dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

xfrm: Add Traffic Flow Confidentiality padding XFRM attribute 

The XFRMA_TFCPAD attribute for XFRM state installation configures
Traffic Flow Confidentiality by padding ESP packets to a specified
length.

Signed-off-by: Martin Willi <martin@strongswan.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Martin Willi 2010-12-08 04:37:49 +00:00 committed by David S. Miller
parent 957fca95e3
commit 35d2856b46
3 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/xfrm.h
View File

@ -283,6 +283,7 @@ enum xfrm_attr_type_t {
XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */ XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */
XFRMA_ALG_AUTH_TRUNC, /* struct xfrm_algo_auth */ XFRMA_ALG_AUTH_TRUNC, /* struct xfrm_algo_auth */
XFRMA_MARK, /* struct xfrm_mark */ XFRMA_MARK, /* struct xfrm_mark */
XFRMA_TFCPAD, /* __u32 */
__XFRMA_MAX __XFRMA_MAX
#define XFRMA_MAX (__XFRMA_MAX - 1) #define XFRMA_MAX (__XFRMA_MAX - 1)

1
include/net/xfrm.h
View File

@ -143,6 +143,7 @@ struct xfrm_state {
struct xfrm_id id; struct xfrm_id id;
struct xfrm_selector sel; struct xfrm_selector sel;
struct xfrm_mark mark; struct xfrm_mark mark;
u32 tfcpad;
u32 genid; u32 genid;

19
net/xfrm/xfrm_user.c
View File

@ -148,7 +148,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
!attrs[XFRMA_ALG_AUTH_TRUNC]) || !attrs[XFRMA_ALG_AUTH_TRUNC]) ||
attrs[XFRMA_ALG_AEAD] || attrs[XFRMA_ALG_AEAD] ||
attrs[XFRMA_ALG_CRYPT] || attrs[XFRMA_ALG_CRYPT] ||
attrs[XFRMA_ALG_COMP]) attrs[XFRMA_ALG_COMP] ||
attrs[XFRMA_TFCPAD])
goto out; goto out;
break; break;
@ -165,6 +166,9 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
attrs[XFRMA_ALG_CRYPT]) && attrs[XFRMA_ALG_CRYPT]) &&
attrs[XFRMA_ALG_AEAD]) attrs[XFRMA_ALG_AEAD])
goto out; goto out;
if (attrs[XFRMA_TFCPAD] &&
p->mode != XFRM_MODE_TUNNEL)
goto out;
break; break;
case IPPROTO_COMP: case IPPROTO_COMP:
@ -172,7 +176,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
attrs[XFRMA_ALG_AEAD] || attrs[XFRMA_ALG_AEAD] ||
attrs[XFRMA_ALG_AUTH] || attrs[XFRMA_ALG_AUTH] ||
attrs[XFRMA_ALG_AUTH_TRUNC] || attrs[XFRMA_ALG_AUTH_TRUNC] ||
attrs[XFRMA_ALG_CRYPT]) attrs[XFRMA_ALG_CRYPT] ||
attrs[XFRMA_TFCPAD])
goto out; goto out;
break; break;
@ -186,6 +191,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
attrs[XFRMA_ALG_CRYPT] || attrs[XFRMA_ALG_CRYPT] ||
attrs[XFRMA_ENCAP] || attrs[XFRMA_ENCAP] ||
attrs[XFRMA_SEC_CTX] || attrs[XFRMA_SEC_CTX] ||
attrs[XFRMA_TFCPAD] ||
!attrs[XFRMA_COADDR]) !attrs[XFRMA_COADDR])
goto out; goto out;
break; break;
@ -439,6 +445,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
goto error; goto error;
} }
if (attrs[XFRMA_TFCPAD])
x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
if (attrs[XFRMA_COADDR]) { if (attrs[XFRMA_COADDR]) {
x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
sizeof(*x->coaddr), GFP_KERNEL); sizeof(*x->coaddr), GFP_KERNEL);
@ -688,6 +697,9 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
if (x->encap) if (x->encap)
NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); NLA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
if (x->tfcpad)
NLA_PUT_U32(skb, XFRMA_TFCPAD, x->tfcpad);
if (xfrm_mark_put(skb, &x->mark)) if (xfrm_mark_put(skb, &x->mark))
goto nla_put_failure; goto nla_put_failure;
@ -2122,6 +2134,7 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
[XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
[XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) }, [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
[XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) }, [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
[XFRMA_TFCPAD] = { .type = NLA_U32 },
}; };
static struct xfrm_link { static struct xfrm_link {
@ -2301,6 +2314,8 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
l += nla_total_size(sizeof(*x->calg)); l += nla_total_size(sizeof(*x->calg));
if (x->encap) if (x->encap)
l += nla_total_size(sizeof(*x->encap)); l += nla_total_size(sizeof(*x->encap));
if (x->tfcpad)
l += nla_total_size(sizeof(x->tfcpad));
if (x->security) if (x->security)
l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) + l += nla_total_size(sizeof(struct xfrm_user_sec_ctx) +
x->security->ctx_len); x->security->ctx_len);