1. 18 Feb, 2008 1 commit
  2. 28 Jan, 2008 17 commits
  3. 20 Dec, 2007 1 commit
  4. 11 Dec, 2007 1 commit
  5. 29 Nov, 2007 1 commit
    • Herbert Xu's avatar
      [IPSEC]: Fix uninitialised dst warning in __xfrm_lookup · 5e5234ff
      Herbert Xu authored
      Andrew Morton reported that __xfrm_lookup generates this warning:
      net/xfrm/xfrm_policy.c: In function '__xfrm_lookup':
      net/xfrm/xfrm_policy.c:1449: warning: 'dst' may be used uninitialized in this function
      This is because if policy->action is of an unexpected value then dst will
      not be initialised.  Of course, in practice this should never happen since
      the input layer xfrm_user/af_key will filter out all illegal values.  But
      the compiler doesn't know that of course.
      So this patch fixes this by taking the conservative approach and treat all
      unknown actions the same as a blocking action.
      Thanks to Andrew for finding this and providing an initial fix.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
  6. 17 Oct, 2007 3 commits
    • Herbert Xu's avatar
      [IPSEC]: Rename mode to outer_mode and add inner_mode · 13996378
      Herbert Xu authored
      This patch adds a new field to xfrm states called inner_mode.  The existing
      mode object is renamed to outer_mode.
      This is the first part of an attempt to fix inter-family transforms.  As it
      is we always use the outer family when determining which mode to use.  As a
      result we may end up shoving IPv4 packets into netfilter6 and vice versa.
      What we really want is to use the inner family for the first part of outbound
      processing and the outer family for the second part.  For inbound processing
      we'd use the opposite pairing.
      I've also added a check to prevent silly combinations such as transport mode
      with inter-family transforms.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Herbert Xu's avatar
      [IPSEC]: Add missing BEET checks · 1bfcb10f
      Herbert Xu authored
      Currently BEET mode does not reinject the packet back into the stack
      like tunnel mode does.  Since BEET should behave just like tunnel mode
      this is incorrect.
      This patch fixes this by introducing a flags field to xfrm_mode that
      tells the IPsec code whether it should terminate and reinject the packet
      back into the stack.
      It then sets the flag for BEET and tunnel mode.
      I've also added a number of missing BEET checks elsewhere where we check
      whether a given mode is a tunnel or not.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    • Herbert Xu's avatar
      [IPSEC]: Move type and mode map into xfrm_state.c · aa5d62cc
      Herbert Xu authored
      The type and mode maps are only used by SAs, not policies.  So it makes
      sense to move them from xfrm_policy.c into xfrm_state.c.  This also allows
      us to mark xfrm_get_type/xfrm_put_type/xfrm_get_mode/xfrm_put_mode as
      The only other change I've made in the move is to get rid of the casts
      on the request_module call for types.  They're unnecessary because C
      will promote them to ints anyway.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  7. 10 Oct, 2007 6 commits
  8. 13 Aug, 2007 1 commit
  9. 02 Aug, 2007 1 commit
  10. 31 Jul, 2007 1 commit
  11. 19 Jul, 2007 1 commit
    • Paul Mundt's avatar
      mm: Remove slab destructors from kmem_cache_create(). · 20c2df83
      Paul Mundt authored
      Slab destructors were no longer supported after Christoph's
       change. They've been
      BUGs for both slab and slub, and slob never supported them
      This rips out support for the dtor pointer from kmem_cache_create()
      completely and fixes up every single callsite in the kernel (there were
      about 224, not including the slab allocator definitions themselves,
      or the documentation references).
      Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
  12. 18 Jul, 2007 2 commits
  13. 07 Jun, 2007 1 commit
    • Joy Latten's avatar
      xfrm: Add security check before flushing SAD/SPD · 4aa2e62c
      Joy Latten authored
      Currently we check for permission before deleting entries from SAD and
      SPD, (see security_xfrm_policy_delete() security_xfrm_state_delete())
      However we are not checking for authorization when flushing the SPD and
      the SAD completely. It was perhaps missed in the original security hooks
      This patch adds a security check when flushing entries from the SAD and
      SPD.  It runs the entire database and checks each entry for a denial.
      If the process attempting the flush is unable to remove all of the
      entries a denial is logged the the flush function returns an error
      without removing anything.
      This is particularly useful when a process may need to create or delete
      its own xfrm entries used for things like labeled networking but that
      same process should not be able to delete other entries or flush the
      entire database.
      Signed-off-by: Joy Latten<latten@austin.ibm.com>
      Signed-off-by: default avatarEric Paris <eparis@parisplace.org>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
  14. 31 May, 2007 1 commit
  15. 24 May, 2007 1 commit
    • David S. Miller's avatar
      [XFRM]: Allow packet drops during larval state resolution. · 14e50e57
      David S. Miller authored
      The current IPSEC rule resolution behavior we have does not work for a
      lot of people, even though technically it's an improvement from the
      -EAGAIN buisness we had before.
      Right now we'll block until the key manager resolves the route.  That
      works for simple cases, but many folks would rather packets get
      silently dropped until the key manager resolves the IPSEC rules.
      We can't tell these folks to "set the socket non-blocking" because
      they don't have control over the non-block setting of things like the
      sockets used to resolve DNS deep inside of the resolver libraries in
      With that in mind I coded up the patch below with some help from
      Herbert Xu which provides packet-drop behavior during larval state
      resolution, controllable via sysctl and off by default.
      This lays the framework to either:
      1) Make this default at some point or...
      2) Move this logic into xfrm{4,6}_policy.c and implement the
         ARP-like resolution queue we've all been dreaming of.
         The idea would be to queue packets to the policy, then
         once the larval state is resolved by the key manager we
         re-resolve the route and push the packets out.  The
         packets would timeout if the rule didn't get resolved
         in a certain amount of time.
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
  16. 14 May, 2007 1 commit
    • Herbert Xu's avatar
      [IPSEC]: Check validity of direction in xfrm_policy_byid · b5505c6e
      Herbert Xu authored
      The function xfrm_policy_byid takes a dir argument but finds the policy
      using the index instead.  We only use the dir argument to update the
      policy count for that direction.  Since the user can supply any value
      for dir, this can corrupt our policy count.
      I know this is the problem because a few days ago I was deleting
      policies by hand using indicies and accidentally typed in the wrong
      direction.  It still deleted the policy and at the time I thought
      that was cool.  In retrospect it isn't such a good idea :)
      I decided against letting it delete the policy anyway just in case
      we ever remove the connection between indicies and direction.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>