linux-stable.git/net/ipv6/esp6.c, branch linux-3.2.y

xfrm: Return error on unknown encap_type in init_state

2018-03-03T15:50:56+00:00

commit bcfd09f7837f5240c30fd2f52ee7293516641faa upstream.

Currently esp will happily create an xfrm state with an unknown
encap type for IPv4, without setting the necessary state parameters.
This patch fixes it by returning -EINVAL.

There is a similar problem in IPv6 where if the mode is unknown
we will skip initialisation while returning zero.  However, this
is harmless as the mode has already been checked further up the
stack.  This patch removes this anomaly by aligning the IPv6
behaviour with IPv4 and treating unknown modes (which cannot
actually happen) as transport mode.

Fixes: 38320c70d282 ("[IPSEC]: Use crypto_aead and authenc in ESP")
Signed-off-by: Herbert Xu 
Signed-off-by: Steffen Klassert 
Signed-off-by: Ben Hutchings

xfrm: take net hdr len into account for esp payload size calculation

2012-06-10T13:42:07+00:00

[ Upstream commit 91657eafb64b4cb53ec3a2fbc4afc3497f735788 ]

Corrects the function that determines the esp payload size. The calculations
done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
certain mtu values and suboptimal frames for others.

According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
net_header_len must be taken into account before doing the alignment
calculation.

Signed-off-by: Benjamin Poirier 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2011-05-05T21:59:02+00:00

Conflicts:
	drivers/net/tg3.c

esp6: Fix scatterlist initialization

2011-04-26T19:46:04+00:00

When we use IPsec extended sequence numbers, we may overwrite
the last scatterlist of the associated data by the scatterlist
for the skb. This patch fixes this by placing the scatterlist
for the skb right behind the last scatterlist of the associated
data. esp4 does it already like that.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

inet: constify ip headers and in6_addr

2011-04-22T18:04:14+00:00

Add const qualifiers to structs iphdr, ipv6hdr and in6_addr pointers
where possible, to make code intention more obvious.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

esp6: Add support for IPsec extended sequence numbers

2011-03-14T03:22:29+00:00

This patch adds IPsec extended sequence numbers support to esp6.
We use the authencesn crypto algorithm to handle esp with separate
encryption/authentication algorithms.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: Use separate low and high order bits of the sequence numbers in xfrm_skb_cb

2011-03-14T03:22:28+00:00

To support IPsec extended sequence numbers, we split the
output sequence numbers of xfrm_skb_cb in low and high order 32 bits
and we add the high order 32 bits to the input sequence numbers.
All users are updated accordingly.

Signed-off-by: Steffen Klassert 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: Traffic Flow Confidentiality for IPv6 ESP

2010-12-10T22:43:59+00:00

Add TFC padding to all packets smaller than the boundary configured
on the xfrm state. If the boundary is larger than the PMTU, limit
padding to the PMTU.

Signed-off-by: Martin Willi 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller

xfrm: SA lookups signature with mark

2010-02-23T00:20:22+00:00

pass mark to all SA lookups to prepare them for when we add code
to have them search.

Signed-off-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller

xfrm: Use the user specified truncation length in ESP and AH

2009-11-25T23:48:41+00:00

Instead of using the hardcoded truncation for authentication
algorithms, use the truncation length specified on xfrm_state.

Signed-off-by: Martin Willi 
Signed-off-by: David S. Miller