XFRM: MIGRATE enhancements
Subsystems (3)
PATCH RESEND 1/1 XFRM: MIGRATE enhancements
Hi,
This is a resend, the patch is now against today's net-next-2.6; I also added Herbert in Cc.
I start with the context, patch-related information follow.
XFRM supports a feature called MIGRATE, used by MIPv6 for the purpose of IPsec SP/SA updates upon movement. It was integrated some time ago by people of USAGI (Masahide Nakamura, Shinta Sugimoto and possibly others). Sugimoto-san and Nakamura-san (in CC) also published a document (IETF draft, see [1]) which specifies the original PF_KEY MIGRATE mechanism.
Because MIGRATE was not sufficient for bootstrapping IKE negotiation in MIPv6 context, an additional PF_KEY extension was also defined in the draft (SADB_X_EXT_PACKET): simply put, its main goal was to carry a verbatim copy of the triggering packet in the ACQUIRE so that the key manager be able to deduce some information on the addresses to use for the negotiation. A limited version of this feature implemented for Linux Kernel proved to be a pain to maintain and there was also additional drawbacks. This is why I never pushed associated patches.
This convinced me to propose some *simple* improvements to MIGRATE
authors: removing SADB_X_EXT_PACKET and replacing it by something more efficient which also solves other lacks. It is defined in a continuation work [2] of MIGRATE mechanim ([1] is expired). The proposed changes have been validated by Sugimoto-san and I have implemented and maintained patches for UMIP (Usagi MIPv6 userland implementation for Linux), racoon (IKE daemon) and Linux kernel (XFRM and PF_KEY) since 2.6.23-rc7 or so. I use it on a daily basis on my main laptop.
Simply put, the feature allows a MIPv6 Mobile Node to negotiate IPsec using IKE (bootstrapping) and then perform movements without the need for rekeying (migration of in-kernel SP/SA (done by current kernel code) *and* passing of required info for update of IKE-maintained structures). Take a look at [3] for more information.
The patch attached to this email provides the missing bits between current MIGRATE implementation and what is specified in [2]. It is against today's net-next-2.6.
If you have questions, do not hesitate.
Cheers,
a+
[1]: http://tools.ietf.org/html/draft-sugimoto-mip6-pfkey-migrate-04
[2]: http://tools.ietf.org/html/draft-ebalard-mext-pfkey-enhanced-migrate-00
[3]: http://natisbad.org/MIPv6/
From: Arnaud Ebalard <[email protected]>
Date: Mon, 25 Aug 2008 08:18:12 +0200
Subject: [PATCH] XFRM: MIGRATE enhancements (draft-ebalard-mext-pfkey-enhanced-migrate)
Provides implementation of the enhancements of XFRM/PF_KEY MIGRATE mechanism specified in draft-ebalard-mext-pfkey-enhanced-migrate-00. Defines associated PF_KEY SADB_X_EXT_KMADDRESS extension XFMR/netlink XFRMA_KMADDRESS attribute.
--- include/linux/pfkeyv2.h | 13 +++++++- include/linux/xfrm.h | 10 +++++ include/net/xfrm.h | 15 +++++++-- net/key/af_key.c | 85 +++++++++++++++++++++++++++++++++++++--------- net/xfrm/xfrm_policy.c | 5 ++- net/xfrm/xfrm_state.c | 5 ++- net/xfrm/xfrm_user.c | 45 ++++++++++++++++++++---- 7 files changed, 145 insertions(+), 33 deletions(-)
include/linux/pfkeyv2.h +12 -1
@@ -226,6 +226,15 @@ struct sadb_x_sec_ctx { } __attribute__((packed));/* sizeof(struct sadb_sec_ctx) = 8 */ +/* Used by MIGRATE to pass addresses IKE will use to perform +* negotiation with the peer */ +struct sadb_x_kmaddress { +uint16_t sadb_x_kmaddress_len; +uint16_t sadb_x_kmaddress_exttype; +uint32_t sadb_x_kmaddress_reserved; +} __attribute__((packed)); +/* sizeof(struct sadb_x_kmaddress) == 8 */ +/* Message types */ #define SADB_RESERVED 0#define SADB_GETSPI 1
@@ -346,7 +355,9 @@ struct sadb_x_sec_ctx {#define SADB_X_EXT_NAT_T_DPORT 22#define SADB_X_EXT_NAT_T_OA 23#define SADB_X_EXT_SEC_CTX 24 -#define SADB_EXT_MAX 24 +/* Used with MIGRATE to pass @ to IKE for negotiation */ +#define SADB_X_EXT_KMADDRESS 25 +#define SADB_EXT_MAX 25/* Identity Extension values */ #define SADB_IDENTTYPE_RESERVED 0
include/linux/xfrm.h +10 -0
@@ -279,6 +279,7 @@ enum xfrm_attr_type_t {XFRMA_POLICY_TYPE ,/* struct xfrm_userpolicy_type */ XFRMA_MIGRATE ,XFRMA_ALG_AEAD ,/* struct xfrm_algo_aead */ +XFRMA_KMADDRESS ,/* struct xfrm_user_kmaddress */ __XFRMA_MAX#define XFRMA_MAX (__XFRMA_MAX - 1)
@@ -415,6 +416,15 @@ struct xfrm_user_report {struct xfrm_selector sel; }; +/* Used by MIGRATE to pass addresses IKE should use to perform +* SA negotiation with the peer */ +struct xfrm_user_kmaddress { +xfrm_address_t local; +xfrm_address_t remote; +__u32 reserved; +__u16 family; +}; +struct xfrm_user_migrate {xfrm_address_t old_daddr;xfrm_address_t old_saddr;
include/net/xfrm.h +12 -3
@@ -476,6 +476,13 @@ struct xfrm_policystruct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH ]; }; +struct xfrm_kmaddress { +xfrm_address_t local; +xfrm_address_t remote; +u32 reserved; +u16 family; +}; +struct xfrm_migrate {xfrm_address_t old_daddr;xfrm_address_t old_saddr;
@@ -515,7 +522,7 @@ struct xfrm_mgrint (*new_mapping)(struct xfrm_state *x,xfrm_address_t *ipaddr,__be16 sport);int (*notify_policy)(struct xfrm_policy *x,int dir,struct km_event *c);int (*report)(u8 proto,struct xfrm_selector *sel,xfrm_address_t *addr); -int (*migrate)(struct xfrm_selector *sel,u8 dir,u8 type,struct xfrm_migrate *m,int num_bundles); +int (*migrate)(struct xfrm_selector *sel,u8 dir,u8 type,struct xfrm_migrate *m,int num_bundles,struct xfrm_kmaddress *k); };extern int xfrm_register_km (struct xfrm_mgr *km);
@@ -1455,12 +1462,14 @@ extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,#ifdef CONFIG_XFRM_MIGRATE extern int km_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_bundles); +struct xfrm_migrate *m,int num_bundles, +struct xfrm_kmaddress *k);extern struct xfrm_state *xfrm_migrate_state_find (struct xfrm_migrate *m);extern struct xfrm_state *xfrm_state_migrate (struct xfrm_state *x,struct xfrm_migrate *m);extern int xfrm_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_bundles); +struct xfrm_migrate *m,int num_bundles, +struct xfrm_kmaddress *k);#endif extern wait_queue_head_t km_waitq;
net/key/af_key.c +68 -17
177 lines not on this page · raw message
net/xfrm/xfrm_policy.c +3 -2
@@ -2673,7 +2673,8 @@ static int xfrm_migrate_check(struct xfrm_migrate *m, int num_migrate) }int xfrm_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_migrate) +struct xfrm_migrate *m,int num_migrate, +struct xfrm_kmaddress *k) {int i, err, nx_cur =0 , nx_new =0 ;struct xfrm_policy *pol =NULL ;
@@ -2717,7 +2718,7 @@ int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, }/* Stage 5 - announce */ -km_migrate (sel, dir, type, m, num_migrate); +km_migrate (sel, dir, type, m, num_migrate, k);xfrm_pol_put (pol);
net/xfrm/xfrm_state.c +3 -2
@@ -1787,7 +1787,8 @@ EXPORT_SYMBOL(km_policy_expired);#ifdef CONFIG_XFRM_MIGRATE int km_migrate (struct xfrm_selector *sel,u8 dir,u8 type, -struct xfrm_migrate *m,int num_migrate) +struct xfrm_migrate *m,int num_migrate, +struct xfrm_kmaddress *k) {int err = -EINVAL ;int ret;
@@ -1796,7 +1797,7 @@ int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,read_lock (&xfrm_km_lock);list_for_each_entry (km, &xfrm_km_list, list) {if (km->migrate) { - ret = km->migrate (sel, dir, type, m, num_migrate); + ret = km->migrate (sel, dir, type, m, num_migrate, k);if (!ret) err = ret; }
net/xfrm/xfrm_user.c +37 -8
123 lines not on this page · raw message
Signature · 1 line
1.5.6.3