linux-stable.git/net/key, branch linux-2.6.23.y

IPSEC: Avoid undefined shift operation when testing algorithm ID

2008-02-08T20:01:24+00:00

[IPSEC]: Avoid undefined shift operation when testing algorithm ID

[ Upstream commit: f398035f2dec0a6150833b0bc105057953594edb ]

The aalgos/ealgos fields are only 32 bits wide.  However, af_key tries
to test them with the expression 1 << id where id can be as large as
253.  This produces different behaviour on different architectures.

The following patch explicitly checks whether ID is greater than 31
and fails the check if that's the case.

We cannot easily extend the mask to be longer than 32 bits due to
exposure to user-space.  Besides, this whole interface is obsolete
anyway in favour of the xfrm_user interface which doesn't use this
bit mask in templates (well not within the kernel anyway).

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

PFKEY: Sending an SADB_GET responds with an SADB_GET

2007-12-14T17:51:05+00:00

[PFKEY]: Sending an SADB_GET responds with an SADB_GET

[ Upstream commit: 435000bebd94aae3a7a50078d142d11683d3b193 ]

Kernel needs to respond to an SADB_GET with the same message type to
conform to the RFC 2367 Section 3.1.5

Signed-off-by: Andrew Morton 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

[PF_KEY]: Fix ipsec not working in 2.6.23-rc1-git10

2007-08-03T02:42:29+00:00

Although an ipsec SA was established, kernel couldn't seem to find it.

I think since we are now using "x->sel.family" instead of "family" in
the xfrm_selector_match() called in xfrm_state_find(), af_key needs to
set this field too, just as xfrm_user.

In af_key.c, x->sel.family only gets set when there's an
ext_hdrs[SADB_EXT_ADDRESS_PROXY-1] which I think is for tunnel.

I think pfkey needs to also set the x->sel.family field when it is 0.

Tested with below patch, and ipsec worked when using pfkey.

Signed-off-by: David S. Miller

net/* misc endianness annotations

2007-07-26T18:11:56+00:00

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

xfrm: Add security check before flushing SAD/SPD

2007-06-07T20:42:46+00:00

Currently we check for permission before deleting entries from SAD and
SPD, (see security_xfrm_policy_delete() security_xfrm_state_delete())
However we are not checking for authorization when flushing the SPD and
the SAD completely. It was perhaps missed in the original security hooks
patch.

This patch adds a security check when flushing entries from the SAD and
SPD.  It runs the entire database and checks each entry for a denial.
If the process attempting the flush is unable to remove all of the
entries a denial is logged the the flush function returns an error
without removing anything.

This is particularly useful when a process may need to create or delete
its own xfrm entries used for things like labeled networking but that
same process should not be able to delete other entries or flush the
entire database.

Signed-off-by: Joy Latten
Signed-off-by: Eric Paris 
Signed-off-by: James Morris

[IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all

2007-05-19T21:21:18+00:00

This is a natural extension of the changeset

    [XFRM]: Probe selected algorithm only.

which only removed the probe call for xfrm_user.  This patch does exactly
the same thing for af_key.  In other words, we load the algorithm requested
by the user rather than everything when adding xfrm states in af_key.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller

[NET]: cleanup extra semicolons

2007-04-26T05:29:24+00:00

Spring cleaning time...

There seems to be a lot of places in the network code that have
extra bogus semicolons after conditionals.  Most commonly is a
bogus semicolon after: switch() { }

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[SK_BUFF]: Introduce skb_reset_transport_header(skb)

2007-04-26T05:25:15+00:00

For the common, open coded 'skb->h.raw = skb->data' operation, so that we can
later turn skb->h.raw into a offset, reducing the size of struct sk_buff in
64bit land while possibly keeping it as a pointer on 32bit.

This one touches just the most simple cases:

skb->h.raw = skb->data;
skb->h.raw = {skb_push|[__]skb_pull}()

The next ones will handle the slightly more "complex" cases.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller

[IPSEC] af_key: Fix thinko in pfkey_xfrm_policy2msg()

2007-04-18T21:16:07+00:00

Make sure to actually assign the determined mode to
rq->sadb_x_ipsecrequest_mode.

Noticed by Joe Perches.

Signed-off-by: David S. Miller

[KEY]: Fix conversion between IPSEC_MODE_xxx and XFRM_MODE_xxx.

2007-04-17T20:13:21+00:00

We should not blindly convert between IPSEC_MODE_xxx and XFRM_MODE_xxx just
by incrementing / decrementing because the assumption is not true any longer.

Signed-off-by: Kazunori MIYAZAWA 
Singed-off-by: YOSHIFUJI Hideaki