Make XFRM optional

PATCH In review Andi Kleen 5 participants 9 messages Aug 4, 2003 – Aug 6, 2003 1 message not in the archive

Subsystems (5)

Networking Network drivers IPv4/IPv6 Networking IPsec +1 more subsystems

lore

Share & tools

lore

Andi Kleen

author

2003-08-04 12:50 UTC #0 lore raw

PATCH 1/1 Make XFRM optional

Only compile in the xfrm subsystem when it's needed by any config options.

This avoids some code/data structure bloat in case you don't use IP tunneling or IPsec.

Also adds a net_ratelimit() to a unprotected printk.

For 2.6.0test2

-Andi

include/net/dst.h renamed from include/net/dst.h-XFRM +8 -0

diff -u linux-work/include/net/dst.h-XFRM linux-work/include/net/dst.h
@@ -247,8 +247,16 @@
 extern void		dst_init(void);
 
 struct flowi;
+#ifndef CONFIG_XFRM
+static inline int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
+		       struct sock *sk, int flags)
+{
+	return 0;
+} 
+#else
 extern int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
 		       struct sock *sk, int flags);
 #endif
+#endif
 
 #endif /* _NET_DST_H */

include/net/xfrm.h renamed from include/net/xfrm.h-XFRM +43 -2

74 lines not on this page · raw message

net/core/skbuff.c renamed from net/core/skbuff.c-XFRM +1 -1

diff -u linux-work/net/core/skbuff.c-XFRM linux-work/net/core/skbuff.c
@@ -225,7 +225,7 @@
 	}
 
 	dst_release(skb->dst);
-#ifdef CONFIG_INET
+#ifdef CONFIG_XFRM
 	secpath_put(skb->sp);
 #endif
 	if(skb->destructor) {

net/ipv4/Kconfig renamed from net/ipv4/Kconfig-XFRM +5 -0

diff -u linux-work/net/ipv4/Kconfig-XFRM linux-work/net/ipv4/Kconfig
@@ -187,6 +187,7 @@
 config NET_IPIP
 	tristate "IP: tunneling"
 	depends on INET
+	select XFRM
 	---help---
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the

@@ -205,6 +206,7 @@
 config NET_IPGRE
 	tristate "IP: GRE tunnels over IP"
 	depends on INET
+	select XFRM
 	help
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the

@@ -343,6 +345,7 @@
 
 config INET_AH
 	tristate "IP: AH transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -354,6 +357,7 @@
 
 config INET_ESP
 	tristate "IP: ESP transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -366,6 +370,7 @@
 
 config INET_IPCOMP
 	tristate "IP: IPComp transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_DEFLATE
 	---help---

net/ipv4/Makefile renamed from net/ipv4/Makefile-XFRM +1 -1

diff -u linux-work/net/ipv4/Makefile-XFRM linux-work/net/ipv4/Makefile
@@ -23,4 +23,4 @@
 obj-$(CONFIG_NETFILTER)	+= netfilter/
 obj-$(CONFIG_IP_VS) += ipvs/
 
-obj-y += xfrm4_policy.o xfrm4_state.o xfrm4_input.o xfrm4_tunnel.o
+obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o xfrm4_tunnel.o

net/ipv4/route.c renamed from net/ipv4/route.c-XFRM +2 -0

diff -u linux-work/net/ipv4/route.c-XFRM linux-work/net/ipv4/route.c
@@ -2785,8 +2785,10 @@
 	create_proc_read_entry("net/rt_acct", 0, 0, ip_rt_acct_read, NULL);
 #endif
 #endif
+#ifdef CONFIG_XFRM
 	xfrm_init();
 	xfrm4_init();
+#endif
 out:
 	return rc;
 out_enomem:

net/ipv4/udp.c renamed from net/ipv4/udp.c-XFRM +7 -2

diff -u linux-work/net/ipv4/udp.c-XFRM linux-work/net/ipv4/udp.c
@@ -938,6 +938,9 @@
  */
 static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
 {
+#ifndef CONFIG_XFRM
+	return 1; 
+#else
 	struct udp_opt *up = udp_sk(sk);
   	struct udphdr *uh = skb->h.uh;
 	struct iphdr *iph;

@@ -997,10 +1000,12 @@
 		return -1;
 
 	default:
-		printk(KERN_INFO "udp_encap_rcv(): Unhandled UDP encap type: %u\n",
-		       encap_type);
+		if (net_ratelimit())
+			printk(KERN_INFO "udp_encap_rcv(): Unhandled UDP encap type: %u\n",
+			       encap_type);
 		return 1;
 	}
+#endif
 }
 
 /* returns:

net/ipv6/Kconfig renamed from net/ipv6/Kconfig-XFRM +5 -0

diff -u linux-work/net/ipv6/Kconfig-XFRM linux-work/net/ipv6/Kconfig
@@ -4,6 +4,7 @@
 config IPV6_PRIVACY
 	bool "IPv6: Privacy Extensions (RFC 3041) support"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_MD5
 	---help---

@@ -22,6 +23,7 @@
 config INET6_AH
 	tristate "IPv6: AH transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -34,6 +36,7 @@
 config INET6_ESP
 	tristate "IPv6: ESP transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -47,6 +50,7 @@
 config INET6_IPCOMP
 	tristate "IPv6: IPComp transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_DEFLATE
 	---help---

@@ -57,6 +61,7 @@
 
 config IPV6_TUNNEL
 	tristate "IPv6: IPv6-in-IPv6 tunnel"
+	select XFRM
 	depends on IPV6
 	---help---
 	  Support for IPv6-in-IPv6 tunnels described in RFC 2473.

net/ipv6/Makefile renamed from net/ipv6/Makefile-XFRM +3 -2

diff -u linux-work/net/ipv6/Makefile-XFRM linux-work/net/ipv6/Makefile
@@ -8,8 +8,9 @@
 		route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
 		protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
 		exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
-		ip6_flowlabel.o ipv6_syms.o \
-		xfrm6_policy.o xfrm6_state.o xfrm6_input.o
+		ip6_flowlabel.o ipv6_syms.o
+
+obj-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o
 
 obj-$(CONFIG_INET6_AH) += ah6.o
 obj-$(CONFIG_INET6_ESP) += esp6.o

net/ipv6/ipv6_syms.c renamed from net/ipv6/ipv6_syms.c-XFRM +2 -0

diff -u linux-work/net/ipv6/ipv6_syms.c-XFRM linux-work/net/ipv6/ipv6_syms.c
@@ -36,7 +36,9 @@
 EXPORT_SYMBOL(in6addr_loopback);
 EXPORT_SYMBOL(in6_dev_finish_destroy);
 EXPORT_SYMBOL(ip6_find_1stfragopt);
+#ifdef CONFIG_XFRM
 EXPORT_SYMBOL(xfrm6_rcv);
+#endif
 EXPORT_SYMBOL(rt6_lookup);
 EXPORT_SYMBOL(fl6_sock_lookup);
 EXPORT_SYMBOL(ipv6_ext_hdr);

net/ipv6/route.c renamed from net/ipv6/route.c-XFRM +2 -0

diff -u linux-work/net/ipv6/route.c-XFRM linux-work/net/ipv6/route.c
@@ -1988,7 +1988,9 @@
 	if (p)
 		p->proc_fops = &rt6_stats_seq_fops;
 #endif
+#ifdef CONFIG_XFRM
 	xfrm6_init();
+#endif
 }
 
 #ifdef MODULE

net/xfrm/Kconfig renamed from net/xfrm/Kconfig-XFRM +5 -1

diff -u linux-work/net/xfrm/Kconfig-XFRM linux-work/net/xfrm/Kconfig
@@ -1,9 +1,13 @@
 #
 # XFRM configuration
 #
+config XFRM
+       bool
+       depends on NET
+
 config XFRM_USER
 	tristate "IPsec user configuration interface"
-	depends on INET
+	depends on INET && XFRM
 	---help---
 	  Support for IPsec user configuration interface used
 	  by native Linux tools.

net/xfrm/Makefile renamed from net/xfrm/Makefile-XFRM +2 -1

diff -u linux-work/net/xfrm/Makefile-XFRM linux-work/net/xfrm/Makefile
@@ -2,6 +2,7 @@
 # Makefile for the XFRM subsystem.
 #
 
-obj-y := xfrm_policy.o xfrm_state.o xfrm_input.o xfrm_algo.o xfrm_output.o
+obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_input.o xfrm_algo.o xfrm_output.o \
+	xfrm_export.o
 obj-$(CONFIG_XFRM_USER) += xfrm_user.o

net/xfrm/xfrm_export.c renamed from net/xfrm/xfrm_export.c-XFRM +76 -0

76 lines not on this page · raw message

net/Kconfig renamed from net/Kconfig-XFRM +1 -0

diff -u linux-work/net/Kconfig-XFRM linux-work/net/Kconfig
@@ -143,6 +143,7 @@
 
 config NET_KEY
 	tristate "PF_KEY sockets"
+	select XFRM
 	---help---
 	  PF_KEYv2 socket family, compatible to KAME ones.
 	  They are required if you are going to use IPsec tools ported

net/netsyms.c renamed from net/netsyms.c-XFRM +0 ~~-73~~

85 lines not on this page · raw message

YOSHIFUJI Hideaki / 吉藤英明

2003-08-04 12:58 UTC #1 lore raw

Hello.

In article <20030804125022.GA8167@averell> (at Mon, 4 Aug 2003 14:50:22 +0200), Andi Kleen <[email protected]> says:

net/ipv6/Kconfig line 10

Quoted 11 lines

diff -u linux-work/net/ipv6/Kconfig-XFRM linux-work/net/ipv6/Kconfig
net/ipv6/Kconfig renamed from net/ipv6/Kconfig-XFRM +1 -0
@@ -4,6 +4,7 @@
 config IPV6_PRIVACY
 	bool "IPv6: Privacy Extensions (RFC 3041) support"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_MD5
 	---help---

We do not need this.

net/ipv6/Kconfig line 67

Quoted 8 lines

net/ipv6/Kconfig renamed from net/ipv6/Kconfig-XFRM +1 -0

@@ -57,6 +61,7 @@
 
 config IPV6_TUNNEL
 	tristate "IPv6: IPv6-in-IPv6 tunnel"
+	select XFRM
 	depends on IPV6
 	---help---
 	  Support for IPv6-in-IPv6 tunnels described in RFC 2473.

We do not need this for now.

Signature · 2 lines

Hideaki YOSHIFUJI @ USAGI Project <[email protected]>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Andi Kleen

2003-08-04 13:04 UTC #2 lore raw

Quoted 4 lines · On Mon, Aug 04, 2003 at 09:58:01PM +0900, YOSHIFUJI Hideaki / ?$B5HF#1QL@ wrote:

Hello.
In article <20030804125022.GA8167@averell> (at Mon, 4 Aug 2003 14:50:22 +0200), Andi Kleen <[email protected]> says:

Quoted 13 lines

net/ipv6/Kconfig line 10
Quoted 11 lines
diff -u linux-work/net/ipv6/Kconfig-XFRM linux-work/net/ipv6/Kconfig
net/ipv6/Kconfig renamed from net/ipv6/Kconfig-XFRM +1 -0
@@ -4,6 +4,7 @@
 config IPV6_PRIVACY
 	bool "IPv6: Privacy Extensions (RFC 3041) support"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_MD5
 	---help---
We do not need this.

Thanks for the feedback. Here is a new patch with the two hunks removed.

-Andi

include/net/dst.h renamed from include/net/dst.h-XFRM +8 -0

diff -u linux-work/include/net/dst.h-XFRM linux-work/include/net/dst.h
@@ -247,8 +247,16 @@
 extern void		dst_init(void);
 
 struct flowi;
+#ifndef CONFIG_XFRM
+static inline int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
+		       struct sock *sk, int flags)
+{
+	return 0;
+} 
+#else
 extern int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
 		       struct sock *sk, int flags);
 #endif
+#endif
 
 #endif /* _NET_DST_H */

include/net/xfrm.h renamed from include/net/xfrm.h-XFRM +43 -2

74 lines not on this page · raw message

net/core/skbuff.c renamed from net/core/skbuff.c-XFRM +1 -1

diff -u linux-work/net/core/skbuff.c-XFRM linux-work/net/core/skbuff.c
@@ -225,7 +225,7 @@
 	}
 
 	dst_release(skb->dst);
-#ifdef CONFIG_INET
+#ifdef CONFIG_XFRM
 	secpath_put(skb->sp);
 #endif
 	if(skb->destructor) {

net/ipv4/Kconfig renamed from net/ipv4/Kconfig-XFRM +5 -0

diff -u linux-work/net/ipv4/Kconfig-XFRM linux-work/net/ipv4/Kconfig
@@ -187,6 +187,7 @@
 config NET_IPIP
 	tristate "IP: tunneling"
 	depends on INET
+	select XFRM
 	---help---
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the

@@ -205,6 +206,7 @@
 config NET_IPGRE
 	tristate "IP: GRE tunnels over IP"
 	depends on INET
+	select XFRM
 	help
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the

@@ -343,6 +345,7 @@
 
 config INET_AH
 	tristate "IP: AH transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -354,6 +357,7 @@
 
 config INET_ESP
 	tristate "IP: ESP transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -366,6 +370,7 @@
 
 config INET_IPCOMP
 	tristate "IP: IPComp transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_DEFLATE
 	---help---

net/ipv4/Makefile renamed from net/ipv4/Makefile-XFRM +1 -1

diff -u linux-work/net/ipv4/Makefile-XFRM linux-work/net/ipv4/Makefile
@@ -23,4 +23,4 @@
 obj-$(CONFIG_NETFILTER)	+= netfilter/
 obj-$(CONFIG_IP_VS) += ipvs/
 
-obj-y += xfrm4_policy.o xfrm4_state.o xfrm4_input.o xfrm4_tunnel.o
+obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o xfrm4_tunnel.o

net/ipv4/route.c renamed from net/ipv4/route.c-XFRM +2 -0

diff -u linux-work/net/ipv4/route.c-XFRM linux-work/net/ipv4/route.c
@@ -2785,8 +2785,10 @@
 	create_proc_read_entry("net/rt_acct", 0, 0, ip_rt_acct_read, NULL);
 #endif
 #endif
+#ifdef CONFIG_XFRM
 	xfrm_init();
 	xfrm4_init();
+#endif
 out:
 	return rc;
 out_enomem:

net/ipv4/udp.c renamed from net/ipv4/udp.c-XFRM +7 -2

diff -u linux-work/net/ipv4/udp.c-XFRM linux-work/net/ipv4/udp.c
@@ -938,6 +938,9 @@
  */
 static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
 {
+#ifndef CONFIG_XFRM
+	return 1; 
+#else
 	struct udp_opt *up = udp_sk(sk);
   	struct udphdr *uh = skb->h.uh;
 	struct iphdr *iph;

@@ -997,10 +1000,12 @@
 		return -1;
 
 	default:
-		printk(KERN_INFO "udp_encap_rcv(): Unhandled UDP encap type: %u\n",
-		       encap_type);
+		if (net_ratelimit())
+			printk(KERN_INFO "udp_encap_rcv(): Unhandled UDP encap type: %u\n",
+			       encap_type);
 		return 1;
 	}
+#endif
 }
 
 /* returns:

net/ipv6/Kconfig renamed from net/ipv6/Kconfig-XFRM +3 -0

diff -u linux-work/net/ipv6/Kconfig-XFRM linux-work/net/ipv6/Kconfig
@@ -22,6 +23,7 @@
 config INET6_AH
 	tristate "IPv6: AH transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -34,6 +36,7 @@
 config INET6_ESP
 	tristate "IPv6: ESP transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -47,6 +50,7 @@
 config INET6_IPCOMP
 	tristate "IPv6: IPComp transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_DEFLATE
 	---help---

net/ipv6/Makefile renamed from net/ipv6/Makefile-XFRM +3 -2

diff -u linux-work/net/ipv6/Makefile-XFRM linux-work/net/ipv6/Makefile
@@ -8,8 +8,9 @@
 		route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
 		protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
 		exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
-		ip6_flowlabel.o ipv6_syms.o \
-		xfrm6_policy.o xfrm6_state.o xfrm6_input.o
+		ip6_flowlabel.o ipv6_syms.o
+
+obj-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o
 
 obj-$(CONFIG_INET6_AH) += ah6.o
 obj-$(CONFIG_INET6_ESP) += esp6.o

net/ipv6/ipv6_syms.c renamed from net/ipv6/ipv6_syms.c-XFRM +2 -0

diff -u linux-work/net/ipv6/ipv6_syms.c-XFRM linux-work/net/ipv6/ipv6_syms.c
@@ -36,7 +36,9 @@
 EXPORT_SYMBOL(in6addr_loopback);
 EXPORT_SYMBOL(in6_dev_finish_destroy);
 EXPORT_SYMBOL(ip6_find_1stfragopt);
+#ifdef CONFIG_XFRM
 EXPORT_SYMBOL(xfrm6_rcv);
+#endif
 EXPORT_SYMBOL(rt6_lookup);
 EXPORT_SYMBOL(fl6_sock_lookup);
 EXPORT_SYMBOL(ipv6_ext_hdr);

net/ipv6/route.c renamed from net/ipv6/route.c-XFRM +2 -0

diff -u linux-work/net/ipv6/route.c-XFRM linux-work/net/ipv6/route.c
@@ -1988,7 +1988,9 @@
 	if (p)
 		p->proc_fops = &rt6_stats_seq_fops;
 #endif
+#ifdef CONFIG_XFRM
 	xfrm6_init();
+#endif
 }
 
 #ifdef MODULE

net/xfrm/Kconfig renamed from net/xfrm/Kconfig-XFRM +5 -1

diff -u linux-work/net/xfrm/Kconfig-XFRM linux-work/net/xfrm/Kconfig
@@ -1,9 +1,13 @@
 #
 # XFRM configuration
 #
+config XFRM
+       bool
+       depends on NET
+
 config XFRM_USER
 	tristate "IPsec user configuration interface"
-	depends on INET
+	depends on INET && XFRM
 	---help---
 	  Support for IPsec user configuration interface used
 	  by native Linux tools.

net/xfrm/Makefile renamed from net/xfrm/Makefile-XFRM +2 -1

diff -u linux-work/net/xfrm/Makefile-XFRM linux-work/net/xfrm/Makefile
@@ -2,6 +2,7 @@
 # Makefile for the XFRM subsystem.
 #
 
-obj-y := xfrm_policy.o xfrm_state.o xfrm_input.o xfrm_algo.o xfrm_output.o
+obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_input.o xfrm_algo.o xfrm_output.o \
+	xfrm_export.o
 obj-$(CONFIG_XFRM_USER) += xfrm_user.o

net/xfrm/xfrm_export.c renamed from net/xfrm/xfrm_export.c-XFRM +76 -0

76 lines not on this page · raw message

net/Kconfig renamed from net/Kconfig-XFRM +1 -0

diff -u linux-work/net/Kconfig-XFRM linux-work/net/Kconfig
@@ -143,6 +143,7 @@
 
 config NET_KEY
 	tristate "PF_KEY sockets"
+	select XFRM
 	---help---
 	  PF_KEYv2 socket family, compatible to KAME ones.
 	  They are required if you are going to use IPsec tools ported

net/netsyms.c renamed from net/netsyms.c-XFRM +0 ~~-73~~

85 lines not on this page · raw message

David S. Miller

2003-08-04 18:45 UTC #3 lore raw

Quoted 2 lines · On 4 Aug 2003 15:04:08 +0200 Andi Kleen <[email protected]> wrote:

Thanks for the feedback. Here is a new patch with the two hunks removed.

Still broken in two areas:

1) You moved inet_peer_idlock into net/xfrm/xfrm_exports.c, that looks quite wrong.

2) Your patch doesn't apply to Linus's current tree because "secpath_dup" got added to net/netsyms.c since 2.6.0-test2 got released.

I wanted to merge this, but I can't until you fix the above problems.

Thanks.

Andi Kleen

2003-08-04 20:35 UTC #4 lore raw

Ok, here is a new patch again current BKCVS. It also moves the inet_peer_idlock only inside netsyms.

-Andi

include/net/dst.h renamed from include/net/dst.h-XFRM +8 -0

diff -u linux-xfrm/include/net/dst.h-XFRM linux-xfrm/include/net/dst.h
@@ -247,8 +247,16 @@
 extern void		dst_init(void);
 
 struct flowi;
+#ifndef CONFIG_XFRM
+static inline int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
+		       struct sock *sk, int flags)
+{
+	return 0;
+} 
+#else
 extern int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
 		       struct sock *sk, int flags);
 #endif
+#endif
 
 #endif /* _NET_DST_H */

include/net/xfrm.h renamed from include/net/xfrm.h-XFRM +43 -2

74 lines not on this page · raw message

net/core/skbuff.c renamed from net/core/skbuff.c-XFRM +1 -1

diff -u linux-xfrm/net/core/skbuff.c-XFRM linux-xfrm/net/core/skbuff.c
@@ -225,7 +225,7 @@
 	}
 
 	dst_release(skb->dst);
-#ifdef CONFIG_INET
+#ifdef CONFIG_XFRM
 	secpath_put(skb->sp);
 #endif
 	if(skb->destructor) {

net/ipv4/Kconfig renamed from net/ipv4/Kconfig-XFRM +5 -0

diff -u linux-xfrm/net/ipv4/Kconfig-XFRM linux-xfrm/net/ipv4/Kconfig
@@ -187,6 +187,7 @@
 config NET_IPIP
 	tristate "IP: tunneling"
 	depends on INET
+	select XFRM
 	---help---
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the

@@ -205,6 +206,7 @@
 config NET_IPGRE
 	tristate "IP: GRE tunnels over IP"
 	depends on INET
+	select XFRM
 	help
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the

@@ -343,6 +345,7 @@
 
 config INET_AH
 	tristate "IP: AH transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -354,6 +357,7 @@
 
 config INET_ESP
 	tristate "IP: ESP transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -366,6 +370,7 @@
 
 config INET_IPCOMP
 	tristate "IP: IPComp transformation"
+	select XFRM
 	select CRYPTO
 	select CRYPTO_DEFLATE
 	---help---

net/ipv4/Makefile renamed from net/ipv4/Makefile-XFRM +1 -1

diff -u linux-xfrm/net/ipv4/Makefile-XFRM linux-xfrm/net/ipv4/Makefile
@@ -23,4 +23,4 @@
 obj-$(CONFIG_NETFILTER)	+= netfilter/
 obj-$(CONFIG_IP_VS) += ipvs/
 
-obj-y += xfrm4_policy.o xfrm4_state.o xfrm4_input.o xfrm4_tunnel.o
+obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o xfrm4_tunnel.o

net/ipv4/route.c renamed from net/ipv4/route.c-XFRM +2 -0

diff -u linux-xfrm/net/ipv4/route.c-XFRM linux-xfrm/net/ipv4/route.c
@@ -2785,8 +2785,10 @@
 	create_proc_read_entry("net/rt_acct", 0, 0, ip_rt_acct_read, NULL);
 #endif
 #endif
+#ifdef CONFIG_XFRM
 	xfrm_init();
 	xfrm4_init();
+#endif
 out:
 	return rc;
 out_enomem:

net/ipv4/udp.c renamed from net/ipv4/udp.c-XFRM +7 -2

diff -u linux-xfrm/net/ipv4/udp.c-XFRM linux-xfrm/net/ipv4/udp.c
@@ -938,6 +938,9 @@
  */
 static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
 {
+#ifndef CONFIG_XFRM
+	return 1; 
+#else
 	struct udp_opt *up = udp_sk(sk);
   	struct udphdr *uh = skb->h.uh;
 	struct iphdr *iph;

@@ -997,10 +1000,12 @@
 		return -1;
 
 	default:
-		printk(KERN_INFO "udp_encap_rcv(): Unhandled UDP encap type: %u\n",
-		       encap_type);
+		if (net_ratelimit())
+			printk(KERN_INFO "udp_encap_rcv(): Unhandled UDP encap type: %u\n",
+			       encap_type);
 		return 1;
 	}
+#endif
 }
 
 /* returns:

net/ipv6/Kconfig renamed from net/ipv6/Kconfig-XFRM +3 -0

diff -u linux-xfrm/net/ipv6/Kconfig-XFRM linux-xfrm/net/ipv6/Kconfig
@@ -22,6 +22,7 @@
 config INET6_AH
 	tristate "IPv6: AH transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -34,6 +35,7 @@
 config INET6_ESP
 	tristate "IPv6: ESP transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_HMAC
 	select CRYPTO_MD5

@@ -47,6 +49,7 @@
 config INET6_IPCOMP
 	tristate "IPv6: IPComp transformation"
 	depends on IPV6
+	select XFRM
 	select CRYPTO
 	select CRYPTO_DEFLATE
 	---help---

net/ipv6/Makefile renamed from net/ipv6/Makefile-XFRM +3 -2

diff -u linux-xfrm/net/ipv6/Makefile-XFRM linux-xfrm/net/ipv6/Makefile
@@ -8,8 +8,9 @@
 		route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
 		protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
 		exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
-		ip6_flowlabel.o ipv6_syms.o \
-		xfrm6_policy.o xfrm6_state.o xfrm6_input.o
+		ip6_flowlabel.o ipv6_syms.o
+
+obj-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o
 
 obj-$(CONFIG_INET6_AH) += ah6.o
 obj-$(CONFIG_INET6_ESP) += esp6.o

net/ipv6/ipv6_syms.c renamed from net/ipv6/ipv6_syms.c-XFRM +2 -0

diff -u linux-xfrm/net/ipv6/ipv6_syms.c-XFRM linux-xfrm/net/ipv6/ipv6_syms.c
@@ -36,7 +36,9 @@
 EXPORT_SYMBOL(in6addr_loopback);
 EXPORT_SYMBOL(in6_dev_finish_destroy);
 EXPORT_SYMBOL(ip6_find_1stfragopt);
+#ifdef CONFIG_XFRM
 EXPORT_SYMBOL(xfrm6_rcv);
+#endif
 EXPORT_SYMBOL(rt6_lookup);
 EXPORT_SYMBOL(fl6_sock_lookup);
 EXPORT_SYMBOL(ipv6_ext_hdr);

net/ipv6/route.c renamed from net/ipv6/route.c-XFRM +2 -0

diff -u linux-xfrm/net/ipv6/route.c-XFRM linux-xfrm/net/ipv6/route.c
@@ -1988,7 +1988,9 @@
 	if (p)
 		p->proc_fops = &rt6_stats_seq_fops;
 #endif
+#ifdef CONFIG_XFRM
 	xfrm6_init();
+#endif
 }
 
 #ifdef MODULE

net/xfrm/Kconfig renamed from net/xfrm/Kconfig-XFRM +5 -1

diff -u linux-xfrm/net/xfrm/Kconfig-XFRM linux-xfrm/net/xfrm/Kconfig
@@ -1,9 +1,13 @@
 #
 # XFRM configuration
 #
+config XFRM
+       bool
+       depends on NET
+
 config XFRM_USER
 	tristate "IPsec user configuration interface"
-	depends on INET
+	depends on INET && XFRM
 	---help---
 	  Support for IPsec user configuration interface used
 	  by native Linux tools.

net/xfrm/Makefile renamed from net/xfrm/Makefile-XFRM +2 -1

diff -u linux-xfrm/net/xfrm/Makefile-XFRM linux-xfrm/net/xfrm/Makefile
@@ -2,6 +2,7 @@
 # Makefile for the XFRM subsystem.
 #
 
-obj-y := xfrm_policy.o xfrm_state.o xfrm_input.o xfrm_algo.o xfrm_output.o
+obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_input.o xfrm_algo.o xfrm_output.o \
+	xfrm_export.o
 obj-$(CONFIG_XFRM_USER) += xfrm_user.o

net/Kconfig renamed from net/Kconfig-XFRM +1 -0

diff -u linux-xfrm/net/Kconfig-XFRM linux-xfrm/net/Kconfig
@@ -83,6 +83,7 @@
 
 config NET_KEY
 	tristate "PF_KEY sockets"
+	select XFRM
 	---help---
 	  PF_KEYv2 socket family, compatible to KAME ones.
 	  They are required if you are going to use IPsec tools ported

net/netsyms.c renamed from net/netsyms.c-XFRM +1 ~~-75~~

94 lines not on this page · raw message

David S. Miller

2003-08-04 23:49 UTC #5 lore raw

Quoted 2 lines · On 4 Aug 2003 22:35:24 +0200 Andi Kleen <[email protected]> wrote:

Ok, here is a new patch again current BKCVS. It also moves the inet_peer_idlock only inside netsyms.

Appied, thanks Andi.

David S. Miller

2003-08-04 23:51 UTC #6 lore raw

In reply to Andi Kleen

Quoted 2 lines · On 4 Aug 2003 22:35:24 +0200 Andi Kleen <[email protected]> wrote:

Ok, here is a new patch again current BKCVS. It also moves the inet_peer_idlock only inside netsyms.

This one is missing net/xfrm/xfrm_export.c :-(

Andi, please be more careful with your patches. I'd suggest use subversions or whatever source management system you like best to help avoid these problems in the future. You seem to be chronicly making mistakes like this, as if you're rushing things.

A message that is not in the archive (sent off-list or not yet received): [email protected]

David S. Miller

2003-08-06 06:08 UTC #8 lore raw

Quoted 1 line · On 5 Aug 2003 15:53:15 +0200 Andi Kleen <[email protected]> wrote:

Here is a new patch that includes the missing file.

Something is still wrong, in particular it seems the net/ipv6/Makefile changes are wrong resulting in:

*** Warning: "xfrm6_fini" [net/ipv6/ipv6.ko] undefined! *** Warning: "xfrm6_init" [net/ipv6/ipv6.ko] undefined! *** Warning: "xfrm6_rcv" [net/ipv6/ipv6.ko] undefined!

When IPV6 is built modular.

Please fix, thanks.

Nivedita Singhvi

2003-08-04 15:50 UTC #9 lore raw

In reply to Andi Kleen

Quoted 3 lines · Andi Kleen

Only compile in the xfrm subsystem when it's needed by any config options.
This avoids some code/data structure bloat in case you don't use IP tunneling or IPsec.

Yes, I would like this too, please.

thanks,
Nivedita