Commit c87acb25 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 



Steffen Klassert says:

====================
pull request (net-next): ipsec-next 2015-08-17

1) Fix IPv6 ECN decapsulation for IPsec interfamily tunnels.
   From Thomas Egerer.

2) Use kmemdup instead of duplicating it in xfrm_dump_sa().
   From Andrzej Hajda.

3) Pass oif to the xfrm lookups so that it gets set on the flow
   and the resolver routines can match based on oif.
   From David Ahern.

4) Add documentation for the new xfrm garbage collector threshold.
   From Alexander Duyck.

Please pull or let me know if there are problems.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents fbaff3ef e69948a0

Documentation/networking/ip-sysctl.txt

+10 −0
Original line number Original line Diff line number Diff line
@@ -1181,6 +1181,11 @@ tag - INTEGER 
	Allows you to write a number, which can be used as required.

	Allows you to write a number, which can be used as required.

	Default value is 0.

	Default value is 0.





xfrm4_gc_thresh - INTEGER

	The threshold at which we will start garbage collecting for IPv4

	destination cache entries.  At twice this value the system will

	refuse new allocations.



Alexey Kuznetsov.

Alexey Kuznetsov.

kuznet@ms2.inr.ac.ru

kuznet@ms2.inr.ac.ru
@@ -1617,6 +1622,11 @@ ratelimit - INTEGER 
	otherwise the minimal space between responses in milliseconds.

	otherwise the minimal space between responses in milliseconds.

	Default: 1000

	Default: 1000





xfrm6_gc_thresh - INTEGER

	The threshold at which we will start garbage collecting for IPv6

	destination cache entries.  At twice this value the system will

	refuse new allocations.







IPv6 Update by:

IPv6 Update by:

Pekka Savola <pekkas@netcore.fi>

Pekka Savola <pekkas@netcore.fi>

include/net/xfrm.h

+5 −2
Original line number Original line Diff line number Diff line
@@ -285,10 +285,13 @@ struct xfrm_policy_afinfo { 
	unsigned short		family;

	unsigned short		family;

	struct dst_ops		*dst_ops;

	struct dst_ops		*dst_ops;

	void			(*garbage_collect)(struct net *net);

	void			(*garbage_collect)(struct net *net);

	struct dst_entry	*(*dst_lookup)(struct net *net, int tos,

	struct dst_entry	*(*dst_lookup)(struct net *net,

					       int tos, int oif,

					       const xfrm_address_t *saddr,

					       const xfrm_address_t *saddr,

					       const xfrm_address_t *daddr);

					       const xfrm_address_t *daddr);

	int			(*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);

	int			(*get_saddr)(struct net *net, int oif,

					     xfrm_address_t *saddr,

					     xfrm_address_t *daddr);

	void			(*decode_session)(struct sk_buff *skb,

	void			(*decode_session)(struct sk_buff *skb,

						  struct flowi *fl,

						  struct flowi *fl,

						  int reverse);

						  int reverse);

net/ipv4/xfrm4_policy.c

+6 −5
Original line number Original line Diff line number Diff line
@@ -19,7 +19,7 @@ 
static struct xfrm_policy_afinfo xfrm4_policy_afinfo;

static struct xfrm_policy_afinfo xfrm4_policy_afinfo;





static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,

static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,

					    int tos,

					    int tos, int oif,

					    const xfrm_address_t *saddr,

					    const xfrm_address_t *saddr,

					    const xfrm_address_t *daddr)

					    const xfrm_address_t *daddr)

{

{
@@ -28,6 +28,7 @@ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4, 
	memset(fl4, 0, sizeof(*fl4));

	memset(fl4, 0, sizeof(*fl4));

	fl4->daddr = daddr->a4;

	fl4->daddr = daddr->a4;

	fl4->flowi4_tos = tos;

	fl4->flowi4_tos = tos;

	fl4->flowi4_oif = oif;

	if (saddr)

	if (saddr)

		fl4->saddr = saddr->a4;

		fl4->saddr = saddr->a4;
@@ -38,22 +39,22 @@ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4, 
	return ERR_CAST(rt);

	return ERR_CAST(rt);

}

}





static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,

static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif,

					  const xfrm_address_t *saddr,

					  const xfrm_address_t *saddr,

					  const xfrm_address_t *daddr)

					  const xfrm_address_t *daddr)

{

{

	struct flowi4 fl4;

	struct flowi4 fl4;





	return __xfrm4_dst_lookup(net, &fl4, tos, saddr, daddr);

	return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr);

}

}





static int xfrm4_get_saddr(struct net *net,

static int xfrm4_get_saddr(struct net *net, int oif,

			   xfrm_address_t *saddr, xfrm_address_t *daddr)

			   xfrm_address_t *saddr, xfrm_address_t *daddr)

{

{

	struct dst_entry *dst;

	struct dst_entry *dst;

	struct flowi4 fl4;

	struct flowi4 fl4;





	dst = __xfrm4_dst_lookup(net, &fl4, 0, NULL, daddr);

	dst = __xfrm4_dst_lookup(net, &fl4, 0, oif, NULL, daddr);

	if (IS_ERR(dst))

	if (IS_ERR(dst))

		return -EHOSTUNREACH;

		return -EHOSTUNREACH;

net/ipv6/xfrm6_mode_tunnel.c

+1 −2
Original line number Original line Diff line number Diff line
@@ -20,10 +20,9 @@ 




static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)

static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)

{

{

	const struct ipv6hdr *outer_iph = ipv6_hdr(skb);

	struct ipv6hdr *inner_iph = ipipv6_hdr(skb);

	struct ipv6hdr *inner_iph = ipipv6_hdr(skb);





	if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph)))

	if (INET_ECN_is_ce(XFRM_MODE_SKB_CB(skb)->tos))

		IP6_ECN_set_ce(inner_iph);

		IP6_ECN_set_ce(inner_iph);

}

}

net/ipv6/xfrm6_policy.c

+4 −3
Original line number Original line Diff line number Diff line
@@ -26,7 +26,7 @@ 




static struct xfrm_policy_afinfo xfrm6_policy_afinfo;

static struct xfrm_policy_afinfo xfrm6_policy_afinfo;





static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,

static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,

					  const xfrm_address_t *saddr,

					  const xfrm_address_t *saddr,

					  const xfrm_address_t *daddr)

					  const xfrm_address_t *daddr)

{

{
@@ -35,6 +35,7 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, 
	int err;

	int err;





	memset(&fl6, 0, sizeof(fl6));

	memset(&fl6, 0, sizeof(fl6));

	fl6.flowi6_oif = oif;

	memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));

	memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));

	if (saddr)

	if (saddr)

		memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));

		memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
@@ -50,13 +51,13 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, 
	return dst;

	return dst;

}

}





static int xfrm6_get_saddr(struct net *net,

static int xfrm6_get_saddr(struct net *net, int oif,

			   xfrm_address_t *saddr, xfrm_address_t *daddr)

			   xfrm_address_t *saddr, xfrm_address_t *daddr)

{

{

	struct dst_entry *dst;

	struct dst_entry *dst;

	struct net_device *dev;

	struct net_device *dev;





	dst = xfrm6_dst_lookup(net, 0, NULL, daddr);

	dst = xfrm6_dst_lookup(net, 0, oif, NULL, daddr);

	if (IS_ERR(dst))

	if (IS_ERR(dst))

		return -EHOSTUNREACH;

		return -EHOSTUNREACH;

CRA Git | Maintained and supported by SUSTech CRA and CCSE