kernel/linux.git/net/ipv4/ah4.c, branch linux-4.16.y

net: use -ENOSPC for transient busy indication

2017-11-03T14:11:17+00:00

Replace -EBUSY with -ENOSPC when handling transient busy indication in the absence of backlog. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-06-23T18:17:31+00:00

Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2017-06-23 1) Use memdup_user to spmlify xfrm_user_policy. From Geliang Tang. 2) Make xfrm_dev_register static to silence a sparse warning. From Wei Yongjun. 3) Use crypto_memneq to check the ICV in the AH protocol. From Sabrina Dubroca. 4) Remove some unused variables in esp6. From Stephen Hemminger. 5) Extend XFRM MIGRATE to allow to change the UDP encapsulation port. From Antony Antony. 6) Include the UDP encapsulation port to km_migrate announcements. From Antony Antony. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller

ipsec: check return value of skb_to_sgvec always

2017-06-05T03:01:47+00:00

Signed-off-by: Jason A. Donenfeld Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Signed-off-by: David S. Miller

ah: use crypto_memneq to check the ICV

2017-05-19T12:30:50+00:00

Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert

IPsec: do not ignore crypto err in ah4 input

2017-01-16T11:57:48+00:00

ah4 input processing uses the asynchronous hash crypto API which supplies an error code as part of the operation completion but the error code was being ignored. Treat a crypto API error indication as a verification failure. While a crypto API reported error would almost certainly result in a memcpy of the digest failing anyway and thus the security risk seems minor, performing a memory compare on what might be uninitialized memory is wrong. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Steffen Klassert

ah4: Fix error return in ah_input().

2015-08-25T20:38:50+00:00

Noticed by Herbert Xu. Signed-off-by: David S. Miller

ipsec: Remove obsolete MAX_AH_AUTH_LEN

2014-09-18T08:54:36+00:00

While tracking down the MAX_AH_AUTH_LEN crash in an old kernel I thought that this limit was rather arbitrary and we should just get rid of it. In fact it seems that we've already done all the work needed to remove it apart from actually removing it. This limit was there in order to limit stack usage. Since we've already switched over to allocating scratch space using kmalloc, there is no longer any need to limit the authentication length. This patch kills all references to it, including the BUG_ONs that led me here. Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert

ah4: Use the IPsec protocol multiplexer API

2014-02-25T06:04:17+00:00

Switch ah4 to use the new IPsec protocol multiplexer. Signed-off-by: Steffen Klassert

{IPv4,xfrm} Add ESN support for AH ingress part

2014-02-12T06:02:10+00:00

This patch add esn support for AH input stage by attaching upper 32bits sequence number right after packet payload as specified by RFC 4302. Then the ICV value will guard upper 32bits sequence number as well when packet getting in. Signed-off-by: Fan Du Signed-off-by: Steffen Klassert

{IPv4,xfrm} Add ESN support for AH egress part

2014-02-12T06:02:10+00:00

This patch add esn support for AH output stage by attaching upper 32bits sequence number right after packet payload as specified by RFC 4302. Then the ICV value will guard upper 32bits sequence number as well when packet going out. Signed-off-by: Fan Du Signed-off-by: Steffen Klassert