linux-stable.git/include/linux/xfrm.h, branch linux-2.6.25.y

[IPSEC]: Add support for combined mode algorithms

2008-02-01T03:27:03+00:00

This patch adds support for combined mode algorithms with GCM being
the first algorithm supported.

Combined mode algorithms can be added through the xfrm_user interface
using the new algorithm payload type XFRMA_ALG_AEAD.  Each algorithms
is identified by its name and the ICV length.

For the purposes of matching algorithms in xfrm_tmpl structures,
combined mode algorithms occupy the same name space as encryption
algorithms.  This is in line with how they are negotiated using IKE.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[XFRM]: Fix struct xfrm_algo code formatting.

2008-01-28T23:02:01+00:00

Realign struct members.

Signed-off-by: David S. Miller

[XFRM]: alg_key_len should be unsigned to avoid integer divides

2008-01-28T23:02:00+00:00

alg_key_len is currently defined as 'signed int'. This unfortunatly
leads to integer divides in several paths.

Converting it to unsigned is safe and saves 208 bytes of text on i386.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

[IPSEC]: Add ICMP host relookup support

2008-01-28T22:57:23+00:00

RFC 4301 requires us to relookup ICMP traffic that does not match any
policies using the reverse of its payload.  This patch implements this
for ICMP traffic that originates from or terminates on localhost.

This is activated on outbound with the new policy flag XFRM_POLICY_ICMP,
and on inbound by the new state flag XFRM_STATE_ICMP.

On inbound the policy check is now performed by the ICMP protocol so
that it can repeat the policy check where necessary.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[IPSEC]: Added xfrm_decode_session_reverse and xfrmX_policy_check_reverse

2008-01-28T22:57:22+00:00

RFC 4301 requires us to relookup ICMP traffic that does not match any
policies using the reverse of its payload.  This patch adds the functions
xfrm_decode_session_reverse and xfrmX_policy_check_reverse so we can get
the reverse flow to perform such a lookup.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[XFRM] SPD info TLV aggregation

2007-05-04T19:55:39+00:00

Aggregate the SPD info TLVs.

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[XFRM] SAD info TLV aggregationx

2007-05-04T19:55:13+00:00

Aggregate the SAD info TLVs.

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[XFRM]: Export SPD info

2007-04-29T04:20:32+00:00

With this patch you can use iproute2 in user space to efficiently see
how many policies exist in different directions.

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

[XFRM]: Export SAD info.

2007-04-26T07:10:29+00:00

On a system with a lot of SAs, counting SAD entries chews useful
CPU time since you need to dump the whole SAD to user space;
i.e something like ip xfrm state ls | grep -i src | wc -l
I have seen taking literally minutes on a 40K SAs when the system
is swapping.
With this patch, some of the SAD info (that was already being tracked)
is exposed to user space. i.e you do:
ip xfrm state count
And you get the count; you can also pass -s to the command line and
get the hash info.

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

[XFRM]: Extension for dynamic update of endpoint address(es)

2007-02-08T21:11:42+00:00

Extend the XFRM framework so that endpoint address(es) in the XFRM
databases could be dynamically updated according to a request (MIGRATE
message) from user application. Target XFRM policy is first identified
by the selector in the MIGRATE message. Next, the endpoint addresses
of the matching templates and XFRM states are updated according to
the MIGRATE message.

Signed-off-by: Shinta Sugimoto 
Signed-off-by: Masahide NAKAMURA 
Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller