linux-stable.git/net/ipv4/esp4.c, branch linux-3.14.y

net: esp{4,6}: get rid of struct esp_data

2013-10-29T05:39:42+00:00

struct esp_data consists of a single pointer, vanishing the need for it
to be a structure. Fold the pointer into 'data' direcly, removing one
level of pointer indirection.

Signed-off-by: Mathias Krause 
Cc: Steffen Klassert 
Cc: Herbert Xu 
Cc: "David S. Miller" 
Signed-off-by: Steffen Klassert

net: esp{4,6}: remove padlen from struct esp_data

2013-10-29T05:39:42+00:00

The padlen member of struct esp_data is always zero. Get rid of it.

Signed-off-by: Mathias Krause 
Cc: Steffen Klassert 
Cc: Herbert Xu 
Cc: "David S. Miller" 
Signed-off-by: Steffen Klassert

net: esp{4,6}: fix potential MTU calculation overflows

2013-08-05T19:26:50+00:00

Commit 91657eafb ("xfrm: take net hdr len into account for esp payload
size calculation") introduced a possible interger overflow in
esp{4,6}_get_mtu() handlers in case of x->props.mode equals
XFRM_MODE_TUNNEL. Thus, the following expression will overflow

  unsigned int net_adj;
  ...
  
         net_adj = 0;
  ...
  return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
           net_adj) & ~(align - 1)) + (net_adj - 2);

where (net_adj - 2) would be evaluated as  + (0 - 2) in an unsigned
context. Fix it by simply removing brackets as those operations here
do not need to have special precedence.

Signed-off-by: Daniel Borkmann 
Cc: Benjamin Poirier 
Cc: Steffen Klassert 
Acked-by: Benjamin Poirier 
Signed-off-by: David S. Miller

ipv4: properly refresh rtable entries on pmtu/redirect events

2013-06-03T07:07:42+00:00

This reverts commit 05ab86c5 (xfrm4: Invalidate all ipv4 routes on
IPsec pmtu events). Flushing all cached entries is not needed.

Instead, invalidate only the related next hop dsts to recheck for
the added next hop exception where needed. This also fixes a subtle
race due to bumping generation id's before updating the pmtu.

Cc: Steffen Klassert 
Signed-off-by: Timo Teräs 
Signed-off-by: David S. Miller

esp4: fix error return code in esp_output()

2013-04-15T18:05:34+00:00

Fix to return a negative error code from the error handling
case instead of 0, as returned elsewhere in this function.

Signed-off-by: Wei Yongjun 
Acked-by: Steffen Klassert 
Signed-off-by: David S. Miller

xfrm4: Invalidate all ipv4 routes on IPsec pmtu events

2013-01-21T11:43:54+00:00

On IPsec pmtu events we can't access the transport headers of
the original packet, so we can't find the socket that sent
the packet. The only chance to notify the socket about the
pmtu change is to force a relookup for all routes. This
patch implenents this for the IPsec protocols.

Signed-off-by: Steffen Klassert

ah4/esp4: set transport header correctly for IPsec tunnel mode.

2013-01-08T11:41:30+00:00

IPsec tunnel does not set ECN field to CE in inner header when
the ECN field in the outer header is CE, and the ECN field in
the inner header is ECT(0) or ECT(1).

The cause is ipip_hdr() does not return the correct address of
inner header since skb->transport-header is not the inner header
after esp_input_done2(), or ah_input().

Signed-off-by: Li RongQing 
Signed-off-by: Steffen Klassert

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-12T04:27:49+00:00

Signed-off-by: David S. Miller

ipv4: Handle PMTU in all ICMP error handlers.

2012-06-15T05:22:07+00:00

With ip_rt_frag_needed() removed, we have to explicitly update PMTU
information in every ICMP error handler.

Create two helper functions to facilitate this.

1) ipv4_sk_update_pmtu()

   This updates the PMTU when we have a socket context to
   work with.

2) ipv4_update_pmtu()

   Raw version, used when no socket context is available.  For this
   interface, we essentially just pass in explicit arguments for
   the flow identity information we would have extracted from the
   socket.

   And you'll notice that ipv4_sk_update_pmtu() is simply implemented
   in terms of ipv4_update_pmtu()

Note that __ip_route_output_key() is used, rather than something like
ip_route_output_flow() or ip_route_output_key().  This is because we
absolutely do not want to end up with a route that does IPSEC
encapsulation and the like.  Instead, we only want the route that
would get us to the node described by the outermost IP header.

Reported-by: Steffen Klassert 
Signed-off-by: David S. Miller

xfrm: take net hdr len into account for esp payload size calculation

2012-05-27T05:08:29+00:00

Corrects the function that determines the esp payload size. The calculations
done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
certain mtu values and suboptimal frames for others.

According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
net_header_len must be taken into account before doing the alignment
calculation.

Signed-off-by: Benjamin Poirier 
Signed-off-by: David S. Miller