *p = iov->iov_base; +get_user (fl->fl_mh_type, &p[2 - len]); + probed =1 ; + }else + len += iov->iov_len; + +break ; +#endif default : probed =1 ;break ;
Signature · 1 line
1.4.0
PATCH 34/44 MIP6: Transformation support mobility header.
From: Masahide NAKAMURA <[email protected]>
Transformation support mobility header.
Based on MIPL2 kernel patch.
--- include/net/xfrm.h | 5 +++++ net/ipv6/xfrm6_policy.c | 15 +++++++++++++++ 2 files changed, 20 insertions(+), 0 deletions(-)
include/net/xfrm.h +5 -0
@@ -547,6 +547,11 @@ u16 xfrm_flowi_sport(struct flowi *fl)case IPPROTO_ICMPV6 : port =htons (fl->fl_icmp_type);break ; +#ifdef CONFIG_IPV6_MIP6 +case IPPROTO_MH : + port =htons (fl->fl_mh_type); +break ; +#endif default : port =0 ;/*XXX*/ }
net/ipv6/xfrm6_policy.c +15 -0
@@ -18,6 +18,9 @@ #include <net/xfrm.h>#include <net/ip.h> #include <net/ipv6.h> #include <net/ip6_route.h> +#ifdef CONFIG_IPV6_MIP6 +#include <net/mip6.h> +#endif static struct dst_ops xfrm6_dst_ops;static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
@@ -270,6 +273,18 @@ _decode_session6(struct sk_buff *skb, st fl->proto = nexthdr;return ; +#ifdef CONFIG_IPV6_MIP6 +case IPPROTO_MH : +if (pskb_may_pull (skb, skb->nh.raw + offset +3 - skb->data)) { +struct ip6_mh *mh; + mh = (struct ip6_mh *)exthdr; + + fl->fl_mh_type = mh->ip6mh_type; + } + fl->proto = nexthdr; +return ; +#endif +/* XXX Why are there these headers? */ case IPPROTO_AH :case IPPROTO_ESP :
Signature · 1 line
1.4.0
PATCH 35/44 : Trace which secpath state is reject factor.
From: Masahide NAKAMURA <[email protected]>
For Mobile IPv6 usage, it is required to trace which secpath state is reject factor in order to notify it to user space (to know the address which cannot be used route optimized communication).
Based on MIPL2 kernel patch.
This patch was also written by: Henrik Petander <[email protected]>
--- include/net/xfrm.h | 1 + net/xfrm/xfrm_policy.c | 55 ++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 49 insertions(+), 7 deletions(-)
include/net/xfrm.h +1 -0
@@ -274,6 +274,7 @@ #define XFRM_TYPE_NON_FRAGMENT 1void (*destructor)(struct xfrm_state *);int (*input)(struct xfrm_state *,struct sk_buff *skb);int (*output)(struct xfrm_state *,struct sk_buff *pskb); +int (*reject)(struct xfrm_state *,struct sk_buff *,struct flowi *);int (*hdr_offset)(struct xfrm_state *,struct sk_buff *,u8 **);xfrm_address_t *(*local_addr)(struct xfrm_state *,xfrm_address_t *);xfrm_address_t *(*remote_addr)(struct xfrm_state *,xfrm_address_t *);
net/xfrm/xfrm_policy.c +48 -7
110 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 36/44 : Introduce XFRM_MSG_REPORT.
From: Masahide NAKAMURA <[email protected]>
XFRM_MSG_REPORT is a message as notification of state protocol and selector from kernel to user-space.
Mobile IPv6 will use it when inbound reject is occurred at route optimization to make user-space know a binding error requirement.
Based on MIPL2 kernel patch.
--- include/linux/xfrm.h | 12 ++++++++++++ include/net/xfrm.h | 2 ++ net/xfrm/xfrm_state.c | 19 +++++++++++++++++++ net/xfrm/xfrm_user.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 79 insertions(+), 0 deletions(-)
include/linux/xfrm.h +12 -0
@@ -166,6 +166,10 @@ #define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FL#define XFRM_MSG_NEWAE XFRM_MSG_NEWAE XFRM_MSG_GETAE,#define XFRM_MSG_GETAE XFRM_MSG_GETAE + + XFRM_MSG_REPORT, +#define XFRM_MSG_REPORT XFRM_MSG_REPORT + __XFRM_MSG_MAX };#define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
@@ -325,12 +329,18 @@ struct xfrm_usersa_flush {__u8 proto; }; +struct xfrm_user_report { +__u8 proto; +struct xfrm_selector sel; +}; +#ifndef __KERNEL__/* backwards compatibility for userspace */ #define XFRMGRP_ACQUIRE 1#define XFRMGRP_EXPIRE 2#define XFRMGRP_SA 4#define XFRMGRP_POLICY 8 +#define XFRMGRP_REPORT 0x10#endif enum xfrm_nlgroups {
@@ -346,6 +356,8 @@ #define XFRMNLGRP_SA XFRMNLGRP_SA#define XFRMNLGRP_POLICY XFRMNLGRP_POLICY XFRMNLGRP_AEVENTS,#define XFRMNLGRP_AEVENTS XFRMNLGRP_AEVENTS + XFRMNLGRP_REPORT, +#define XFRMNLGRP_REPORT XFRMNLGRP_REPORT __XFRMNLGRP_MAX };#define XFRMNLGRP_MAX (__XFRMNLGRP_MAX - 1)
include/net/xfrm.h +2 -0
@@ -382,6 +382,7 @@ struct xfrm_mgrstruct xfrm_policy *(*compile_policy)(struct sock *sk,int opt,u8 *data,int len,int *dir);int (*new_mapping)(struct xfrm_state *x,xfrm_address_t *ipaddr,u16 sport);int (*notify_policy)(struct xfrm_policy *x,int dir,struct km_event *c); +int (*report)(u8 proto,struct xfrm_selector *sel,xfrm_address_t *addr); };extern int xfrm_register_km (struct xfrm_mgr *km);
@@ -1043,6 +1044,7 @@ extern void xfrm_init_pmtu(struct dst_enextern wait_queue_head_t km_waitq;extern int km_new_mapping (struct xfrm_state *x,xfrm_address_t *ipaddr,u16 sport);extern void km_policy_expired (struct xfrm_policy *pol,int dir,int hard,u32 pid); +extern int km_report (u8 proto,struct xfrm_selector *sel,xfrm_address_t *addr);extern void xfrm_input_init (void );extern int xfrm_parse_spi (struct sk_buff *skb,u8 nexthdr,u32 *spi,u32 *seq);
net/xfrm/xfrm_state.c +19 -0
@@ -1055,6 +1055,25 @@ void km_policy_expired(struct xfrm_polic }EXPORT_SYMBOL (km_policy_expired); +int km_report (u8 proto,struct xfrm_selector *sel,xfrm_address_t *addr) +{ +int err = -EINVAL ; +int ret; +struct xfrm_mgr *km; + +read_lock (&xfrm_km_lock); +list_for_each_entry (km, &xfrm_km_list, list) { +if (km->report) { + ret = km->report (proto, sel, addr); +if (!ret) + err = ret; + } + } +read_unlock (&xfrm_km_lock); +return err; +} +EXPORT_SYMBOL (km_report); +int xfrm_user_policy (struct sock *sk,int optname,u8 __user *optval,int optlen) {int err;
net/xfrm/xfrm_user.c +46 -0
64 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 37/44 MIP6: Report to user-space when home address option is rejected.
From: Masahide NAKAMURA <[email protected]>
Report to user-space when home address option is rejected.
In receiving this message user-space application will send Mobile IPv6 binding error. It is rate-limited by kernel.
Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
--- net/ipv6/mip6.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 83 insertions(+), 0 deletions(-)
net/ipv6/mip6.c +83 -0
@@ -25,6 +25,7 @@#include <linux/config.h> #include <linux/module.h> #include <linux/skbuff.h> +#include <linux/time.h> #include <linux/ipv6.h> #include <linux/icmpv6.h> #include <net/sock.h>
@@ -138,6 +139,18 @@ int mip6_mh_filter(struct sock *sk, strureturn 0 ; } +struct mip6_report_rate_limiter { +spinlock_t lock; +struct timeval stamp; +int iif; +struct in6_addr src; +struct in6_addr dst; +}; + +static struct mip6_report_rate_limiter mip6_report_rl = { + .lock =SPIN_LOCK_UNLOCKED +}; +static int mip6_destopt_input (struct xfrm_state *x,struct sk_buff *skb) {struct ipv6hdr *iph = skb->nh.ipv6h;
@@ -189,6 +202,75 @@ static int mip6_destopt_output(struct xfreturn 0 ; } +static inline int mip6_report_rl_allow (struct timeval *stamp, +struct in6_addr *dst, +struct in6_addr *src,int iif) +{ +int allow =0 ; + +spin_lock_bh (&mip6_report_rl.lock); +if (mip6_report_rl.stamp.tv_sec != stamp->tv_sec || + mip6_report_rl.stamp.tv_usec != stamp->tv_usec || + mip6_report_rl.iif != iif || + !ipv6_addr_equal (&mip6_report_rl.src, src) || + !ipv6_addr_equal (&mip6_report_rl.dst, dst)) { + mip6_report_rl.stamp.tv_sec = stamp->tv_sec; + mip6_report_rl.stamp.tv_usec = stamp->tv_usec; + mip6_report_rl.iif = iif; +ipv6_addr_copy (&mip6_report_rl.src, src); +ipv6_addr_copy (&mip6_report_rl.dst, dst); + allow =1 ; + } +spin_unlock_bh (&mip6_report_rl.lock); +return allow; +} + +static int mip6_destopt_reject (struct xfrm_state *x,struct sk_buff *skb,struct flowi *fl) +{ +struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb; +struct ipv6_destopt_hao *hao =NULL ; +struct xfrm_selector sel; +int offset; +struct timeval stamp; +int err =0 ; + +if (likely (opt->dsthao)) { + offset =ipv6_find_tlv (skb, opt->dsthao,IPV6_TLV_HAO ); +if (likely (offset >=0 )) + hao = (struct ipv6_destopt_hao *)(skb->nh.raw + offset); + } + +skb_get_timestamp (skb, &stamp); + +if (!mip6_report_rl_allow (&stamp, &skb->nh.ipv6h->daddr, + hao ? &hao->addr : &skb->nh.ipv6h->saddr, + opt->iif)) + goto out; + +memset (&sel,0 ,sizeof (sel)); +memcpy (&sel.daddr, (xfrm_address_t *)&skb->nh.ipv6h->daddr, +sizeof (sel.daddr)); + sel.prefixlen_d =128 ; +memcpy (&sel.saddr, (xfrm_address_t *)&skb->nh.ipv6h->saddr, +sizeof (sel.saddr)); + sel.prefixlen_s =128 ; + sel.family =AF_INET6 ; + sel.proto = fl->proto; + sel.dport =xfrm_flowi_dport (fl); +if (sel.dport) + sel.dport_mask = ~((__u16 )0 ); + sel.sport =xfrm_flowi_sport (fl); +if (sel.sport) + sel.sport_mask = ~((__u16 )0 ); + sel.ifindex = fl->oif; + + err =km_report (IPPROTO_DSTOPTS , &sel, + (hao ? (xfrm_address_t *)&hao->addr :NULL )); + + out: +return err; +} +static int mip6_destopt_offset (struct xfrm_state *x,struct sk_buff *skb,u8 **nexthdr) {
@@ -273,6 +355,7 @@ static struct xfrm_type mip6_destopt_typ .destructor = mip6_destopt_destroy, .input = mip6_destopt_input, .output = mip6_destopt_output, + .reject = mip6_destopt_reject, .hdr_offset = mip6_destopt_offset, .local_addr = mip6_xfrm_addr, };
Signature · 1 line
1.4.0
PATCH 38/44 MIP6: Ignore to report if mobility headers is rejected.
From: Masahide NAKAMURA <[email protected]>
Ignore to report user-space for known mobility headers rejected by destination options header transformation.
Mobile IPv6 specification (RFC3775) says that mobility header is used with destination options header carrying home address option only for binding update message. Other type message cannot be used and node must drop it silently (and must not send binding error) if receving such packet.
To achieve it, (1) application should use transformation policy and wild-card states to catch binding update message prior other packets
(2) kernel doesn't report the reject to user-space not to send binding error message by application.
This patch is for (2).
Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
--- net/ipv6/mip6.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
net/ipv6/mip6.c +3 -0
@@ -234,6 +234,9 @@ static int mip6_destopt_reject(struct xfstruct timeval stamp;int err =0 ; +if (unlikely (fl->proto ==IPPROTO_MH && fl->fl_mh_type <=IP6_MH_TYPE_MAX )) + goto out; +if (likely (opt->dsthao)) { offset =ipv6_find_tlv (skb, opt->dsthao,IPV6_TLV_HAO );if (likely (offset >=0 ))
Signature · 1 line
1.4.0
PATCH 39/44 POLICY: Add Kconfig to support sub policy.
From: Masahide NAKAMURA <[email protected]>
Add Kconfig to support sub policy.
--- net/xfrm/Kconfig | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)
net/xfrm/Kconfig +10 -0
@@ -14,6 +14,16 @@ config XFRM_USER If unsure, say Y. +config XFRM_SUB_POLICY + bool "Transformation sub policy support (EXPERIMENTAL)" + depends on XFRM && EXPERIMENTAL + ---help--- + Support sub policy for developers. By using sub policy with main + one, two policies can be applied to the same packet at once. + Policy which lives shorter time in kernel should be a sub. + + If unsure, say N. + config NET_KEY tristate "PF_KEY sockets" select XFRM
Signature · 1 line
1.4.0
PATCH 40/44 POLICY: sub policy support.
From: Masahide NAKAMURA <[email protected]>
Sub policy is introduced. Main and sub policy are applied the same flow. (Policy that current kernel uses is named as main.)
It is required another transformation policy management to keep IPsec and Mobile IPv6 lives separate.
Policy which lives shorter time in kernel should be a sub i.e. normally main is for IPsec and sub is for Mobile IPv6.
(Such usage as two IPsec policies on different database can be used, too.)
Limitation or TODOs:
- Sub policy is not supported for per socket one (it is always inserted as main).
- Current kernel makes cached outbound with flowi to skip searching database. However this patch makes it disabled only when "two policies are used and the first matched one is bypass case" because neither flowi nor bundle information knows about transformation template size.
--- include/linux/xfrm.h | 7 + include/net/xfrm.h | 45 +++++++-- net/xfrm/xfrm_policy.c | 252 +++++++++++++++++++++++++++++++++++++++++------- 3 files changed, 260 insertions(+), 44 deletions(-)
include/linux/xfrm.h +7 -0
@@ -104,6 +104,13 @@ struct xfrm_stats {enum { +XFRM_POLICY_TYPE_MAIN =0 , +XFRM_POLICY_TYPE_SUB =1 , +XFRM_POLICY_TYPE_MAX =2 +}; + +enum +{XFRM_POLICY_IN =0 ,XFRM_POLICY_OUT =1 ,XFRM_POLICY_FWD =2 ,
include/net/xfrm.h +37 -8
88 lines not on this page · raw message
net/xfrm/xfrm_policy.c +216 -36
508 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 41/44 : Add sorting interface for state and template.
From: Masahide NAKAMURA <[email protected]>
Under two transformation policies it is required to merge them. This is a platform to sort state for outbound and templates for inbound respectively.
It will be used when Mobile IPv6 and IPsec are used at the same time.
--- include/net/xfrm.h | 20 ++++++++++++++++++++ net/xfrm/xfrm_policy.c | 16 ++++++++++++++-- net/xfrm/xfrm_state.c | 38 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 72 insertions(+), 2 deletions(-)
include/net/xfrm.h +20 -0
@@ -255,6 +255,8 @@ struct xfrm_state_afinfo {struct xfrm_state *(*find_acq)(u8 mode,u32 reqid,u8 proto,xfrm_address_t *daddr,xfrm_address_t *saddr,int create); +int (*tmpl_sort)(struct xfrm_tmpl **dst,struct xfrm_tmpl **src,int n); +int (*state_sort)(struct xfrm_state **dst,struct xfrm_state **src,int n); };extern int xfrm_state_register_afinfo (struct xfrm_state_afinfo *afinfo);
@@ -1002,6 +1004,24 @@ extern int xfrm_state_add(struct xfrm_stextern int xfrm_state_update (struct xfrm_state *x);extern struct xfrm_state *xfrm_state_lookup (xfrm_address_t *daddr,u32 spi,u8 proto,unsigned short family);extern struct xfrm_state *xfrm_state_lookup_byaddr (xfrm_address_t *daddr,xfrm_address_t *saddr,u8 proto,unsigned short family); +#ifdef CONFIG_XFRM_SUB_POLICY +extern int xfrm_tmpl_sort (struct xfrm_tmpl **dst,struct xfrm_tmpl **src, +int n,unsigned short family); +extern int xfrm_state_sort (struct xfrm_state **dst,struct xfrm_state **src, +int n,unsigned short family); +#else +static inline int xfrm_tmpl_sort (struct xfrm_tmpl **dst,struct xfrm_tmpl **src, +int n,unsigned short family) +{ +return -ENOSYS ; +} + +static inline int xfrm_state_sort (struct xfrm_state **dst,struct xfrm_state **src, +int n,unsigned short family) +{ +return -ENOSYS ; +} +#endif extern struct xfrm_state *xfrm_find_acq_byseq (u32 seq);extern int xfrm_state_delete (struct xfrm_state *x);extern void xfrm_state_flush (u8 proto);
net/xfrm/xfrm_policy.c +14 -2
@@ -861,6 +861,8 @@ xfrm_tmpl_resolve(struct xfrm_policy **p struct xfrm_state **xfrm, unsigned short family) { +struct xfrm_state *tp[XFRM_MAX_DEPTH ]; +struct xfrm_state **tpp = (npols >1 ) ? tp : xfrm;int cnx =0 ;int error;int ret;
@@ -871,7 +873,8 @@ xfrm_tmpl_resolve(struct xfrm_policy **p error = -ENOBUFS ; goto fail; } - ret =xfrm_tmpl_resolve_one (pols[i], fl, &xfrm[cnx], family); + + ret =xfrm_tmpl_resolve_one (pols[i], fl, &tpp[cnx], family);if (ret <0 ) { error = ret; goto fail;
@@ -879,11 +882,15 @@ xfrm_tmpl_resolve(struct xfrm_policy **p cnx += ret; } +/* found states are sorted for outbound processing */ +if (npols >1 ) +xfrm_state_sort (xfrm, tpp, cnx, family); +return cnx; fail:for (cnx--; cnx>=0 ; cnx--) -xfrm_state_put (xfrm[cnx]); +xfrm_state_put (tpp[cnx]);return error; }
@@ -1280,6 +1287,7 @@ #endifstruct sec_path *sp;static struct sec_path dummy;struct xfrm_tmpl *tp[XFRM_MAX_DEPTH ]; +struct xfrm_tmpl *stp[XFRM_MAX_DEPTH ];struct xfrm_tmpl **tpp = tp;int ti =0 ;int i, k;
@@ -1297,6 +1305,10 @@ #endif tpp[ti++] = &pols[pi]->xfrm_vec[i]; } xfrm_nr = ti; +if (npols >1 ) { +xfrm_tmpl_sort (stp, tpp, xfrm_nr, family); + tpp = stp; + }/* For each tunnel xfrm, find the first matching tmpl. * For each tmpl before that, find corresponding xfrm.
net/xfrm/xfrm_state.c +38 -0
@@ -728,6 +728,44 @@ xfrm_find_acq(u8 mode, u32 reqid, u8 pro }EXPORT_SYMBOL (xfrm_find_acq); +#ifdef CONFIG_XFRM_SUB_POLICY +int +xfrm_tmpl_sort (struct xfrm_tmpl **dst,struct xfrm_tmpl **src,int n, +unsigned short family) +{ +int err =0 ; +struct xfrm_state_afinfo *afinfo =xfrm_state_get_afinfo (family); +if (!afinfo) +return -EAFNOSUPPORT ; + +spin_lock_bh (&xfrm_state_lock); +if (afinfo->tmpl_sort) + err = afinfo->tmpl_sort (dst, src, n); +spin_unlock_bh (&xfrm_state_lock); +xfrm_state_put_afinfo (afinfo); +return err; +} +EXPORT_SYMBOL (xfrm_tmpl_sort); + +int +xfrm_state_sort (struct xfrm_state **dst,struct xfrm_state **src,int n, +unsigned short family) +{ +int err =0 ; +struct xfrm_state_afinfo *afinfo =xfrm_state_get_afinfo (family); +if (!afinfo) +return -EAFNOSUPPORT ; + +spin_lock_bh (&xfrm_state_lock); +if (afinfo->state_sort) + err = afinfo->state_sort (dst, src, n); +spin_unlock_bh (&xfrm_state_lock); +xfrm_state_put_afinfo (afinfo); +return err; +} +EXPORT_SYMBOL (xfrm_state_sort); +#endif +/* Silly enough, but I'm lazy to build resolution list */ static struct xfrm_state *__xfrm_find_acq_byseq (u32 seq)
Signature · 1 line
1.4.0
PATCH 42/44 POLICY: Support netlink socket interface for sub policy.
From: Masahide NAKAMURA <[email protected]>
Sub policy can be used through netlink socket. PF_KEY uses main only and it is TODO to support sub.
--- include/linux/xfrm.h | 7 +++ include/net/xfrm.h | 1 net/key/af_key.c | 18 +++++-- net/xfrm/xfrm_user.c | 134 +++++++++++++++++++++++++++++++++++++++++++++----- 4 files changed, 142 insertions(+), 18 deletions(-)
include/linux/xfrm.h +7 -0
@@ -230,6 +230,12 @@ enum xfrm_ae_ftype_t {#define XFRM_AE_MAX (__XFRM_AE_MAX - 1) }; +struct xfrm_userpolicy_type { +__u8 type; +__u16 reserved1; +__u8 reserved2; +}; +/* Netlink message attributes. */ enum xfrm_attr_type_t {XFRMA_UNSPEC ,
@@ -248,6 +254,7 @@ enum xfrm_attr_type_t {XFRMA_SRCADDR ,/* xfrm_address_t */ XFRMA_COADDR ,/* xfrm_address_t */ XFRMA_LASTUSED , +XFRMA_POLICY_TYPE ,/* struct xfrm_userpolicy_type */ __XFRMA_MAX#define XFRMA_MAX (__XFRMA_MAX - 1)
include/net/xfrm.h +1 -0
@@ -204,6 +204,7 @@ struct km_eventu32 proto;u32 byid;u32 aevent; +u32 type; } data;u32 seq;
net/key/af_key.c +13 -5
@@ -1731,7 +1731,8 @@ static u32 gen_reqid(void) ++reqid;if (reqid ==0 ) reqid =IPSEC_MANUAL_REQID_MAX +1 ; -if (xfrm_policy_walk (check_reqid, (void *)&reqid) != -EEXIST ) +if (xfrm_policy_walk (XFRM_POLICY_TYPE_MAIN , check_reqid, + (void *)&reqid) != -EEXIST )return reqid; }while (reqid != start);return 0 ;
@@ -2268,7 +2269,8 @@ static int pfkey_spddelete(struct sock *return err; } - xp =xfrm_policy_bysel_ctx (pol->sadb_x_policy_dir-1 , &sel, tmp.security,1 ); + xp =xfrm_policy_bysel_ctx (XFRM_POLICY_TYPE_MAIN , pol->sadb_x_policy_dir-1 , + &sel, tmp.security,1 );security_xfrm_policy_free (&tmp);if (xp ==NULL )return -ENOENT ;
@@ -2330,7 +2332,7 @@ static int pfkey_spdget(struct sock *sk,if (dir >=XFRM_POLICY_MAX )return -EINVAL ; - xp =xfrm_policy_byid (dir, pol->sadb_x_policy_id, + xp =xfrm_policy_byid (XFRM_POLICY_TYPE_MAIN , dir, pol->sadb_x_policy_id, hdr->sadb_msg_type ==SADB_X_SPDDELETE2 );if (xp ==NULL )return -ENOENT ;
@@ -2378,7 +2380,7 @@ static int pfkey_spddump(struct sock *sk {struct pfkey_dump_data data = { .skb = skb, .hdr = hdr, .sk = sk }; -return xfrm_policy_walk (dump_sp, &data); +return xfrm_policy_walk (XFRM_POLICY_TYPE_MAIN , dump_sp, &data); }static int key_notify_policy_flush (struct km_event *c)
@@ -2405,7 +2407,8 @@ static int pfkey_spdflush(struct sock *s {struct km_event c; -xfrm_policy_flush (); +xfrm_policy_flush (XFRM_POLICY_TYPE_MAIN ); + c.data.type =XFRM_POLICY_TYPE_MAIN ; c.event =XFRM_MSG_FLUSHPOLICY ; c.pid = hdr->sadb_msg_pid; c.seq = hdr->sadb_msg_seq;
@@ -2667,6 +2670,9 @@ static int pfkey_send_notify(struct xfrmstatic int pfkey_send_policy_notify (struct xfrm_policy *xp,int dir,struct km_event *c) { +if (xp && xp->type !=XFRM_POLICY_TYPE_MAIN ) +return 0 ; +switch (c->event) {case XFRM_MSG_POLEXPIRE :return key_notify_policy_expire (xp, c);
@@ -2675,6 +2681,8 @@ static int pfkey_send_policy_notify(strucase XFRM_MSG_UPDPOLICY :return key_notify_policy (xp, dir, c);case XFRM_MSG_FLUSHPOLICY : +if (c->data.type !=XFRM_POLICY_TYPE_MAIN ) +break ;return key_notify_policy_flush (c);default :printk ("pfkey: Unknown policy event %d\n" , c->event);
net/xfrm/xfrm_user.c +121 -13
261 lines not on this page · raw message
Signature · 1 line
1.4.0
PATCH 43/44 IPV6: Add sort functions to combine templates/states for IPsec.
From: Masahide NAKAMURA <[email protected]>
Add sort functions to combine templates/states for IPsec.
Think of outbound transformation order we should be careful with transport AH which must be the last of all transport ones.
--- net/ipv6/xfrm6_state.c | 97 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 97 insertions(+), 0 deletions(-)
net/ipv6/xfrm6_state.c +97 -0
@@ -156,12 +156,109 @@ __xfrm6_find_acq(u8 mode, u32 reqid, u8return x0; } +static int +__xfrm6_state_sort (struct xfrm_state **dst,struct xfrm_state **src,int n) +{ +int i; +int j =0 ; + +/* Rule 1: select IPsec transport except AH */ +for (i =0 ; i < n; i++) { +if (src[i]->props.mode ==XFRM_MODE_TRANSPORT && + src[i]->id.proto !=IPPROTO_AH ) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } +if (j == n) + goto end; + +/* XXX: Rule 2: select MIPv6 RO or inbound trigger */ + +/* Rule 3: select IPsec transport AH */ +for (i =0 ; i < n; i++) { +if (src[i] && + src[i]->props.mode ==XFRM_MODE_TRANSPORT && + src[i]->id.proto ==IPPROTO_AH ) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } +if (j == n) + goto end; + +/* Rule 4: select IPsec tunnel */ +for (i =0 ; i < n; i++) { +if (src[i] && + src[i]->props.mode ==XFRM_MODE_TUNNEL ) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } +if (likely (j == n)) + goto end; + +/* Final rule */ +for (i =0 ; i < n; i++) { +if (src[i]) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } + + end: +return 0 ; +} + +static int +__xfrm6_tmpl_sort (struct xfrm_tmpl **dst,struct xfrm_tmpl **src,int n) +{ +int i; +int j =0 ; + +/* Rule 1: select IPsec transport */ +for (i =0 ; i < n; i++) { +if (src[i]->mode ==XFRM_MODE_TRANSPORT ) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } +if (j == n) + goto end; + +/* XXX: Rule 2: select MIPv6 RO or inbound trigger */ + +/* Rule 3: select IPsec tunnel */ +for (i =0 ; i < n; i++) { +if (src[i] && + src[i]->mode ==XFRM_MODE_TUNNEL ) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } +if (likely (j == n)) + goto end; + +/* Final rule */ +for (i =0 ; i < n; i++) { +if (src[i]) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } + + end: +return 0 ; +} +static struct xfrm_state_afinfo xfrm6_state_afinfo = { .family =AF_INET6 , .init_tempsel = __xfrm6_init_tempsel, .state_lookup = __xfrm6_state_lookup, .state_lookup_byaddr = __xfrm6_state_lookup_byaddr, .find_acq = __xfrm6_find_acq, + .tmpl_sort = __xfrm6_tmpl_sort, + .state_sort = __xfrm6_state_sort, };void __init xfrm6_state_init (void )
Signature · 1 line
1.4.0
PATCH 44/44 IPV6: Support Mobile IPv6 extension headers sorting.
From: Masahide NAKAMURA <[email protected]>
Support Mobile IPv6 extension headers sorting for two transformation policies. Mobile IPv6 extension headers should be placed after IPsec transport mode, but before transport AH when outbound.
--- net/ipv6/xfrm6_state.c | 28 ++++++++++++++++++++++++++-- 1 files changed, 26 insertions(+), 2 deletions(-)
net/ipv6/xfrm6_state.c +26 -2
@@ -173,7 +173,19 @@ __xfrm6_state_sort(struct xfrm_state **dif (j == n) goto end; -/* XXX: Rule 2: select MIPv6 RO or inbound trigger */ +/* Rule 2: select MIPv6 RO or inbound trigger */ +#ifdef CONFIG_IPV6_MIP6 +for (i =0 ; i < n; i++) { +if (src[i] && + (src[i]->props.mode ==XFRM_MODE_ROUTEOPTIMIZATION || + src[i]->props.mode ==XFRM_MODE_IN_TRIGGER )) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } +if (j == n) + goto end; +#endif /* Rule 3: select IPsec transport AH */ for (i =0 ; i < n; i++) {
@@ -226,7 +238,19 @@ __xfrm6_tmpl_sort(struct xfrm_tmpl **dstif (j == n) goto end; -/* XXX: Rule 2: select MIPv6 RO or inbound trigger */ +/* Rule 2: select MIPv6 RO or inbound trigger */ +#ifdef CONFIG_IPV6_MIP6 +for (i =0 ; i < n; i++) { +if (src[i] && + (src[i]->mode ==XFRM_MODE_ROUTEOPTIMIZATION || + src[i]->mode ==XFRM_MODE_IN_TRIGGER )) { + dst[j++] = src[i]; + src[i] =NULL ; + } + } +if (j == n) + goto end; +#endif /* Rule 3: select IPsec tunnel */ for (i =0 ; i < n; i++) {
Signature · 1 line
1.4.0
David Miller
maintainerRe: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:45 +0900
Quoted 6 lines
Support Mobile IPv6 extension headers sorting for two transformation policies. Mobile IPv6 extension headers should be placed after IPsec transport mode, but before transport AH when outbound.
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Ok, this is applied to net-2.6.19 too.
Are there any other Mobile-IPV6 patches necessary for the kernel?
Re: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
In article <[email protected]> (at Wed, 23 Aug 2006 22:57:06 -0700 (PDT)), David Miller <[email protected]> says:
Quoted 2 lines
Are there any other Mobile-IPV6 patches necessary for the kernel?
The patches cover most of MIPv6 and CN should work. However, for HA/MN, there are small number of patches to send.
We will send them, of course.
Nakamura-san, please describe the details.
--yoshfuji
David Miller
maintainerRe: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 15:04:42 +0900 (JST)
Quoted 11 lines
In article <[email protected]> (at Wed, 23 Aug 2006 22:57:06 -0700 (PDT)), David Miller <[email protected]> says:
Quoted 2 lines
Are there any other Mobile-IPV6 patches necessary for the kernel?
The patches cover most of MIPv6 and CN should work. However, for HA/MN, there are small number of patches to send.
We will send them, of course.
Nakamura-san, please describe the details.
Ok, thank you.
In the mean time, I will work on porting my XFRM hashing changes for the current net-2.6.19 tree.
Re: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
Quoted 13 lines · David Miller
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 15:04:42 +0900 (JST)Quoted 10 lines
In article <[email protected]> (at Wed, 23 Aug 2006 22:57:06 -0700 (PDT)), David Miller <[email protected]> says:
Quoted 2 lines
Are there any other Mobile-IPV6 patches necessary for the kernel?
The patches cover most of MIPv6 and CN should work. However, for HA/MN, there are small number of patches to send.
We will send them, of course.
Nakamura-san, please describe the details.
I'll send them later, but anyway,
Quoted 5 lines
Ok, thank you.
In the mean time, I will work on porting my XFRM hashing changes for the current net-2.6.19 tree.
FYI, your work will not have any conflict with the left of MIPv6 patches which I will describe later since they are almost out of XFRM.
Regards,
Signature · 1 line
Masahide NAKAMURA
David Miller
maintainerRe: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
From: Masahide NAKAMURA <[email protected]>
Date: Thu, 24 Aug 2006 16:05:39 +0900
Quoted 6 lines
Quoted 2 lines · David Miller
In the mean time, I will work on porting my XFRM hashing changes for the current net-2.6.19 tree.
FYI, your work will not have any conflict with the left of MIPv6 patches which I will describe later since they are almost out of XFRM.
Great.
I just finished the port and pushed all of that work to net-2.6.19, can folks please take a look?
I tested IPSEC as best as I could with XFRM_SUB_POLICY enabled, but I have no way currently to test sub-policies or MIPV6 cases.
Thank you.
Re: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
Quoted 9 lines · David Miller
From: Masahide NAKAMURA <[email protected]>
Date: Thu, 24 Aug 2006 16:05:39 +0900Quoted 5 lines
Quoted 2 lines · David Miller
In the mean time, I will work on porting my XFRM hashing changes for the current net-2.6.19 tree.
FYI, your work will not have any conflict with the left of MIPv6 patches which I will describe later since they are almost out of XFRM.
Quoted 7 lines
Great.
I just finished the port and pushed all of that work to net-2.6.19, can folks please take a look?
I tested IPSEC as best as I could with
XFRM_SUB_POLICYenabled, but I have no way currently to test sub-policies or MIPV6 cases.
OK, I will review it and also start my XFRM test with net-2.6.19 as I've done with my tree.
Regards,
Signature · 1 line
Masahide NAKAMURA
Re: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
Quoted 12 lines · Masahide NAKAMURA
Quoted 11 lines · David Miller
From: Masahide NAKAMURA <[email protected]>
Date: Thu, 24 Aug 2006 16:05:39 +0900Quoted 5 lines
Quoted 2 lines · David Miller
In the mean time, I will work on porting my XFRM hashing changes for the current net-2.6.19 tree.
FYI, your work will not have any conflict with the left of MIPv6 patches which I will describe later since they are almost out of XFRM.
Great.
Quoted 8 lines
Quoted 5 lines
I just finished the port and pushed all of that work to net-2.6.19, can folks please take a look?
I tested IPSEC as best as I could with
XFRM_SUB_POLICYenabled, but I have no way currently to test sub-policies or MIPV6 cases.OK, I will review it and also start my XFRM test with net-2.6.19 as I've done with my tree.
I've found a problem about MIPv6 CN with the patch below.
commit 02b0fa84daaa70f035767c9a5a0d539667249e60
Author: David S. Miller <[email protected]> Date: Thu Aug 24 04:45:07 2006 -0700
[XFRM]: Hash policies when non-prefixed.
It seems that the policy hashing is not always used with selector protocol. It may conflict with MIPL daemon thought.
Let me explain the detail:
MIPv6 specification says that all mobility header(MH) must be sent without routing header type 2(RT2) / home address option, except [*1].
To satisfy it MIPL daemon uses some bypass policies.
For CN outbound example(ip command output):
(a)MIPL daemon adds MH bypass policy when it starts to run:
src ::/0 dst ::/0 proto 135
dir out priority 12 ptype sub
(b)After binding is accepted, it also adds route optimization policy to send user traffic with RT2:
src 3ffe:501:ffff:100::XXXX/128 dst 3ffe:501:ffff:101::YYYY/128
dir out priority 16 ptype sub
tmpl src :: dst ::
proto route2 reqid 0 mode ro
level use
When the daemon added both policy we expected that all MH was used (a) otherwise (b) because of priority order. But the kernel used (b) when the daemon sent MH from 3ffe:501:ffff:100::XXXX to 3ffe:501:ffff:101::YYYY.
Note: such bypasses are also required for ICMPv6 error and neighbor discovery.
(*1:
Binding update(BU) can be sent with home address option and binding ack(BA) can be sent with RT2.)
Do you have any ideas?
Thanks,
Signature · 1 line
Masahide NAKAMURA
David Miller
maintainerRe: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
From: Masahide NAKAMURA <[email protected]>
Date: Fri, 25 Aug 2006 19:06:40 +0900
Quoted 1 line
I've found a problem about MIPv6 CN with the patch below.
We just need to search by priority in the inexact list, even if we get a hit in the hash table.
The fix is trivial, please try this patch:
net/xfrm/xfrm_policy.c +10 -9
@@ -908,6 +908,7 @@ static struct xfrm_policy *xfrm_policy_lxfrm_address_t *daddr, *saddr;struct hlist_node *entry;struct hlist_head *chain; +u32 priority = ~0U ; daddr =xfrm_flowi_daddr (fl, family); saddr =xfrm_flowi_saddr (fl, family);
@@ -919,21 +920,21 @@ static struct xfrm_policy *xfrm_policy_l ret =NULL ;hlist_for_each_entry (pol, entry, chain, bydst) {if (xfrm_policy_match (pol, fl, type, family, dir)) { -xfrm_pol_hold (pol); ret = pol; + priority = ret->priority;break ; } } -if (!ret) { - chain = &xfrm_policy_inexact[dir]; -hlist_for_each_entry (pol, entry, chain, bydst) { -if (xfrm_policy_match (pol, fl, type, family, dir)) { -xfrm_pol_hold (pol); - ret = pol; -break ; - } + chain = &xfrm_policy_inexact[dir]; +hlist_for_each_entry (pol, entry, chain, bydst) { +if (xfrm_policy_match (pol, fl, type, family, dir) && + pol->priority < priority) { + ret = pol; +break ; } } +if (ret) +xfrm_pol_hold (ret);read_unlock_bh (&xfrm_policy_lock);return ret;
Re: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
Quoted 9 lines · On Fri, 25 Aug 2006 03:16:51 -0700 (PDT) David Miller <[email protected]>…
From: Masahide NAKAMURA <[email protected]>
Date: Fri, 25 Aug 2006 19:06:40 +0900Quoted 1 line
I've found a problem about MIPv6 CN with the patch below.
We just need to search by priority in the inexact list, even if we get a hit in the hash table.
The fix is trivial, please try this patch:
Thank you for providing it quickly.
It works!
I continue my test with this patch for now to confirm other features.
Regards,
Signature · 1 line
Masahide NAKAMURA
David Miller
maintainerRe: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
From: Masahide NAKAMURA <[email protected]>
Date: Fri, 25 Aug 2006 23:29:05 +0900
Quoted 2 lines
Thank you for providing it quickly.
It works!
Thank you for testing. I have pushed this bug fix into the net-2.6.19 tree.
PATCH 1/1 STATE: Fix flusing with hash mask.
Hello,
This is a minor fix about transformation state flushing for net-2.6.19. Please apply it.
--- net/xfrm/xfrm_state.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
net/xfrm/xfrm_state.c +1 -1
@@ -384,7 +384,7 @@ void xfrm_state_flush(u8 proto)int i;spin_lock_bh (&xfrm_state_lock); -for (i =0 ; i < xfrm_state_hmask; i++) { +for (i =0 ; i <= xfrm_state_hmask; i++) {struct hlist_node *entry;struct xfrm_state *x; restart:
Signature · 1 line
1.4.2
David Miller
maintainerRe: [PATCH] [XFRM] STATE: Fix flusing with hash mask.
From: Masahide NAKAMURA <[email protected]>
Date: Thu, 31 Aug 2006 21:00:17 +0900
Quoted 2 lines
This is a minor fix about transformation state flushing for net-2.6.19. Please apply it.
Thank you for finding this bug. Patch applied.
Masahide-san, please provide a Signed-off-by: line in the future, even for simple changes like this one.
Arigato.
Re: [PATCH] [XFRM] STATE: Fix flusing with hash mask.
Quoted 2 lines · David Miller
Masahide-san, please provide a Signed-off-by: line in the future, even for simple changes like this one.
OK, I'll :-)
Regards,
Signature · 1 line
Masahide NAKAMURA
Re: [PATCH 44/44] [XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
In reply to David MillerHi,
I m started working on vertical handover, and also got the patch (NIST_Mobility) working on ns-2.29 (but it doesn't matter its not 2.29). But i m new to this subject, so i need some help, that how should i implement MIPL on ns-2. or have you worked on NIST_Mobility patch on ns, that whether nist_mobility patch support mipl and mipv6 or not.
because i found a header file name as "mip6.h"
could you help me in this topic, if not, then if you direct me to someone.
reards
Wisal Sami
[email protected]
Signature · 2 lines
View this message in context: http://old.nabble.com/-PATCH-0-44--Mobile-IPv6-Platform%2C-Take-2-%28for-net-2.6.19%29-tp5946388p30403215.html Sent from the netdev mailing list archive at Nabble.com.
Re: [PATCH 43/44] [XFRM] IPV6: Add sort functions to combine templates/states for IPsec.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:44 +0900
Quoted 6 lines
Add sort functions to combine templates/states for IPsec.
Think of outbound transformation order we should be careful with transport AH which must be the last of all transport ones.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thank you.
Re: [PATCH 42/44] [XFRM] POLICY: Support netlink socket interface for sub policy.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:43 +0900
Quoted 5 lines
Sub policy can be used through netlink socket.
PF_KEYuses main only and it is TODO to support sub.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 41/44] [XFRM]: Add sorting interface for state and template.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:42 +0900
Quoted 7 lines
Under two transformation policies it is required to merge them. This is a platform to sort state for outbound and templates for inbound respectively.
It will be used when Mobile IPv6 and IPsec are used at the same time.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks.
Re: [PATCH 40/44] [XFRM] POLICY: sub policy support.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:41 +0900
Quoted 15 lines
Sub policy is introduced. Main and sub policy are applied the same flow. (Policy that current kernel uses is named as main.)
It is required another transformation policy management to keep IPsec and Mobile IPv6 lives separate.
Policy which lives shorter time in kernel should be a sub i.e. normally main is for IPsec and sub is for Mobile IPv6.
(Such usage as two IPsec policies on different database can be used, too.)Limitation or TODOs:
- Sub policy is not supported for per socket one (it is always inserted as main).
- Current kernel makes cached outbound with flowi to skip searching database. However this patch makes it disabled only when "two policies are used and the first matched one is bypass case" because neither flowi nor bundle information knows about transformation template size.
Quoted 2 lines
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Those socket policies are becomming more and more difficult to deal with. I like them as a feature, but I wonder who uses them :-) They do not live in the flow cache so they hurt performance until we find a way to place them there. Perhaps we can extend the flow keying somehow to account for socket based policies in the flow cache.
Herbert Xu
maintainerRe: [PATCH 40/44] [XFRM] POLICY: sub policy support.
Quoted 7 lines · David Miller
Those socket policies are becomming more and more difficult to deal with. I like them as a feature, but I wonder who uses them :-) They do not live in the flow cache so they hurt performance until we find a way to place them there. Perhaps we can extend the flow keying somehow to account for socket based policies in the flow cache.
The KM's use it to allow ISAKMP traffic to punch through IPsec.
That should definitely be the exception though. Most apps should have zero socket policies, especially since socket policies need root privileges.
Cheers,
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txtRe: [PATCH 39/44] [XFRM] POLICY: Add Kconfig to support sub policy.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:40 +0900
Quoted 4 lines
Add
Kconfigto support sub policy.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Note that sub-policy support is probably the area which will need some simplifications and refactoring.
It is clear that IPSEC performance is tied strictly to the speed at which routes can be resolved. Sub-policies add more overhead to this area.
We wish to push fully resolved IPSEC routes into the flow cache so that we got not only policy but pre-lookup of bundle entry as a result of lookup. I attach an example patch implementing that (it is relative to the tree before all the MIPV6 changes) to give you an idea.
Also, if sub-policies are really the final way to address the MIPV6+IPSEC separation issue, probably we should just kill the kernel config option and optimize it as best we can.
include/net/flow.h +7 -3
@@ -84,12 +84,16 @@ #define FLOW_DIR_IN 0#define FLOW_DIR_OUT 1#define FLOW_DIR_FWD 2 -struct sock ;typedef void (*flow_resolve_t )(struct flowi *key,u32 sk_sid,u16 family,u8 dir,void **objp,atomic_t **obj_refp); -extern void *flow_cache_lookup (struct flowi *key,u32 sk_sid,u16 family,u8 dir, -flow_resolve_t resolver); +struct dst_entry ; +extern void *flow_cache_lookup (struct flowi *key,u32 sk_sid, +u16 family,u8 dir, +struct dst_entry **dstp, +flow_resolve_t resolver); +extern void flow_cache_dst_set (struct flowi *key,u32 sk_sid, +u16 family,u8 dir,struct dst_entry *dst);extern void flow_cache_flush (void );extern atomic_t flow_cache_genid;
net/core/flow.c +36 -1
@@ -25,6 +25,7 @@ #include <net/flow.h>#include <asm/atomic.h> #include <asm/semaphore.h> #include <linux/security.h> +#include <net/dst.h> struct flow_cache_entry {struct flow_cache_entry *next;
@@ -35,6 +36,7 @@ struct flow_cache_entry {u32 sk_sid;void *object;atomic_t *object_ref; +struct dst_entry *dst; };atomic_t flow_cache_genid =ATOMIC_INIT (0 );
@@ -166,7 +168,7 @@ static int flow_key_compare(struct flowi }void *flow_cache_lookup (struct flowi *key,u32 sk_sid,u16 family,u8 dir, -flow_resolve_t resolver) +struct dst_entry **dstp,flow_resolve_t resolver) {struct flow_cache_entry *fle, **head;unsigned int hash;
@@ -196,6 +198,8 @@ void *flow_cache_lookup(struct flowi *keif (ret)atomic_inc (fle->object_ref); +if (dstp) + *dstp =dst_clone (fle->dst);local_bh_enable ();return ret;
@@ -217,6 +221,7 @@ void *flow_cache_lookup(struct flowi *ke fle->sk_sid = sk_sid;memcpy (&fle->key, key,sizeof (*key)); fle->object =NULL ; + fle->dst =NULL ;flow_count (cpu)++; } }
@@ -245,6 +250,34 @@ nocache: } } +void flow_cache_dst_set (struct flowi *key,u32 sk_sid,u16 family,u8 dir, +struct dst_entry *dst) +{ +struct flow_cache_entry *fle, **head; +unsigned int hash; +int cpu; + +local_bh_disable (); + cpu =smp_processor_id (); + hash =flow_hash_code (key, cpu); + head = &flow_table (cpu)[hash]; +for (fle = *head; fle; fle = fle->next) { +if (fle->family == family && + fle->dir == dir && + fle->sk_sid == sk_sid && +flow_key_compare (key, &fle->key) ==0 ) { +if (fle->genid ==atomic_read (&flow_cache_genid)) { +struct dst_entry *orig = fle->dst; + +dst_release (orig); + fle->dst =dst_clone (dst); + } +break ; + } + } +local_bh_enable (); +} +static void flow_cache_flush_tasklet (unsigned long data) {struct flow_flush_info *info = (void *)data;
@@ -264,6 +297,8 @@ static void flow_cache_flush_tasklet(uns fle->object =NULL ;atomic_dec (fle->object_ref); +dst_release (fle->dst); + fle->dst =NULL ; } }
net/xfrm/xfrm_policy.c +24 -5
@@ -1149,7 +1149,7 @@ int xfrm_lookup(struct dst_entry **dst_pstruct xfrm_state *xfrm[XFRM_MAX_DEPTH ];struct dst_entry *dst, *dst_orig = *dst_p;int nx =0 ; -int err; +int err, sock_policy;u32 genid;u16 family;u8 dir =policy_to_flow_dir (XFRM_POLICY_OUT );
@@ -1157,16 +1157,21 @@ int xfrm_lookup(struct dst_entry **dst_p restart: genid =atomic_read (&flow_cache_genid); policy =NULL ; -if (sk && sk->sk_policy[1 ]) + sock_policy =0 ; +if (sk && sk->sk_policy[XFRM_POLICY_OUT ]) { policy =xfrm_sk_policy_lookup (sk,XFRM_POLICY_OUT , fl, sk_sid); +if (policy) + sock_policy =1 ; + } + dst =NULL ;if (!policy) {/* To accelerate a bit... */ if ((dst_orig->flags &DST_NOXFRM ) || !xfrm_policy_count[XFRM_POLICY_OUT ])return 0 ; policy =flow_cache_lookup (fl, sk_sid, dst_orig->ops->family, - dir, xfrm_policy_lookup); + dir, &dst, xfrm_policy_lookup); }if (!policy)
@@ -1179,6 +1184,7 @@ restart:case XFRM_POLICY_BLOCK :/* Prohibit the flow */ err = -EPERM ; +dst_release (dst); goto error;case XFRM_POLICY_ALLOW :
@@ -1188,6 +1194,14 @@ restart:return 0 ; } +/* Cached dst from flow cache? */ +if (dst) { +if (likely (!stale_bundle (dst))) +break ; +dst_release (dst); +flow_cache_dst_set (fl, sk_sid, family, dir,NULL ); + } +/* Try to find matching bundle. * * LATER: help from flow cache. It is optional, this
@@ -1199,8 +1213,11 @@ restart: goto error; } -if (dst) +if (dst) { +if (!sock_policy) +flow_cache_dst_set (fl, sk_sid, family, dir, dst);break ; + } nx =xfrm_tmpl_resolve (policy, fl, xfrm, family);
@@ -1265,6 +1282,8 @@ restart: policy->bundles = dst;dst_hold (dst);write_unlock_bh (&policy->lock); +if (!sock_policy) +flow_cache_dst_set (fl, sk_sid, family, dir, dst); } *dst_p = dst;dst_release (dst_orig);
@@ -1374,7 +1393,7 @@ int __xfrm_policy_check(struct sock *sk,if (!pol) pol =flow_cache_lookup (&fl, sk_sid, family, fl_dir, - xfrm_policy_lookup); +NULL , xfrm_policy_lookup);if (!pol)return !skb->sp || !secpath_has_tunnel (skb->sp,0 );
Re: [PATCH 38/44] [IPV6] MIP6: Ignore to report if mobility headers is rejected.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:39 +0900
Quoted 14 lines
Ignore to report user-space for known mobility headers rejected by destination options header transformation.
Mobile IPv6 specification (RFC3775) says that mobility header is used with destination options header carrying home address option only for binding update message. Other type message cannot be used and node must drop it silently (and must not send binding error) if receving such packet.
To achieve it, (1) application should use transformation policy and wild-card states to catch binding update message prior other packets
(2) kernel doesn't report the reject to user-space not to send binding error message by application.
This patch is for (2).
Based on MIPL2 kernel patch.
Quoted 4 lines
This patch was also written by: Ville Nuorvala <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19.
net/ipv6/mip6.c static int mip6_destopt_reject(struct xf · line 239
Quoted 3 lines
net/ipv6/mip6.c +3
-0+if (unlikely (fl->proto ==IPPROTO_MH && fl->fl_mh_type <=IP6_MH_TYPE_MAX )) + goto out; +
It is another long line which can be split up for
readability :-)
Thank you.
Re: [PATCH 37/44] [IPV6] MIP6: Report to user-space when home address option is rejected.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:38 +0900
Quoted 9 lines
Report to user-space when home address option is rejected.
In receiving this message user-space application will send Mobile IPv6 binding error. It is rate-limited by kernel.
Based on MIPL2 kernel patch.This patch was also written by: Ville Nuorvala <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks.
Re: [PATCH 36/44] [XFRM]: Introduce XFRM_MSG_REPORT.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:37 +0900
Quoted 8 lines
XFRM_MSG_REPORTis a message as notification of state protocol and selector from kernel to user-space.
Mobile IPv6 will use it when inbound reject is occurred at route optimization to make user-space know a binding error requirement.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, but...
Please check whether this XFRM_MSG_REPORT functionality can be provided via XFRM_MSG_*AE. It seems to me that AEVENTS can be used to report these rejection situations too. But you might have a good reason why not do merge the functionality.
Just let me know.
Re: [PATCH 36/44] [XFRM]: Introduce XFRM_MSG_REPORT.
Quoted 12 lines · David Miller
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:37 +0900Quoted 8 lines
XFRM_MSG_REPORTis a message as notification of state protocol and selector from kernel to user-space.
Mobile IPv6 will use it when inbound reject is occurred at route optimization to make user-space know a binding error requirement.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Quoted 8 lines
Applied to net-2.6.19, but...
Please check whether this
XFRM_MSG_REPORTfunctionality can be provided via XFRM_MSG_*AE. It seems to me that AEVENTS can be used to report these rejection situations too. But you might have a good reason why not do merge the functionality.Just let me know.
Thank you for pointing it. Now I've checked AEVENT briefly and I feel it is a smarter design to implement this rejection on AEVENT. However it would make us have more lines than XFRM_MSG_REPORT.
AEVENT is designed to manage for each existing XFRM state. OTOH XFRM_MSG_REPORT's requirement is to manage unexpected packet then no matching state is there.
We would need to add such code as "XFRM state generated by kernel for REPORT" like ACQUIRE to use AEVENT. It might make us define one more status XFRM_STATE_XXX (or adding xfrm_state.km.XXX used with XFRM_STATE_ACQ), too.
It is good that AEVENT has a reducing mechanism for message passing between kernel and user-space in receiving packet. For REPORT purpose, we would need to modify to specify thresh e.g. dividing sysctl per XFRM protocol (i.e. ESP, AH, IPComp and DSTOPTS) to specify REPORT state.
Should I start to design it?
Signature · 1 line
Masahide NAKAMURA
David Miller
maintainerRe: [PATCH 36/44] [XFRM]: Introduce XFRM_MSG_REPORT.
From: Masahide NAKAMURA <[email protected]>
Date: Thu, 24 Aug 2006 15:48:10 +0900
Quoted 1 line
Should I start to design it?
Thank you for the analysis.
Let's not jump so quickly towards implementation just yet.
What I plan to do right now is port my XFRM hashing patches into the current net-2.6.19 tree.
I am hoping that, in the mean time, maybe someone such as Jamal, Thomas Graf, or Herbert Xu might have some opinion in the area of AEVENT and XFRM_MSG_REPORT.
Re: [PATCH 35/44] [XFRM]: Trace which secpath state is reject factor.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:36 +0900
Quoted 9 lines
For Mobile IPv6 usage, it is required to trace which secpath state is reject factor in order to notify it to user space (to know the address which cannot be used route optimized communication).
Based on MIPL2 kernel patch.This patch was also written by: Henrik Petander <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks.
Re: [PATCH 34/44] [IPV6] MIP6: Transformation support mobility header.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:35 +0900
Quoted 5 lines
Transformation support mobility header.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks.
Re: [PATCH 33/44] [IPV6] MIP6: Add sending mobility header functions through raw socket.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:34 +0900
Quoted 8 lines
From: Masahide NAKAMURA <[email protected]>
Mobility header is built by user-space and sent through raw socket. Kernel just extracts its type to flow.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 32/44] [IPV6] MIP6: Add receiving mobility header functions through raw socket.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:33 +0900
Quoted 10 lines
Like ICMPv6, mobility header is handled through raw socket.
In inbound case, check only whether ICMPv6 error should be sent as a reply or not by kernel.
Based on MIPL2 kernel patch.This patch was also written by: Ville Nuorvala <[email protected]> This patch was also written by: Antti Tuominen <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
net/ipv6/mip6.c static inline void *mip6_padn(__u8 *data · line 123
Quoted 1 line
net/ipv6/mip6.c +1
-0+ LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH checksum failed [%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x > %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x]\n",
Let us try to avoid such long lines in the future.
Thanks a lot.
Re: [PATCH 31/44] [IPV6] MIP6: Add Mobility header definition.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:32 +0900
Quoted 7 lines
Add Mobility header definition for Mobile IPv6.
Based on MIPL2 kernel patch.This patch was also written by: Antti Tuominen <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Thanks
Re: [PATCH 30/44] [XFRM] STATE: Add Mobile IPv6 route optimization protocols to netlink interface.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:31 +0900
Quoted 6 lines
Add Mobile IPv6 route optimization protocols to netlink interface. Route optimization states carry care-of address.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks.
Re: [PATCH 29/44] [IPV6] MIP6: Add destination options header transformation.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:30 +0900
Quoted 10 lines
From: Masahide NAKAMURA <[email protected]>
Add destination options header transformation for Mobile IPv6. Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
Signed-off-by Noriaki TAKAMIYA <[email protected]>Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 28/44] [IPV6] MIP6: Add routing header type 2 transformation.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:29 +0900
Quoted 8 lines
From: Masahide NAKAMURA <[email protected]>
Add routing header type 2 transformation for Mobile IPv6. Based on MIPL2 kernel patch.
Signed-off-by Noriaki TAKAMIYA <[email protected]>Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 27/44] [IPV6] IPSEC: Support sending with Mobile IPv6 extension headers.
In reply to YOSHIFUJI HideakiIn article <[email protected]> (at Thu, 24 Aug 2006 00:02:28 +0900), YOSHIFUJI Hideaki <[email protected]> says:
net/ipv6/ah6.c static int ah6_input(struct xfrm_state * · line 391
Quoted 7 lines
net/ipv6/ah6.c +5
-0+#ifdef CONFIG_IPV6_MIP6 +if (ipv6_clear_mutable_options (skb->nh.ipv6h, hdr_len,XFRM_POLICY_IN )) + goto out; +#else if (ipv6_clear_mutable_options (skb->nh.ipv6h, hdr_len)) goto free_out; +#endif
Oops, I missed this.
This will result in memory leakage...
We will fix it with some clean-ups in the next spin.
--yoshfuji
Re: [PATCH 27/44] [IPV6] IPSEC: Support sending with Mobile IPv6 extension headers.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:28 +0900
Quoted 9 lines
Mobile IPv6 defines home address option as an option of destination options header. It is placed before fragment header then
ip6_find_1stfragopt()is fixed to know about it.
Home address option also carries final source address of the flow, then outbound AH calculation should take care of it like routing header case. Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, and I fixed the leak mentioned here:
net/ipv6/ah6.c static int ah6_input(struct xfrm_state * · line 391
Quoted 7 lines
net/ipv6/ah6.c +5
-0+#ifdef CONFIG_IPV6_MIP6 +if (ipv6_clear_mutable_options (skb->nh.ipv6h, hdr_len,XFRM_POLICY_IN )) + goto out; +#else if (ipv6_clear_mutable_options (skb->nh.ipv6h, hdr_len)) goto free_out; +#endif
By making MIP6 case goto free_out; too.
Re: [PATCH 26/44] [IPV6] MIP6: Revert address to send ICMPv6 error.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:27 +0900
Quoted 11 lines
IPv6 source address is replaced in receiving packet
with home address option carried by destination options header. To send ICMPv6 error back, original address which is received one on wire should be used. This function checks such header is included and reverts them.
Based on MIPL2 kernel patch.This patch was also written by: Ville Nuorvala <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 25/44] [IPV6] MIP6: Add inbound interface of home address option.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:26 +0900
Quoted 10 lines
From: Masahide NAKAMURA <[email protected]>
Add inbound function of home address option by registering it to TLV table for destination options header.
Based on MIPL2 kernel patch.This patch was also written by: Ville Nuorvala <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thank you.
I made a small change afterwards, placing 'dsthao' after 'flags' in inet6_skb_parm in order to pack structure more tightly.
Thanks again.
Re: [PATCH 24/44] [IPV6] MIP6: Add home address option definition.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:25 +0900
Quoted 6 lines
Add home address option definition for Mobile IPv6. Based on MIPL2 kernel patch.
Signed-off-by Noriaki TAKAMIYA <[email protected]>Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Thank you.
Re: [PATCH 23/44] [IPV6]: Allow to replace skbuff by TLV parser.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:24 +0900
Quoted 9 lines
In receiving Mobile IPv6 home address option which is a TLV carried by destination options header, kernel will try to mangle source adderss of packet. Think of cloned skbuff it is required to replace it by the parser just like routing header case.
This is a framework to achieve that to allow TLV parser to replace inbound skbuff pointer.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
[IPV6] MIP6: Fix to update IP6CB when cloned skbuff is received at HAO. (Re: [PATCH 23/44] [IPV6]: Allow to replace skbuff by TLV parser.)
Quoted 10 lines
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:24 +0900Quoted 7 lines
In receiving Mobile IPv6 home address option which is a TLV carried by destination options header, kernel will try to mangle source adderss of packet. Think of cloned skbuff it is required to replace it by the parser just like routing header case.
This is a framework to achieve that to allow TLV parser to replace inbound skbuff pointer.
Quoted 5 lines
Quoted 2 lines
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>Applied to net-2.6.19, thanks a lot.
I've found issue about the patch above.
This is a fix for it, to update IP6CB when cloned skbuff is received at HAO.
--- net/ipv6/exthdrs.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)
net/ipv6/exthdrs.c +7 -0
@@ -233,9 +233,14 @@ static int ipv6_dest_hao(struct sk_buffif (skb_cloned (skb)) {struct sk_buff *skb2 =skb_copy (skb,GFP_ATOMIC ); +struct inet6_skb_parm *opt2; +if (skb2 ==NULL ) goto discard; + opt2 =IP6CB (skb2); +memcpy (opt2, opt,sizeof (*opt2)); +kfree_skb (skb);/* update all variable using below by copied skbuff */
@@ -296,6 +301,7 @@ #endifif (ip6_parse_tlv (tlvprocdestopt_lst, skbp)) { skb = *skbp; skb->h.raw += ((skb->h.raw[1 ]+1 )<<3 ); + opt =IP6CB (skb);#ifdef CONFIG_IPV6_MIP6 opt->nhoff = dstbuf;#else
@@ -690,6 +696,7 @@ int ipv6_parse_hopopts(struct sk_buff **if (ip6_parse_tlv (tlvprochopopt_lst, skbp)) { skb = *skbp; skb->h.raw += (skb->h.raw[1 ]+1 )<<3 ; + opt =IP6CB (skb); opt->nhoff =sizeof (struct ipv6hdr );return 1 ; }
Signature · 1 line
1.4.2
David Miller
maintainerRe: [IPV6] MIP6: Fix to update IP6CB when cloned skbuff is received at HAO.
From: Masahide NAKAMURA <[email protected]>
Date: Thu, 31 Aug 2006 21:05:41 +0900
Quoted 13 lines
Quoted 13 lines
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:24 +0900Quoted 9 lines
In receiving Mobile IPv6 home address option which is a TLV carried by destination options header, kernel will try to mangle source adderss of packet. Think of cloned skbuff it is required to replace it by the parser just like routing header case.
This is a framework to achieve that to allow TLV parser to replace inbound skbuff pointer.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Quoted 7 lines
Quoted 2 lines
Applied to net-2.6.19, thanks a lot.
I've found issue about the patch above.
This is a fix for it, to update IP6CB when cloned skbuff is received at HAO.Signed-off-by Masahide NAKAMURA <[email protected]>
Patch applied, thank you very much.
Re: [PATCH 22/44] [IPV6]: Find option offset by type.
In reply to YOSHIFUJI Hideakinet/ipv6/exthdrs.c #endif · line 93
Quoted 12 lines · YOSHIFUJI Hideaki
From: Masahide NAKAMURA <[email protected]>
This is a helper to search option offset from extension header which can carry TLV option like destination options header. Mobile IPv6 home address option will use it.
Based on MIPL2 kernel patch.net/ipv6/exthdrs.c +5
-0+/* not_found */ +return -1 ; + bad: +return -1 ; +}
You could change this to:
/* not_found */ bad: return -1;
}
-Brian
Re: [PATCH 22/44] [IPV6]: Find option offset by type.
In article <[email protected]> (at Wed, 23 Aug 2006 13:22:06 -0400), Brian Haley <[email protected]> says:
Quoted 8 lines
net/ipv6/exthdrs.c #endif · line 93
Quoted 5 lines
net/ipv6/exthdrs.c +5
-0+/* not_found */ +return -1 ; + bad: +return -1 ; +}You could change this to:
Quoted 4 lines
/* not_found */
bad:
return -1;
}Right. I think our compiler is smart enough to eliminate that though. (Similar clean-up will be done for ipv6_rearrange_destopt() as well.)
--yoshfuji
Re: [PATCH 22/44] [IPV6]: Find option offset by type.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:23 +0900
Quoted 7 lines
This is a helper to search option offset from extension header which can carry TLV option like destination options header. Mobile IPv6 home address option will use it.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 21/44] [IPV6] MIP6: Add socket option and ancillary data interface of routing header type 2.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:22 +0900
Quoted 7 lines
Add socket option and ancillary data interface of routing header type 2. Mobile IPv6 application will use this to send binding acknowledgement with the header without relation of confirmed route optimization (binding). Based on MIPL2 kernel patch.
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 20/44] [IPV6] MIP6: Add inbound interface of routing header type 2.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:21 +0900
Quoted 7 lines
Add inbound interface of routing header type 2 for Mobile IPv6. Based on MIPL2 kernel patch.
This patch was also written by: Ville Nuorvala <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Thanks.
Re: [PATCH 19/44] [IPV6] MIP6: Add routing header type 2 definition.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:20 +0900
Quoted 6 lines
Add routing header type 2 definition for Mobile IPv6. Based on MIPL2 kernel patch.
Signed-off-by Noriaki TAKAMIYA <[email protected]>Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 18/44] [IPV6]: Add Kconfig to enable Mobile IPv6.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:19 +0900
Quoted 8 lines
From: Masahide NAKAMURA <[email protected]>
Add
Kconfigto enable Mobile IPv6.
Based on MIPL2 kernel patch.Signed-off-by Noriaki TAKAMIYA <[email protected]>Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Won't we also need a selection of route optimization and/or subtree options when enabling the mobile ipv6 config option?
Re: [PATCH 18/44] [IPV6]: Add Kconfig to enable Mobile IPv6.
Quoted 8 lines · David Miller
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:19 +0900Quoted 5 lines
From: Masahide NAKAMURA <[email protected]>
Add
Kconfigto enable Mobile IPv6.
Based on MIPL2 kernel patch.
Quoted 8 lines
Quoted 3 lines
Signed-off-by Noriaki TAKAMIYA <[email protected]>Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>Applied to net-2.6.19
Won't we also need a selection of route optimization and/or subtree options when enabling the mobile ipv6 config option?
We won't need them for building. I thought this option should be just for the basic MIPv6 feature (i.e. knowledge of header types) then I didn't add such dependency.
However, if we would think this option is a switch for enabling MIPv6 roles (i.e. CN, HA and MN),
RO mode: Yes, it is required by all roles.
Policy routing: I guess No. Because it is not required by CN. (required by MN, used by HA only for supporting physical home link)
Regards,
Signature · 1 line
Masahide NAKAMURA
Re: [PATCH 17/44] [XFRM]: Fix message about transformation user interface.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:18 +0900
Quoted 5 lines
Transformation user interface is not only for IPsec. Based on MIPL2 kernel patch.
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
David Miller
maintainerRe: [PATCH 16/44] [XFRM] IPV6: Restrict bundle reusing
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:17 +0900
Quoted 14 lines
From: Masahide NAKAMURA <[email protected]>
For outbound transformation, bundle is checked whether it is suitable for current flow to be reused or not. In such IPv6 case as below, transformation may apply incorrect bundle for the flow instead of creating another bundle:
- The policy selector has destination prefix length < 128 (Two or more addresses can be matched it)
- Its bundle holds dst entry of default route whose prefix length < 128 (Previous traffic was used such route as next hop)
- The policy and the bundle were used a transport mode state and this time flow address is not matched the bundled state.
Quoted 7 lines
This issue is found by Mobile IPv6 usage to protect mobility signaling by IPsec, but it is not a Mobile IPv6 specific.
This patch adds strict check toxfrm_bundle_ok()for each state mode and address when prefix length is less than 128.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied. Maybe ipv4 side wants to check for prefix length < 32? Or does it not matter for some reason under ipv4?
Re: [PATCH 16/44] [XFRM] IPV6: Restrict bundle reusing
Quoted 22 lines · David Miller
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:17 +0900Quoted 19 lines
From: Masahide NAKAMURA <[email protected]>
For outbound transformation, bundle is checked whether it is suitable for current flow to be reused or not. In such IPv6 case as below, transformation may apply incorrect bundle for the flow instead of creating another bundle:
- The policy selector has destination prefix length < 128 (Two or more addresses can be matched it)
- Its bundle holds dst entry of default route whose prefix length < 128 (Previous traffic was used such route as next hop)
- The policy and the bundle were used a transport mode state and this time flow address is not matched the bundled state.This issue is found by Mobile IPv6 usage to protect mobility signaling by IPsec, but it is not a Mobile IPv6 specific.
This patch adds strict check toxfrm_bundle_ok()for each state mode and address when prefix length is less than 128.
Quoted 5 lines
Quoted 2 lines
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>Applied. Maybe ipv4 side wants to check for prefix length < 32? Or does it not matter for some reason under ipv4?
Logically yes. But I was not clear IPv4 __xfrm4_find_bundle() has no prefix check as opposed to IPv6 one then I couldn't include it.
Signature · 1 line
Masahide NAKAMURA
David Miller
maintainerRe: [PATCH 15/44] [XFRM] IPV6: Update outbound state timestamp for each sending.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:16 +0900
Quoted 11 lines
From: Masahide NAKAMURA <[email protected]>
With this patch transformation state is updated last used time for each sending. Xtime is used for it like other state lifetime expiration.
Mobile IPv6 enabled nodes will want to know traffic status of each binding (e.g. judgement to request binding refresh by correspondent node, or to keep home/care-of nonce alive by mobile node).
The last used timestamp is an important hint about it.
Based on MIPL2 kernel patch.
Quoted 4 lines
This patch was also written by: Henrik Petander <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Patch applied to net-2.6.19
Re: [PATCH 14/44] [XFRM] STATE: Introduce care-of address.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:15 +0900
Quoted 7 lines
Care-of address is carried by state as a transformation option like IPsec encryption/authentication algorithm.
Based on MIPL2 kernel patch.Signed-off-by Noriaki TAKAMIYA <[email protected]>Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 13/44] [XFRM] STATE: Support non-fragment outbound transformation headers.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:14 +0900
Quoted 11 lines
For originated outbound IPv6 packets which will fragment,
ip6_append_data()should know length of extension headers before sending them and the length is carried bydst_entry.
IPv6 IPsec headers fragment then transformation was
designed to place all headers after fragment header.
OTOH Mobile IPv6 extension headers do not fragment then
it is a good idea to makedst_entryhave non-fragment length to tell it toip6_append_data().Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thank you.
Re: [PATCH 12/44] [XFRM] STATE: Add a hook to obtain local/remote outbound address.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:13 +0900
Quoted 11 lines
Outbound transformation replaces both source and destination address with state's end-point addresses at the same time when IPsec tunnel mode. It is also required to change them for Mobile IPv6 route optimization, but we should care about the following differences:
- changing result is not end-point but care-of address
- either source or destination is replaced for each state
This hook is a common platform to change outbound address.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 11/44] [XFRM]: Rename secpath_has_tunnel to secpath_has_nontransport.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:12 +0900
Quoted 9 lines
On current kernel inbound transformation state is allowed transport and disallowed tunnel mode when mismatch is occurred between tempates and states. As the result of adding two more modes by Mobile IPv6, this function name is misleading. Inbound transformation can allow only transport mode when mismatch is occurred between template and secpath.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
Re: [PATCH 10/44] [XFRM] STATE: Common receive function for route optimization extension headers.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:11 +0900
Quoted 8 lines
XFRM_STATE_WILDRECVflag is introduced; the last resort state is set it and receives packet which is not route optimized but uses such extension headers i.e. Mobile IPv6 signaling (binding update and acknowledgement). A node enabled Mobile IPv6 adds the state.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
David Miller
maintainerRe: [PATCH 9/44] [XFRM]: Restrict authentication algorithm only when inbound transformation protocol is IPsec.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:10 +0900
Quoted 6 lines
For Mobile IPv6 usage, routing header or destination options header is used and it doesn't require this comparison. It is checked only for IPsec template. Based on MIPL2 kernel patch.
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Looks good, applied to net-2.6.19
Thanks a lot.
Re: [PATCH 8/44] [XFRM] STATE: Introduce route optimization mode.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:09 +0900
Quoted 8 lines
Route optimization is used with routing header and destination options header for Mobile IPv6.
At outbound it makes header space like IPsec transport. At inbound it does nothing becauseexhdrs.cfunctions have responsibility to update skbuff information for these headers.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
David Miller
maintainerRe: [PATCH 7/44] [XFRM] STATE: Add a hook to find offset to be inserted header in outbound.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:08 +0900
Quoted 10 lines
On current kernel,
ip6_find_1stfragopt()is used by IPv6 IPsec to find offset to be inserted header in outbound for transport mode. (BTW, no usage may be needed for IPv4 case.)
Mobile IPv6 requires another logic for routing header and destination options header respectively. This patch is common platform for the offset and adopts it to IPsec.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Patch applied to net-2.6.19, thanks a lot.
Re: [PATCH 6/44] [XFRM] STATE: Search by address using source address list.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:07 +0900
Quoted 10 lines
From: Masahide NAKAMURA <[email protected]>
This is a support to search transformation states by its addresses by using source address list for Mobile IPv6 usage.
To use it from user-space, it is also added a message type for source address as a xfrm state option.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19, thanks a lot.
David Miller
maintainerRe: [PATCH 5/44] [XFRM] STATE: Add source address list.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:06 +0900
Quoted 8 lines
From: Masahide NAKAMURA <[email protected]>
Support source address based searching.
Mobile IPv6 will use it.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Patch applied to net-2.6.19, thanks a lot.
I see this is where I will need to perform conflict resolution with my XFRM layer hashing patches :-)
Re: [PATCH 5/44] [XFRM] STATE: Add source address list.
Quoted 9 lines · David Miller
From: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:06 +0900Quoted 6 lines
From: Masahide NAKAMURA <[email protected]>
Support source address based searching.
Mobile IPv6 will use it.
Based on MIPL2 kernel patch.
Quoted 7 lines
Quoted 2 lines
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>Patch applied to net-2.6.19, thanks a lot.
I see this is where I will need to perform conflict resolution with my XFRM layer hashing patches :-)
That's right.
As you may already find out the resolution will not be so hard since this it is doing the same thing as destination hash about XFRM list.
Thanks,
Signature · 1 line
Masahide NAKAMURA
David Miller
maintainerRe: [PATCH 5/44] [XFRM] STATE: Add source address list.
From: Masahide NAKAMURA <[email protected]>
Date: Thu, 24 Aug 2006 10:19:47 +0900
Quoted 3 lines
As you may already find out the resolution will not be so hard since this it is doing the same thing as destination hash about XFRM list.
Correct. I also do not think it will be very difficult.
Re: [PATCH 4/44] [XFRM]: Expand XFRM_MAX_DEPTH for route optimization.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:05 +0900
Quoted 8 lines
From: Masahide NAKAMURA <[email protected]>
XFRM_MAX_DEPTHis a limit of transformation states to be applied to the same flow. Two more extension headers are used by Mobile IPv6 transformation. Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Thanks.
David Miller
maintainerRe: [PATCH 3/44] [XFRM] STATE: Allow non IPsec protocol.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:04 +0900
Quoted 10 lines
From: Masahide NAKAMURA <[email protected]>
It will be added two more transformation protocols (routing header and destination options header) for Mobile IPv6.
xfrm_id_proto_match()can be handle zero as all,IPSEC_PROTO_ANYas all IPsec and otherwise as exact one.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Patch applied to net-2.6.19, thanks a lot.
Re: [PATCH 2/44] [XFRM]: Introduce a helper to compare id protocol.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:03 +0900
Quoted 7 lines
From: Masahide NAKAMURA <[email protected]>
Put the helper to header for future use.
Based on MIPL2 kernel patch.Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
Applied to net-2.6.19
Thank you.
David Miller
maintainerRe: [PATCH 1/44] [XFRM]: Add XFRM_MODE_xxx for future use.
In reply to YOSHIFUJI HideakiFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:02 +0900
Quoted 9 lines
Transformation mode is used as either IPsec transport or tunnel. It is required to add two more items, route optimization and inbound trigger for Mobile IPv6.
Based on MIPL2 kernel patch.This patch was also written by: Ville Nuorvala <[email protected]>
Signed-off-by Masahide NAKAMURA <[email protected]>Signed-off-by YOSHIFUJI Hideaki <[email protected]>
This looks perfectly fine.
Patch applied to net-2.6.19.
In article <[email protected]> (at Thu, 24 Aug 2006 00:02:01 +0900), YOSHIFUJI Hideaki <[email protected]> says:
Quoted 2 lines
This is the update of the "MIPv6 CN introduction" and "MIPv6 CN" based on the MIPL2 kernel patch.
Headlines and diffstats are:
HEADLINES
---------
[XFRM]: Add XFRM_MODE_xxx for future use.
[XFRM]: Introduce a helper to compare id protocol.
[XFRM] STATE: Allow non IPsec protocol.
[XFRM]: Expand XFRM_MAX_DEPTH for route optimization.
[XFRM] STATE: Add source address list.
[XFRM] STATE: Search by address using source address list.
[XFRM] STATE: Add a hook to find offset to be inserted header in outbound. [XFRM] STATE: Introduce route optimization mode.
[XFRM]: Restrict authentication algorithm only when inbound transformation protocol is IPsec. [XFRM] STATE: Common receive function for route optimization extension headers. [XFRM]: Rename secpath_has_tunnel to secpath_has_nontransport.
[XFRM] STATE: Add a hook to obtain local/remote outbound address.
[XFRM] STATE: Support non-fragment outbound transformation headers.
[XFRM] STATE: Introduce care-of address.
[XFRM] IPV6: Update outbound state timestamp for each sending.
[XFRM] IPV6: Restrict bundle reusing
[XFRM]: Fix message about transformation user interface.
[IPV6]: Add Kconfig to enable Mobile IPv6.
[IPV6] MIP6: Add routing header type 2 definition.
[IPV6] MIP6: Add inbound interface of routing header type 2.
[IPV6] MIP6: Add socket option and ancillary data interface of routing header type 2. [IPV6]: Find option offset by type.
[IPV6]: Allow to replace skbuff by TLV parser.
[IPV6] MIP6: Add home address option definition.
[IPV6] MIP6: Add inbound interface of home address option.
[IPV6] MIP6: Revert address to send ICMPv6 error.
[IPV6] IPSEC: Support sending with Mobile IPv6 extension headers.
[IPV6] MIP6: Add routing header type 2 transformation.
[IPV6] MIP6: Add destination options header transformation.
[XFRM] STATE: Add Mobile IPv6 route optimization protocols to netlink interface. [IPV6] MIP6: Add Mobility header definition.
[IPV6] MIP6: Add receiving mobility header functions through raw socket. [IPV6] MIP6: Add sending mobility header functions through raw socket.
[IPV6] MIP6: Transformation support mobility header.
[XFRM]: Trace which secpath state is reject factor.
[XFRM]: Introduce XFRM_MSG_REPORT.
[IPV6] MIP6: Report to user-space when home address option is rejected. [IPV6] MIP6: Ignore to report if mobility headers is rejected.
[XFRM] POLICY: Add Kconfig to support sub policy.
[XFRM] POLICY: sub policy support.
[XFRM]: Add sorting interface for state and template.
[XFRM] POLICY: Support netlink socket interface for sub policy.
[XFRM] IPV6: Add sort functions to combine templates/states for IPsec.
[XFRM] IPV6: Support Mobile IPv6 extension headers sorting.
DIFFSTAT
--------
include/linux/in6.h | 2 include/linux/ipv6.h | 26 ++ include/linux/xfrm.h | 36 +++ include/net/addrconf.h | 7 + include/net/dst.h | 1 include/net/flow.h | 9 + include/net/ipv6.h | 5 include/net/mip6.h | 61 +++++ include/net/xfrm.h | 149 ++++++++++- net/ipv4/ah4.c | 2 net/ipv4/esp4.c | 6 net/ipv4/ipcomp.c | 8 - net/ipv4/xfrm4_input.c | 2 net/ipv4/xfrm4_output.c | 4 net/ipv4/xfrm4_policy.c | 5 net/ipv4/xfrm4_state.c | 14 + net/ipv4/xfrm4_tunnel.c | 2 net/ipv6/Kconfig | 16 + net/ipv6/Makefile | 3 net/ipv6/af_inet6.c | 9 + net/ipv6/ah6.c | 114 ++++++++- net/ipv6/datagram.c | 11 + net/ipv6/esp6.c | 7 - net/ipv6/exthdrs.c | 225 ++++++++++++++++- net/ipv6/icmp.c | 25 ++ net/ipv6/ip6_input.c | 2 net/ipv6/ip6_output.c | 20 +- net/ipv6/ipcomp6.c | 7 - net/ipv6/ipv6_sockglue.c | 10 + net/ipv6/ipv6_syms.c | 2 net/ipv6/mip6.c | 517 +++++++++++++++++++++++++++++++++++++++ net/ipv6/raw.c | 46 +++ net/ipv6/xfrm6_input.c | 110 ++++++++ net/ipv6/xfrm6_mode_ro.c | 94 +++++++ net/ipv6/xfrm6_mode_transport.c | 2 net/ipv6/xfrm6_output.c | 12 + net/ipv6/xfrm6_policy.c | 65 ++++- net/ipv6/xfrm6_state.c | 147 +++++++++++ net/ipv6/xfrm6_tunnel.c | 2 net/key/af_key.c | 24 +- net/xfrm/Kconfig | 16 + net/xfrm/xfrm_policy.c | 337 ++++++++++++++++++++++--- net/xfrm/xfrm_state.c | 128 +++++++++- net/xfrm/xfrm_user.c | 294 ++++++++++++++++++++-- 44 files changed, 2410 insertions(+), 174 deletions(-)
Signature · 2 lines
YOSHIFUJI Hideaki @ USAGI Project <[email protected]> GPG-FP : 9022 65EB 1ECF 3AD1 0BDF 80D8 4807 F894 E062 0EEA
David Miller
maintainerFrom: YOSHIFUJI Hideaki <[email protected]>
Date: Thu, 24 Aug 2006 00:02:01 +0900
Quoted 4 lines
we have another discussion about improvement of XFRM state hash. Our patches (about source address list part) will conflict with that work, but we did not take that into account so far because it was not in the tree.
Yes, do not worry about this. I will add my changes later after we integrate the mobile-ipv6 work, and therefore I will take care of the conflicts.