Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Bohac <jbohac@suse.cz>2010-12-29 14:10:16 +0100
committerJiri Bohac <jbohac@suse.cz>2010-12-29 14:12:58 +0100
commit8c0080bd950aaef83f5f50740febeae6f16a98aa (patch)
tree26c953b77da9e970bb322d41db5cf87951255038
parentc468b6d0e8bd6c5b24864891cc4fe0d3b2248433 (diff)
- patches.fixes/xfrm-ipv6-fragment-locally-generated-packets.patch:
ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.
-rw-r--r--kernel-source.changes7
-rw-r--r--patches.fixes/xfrm-ipv6-fragment-locally-generated-packets.patch111
-rw-r--r--series.conf1
3 files changed, 119 insertions, 0 deletions
diff --git a/kernel-source.changes b/kernel-source.changes
index 33af562fcb..c2718763b7 100644
--- a/kernel-source.changes
+++ b/kernel-source.changes
@@ -1,4 +1,11 @@
-------------------------------------------------------------------
+Wed Dec 29 14:09:24 CET 2010 - jbohac@suse.cz
+
+- patches.fixes/xfrm-ipv6-fragment-locally-generated-packets.patch:
+ ipv6: Fragment locally generated tunnel-mode IPSec6 packets
+ as needed.
+
+-------------------------------------------------------------------
Wed Dec 29 13:43:39 CET 2010 - rjw@suse.de
- patches.fixes/isdn-hisax-replace-access-to-irq-stats.patch:
diff --git a/patches.fixes/xfrm-ipv6-fragment-locally-generated-packets.patch b/patches.fixes/xfrm-ipv6-fragment-locally-generated-packets.patch
new file mode 100644
index 0000000000..fc729ca983
--- /dev/null
+++ b/patches.fixes/xfrm-ipv6-fragment-locally-generated-packets.patch
@@ -0,0 +1,111 @@
+From: David Stevens <dlstevens@us.ibm.com>
+Subject: ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.
+References: bnc#657976
+Patch-mainline: 2.6.37?
+Git-commit: ad0081e43af6de3fecf308b0d098f9611835766b
+Git-repo: http://www.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6.git
+
+Acked-by: Jiri Bohac <jbohac@suse.cz>
+
+This patch modifies IPsec6 to fragment IPv6 packets that are
+locally generated as needed.
+
+This version of the patch only fragments in tunnel mode, so that fragment
+headers will not be obscured by ESP in transport mode.
+
+Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 0e1b8ae..a7e15b5 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -147,5 +147,15 @@ static inline int ipv6_unicast_destination(struct sk_buff *skb)
+ return rt->rt6i_flags & RTF_LOCAL;
+ }
+
++int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
++
++static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
++{
++ struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
++
++ return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
++ skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
++}
++
+ #endif
+ #endif
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index eca3ef7..c3471d9 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -55,7 +55,7 @@
+ #include <net/checksum.h>
+ #include <linux/mroute6.h>
+
+-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
++int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+
+ int __ip6_local_out(struct sk_buff *skb)
+ {
+@@ -155,14 +155,6 @@ static int ip6_output2(struct sk_buff *skb)
+ ip6_output_finish);
+ }
+
+-static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+-{
+- struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+-
+- return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
+- skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+-}
+-
+ int ip6_output(struct sk_buff *skb)
+ {
+ struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
+@@ -604,7 +596,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ return offset;
+ }
+
+-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
++int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ {
+ struct sk_buff *frag;
+ struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index c4f4eef..798ded7 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -17,6 +17,7 @@
+ #include <linux/netfilter_ipv6.h>
+ #include <net/dst.h>
+ #include <net/ipv6.h>
++#include <net/ip6_route.h>
+ #include <net/xfrm.h>
+
+ int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
+@@ -88,8 +89,21 @@ static int xfrm6_output_finish(struct sk
+ return xfrm_output(skb);
+ }
+
++static int __xfrm6_output(struct sk_buff *skb)
++{
++ struct dst_entry *dst = skb_dst(skb);
++ struct xfrm_state *x = dst->xfrm;
++
++ if ((x && x->props.mode == XFRM_MODE_TUNNEL) &&
++ ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
++ dst_allfrag(skb_dst(skb)))) {
++ return ip6_fragment(skb, xfrm6_output_finish);
++ }
++ return xfrm6_output_finish(skb);
++}
++
+ int xfrm6_output(struct sk_buff *skb)
+ {
+ return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb_dst(skb)->dev,
+- xfrm6_output_finish);
++ __xfrm6_output);
+ }
diff --git a/series.conf b/series.conf
index 97a351729d..b737205743 100644
--- a/series.conf
+++ b/series.conf
@@ -791,6 +791,7 @@
patches.fixes/xfrm-Fix-truncation-length-of-authentication-algorit.patch
patches.fixes/sched-qdisc_reset_all_tx-is-calling-qdisc_reset-with.patch
patches.fixes/tcp-increase-tcp_maxseg-socket-option-minimum
+ patches.fixes/xfrm-ipv6-fragment-locally-generated-packets.patch
########################################################
# NFS