github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

xfrm: add generic iptfs defines and functionality

Browse Source 
Define `XFRM_MODE_IPTFS` and `IPSEC_MODE_IPTFS` constants, and add these to
switch case and conditionals adjacent with the existing TUNNEL modes.

Signed-off-by: Christian Hopps <chopps@labn.net>
Tested-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Christian Hopps 2024-11-14 02:07:02 -05:00 committed by Steffen Klassert
parent 7ac64f4598
commit d1716d5a44
12 changed files with 48 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/xfrm.h
View File

@ -38,6 +38,7 @@
#define XFRM_PROTO_COMP 108 #define XFRM_PROTO_COMP 108
#define XFRM_PROTO_IPIP 4 #define XFRM_PROTO_IPIP 4
#define XFRM_PROTO_IPV6 41 #define XFRM_PROTO_IPV6 41
#define XFRM_PROTO_IPTFS IPPROTO_AGGFRAG
#define XFRM_PROTO_ROUTING IPPROTO_ROUTING #define XFRM_PROTO_ROUTING IPPROTO_ROUTING
#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS

3
include/uapi/linux/ipsec.h
View File

@ -14,7 +14,8 @@ enum {
IPSEC_MODE_ANY = 0, /* We do not support this for SA */ IPSEC_MODE_ANY = 0, /* We do not support this for SA */
IPSEC_MODE_TRANSPORT = 1, IPSEC_MODE_TRANSPORT = 1,
IPSEC_MODE_TUNNEL = 2, IPSEC_MODE_TUNNEL = 2,
IPSEC_MODE_BEET = 3 IPSEC_MODE_BEET = 3,
IPSEC_MODE_IPTFS = 4
}; };
enum { enum {

2
include/uapi/linux/snmp.h
View File

@ -339,6 +339,8 @@ enum
LINUX_MIB_XFRMACQUIREERROR, /* XfrmAcquireError */ LINUX_MIB_XFRMACQUIREERROR, /* XfrmAcquireError */
LINUX_MIB_XFRMOUTSTATEDIRERROR, /* XfrmOutStateDirError */ LINUX_MIB_XFRMOUTSTATEDIRERROR, /* XfrmOutStateDirError */
LINUX_MIB_XFRMINSTATEDIRERROR, /* XfrmInStateDirError */ LINUX_MIB_XFRMINSTATEDIRERROR, /* XfrmInStateDirError */
LINUX_MIB_XFRMINIPTFSERROR, /* XfrmInIptfsError */
LINUX_MIB_XFRMOUTNOQSPACE, /* XfrmOutNoQueueSpace */
__LINUX_MIB_XFRMMAX __LINUX_MIB_XFRMMAX
}; };

3
net/ipv4/esp4.c
View File

@ -816,7 +816,8 @@ int esp_input_done2(struct sk_buff *skb, int err)
} }
skb_pull_rcsum(skb, hlen); skb_pull_rcsum(skb, hlen);
if (x->props.mode == XFRM_MODE_TUNNEL) if (x->props.mode == XFRM_MODE_TUNNEL ||
x->props.mode == XFRM_MODE_IPTFS)
skb_reset_transport_header(skb); skb_reset_transport_header(skb);
else else
skb_set_transport_header(skb, -ihl); skb_set_transport_header(skb, -ihl);

3
net/ipv6/esp6.c
View File

@ -859,7 +859,8 @@ int esp6_input_done2(struct sk_buff *skb, int err)
skb_postpull_rcsum(skb, skb_network_header(skb), skb_postpull_rcsum(skb, skb_network_header(skb),
skb_network_header_len(skb)); skb_network_header_len(skb));
skb_pull_rcsum(skb, hlen); skb_pull_rcsum(skb, hlen);
if (x->props.mode == XFRM_MODE_TUNNEL) if (x->props.mode == XFRM_MODE_TUNNEL ||
x->props.mode == XFRM_MODE_IPTFS)
skb_reset_transport_header(skb); skb_reset_transport_header(skb);
else else
skb_set_transport_header(skb, -hdr_len); skb_set_transport_header(skb, -hdr_len);

3
net/netfilter/nft_xfrm.c
View File

@ -112,7 +112,8 @@ static bool xfrm_state_addr_ok(enum nft_xfrm_keys k, u8 family, u8 mode)
return true; return true;
} }
return mode == XFRM_MODE_BEET || mode == XFRM_MODE_TUNNEL; return mode == XFRM_MODE_BEET || mode == XFRM_MODE_TUNNEL ||
mode == XFRM_MODE_IPTFS;
} }
static void nft_xfrm_state_get_key(const struct nft_xfrm *priv, static void nft_xfrm_state_get_key(const struct nft_xfrm *priv,

1
net/xfrm/xfrm_device.c
View File

@ -69,6 +69,7 @@ static void __xfrm_mode_beet_prep(struct xfrm_state *x, struct sk_buff *skb,
static void xfrm_outer_mode_prep(struct xfrm_state *x, struct sk_buff *skb) static void xfrm_outer_mode_prep(struct xfrm_state *x, struct sk_buff *skb)
{ {
switch (x->outer_mode.encap) { switch (x->outer_mode.encap) {
case XFRM_MODE_IPTFS:
case XFRM_MODE_TUNNEL: case XFRM_MODE_TUNNEL:
if (x->outer_mode.family == AF_INET) if (x->outer_mode.family == AF_INET)
return __xfrm_mode_tunnel_prep(x, skb, return __xfrm_mode_tunnel_prep(x, skb,

4
net/xfrm/xfrm_output.c
View File

@ -677,6 +677,10 @@ static void xfrm_get_inner_ipproto(struct sk_buff *skb, struct xfrm_state *x)
return; return;
} }
if (x->outer_mode.encap == XFRM_MODE_IPTFS) {
xo->inner_ipproto = IPPROTO_AGGFRAG;
return;
}
/* non-Tunnel Mode */ /* non-Tunnel Mode */
if (!skb->encapsulation) if (!skb->encapsulation)

8
net/xfrm/xfrm_policy.c
View File

@ -2497,6 +2497,7 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl,
struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i]; struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
if (tmpl->mode == XFRM_MODE_TUNNEL || if (tmpl->mode == XFRM_MODE_TUNNEL ||
tmpl->mode == XFRM_MODE_IPTFS ||
tmpl->mode == XFRM_MODE_BEET) { tmpl->mode == XFRM_MODE_BEET) {
remote = &tmpl->id.daddr; remote = &tmpl->id.daddr;
local = &tmpl->saddr; local = &tmpl->saddr;
@ -3294,7 +3295,8 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
ok: ok:
xfrm_pols_put(pols, drop_pols); xfrm_pols_put(pols, drop_pols);
if (dst && dst->xfrm && if (dst && dst->xfrm &&
dst->xfrm->props.mode == XFRM_MODE_TUNNEL) (dst->xfrm->props.mode == XFRM_MODE_TUNNEL ||
dst->xfrm->props.mode == XFRM_MODE_IPTFS))
dst->flags |= DST_XFRM_TUNNEL; dst->flags |= DST_XFRM_TUNNEL;
return dst; return dst;
@ -4523,6 +4525,7 @@ static int migrate_tmpl_match(const struct xfrm_migrate *m, const struct xfrm_tm
switch (t->mode) { switch (t->mode) {
case XFRM_MODE_TUNNEL: case XFRM_MODE_TUNNEL:
case XFRM_MODE_BEET: case XFRM_MODE_BEET:
case XFRM_MODE_IPTFS:
if (xfrm_addr_equal(&t->id.daddr, &m->old_daddr, if (xfrm_addr_equal(&t->id.daddr, &m->old_daddr,
m->old_family) && m->old_family) &&
xfrm_addr_equal(&t->saddr, &m->old_saddr, xfrm_addr_equal(&t->saddr, &m->old_saddr,
@ -4565,7 +4568,8 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol,
continue; continue;
n++; n++;
if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL && if (pol->xfrm_vec[i].mode != XFRM_MODE_TUNNEL &&
pol->xfrm_vec[i].mode != XFRM_MODE_BEET) pol->xfrm_vec[i].mode != XFRM_MODE_BEET &&
pol->xfrm_vec[i].mode != XFRM_MODE_IPTFS)
continue; continue;
/* update endpoints */ /* update endpoints */
memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr, memcpy(&pol->xfrm_vec[i].id.daddr, &mp->new_daddr,

2
net/xfrm/xfrm_proc.c
View File

@ -43,6 +43,8 @@ static const struct snmp_mib xfrm_mib_list[] = {
SNMP_MIB_ITEM("XfrmAcquireError", LINUX_MIB_XFRMACQUIREERROR), SNMP_MIB_ITEM("XfrmAcquireError", LINUX_MIB_XFRMACQUIREERROR),
SNMP_MIB_ITEM("XfrmOutStateDirError", LINUX_MIB_XFRMOUTSTATEDIRERROR), SNMP_MIB_ITEM("XfrmOutStateDirError", LINUX_MIB_XFRMOUTSTATEDIRERROR),
SNMP_MIB_ITEM("XfrmInStateDirError", LINUX_MIB_XFRMINSTATEDIRERROR), SNMP_MIB_ITEM("XfrmInStateDirError", LINUX_MIB_XFRMINSTATEDIRERROR),
SNMP_MIB_ITEM("XfrmInIptfsError", LINUX_MIB_XFRMINIPTFSERROR),
SNMP_MIB_ITEM("XfrmOutNoQueueSpace", LINUX_MIB_XFRMOUTNOQSPACE),
SNMP_MIB_SENTINEL SNMP_MIB_SENTINEL
}; };

12
net/xfrm/xfrm_state.c
View File

@ -467,6 +467,11 @@ static const struct xfrm_mode xfrm4_mode_map[XFRM_MODE_MAX] = {
.flags = XFRM_MODE_FLAG_TUNNEL, .flags = XFRM_MODE_FLAG_TUNNEL,
.family = AF_INET, .family = AF_INET,
}, },
[XFRM_MODE_IPTFS] = {
.encap = XFRM_MODE_IPTFS,
.flags = XFRM_MODE_FLAG_TUNNEL,
.family = AF_INET,
},
}; };
static const struct xfrm_mode xfrm6_mode_map[XFRM_MODE_MAX] = { static const struct xfrm_mode xfrm6_mode_map[XFRM_MODE_MAX] = {
@ -488,6 +493,11 @@ static const struct xfrm_mode xfrm6_mode_map[XFRM_MODE_MAX] = {
.flags = XFRM_MODE_FLAG_TUNNEL, .flags = XFRM_MODE_FLAG_TUNNEL,
.family = AF_INET6, .family = AF_INET6,
}, },
[XFRM_MODE_IPTFS] = {
.encap = XFRM_MODE_IPTFS,
.flags = XFRM_MODE_FLAG_TUNNEL,
.family = AF_INET6,
},
}; };
static const struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family) static const struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family)
@ -2334,6 +2344,7 @@ static int __xfrm6_state_sort_cmp(const void *p)
#endif #endif
case XFRM_MODE_TUNNEL: case XFRM_MODE_TUNNEL:
case XFRM_MODE_BEET: case XFRM_MODE_BEET:
case XFRM_MODE_IPTFS:
return 4; return 4;
} }
return 5; return 5;
@ -2360,6 +2371,7 @@ static int __xfrm6_tmpl_sort_cmp(const void *p)
#endif #endif
case XFRM_MODE_TUNNEL: case XFRM_MODE_TUNNEL:
case XFRM_MODE_BEET: case XFRM_MODE_BEET:
case XFRM_MODE_IPTFS:
return 3; return 3;
} }
return 4; return 4;

12
net/xfrm/xfrm_user.c
View File

@ -383,6 +383,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
case XFRM_MODE_ROUTEOPTIMIZATION: case XFRM_MODE_ROUTEOPTIMIZATION:
case XFRM_MODE_BEET: case XFRM_MODE_BEET:
break; break;
case XFRM_MODE_IPTFS:
if (p->id.proto != IPPROTO_ESP) {
NL_SET_ERR_MSG(extack, "IP-TFS mode only supported with ESP");
goto out;
}
if (sa_dir == 0) {
NL_SET_ERR_MSG(extack, "IP-TFS mode requires in or out direction attribute");
goto out;
}
break;
default: default:
NL_SET_ERR_MSG(extack, "Unsupported mode"); NL_SET_ERR_MSG(extack, "Unsupported mode");
@ -2014,6 +2024,8 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family,
return -EINVAL; return -EINVAL;
} }
break; break;
case XFRM_MODE_IPTFS:
break;
default: default:
if (ut[i].family != prev_family) { if (ut[i].family != prev_family) {
NL_SET_ERR_MSG(extack, "Mode in template doesn't support a family change"); NL_SET_ERR_MSG(extack, "Mode in template doesn't support a family change");