linux/include/net/flow.h, branch v2.6.19

[NET]: Reduce sizeof(struct flowi) by 20 bytes.

2006-10-22T03:24:01Z

As suggested by David, just kill off some unused fields in dnports to reduce sizef(struct flowi). If they come back, they should be moved to nl_u.dn_u in order not to enlarge again struct flowi [ Modified to really delete this stuff instead of using #if 0. -DaveM ] Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller

IPsec: propagate security module errors up from flow_cache_lookup

2006-10-12T06:59:34Z

When a security module is loaded (in this case, SELinux), the security_xfrm_policy_lookup() hook can return an access denied permission (or other error). We were not handling that correctly, and in fact inverting the return logic and propagating a false "ok" back up to xfrm_lookup(), which then allowed packets to pass as if they were not associated with an xfrm policy. The way I was seeing the problem was when connecting via IPsec to a confined service on an SELinux box (vsftpd), which did not have the appropriate SELinux policy permissions to send packets via IPsec. The first SYNACK would be blocked, because of an uncached lookup via flow_cache_lookup(), which would fail to resolve an xfrm policy because the SELinux policy is checked at that point via the resolver. However, retransmitted SYNACKs would then find a cached flow entry when calling into flow_cache_lookup() with a null xfrm policy, which is interpreted by xfrm_lookup() as the packet not having any associated policy and similarly to the first case, allowing it to pass without transformation. The solution presented here is to first ensure that errno values are correctly propagated all the way back up through the various call chains from security_xfrm_policy_lookup(), and handled correctly. Then, flow_cache_lookup() is modified, so that if the policy resolver fails (typically a permission denied via the security module), the flow cache entry is killed rather than having a null policy assigned (which indicates that the packet can pass freely). This also forces any future lookups for the same flow to consult the security module (e.g. SELinux) for current security policy (rather than, say, caching the error on the flow cache entry). Signed-off-by: James Morris

[XFRM]: fl_ipsec_spi is net-endian

2006-09-29T01:02:43Z

Signed-off-by: Al Viro Signed-off-by: David S. Miller

[NET]: ip ports in struct flowi are net-endian

2006-09-29T01:02:07Z

Signed-off-by: Al Viro Signed-off-by: David S. Miller

[IPV4]: annotate ipv4 addresses in struct rtable and struct flowi

2006-09-29T00:54:05Z

Signed-off-by: Al Viro Signed-off-by: David S. Miller

[IPV6] ROUTE: Routing by FWMARK.

2006-09-22T22:18:00Z

Based on patch by Jean Lorchat . Signed-off-by: YOSHIFUJI Hideaki

[IPV6] MIP6: Add Mobility header definition.

2006-09-22T22:07:00Z

Add Mobility header definition for Mobile IPv6. Based on MIPL2 kernel patch. This patch was also written by: Antti Tuominen Signed-off-by: Masahide NAKAMURA Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

[MLSXFRM]: Flow based matching of xfrm policy and state

2006-09-22T21:53:24Z

This implements a seemless mechanism for xfrm policy selection and state matching based on the flow sid. This also includes the necessary SELinux enforcement pieces. Signed-off-by: Venkat Yekkirala Signed-off-by: David S. Miller

[MLSXFRM]: Add security sid to flowi

2006-09-22T21:53:23Z

This adds security to flow key for labeling of flows as also to allow for making flow cache lookups based on the security label seemless. Signed-off-by: Venkat Yekkirala Signed-off-by: David S. Miller

[DECnet]: Endian annotation and fixes for DECnet.

2006-03-21T06:42:39Z

The typedef for dn_address has been removed in favour of using __le16 or __u16 directly as appropriate. All the DECnet header files are updated accordingly. The byte ordering of dn_eth2dn() and dn_dn2eth() are both changed since just about all their callers wanted network order rather than host order, so the conversion is now done in the functions themselves. Several missed endianess conversions have been picked up during the conversion process. The nh_gw field in struct dn_fib_info has been changed from a 32 bit field to 16 bits as it ought to be. One or two cases of using htons rather than dn_htons in the routing code have been found and fixed. There are still a few warnings to fix, but this patch deals with the important cases. Signed-off-by: Steven Whitehouse Signed-off-by: Patrick Caulfield Signed-off-by: David S. Miller