Commit 995dca4c authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 



Steffen Klassert says:

====================
One patch to rename a newly introduced struct. The rest is
the rework of the IPsec virtual tunnel interface for ipv6 to
support inter address family tunneling and namespace crossing.

1) Rename the newly introduced struct xfrm_filter to avoid a
   conflict with iproute2. From Nicolas Dichtel.

2) Introduce xfrm_input_afinfo to access the address family
   dependent tunnel callback functions properly.

3) Add and use a IPsec protocol multiplexer for ipv6.

4) Remove dst_entry caching. vti can lookup multiple different
   dst entries, dependent of the configured xfrm states. Therefore
   it does not make to cache a dst_entry.

5) Remove caching of flow informations. vti6 does not use the the
   tunnel endpoint addresses to do route and xfrm lookups.

6) Update the vti6 to use its own receive hook.

7) Remove the now unused xfrm_tunnel_notifier. This was used from vti
   and is replaced by the IPsec protocol multiplexer hooks.

8) Support inter address family tunneling for vti6.

9) Check if the tunnel endpoints of the xfrm state and the vti interface
   are matching and return an error otherwise.

10) Enable namespace crossing for vti devices.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents d70e941b 61220ab3

include/net/xfrm.h

+28 −22
Original line number Diff line number Diff line
@@ -121,7 +121,7 @@ struct xfrm_state_walk { 
	u8			dying;

	u8			proto;

	u32			seq;

	struct xfrm_filter	*filter;

	struct xfrm_address_filter *filter;

};



/* Full description of state of transformer. */
@@ -349,6 +349,16 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 
struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);

void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);



struct xfrm_input_afinfo {

	unsigned int		family;

	struct module		*owner;

	int			(*callback)(struct sk_buff *skb, u8 protocol,

					    int err);

};



int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);

int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);



void xfrm_state_delete_tunnel(struct xfrm_state *x);



struct xfrm_type {
@@ -1364,18 +1374,22 @@ struct xfrm4_protocol { 
	int priority;

};



/* XFRM tunnel handlers.  */

struct xfrm_tunnel {

struct xfrm6_protocol {

	int (*handler)(struct sk_buff *skb);

	int (*err_handler)(struct sk_buff *skb, u32 info);

	int (*cb_handler)(struct sk_buff *skb, int err);

	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,

			   u8 type, u8 code, int offset, __be32 info);



	struct xfrm_tunnel __rcu *next;

	struct xfrm6_protocol __rcu *next;

	int priority;

};



struct xfrm_tunnel_notifier {

/* XFRM tunnel handlers.  */

struct xfrm_tunnel {

	int (*handler)(struct sk_buff *skb);

	struct xfrm_tunnel_notifier __rcu *next;

	int (*err_handler)(struct sk_buff *skb, u32 info);



	struct xfrm_tunnel __rcu *next;

	int priority;

};
@@ -1392,11 +1406,14 @@ void xfrm4_init(void); 
int xfrm_state_init(struct net *net);

void xfrm_state_fini(struct net *net);

void xfrm4_state_init(void);

void xfrm4_protocol_init(void);

#ifdef CONFIG_XFRM

int xfrm6_init(void);

void xfrm6_fini(void);

int xfrm6_state_init(void);

void xfrm6_state_fini(void);

int xfrm6_protocol_init(void);

void xfrm6_protocol_fini(void);

#else

static inline int xfrm6_init(void)

{
@@ -1423,7 +1440,7 @@ static inline void xfrm_sysctl_fini(struct net *net) 
#endif



void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,

			  struct xfrm_filter *filter);

			  struct xfrm_address_filter *filter);

int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,

		    int (*func)(struct xfrm_state *, int, void*), void *);

void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
@@ -1531,8 +1548,6 @@ int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char prot 
int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);

int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);

void xfrm4_local_error(struct sk_buff *skb, u32 mtu);

int xfrm6_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);

int xfrm6_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);

int xfrm6_extract_header(struct sk_buff *skb);

int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);

int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
@@ -1541,6 +1556,9 @@ int xfrm6_rcv(struct sk_buff *skb); 
int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,

		     xfrm_address_t *saddr, u8 proto);

void xfrm6_local_error(struct sk_buff *skb, u32 mtu);

int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);

int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);

int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);

int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);

int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);

__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
@@ -1784,18 +1802,6 @@ static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 
	return ret;

}



static inline int xfrm_rcv_cb(struct sk_buff *skb, unsigned int family,

			      u8 protocol, int err)

{

	switch(family) {

#ifdef CONFIG_INET

	case AF_INET:

		return xfrm4_rcv_cb(skb, protocol, err);

#endif

	}

	return 0;

}



static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,

				    unsigned int family)

{

include/uapi/linux/xfrm.h

+2 −2
Original line number Diff line number Diff line
@@ -299,7 +299,7 @@ enum xfrm_attr_type_t { 
	XFRMA_REPLAY_ESN_VAL,	/* struct xfrm_replay_esn */

	XFRMA_SA_EXTRA_FLAGS,	/* __u32 */

	XFRMA_PROTO,		/* __u8 */

	XFRMA_FILTER,		/* struct xfrm_filter */

	XFRMA_ADDRESS_FILTER,	/* struct xfrm_address_filter */

	__XFRMA_MAX



#define XFRMA_MAX (__XFRMA_MAX - 1)
@@ -476,7 +476,7 @@ struct xfrm_user_mapping { 
	__be16				new_sport;

};



struct xfrm_filter {

struct xfrm_address_filter {

	xfrm_address_t			saddr;

	xfrm_address_t			daddr;

	__u16				family;

net/ipv4/xfrm4_policy.c

+1 −0
Original line number Diff line number Diff line
@@ -325,6 +325,7 @@ void __init xfrm4_init(void) 


	xfrm4_state_init();

	xfrm4_policy_init();

	xfrm4_protocol_init();

#ifdef CONFIG_SYSCTL

	register_pernet_subsys(&xfrm4_net_ops);

#endif

net/ipv4/xfrm4_protocol.c

+12 −1
Original line number Diff line number Diff line
@@ -179,6 +179,12 @@ static const struct net_protocol ipcomp4_protocol = { 
	.netns_ok	=	1,

};



static struct xfrm_input_afinfo xfrm4_input_afinfo = {

	.family		=	AF_INET,

	.owner		=	THIS_MODULE,

	.callback	=	xfrm4_rcv_cb,

};



static inline const struct net_protocol *netproto(unsigned char protocol)

{

	switch (protocol) {
@@ -199,7 +205,6 @@ int xfrm4_protocol_register(struct xfrm4_protocol *handler, 
	struct xfrm4_protocol __rcu **pprev;

	struct xfrm4_protocol *t;

	bool add_netproto = false;



	int ret = -EEXIST;

	int priority = handler->priority;
@@ -273,3 +278,9 @@ int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, 
	return ret;

}

EXPORT_SYMBOL(xfrm4_protocol_deregister);



void __init xfrm4_protocol_init(void)

{

	xfrm_input_register_afinfo(&xfrm4_input_afinfo);

}

EXPORT_SYMBOL(xfrm4_protocol_init);

net/ipv6/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -16,7 +16,7 @@ ipv6-$(CONFIG_SYSCTL) = sysctl_net_ipv6.o 
ipv6-$(CONFIG_IPV6_MROUTE) += ip6mr.o



ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \

	xfrm6_output.o

	xfrm6_output.o xfrm6_protocol.o

ipv6-$(CONFIG_NETFILTER) += netfilter.o

ipv6-$(CONFIG_IPV6_MULTIPLE_TABLES) += fib6_rules.o

ipv6-$(CONFIG_PROC_FS) += proc.o

CRA Git | Maintained and supported by SUSTech CRA and CCSE