kernel.git/net/ipv4/ah4.c, branch linux-2.6.27.y

[IPSEC]: Fix bogus usage of u64 on input sequence number

2008-02-13T06:50:35Z

Al Viro spotted a bogus use of u64 on the input sequence number which is big-endian. This patch fixes it by giving the input sequence number its own member in the xfrm_skb_cb structure. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

[XFRM]: constify 'struct xfrm_type'

2008-02-01T03:27:20Z

Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

[IPSEC]: Move all calls to xfrm_audit_state_icvfail to xfrm_input

2008-01-28T23:00:10Z

Let's nip the code duplication in the bud :) Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

[XFRM]: RFC4303 compliant auditing

2008-01-28T23:00:01Z

This patch adds a number of new IPsec audit events to meet the auditing requirements of RFC4303. This includes audit hooks for the following events: * Could not find a valid SA [sections 2.1, 3.4.2] . xfrm_audit_state_notfound() . xfrm_audit_state_notfound_simple() * Sequence number overflow [section 3.3.3] . xfrm_audit_state_replay_overflow() * Replayed packet [section 3.4.3] . xfrm_audit_state_replay() * Integrity check failure [sections 3.4.4.1, 3.4.4.2] . xfrm_audit_state_icvfail() While RFC4304 deals only with ESP most of the changes in this patch apply to IPsec in general, i.e. both AH and ESP. The one case, integrity check failure, where ESP specific code had to be modified the same was done to the AH code for the sake of consistency. Signed-off-by: Paul Moore Acked-by: James Morris Signed-off-by: David S. Miller

[IPSEC]: Move state lock into x->type->input

2008-01-28T22:53:52Z

This patch releases the lock on the state before calling x->type->input. It also adds the lock to the spots where they're currently needed. Most of those places (all except mip6) are expected to disappear with async crypto. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

[IPSEC]: Move integrity stat collection into xfrm_input

2008-01-28T22:53:51Z

Similar to the moving out of the replay processing on the output, this patch moves the integrity stat collectin from x->type->input into xfrm_input. This would eventually allow transforms such as AH/ESP to be lockless. The error value EBADMSG (currently unused in the crypto layer) is used to indicate a failed integrity check. In future this error can be directly returned by the crypto layer once we switch to aead algorithms. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

cleanup asm/scatterlist.h includes

2007-11-02T07:47:06Z

Not architecture specific code should not #include . This patch therefore either replaces them with #include or simply removes them if they were unused. Signed-off-by: Adrian Bunk Signed-off-by: Jens Axboe

[IPSEC]: Move IP protocol setting from transforms into xfrm4_input.c

2007-10-10T23:55:56Z

This patch makes the IPv4 x->type->input functions return the next protocol instead of setting it directly. This is identical to how we do things in IPv6 and will help us merge common code on the input path. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

[IPSEC]: Move IP length/checksum setting out of transforms

2007-10-10T23:55:56Z

This patch moves the setting of the IP length and checksum fields out of the transforms and into the xfrmX_output functions. This would help future efforts in merging the transforms themselves. It also adds an optimisation to ipcomp due to the fact that the transport offset is guaranteed to be zero. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

[IPSEC]: Get rid of ipv6_{auth,esp,comp}_hdr

2007-10-10T23:55:55Z

This patch removes the duplicate ipv6_{auth,esp,comp}_hdr structures since they're identical to the IPv4 versions. Duplicating them would only create problems for ourselves later when we need to add things like extended sequence numbers. I've also added transport header type conversion headers for these types which are now used by the transforms. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller