XFRM: MIGRATE enhancements
Subsystems (3)
PATCH 1/1 XFRM: MIGRATE enhancements
Hi,
As there were quite some XFRM/PF_KEY changes in net-next recently, here is an updated version of MIGRATE enhancements patch. It is tested (I am currently running today's net-next with the patch applied).
David, it addresses the comments you made 3 weeks ago, as described previously [1].
Comments welcome.
a+
[1]: http://thread.gmane.org/gmane.linux.network/103497
From: Arnaud Ebalard <[email protected]>
Date: Thu, 2 Oct 2008 07:57:51 +0200
Subject: [PATCH] XFRM: MIGRATE enhancements (draft-ebalard-mext-pfkey-enhanced-migrate)
Provides implementation of the enhancements of XFRM/PF_KEY MIGRATE mechanism specified in draft-ebalard-mext-pfkey-enhanced-migrate-00. Defines associated PF_KEY SADB_X_EXT_KMADDRESS extension and XFRM/netlink XFRMA_KMADDRESS attribute.
--- include/linux/pfkeyv2.h | 13 ++++++- include/linux/xfrm.h | 10 +++++ include/net/xfrm.h | 15 ++++++-- net/key/af_key.c | 86 +++++++++++++++++++++++++++++++++++++--------- net/xfrm/xfrm_policy.c | 5 ++- net/xfrm/xfrm_state.c | 5 ++- net/xfrm/xfrm_user.c | 57 ++++++++++++++++++++++++------ 7 files changed, 154 insertions(+), 37 deletions(-)
include/linux/pfkeyv2.h +12 -1
@@ -226,6 +226,15 @@ struct sadb_x_sec_ctx { } __attribute__((packed));/* sizeof(struct sadb_sec_ctx) = 8 */ +/* Used by MIGRATE to pass addresses IKE will use to perform +* negotiation with the peer */ +struct sadb_x_kmaddress { +uint16_t sadb_x_kmaddress_len; +uint16_t sadb_x_kmaddress_exttype; +uint32_t sadb_x_kmaddress_reserved; +} __attribute__((packed)); +/* sizeof(struct sadb_x_kmaddress) == 8 */ +/* Message types */ #define SADB_RESERVED 0#define SADB_GETSPI 1
@@ -346,7 +355,9 @@ struct sadb_x_sec_ctx {#define SADB_X_EXT_NAT_T_DPORT 22#define SADB_X_EXT_NAT_T_OA 23#define SADB_X_EXT_SEC_CTX 24 -#define SADB_EXT_MAX 24 +/* Used with MIGRATE to pass @ to IKE for negotiation */ +#define SADB_X_EXT_KMADDRESS 25 +#define SADB_EXT_MAX 25/* Identity Extension values */ #define SADB_IDENTTYPE_RESERVED 0
include/linux/xfrm.h +10 -0
@@ -279,6 +279,7 @@ enum xfrm_attr_type_t {XFRMA_POLICY_TYPE ,/* struct xfrm_userpolicy_type */ XFRMA_MIGRATE ,XFRMA_ALG_AEAD ,/* struct xfrm_algo_aead */ +XFRMA_KMADDRESS ,/* struct xfrm_user_kmaddress */ __XFRMA_MAX#define XFRMA_MAX (__XFRMA_MAX - 1)
@@ -415,6 +416,15 @@ struct xfrm_user_report {struct xfrm_selector sel; }; +/* Used by MIGRATE to pass addresses IKE should use to perform +* SA negotiation with the peer */ +struct xfrm_user_kmaddress { +xfrm_address_t local; +xfrm_address_t remote; +__u32 reserved; +__u16 family; +}; +struct xfrm_user_migrate {xfrm_address_t old_daddr;xfrm_address_t old_saddr;
include/net/xfrm.h +12 -3
@@ -492,6 +492,13 @@ struct xfrm_policystruct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH ]; }; +struct xfrm_kmaddress { +xfrm_address_t local; +xfrm_address_t remote; +u32 reserved; +u16 family; +}; +struct xfrm_migrate {xfrm_address_t old_daddr;xfrm_address_t old_saddr;
@@ -531,7 +538,7 @@ struct xfrm_mgrint (*new_mapping)(struct xfrm_state *x,xfrm_address_t *ipaddr,__be16 sport);int (*notify_policy)(struct xfrm_policy *x,int dir,struct km_event *c);int (*report)(u8 proto,struct xfrm_selector *sel,xfrm_address_t *addr); -int (*migrate)(struct xfrm_selector *sel,u8 dir,u8 type,struct xfrm_migrate *m,int num_bundles); +int (*migrate)(struct xfrm_selector *sel,u8 dir,u8 type,struct xfrm_migrate *m,int num_bundles,struct xfrm_kmaddress *k); };extern int xfrm_register_km (struct xfrm_mgr *km);
@@ -1432,12 +1439,14 @@ extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,#ifdef CONFIG_XFRM_MIGRATE extern int km_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_bundles); +struct xfrm_migrate *m,int num_bundles, +struct xfrm_kmaddress *k);extern struct xfrm_state *xfrm_migrate_state_find (struct xfrm_migrate *m);extern struct xfrm_state *xfrm_state_migrate (struct xfrm_state *x,struct xfrm_migrate *m);extern int xfrm_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_bundles); +struct xfrm_migrate *m,int num_bundles, +struct xfrm_kmaddress *k);#endif extern wait_queue_head_t km_waitq;
net/key/af_key.c +69 -17
181 lines not on this page · raw message
net/xfrm/xfrm_policy.c +3 -2
@@ -2679,7 +2679,8 @@ static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate) }int xfrm_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_migrate) +struct xfrm_migrate *m,int num_migrate, +struct xfrm_kmaddress *k) {int i, err, nx_cur =0 , nx_new =0 ;struct xfrm_policy *pol =NULL ;
@@ -2723,7 +2724,7 @@ int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, }/* Stage 5 - announce */ -km_migrate (sel, dir, type, m, num_migrate); +km_migrate (sel, dir, type, m, num_migrate, k);xfrm_pol_put (pol);
net/xfrm/xfrm_state.c +3 -2
@@ -1814,7 +1814,8 @@ EXPORT_SYMBOL(km_policy_expired);#ifdef CONFIG_XFRM_MIGRATE int km_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_migrate) +struct xfrm_migrate *m,int num_migrate, +struct xfrm_kmaddress *k) {int err = -EINVAL ;int ret;
@@ -1823,7 +1824,7 @@ int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,read_lock (&xfrm_km_lock);list_for_each_entry (km, &xfrm_km_list, list) {if (km->migrate) { - ret = km->migrate (sel, dir, type, m, num_migrate); + ret = km->migrate (sel, dir, type, m, num_migrate, k);if (!ret) err = ret; }
net/xfrm/xfrm_user.c +45 -12
133 lines not on this page · raw message
Signature · 1 line
1.5.6.3
From: [email protected] (Arnaud Ebalard)
Date: Thu, 02 Oct 2008 09:42:23 +0200
Quoted 6 lines
As there were quite some XFRM/PF_KEY changes in net-next recently, here is an updated version of MIGRATE enhancements patch. It is tested (I am currently running today's net-next with the patch applied).
David, it addresses the comments you made 3 weeks ago, as described previously [1].
Applied to net-next-2.6, thanks!