Commit 7b77d161 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 



Conflicts:
	include/net/xfrm.h

Simple conflict between Joe Perches "extern" removal for function
declarations in header files and the changes in Steffen's tree.

Steffen Klassert says:

====================
Two patches that are left from the last development cycle.
Manual merging of include/net/xfrm.h is needed. The conflict
can be solved as it is currently done in linux-next.

1) We announce the creation of temporary acquire state via an asyc event,
   so the deletion should be annunced too. From Nicolas Dichtel.

2) The VTI tunnels do not real tunning, they just provide a routable
   IPsec tunnel interface. So introduce and use xfrm_tunnel_notifier
   instead of xfrm_tunnel for xfrm tunnel mode callback. From Fan Du.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 44a504c7 aba82695

include/net/xfrm.h

+10 −5
Original line number Diff line number Diff line
@@ -1357,6 +1357,12 @@ struct xfrm_tunnel { 
	int priority;

};



struct xfrm_tunnel_notifier {

	int (*handler)(struct sk_buff *skb);

	struct xfrm_tunnel_notifier __rcu *next;

	int priority;

};



struct xfrm6_tunnel {

	int (*handler)(struct sk_buff *skb);

	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -1499,9 +1505,9 @@ int xfrm4_output(struct sk_buff *skb); 
int xfrm4_output_finish(struct sk_buff *skb);

int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);

int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);

int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler);

int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler);

void xfrm4_local_error(struct sk_buff *skb, u32 mtu);

int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);

int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);

int xfrm6_extract_header(struct sk_buff *skb);

int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);

int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
@@ -1509,9 +1515,9 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async); 
int xfrm6_rcv(struct sk_buff *skb);

int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,

		     xfrm_address_t *saddr, u8 proto);

void xfrm6_local_error(struct sk_buff *skb, u32 mtu);

int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);

int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler,

			    unsigned short family);

int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);

__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);

__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);

int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
@@ -1520,7 +1526,6 @@ int xfrm6_output(struct sk_buff *skb); 
int xfrm6_output_finish(struct sk_buff *skb);

int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,

			  u8 **prevhdr);

void xfrm6_local_error(struct sk_buff *skb, u32 mtu);



#ifdef CONFIG_XFRM

int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);

net/ipv4/ip_vti.c

+1 −66
Original line number Diff line number Diff line
@@ -49,70 +49,6 @@ static struct rtnl_link_ops vti_link_ops __read_mostly; 
static int vti_net_id __read_mostly;

static int vti_tunnel_init(struct net_device *dev);



static int vti_err(struct sk_buff *skb, u32 info)

{



	/* All the routers (except for Linux) return only

	 * 8 bytes of packet payload. It means, that precise relaying of

	 * ICMP in the real Internet is absolutely infeasible.

	 */

	struct net *net = dev_net(skb->dev);

	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);

	struct iphdr *iph = (struct iphdr *)skb->data;

	const int type = icmp_hdr(skb)->type;

	const int code = icmp_hdr(skb)->code;

	struct ip_tunnel *t;

	int err;



	switch (type) {

	default:

	case ICMP_PARAMETERPROB:

		return 0;



	case ICMP_DEST_UNREACH:

		switch (code) {

		case ICMP_SR_FAILED:

		case ICMP_PORT_UNREACH:

			/* Impossible event. */

			return 0;

		default:

			/* All others are translated to HOST_UNREACH. */

			break;

		}

		break;

	case ICMP_TIME_EXCEEDED:

		if (code != ICMP_EXC_TTL)

			return 0;

		break;

	}



	err = -ENOENT;



	t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,

			     iph->daddr, iph->saddr, 0);

	if (t == NULL)

		goto out;



	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {

		ipv4_update_pmtu(skb, dev_net(skb->dev), info,

				 t->parms.link, 0, IPPROTO_IPIP, 0);

		err = 0;

		goto out;

	}



	err = 0;

	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)

		goto out;



	if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))

		t->err_count++;

	else

		t->err_count = 1;

	t->err_time = jiffies;

out:

	return err;

}



/* We dont digest the packet therefore let the packet pass */

static int vti_rcv(struct sk_buff *skb)

{
@@ -296,9 +232,8 @@ static void __net_init vti_fb_tunnel_init(struct net_device *dev) 
	iph->ihl		= 5;

}



static struct xfrm_tunnel vti_handler __read_mostly = {

static struct xfrm_tunnel_notifier vti_handler __read_mostly = {

	.handler	=	vti_rcv,

	.err_handler	=	vti_err,

	.priority	=	1,

};

net/ipv4/xfrm4_mode_tunnel.c

+8 −8
Original line number Diff line number Diff line
@@ -16,13 +16,13 @@ 
#include <net/xfrm.h>



/* Informational hook. The decap is still done here. */

static struct xfrm_tunnel __rcu *rcv_notify_handlers __read_mostly;

static struct xfrm_tunnel_notifier __rcu *rcv_notify_handlers __read_mostly;

static DEFINE_MUTEX(xfrm4_mode_tunnel_input_mutex);



int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler)

int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler)

{

	struct xfrm_tunnel __rcu **pprev;

	struct xfrm_tunnel *t;

	struct xfrm_tunnel_notifier __rcu **pprev;

	struct xfrm_tunnel_notifier *t;

	int ret = -EEXIST;

	int priority = handler->priority;
@@ -50,10 +50,10 @@ err: 
}

EXPORT_SYMBOL_GPL(xfrm4_mode_tunnel_input_register);



int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler)

int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler)

{

	struct xfrm_tunnel __rcu **pprev;

	struct xfrm_tunnel *t;

	struct xfrm_tunnel_notifier __rcu **pprev;

	struct xfrm_tunnel_notifier *t;

	int ret = -ENOENT;



	mutex_lock(&xfrm4_mode_tunnel_input_mutex);
@@ -134,7 +134,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) 


static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)

{

	struct xfrm_tunnel *handler;

	struct xfrm_tunnel_notifier *handler;

	int err = -EINVAL;



	if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)

net/xfrm/xfrm_state.c

+1 −1
Original line number Diff line number Diff line
@@ -468,7 +468,7 @@ expired: 
	}



	err = __xfrm_state_delete(x);

	if (!err && x->id.spi)

	if (!err)

		km_state_expired(x, 1, 0);



	xfrm_audit_state_delete(x, err ? 0 : 1,

CRA Git | Maintained and supported by SUSTech CRA and CCSE