summaryrefslogtreecommitdiff
path: root/net/xfrm/xfrm_policy.c
AgeCommit message (Collapse)AuthorFilesLines
2012-05-27ipv6: fix incorrect ipsec fragmentGao feng1-0/+3
Since commit ad0081e43a "ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed" the fragment of packets is incorrect. because tunnel mode needs IPsec headers and trailer for all fragments, while on transport mode it is sufficient to add the headers to the first fragment and the trailer to the last. so modify mtu and maxfraglen base on ipsec mode and if fragment is first or last. with my test,it work well(every fragment's size is the mtu) and does not trigger slow fragment path. Changes from v1: though optimization, mtu_prev and maxfraglen_prev can be delete. replace xfrm mode codes with dst_entry's new frag DST_XFRM_TUNNEL. add fuction ip6_append_data_mtu to make codes clearer. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-05-22Merge branch 'next' of ↵Linus Torvalds1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull security subsystem updates from James Morris: "New notable features: - The seccomp work from Will Drewry - PR_{GET,SET}_NO_NEW_PRIVS from Andy Lutomirski - Longer security labels for Smack from Casey Schaufler - Additional ptrace restriction modes for Yama by Kees Cook" Fix up trivial context conflicts in arch/x86/Kconfig and include/linux/filter.h * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (65 commits) apparmor: fix long path failure due to disconnected path apparmor: fix profile lookup for unconfined ima: fix filename hint to reflect script interpreter name KEYS: Don't check for NULL key pointer in key_validate() Smack: allow for significantly longer Smack labels v4 gfp flags for security_inode_alloc()? Smack: recursive tramsmute Yama: replace capable() with ns_capable() TOMOYO: Accept manager programs which do not start with / . KEYS: Add invalidation support KEYS: Do LRU discard in full keyrings KEYS: Permit in-place link replacement in keyring list KEYS: Perform RCU synchronisation on keys prior to key destruction KEYS: Announce key type (un)registration KEYS: Reorganise keys Makefile KEYS: Move the key config into security/keys/Kconfig KEYS: Use the compat keyctl() syscall wrapper on Sparc64 for Sparc32 compat Yama: remove an unused variable samples/seccomp: fix dependencies on arch macros Yama: add additional ptrace scopes ...
2012-05-15xfrm: Convert several xfrm policy match functions to bool.David S. Miller1-13/+14
xfrm_selector_match xfrm_sec_ctx_match __xfrm4_selector_match __xfrm6_selector_match Signed-off-by: David S. Miller <davem@davemloft.net>
2012-04-09SELinux: include flow.h where used rather than get it indirectlyEric Paris1-0/+1
We use flow_cache_genid in the selinux xfrm files. This is declared in net/flow.h However we do not include that file directly anywhere. We have always just gotten it through a long chain of indirect .h file includes. on x86_64: CC security/selinux/ss/services.o In file included from /next/linux-next-20120216/security/selinux/ss/services.c:69:0: /next/linux-next-20120216/security/selinux/include/xfrm.h: In function 'selinux_xfrm_notify_policyload': /next/linux-next-20120216/security/selinux/include/xfrm.h:51:14: error: 'flow_cache_genid' undeclared (first use in this function) /next/linux-next-20120216/security/selinux/include/xfrm.h:51:14: note: each undeclared identifier is reported only once for each function it appears in make[3]: *** [security/selinux/ss/services.o] Error 1 Reported-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Eric Paris <eparis@redhat.com>
2011-12-24Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller1-4/+14
Conflicts: net/bluetooth/l2cap_core.c Just two overlapping changes, one added an initialization of a local variable, and another change added a new local variable. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-22net: Add a flow_cache_flush_deferred functionSteffen Klassert1-4/+14
flow_cach_flush() might sleep but can be called from atomic context via the xfrm garbage collector. So add a flow_cache_flush_deferred() function and use this if the xfrm garbage colector is invoked from within the packet path. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Acked-by: Timo Teräs <timo.teras@iki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-12net: use IS_ENABLED(CONFIG_IPV6)Eric Dumazet1-3/+3
Instead of testing defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-06net: Rename dst_get_neighbour{, _raw} to dst_get_neighbour_noref{, _raw}.David Miller1-1/+1
To reflect the fact that a refrence is not obtained to the resulting neighbour entry. Signed-off-by: David S. Miller <davem@davemloft.net> Acked-by: Roland Dreier <roland@purestorage.com>
2011-11-26Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller1-4/+6
Conflicts: net/ipv4/inet_diag.c
2011-11-26net: Move mtu handling down to the protocol depended handlersSteffen Klassert1-1/+3
We move all mtu handling from dst_mtu() down to the protocol layer. So each protocol can implement the mtu handling in a different manner. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-26net: Rename the dst_opt default_mtu method to mtuSteffen Klassert1-3/+3
We plan to invoke the dst_opt->default_mtu() method unconditioally from dst_mtu(). So rename the method to dst_opt->mtu() to match the name with the new meaning. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-23xfrm: optimize ipv4 selector matchingAlexey Dobriyan1-2/+2
Current addr_match() is errh, under-optimized. Compiler doesn't know that memcmp() branch doesn't trigger for IPv4. Also, pass addresses by value -- they fit into register. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27net: check return value for dst_allocMadalin Bucur1-4/+6
return value of dst_alloc must be checked before use Signed-off-by: Madalin Bucur <madalin.bucur@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-18net: Add ->neigh_lookup() operation to dst_opsDavid S. Miller1-0/+7
In the future dst entries will be neigh-less. In that environment we need to have an easy transition point for current users of dst->neighbour outside of the packet output fast path. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-18net: Abstract dst->neighbour accesses behind helpers.David S. Miller1-1/+1
dst_{get,set}_neighbour() Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-02xfrm: Remove family arg from xfrm_bundle_okSteffen Klassert1-3/+3
The family arg is not used any more, so remove it. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-11Merge branch 'master' of ↵David S. Miller1-1/+13
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-3.6 Conflicts: drivers/net/benet/be_main.c
2011-05-11xfrm: Assign the inner mode output function to the dst entrySteffen Klassert1-1/+13
As it is, we assign the outer modes output function to the dst entry when we create the xfrm bundle. This leads to two problems on interfamily scenarios. We might insert ipv4 packets into ip6_fragment when called from xfrm6_output. The system crashes if we try to fragment an ipv4 packet with ip6_fragment. This issue was introduced with git commit ad0081e4 (ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed). The second issue is, that we might insert ipv4 packets in netfilter6 and vice versa on interfamily scenarios. With this patch we assign the inner mode output function to the dst entry when we create the xfrm bundle. So xfrm4_output/xfrm6_output from the inner mode is used and the right fragmentation and netfilter functions are called. We switch then to outer mode with the output_finish functions. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-04-29net: Use non-zero allocations in dst_alloc().David S. Miller1-0/+1
Make dst_alloc() and it's users explicitly initialize the entire entry. The zero'ing done by kmem_cache_zalloc() was almost entirely redundant. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-04-29net: Make dst_alloc() take more explicit initializations.David S. Miller1-1/+1
Now the dst->dev, dev->obsolete, and dst->flags values can be specified as well. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-16xfrm: Refcount destination entry on xfrm_lookupSteffen Klassert1-0/+2
We return a destination entry without refcount if a socket policy is found in xfrm_lookup. This triggers a warning on a negative refcount when freeeing this dst entry. So take a refcount in this case to fix it. This refcount was forgotten when xfrm changed to cache bundles instead of policies for outgoing flows. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Acked-by: Timo Teräs <timo.teras@iki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-16xfrm: fix __xfrm_route_forward()Eric Dumazet1-2/+2
This function should return 0 in case of error, 1 if OK commit 452edd598f60522 (xfrm: Return dst directly from xfrm_lookup()) got it wrong. Reported-and-bisected-by: Michael Smith <msmith@cbnco.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-13net: Use flowi4 and flowi6 in xfrm layer.David S. Miller1-12/+16
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-13net: Break struct flowi out into AF specific instances.David S. Miller1-4/+4
Now we have struct flowi4, flowi6, and flowidn for each address family. And struct flowi is just a union of them all. It might have been troublesome to convert flow_cache_uli_match() but as it turns out this function is completely unused and therefore can be simply removed. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-13net: Make flowi ports AF dependent.David S. Miller1-4/+4
Create two sets of port member accessors, one set prefixed by fl4_* and the other prefixed by fl6_* This will let us to create AF optimal flow instances. It will work because every context in which we access the ports, we have to be fully aware of which AF the flowi is anyways. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-13net: Put flowi_* prefix on AF independent members of struct flowiDavid S. Miller1-9/+9
I intend to turn struct flowi into a union of AF specific flowi structs. There will be a common structure that each variant includes first, much like struct sock_common. This is the first step to move in that direction. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-13xfrm: Eliminate "fl" and "pol" args to xfrm_bundle_ok().David S. Miller1-19/+3
There is only one caller of xfrm_bundle_ok(), and that always passes these parameters as NULL. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-03xfrm: Return dst directly from xfrm_lookup()David S. Miller1-17/+17
Instead of on the stack. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-02xfrm: Handle blackhole route creation via afinfo.David S. Miller1-20/+26
That way we don't have to potentially do this in every xfrm_lookup() caller. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-03-02xfrm: Kill XFRM_LOOKUP_WAIT flag.David S. Miller1-1/+1
This can be determined from the flow flags instead. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify sec_path arg to secpath_has_nontransport.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify ptr args to xfrm_policy_ok.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify ptr args to xfrm_state_ok.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify selector arg to xfrm_dst_update_parent.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify policy arg to clone_policy.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify policy arg and local selector in xfrm_policy_match.David S. Miller1-2/+3
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify local xfrm_address_t pointers in xfrm_policy_lookup_bytype.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify selector args in xfrm_migrate paths.David S. Miller1-4/+4
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify address args to hash helpers.David S. Miller1-2/+7
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify pointer args to migrate_tmpl_match and xfrm_migrate_checkDavid S. Miller1-2/+2
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify address arguments to __xfrm_dst_lookup()David S. Miller1-2/+2
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-24xfrm: Const'ify selector argument to xfrm_selector_match()David S. Miller1-3/+3
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23net: Make flow cache paths use a const struct flowi.David S. Miller1-5/+8
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23xfrm: Mark flowi arg to xfrm_resolve_and_create_bundle() const.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23xfrm: Mark flowi arg to xfrm_dst_{alloc_copy,update_origin}() const.David S. Miller1-2/+2
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23xfrm: Mark flowi arg to xfrm_bundle_create() const.David S. Miller1-1/+1
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23xfrm: Mark flowi arg to xfrm_tmpl_resolve{,_one}() const.David S. Miller1-6/+4
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23xfrm: Mark flowi arg to xfrm_expand_policies() const.David S. Miller1-2/+2
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23xfrm: Mark flowi arg to xfrm_policy_{lookup_by_type,match}() const.David S. Miller1-2/+2
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-02-23xfrm: Kill strict arg to xfrm_bundle_ok().David S. Miller1-8/+3
Always set to "0". Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.0) at 2024-12-25 12:02:02 +0300