diff options
| author | David Lebrun <david.lebrun@uclouvain.be> | 2016-11-08 16:59:19 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-11-10 04:40:06 +0300 |
| commit | 9baee83406d6a4b02222f5ee21511c3f4c19e39d (patch) | |
| tree | 2a048ee6d143496156dbfe71402f84971cf41ec3 /net/ipv6/seg6_iptunnel.c | |
| parent | 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 (diff) | |
| download | linux-9baee83406d6a4b02222f5ee21511c3f4c19e39d.tar.xz | |
ipv6: sr: add calls to verify and insert HMAC signatures
This patch enables the verification of the HMAC signature for transiting
SR-enabled packets, and its insertion on encapsulated/injected SRH.
Signed-off-by: David Lebrun <david.lebrun@uclouvain.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/seg6_iptunnel.c')
| -rw-r--r-- | net/ipv6/seg6_iptunnel.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 39762b2fa7a2..bbfca22c34ae 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -29,6 +29,9 @@ #ifdef CONFIG_DST_CACHE #include <net/dst_cache.h> #endif +#ifdef CONFIG_IPV6_SEG6_HMAC +#include <net/seg6_hmac.h> +#endif struct seg6_lwt { #ifdef CONFIG_DST_CACHE @@ -130,6 +133,14 @@ static int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) hdr->daddr = isrh->segments[isrh->first_segment]; set_tun_src(net, skb->dev, &hdr->daddr, &hdr->saddr); +#ifdef CONFIG_IPV6_SEG6_HMAC + if (sr_has_hmac(isrh)) { + err = seg6_push_hmac(net, &hdr->saddr, isrh); + if (unlikely(err)) + return err; + } +#endif + skb_postpush_rcsum(skb, hdr, tot_len); return 0; @@ -172,6 +183,16 @@ static int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) isrh->segments[0] = hdr->daddr; hdr->daddr = isrh->segments[isrh->first_segment]; +#ifdef CONFIG_IPV6_SEG6_HMAC + if (sr_has_hmac(isrh)) { + struct net *net = dev_net(skb_dst(skb)->dev); + + err = seg6_push_hmac(net, &hdr->saddr, isrh); + if (unlikely(err)) + return err; + } +#endif + skb_postpush_rcsum(skb, hdr, sizeof(struct ipv6hdr) + hdrlen); return 0; |