linux.git/net/ipv4/esp4.c, branch v4.12

esp4: Fix udpencap for local TCP packets.

2017-05-04T05:27:26+00:00

Locally generated TCP packets are usually cloned, so we
do skb_cow_data() on this packets. After that we need to
reload the pointer to the esp header. On udpencap this
header has an offset to skb_transport_header, so take this
offset into account.

Fixes: 67d349ed603 ("net/esp4: Fix invalid esph pointer crash")
Fixes: fca11ebde3f0 ("esp4: Reorganize esp_output")
Reported-by: Don Bowman 
Signed-off-by: Steffen Klassert

net/esp4: Fix invalid esph pointer crash

2017-05-01T18:58:50+00:00

Both esp_output and esp_xmit take a pointer to the ESP header
and place it in esp_info struct prior to calling esp_output_head.

Inside esp_output_head, the call to esp_output_udp_encap
makes sure to update the pointer if it gets invalid.
However, if esp_output_head itself calls skb_cow_data, the
pointer is not updated and stays invalid, causing a crash
after esp_output_head returns.

Update the pointer if it becomes invalid in esp_output_head

Fixes: fca11ebde3f0 ("esp4: Reorganize esp_output")
Signed-off-by: Ilan Tayari 
Signed-off-by: David S. Miller

esp: Fix misplaced spin_unlock_bh.

2017-04-24T05:56:31+00:00

A recent commit moved esp_alloc_tmp() out of a lock
protected region, but forgot to remove the unlock from
the error path. This patch removes the forgotten unlock.
While at it, remove some unneeded error assignments too.

Fixes: fca11ebde3f0 ("esp4: Reorganize esp_output")
Fixes: 383d0350f2cc ("esp6: Reorganize esp_output")
Reported-by: Dan Carpenter 
Signed-off-by: Steffen Klassert

esp: Use a synchronous crypto algorithm on offloading.

2017-04-14T08:07:19+00:00

We need a fallback algorithm for crypto offloading to a NIC.
This is because packets can be rerouted to other NICs that
don't support crypto offloading. The fallback is going to be
implemented at layer2 where we know the final output device
but can't handle asynchronous returns fron the crypto layer.

Signed-off-by: Steffen Klassert

esp: Add gso handlers for esp4 and esp6

2017-04-14T08:06:50+00:00

This patch extends the xfrm_type by an encap function pointer
and implements esp4_gso_encap and esp6_gso_encap. These functions
doing the basic esp encapsulation for a GSO packet. In case the
GSO packet needs to be segmented in software, we add gso_segment
functions. This codepath is going to be used on esp hardware
offloads.

Signed-off-by: Steffen Klassert

esp4: Reorganize esp_output

2017-04-14T08:06:33+00:00

We need a fallback for ESP at layer 2, so split esp_output
into generic functions that can be used at layer 3 and layer 2
and use them in esp_output. We also add esp_xmit which is
used for the layer 2 fallback.

Signed-off-by: Steffen Klassert

xfrm: Add an IPsec hardware offloading API

2017-04-14T08:06:10+00:00

This patch adds all the bits that are needed to do
IPsec hardware offload for IPsec states and ESP packets.
We add xfrmdev_ops to the net_device. xfrmdev_ops has
function pointers that are needed to manage the xfrm
states in the hardware and to do a per packet
offloading decision.

Joint work with:
Ilan Tayari 
Guy Shapiro 
Yossi Kuperman 

Signed-off-by: Guy Shapiro 
Signed-off-by: Ilan Tayari 
Signed-off-by: Yossi Kuperman 
Signed-off-by: Steffen Klassert

esp: Introduce a helper to setup the trailer

2017-01-17T09:23:08+00:00

We need to setup the trailer in two different cases,
so add a helper to avoid code duplication.

Signed-off-by: Steffen Klassert

esp4: Avoid skb_cow_data whenever possible

2017-01-17T09:22:57+00:00

This patch tries to avoid skb_cow_data on esp4.

On the encrypt side we add the IPsec tailbits
to the linear part of the buffer if there is
space on it. If there is no space on the linear
part, we add a page fragment with the tailbits to
the buffer and use separate src and dst scatterlists.

On the decrypt side, we leave the buffer as it is
if it is not cloned.

With this, we can avoid a linearization of the buffer
in most of the cases.

Joint work with:
Sowmini Varadhan 
Ilan Tayari 

Signed-off-by: Sowmini Varadhan 
Signed-off-by: Ilan Tayari 
Signed-off-by: Steffen Klassert

esp4: Fix integrity verification when ESN are used

2016-11-30T10:09:39+00:00

When handling inbound packets, the two halves of the sequence number
stored on the skb are already in network order.

Fixes: 7021b2e1cddd ("esp4: Switch to new AEAD interface")
Signed-off-by: Tobias Brunner 
Acked-by: Herbert Xu 
Signed-off-by: Steffen Klassert