* [RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits @ 2011-01-13 17:20 Nicolas Dichtel 2011-01-22 4:20 ` David Miller 0 siblings, 1 reply; 11+ messages in thread From: Nicolas Dichtel @ 2011-01-13 17:20 UTC (permalink / raw) To: netdev; +Cc: Christophe Gouault [-- Attachment #1: Type: text/plain, Size: 298 bytes --] Hi, here is a patch to fix alignment of IPv4 AH. Note that this break compatiblity for some algorithms (like SHA256) with old kernels ... but upstream cannot use SHA256 on IPv4, for example, with a target that is RFC compliant. I don't know what is the best way to fix this. Regards, Nicolas [-- Attachment #2: 0001-ipsec-fix-IPv4-AH-alignment-on-32-bits.patch --] [-- Type: text/x-patch, Size: 2682 bytes --] >From 14bbe173eed25cf59e3e54222eb7de1a5578e54e Mon Sep 17 00:00:00 2001 From: Dang Hongwu <hongwu.dang@6wind.com> Date: Wed, 22 Dec 2010 11:38:47 -0500 Subject: [PATCH] ipsec: fix IPv4 AH alignment on 32 bits The Linux IPv4 AH stack aligns the AH header on a 64 bit boundary (like in IPv6). This is not RFC compliant (see RFC4302, Section 3.3.3.2.1), it should be aligned on 32 bits. For most of the authentication algorithms, the ICV size is 96 bits. The AH header alignment on 32 or 64 bits gives the same results. However for SHA-256-128 for instance, the wrong 64 bit alignment results in adding useless padding in IPv4 AH, which is forbidden by the RFC. Signed-off-by: Dang Hongwu <hongwu.dang@6wind.com> Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> --- include/net/xfrm.h | 1 + net/ipv4/ah4.c | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index bcfb6b2..525d882 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -36,6 +36,7 @@ #define XFRM_PROTO_ROUTING IPPROTO_ROUTING #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS +#define XFRM_ALIGN4(len) (((len) + 3) & ~3) #define XFRM_ALIGN8(len) (((len) + 7) & ~7) #define MODULE_ALIAS_XFRM_MODE(family, encap) \ MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c index 86961be..95561d6 100644 --- a/net/ipv4/ah4.c +++ b/net/ipv4/ah4.c @@ -201,7 +201,7 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb) top_iph->ttl = 0; top_iph->check = 0; - ah->hdrlen = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; + ah->hdrlen = (XFRM_ALIGN4(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; ah->reserved = 0; ah->spi = x->id.spi; @@ -299,8 +299,8 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) nexthdr = ah->nexthdr; ah_hlen = (ah->hdrlen + 2) << 2; - if (ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_full_len) && - ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len)) + if (ah_hlen != XFRM_ALIGN4(sizeof(*ah) + ahp->icv_full_len) && + ah_hlen != XFRM_ALIGN4(sizeof(*ah) + ahp->icv_trunc_len)) goto out; if (!pskb_may_pull(skb, ah_hlen)) @@ -450,7 +450,7 @@ static int ah_init_state(struct xfrm_state *x) BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN); - x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + + x->props.header_len = XFRM_ALIGN4(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len); if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); -- 1.5.6.5 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits 2011-01-13 17:20 [RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits Nicolas Dichtel @ 2011-01-22 4:20 ` David Miller 2011-01-28 4:51 ` Herbert Xu 0 siblings, 1 reply; 11+ messages in thread From: David Miller @ 2011-01-22 4:20 UTC (permalink / raw) To: nicolas.dichtel; +Cc: netdev, christophe.gouault From: Nicolas Dichtel <nicolas.dichtel@6wind.com> Date: Thu, 13 Jan 2011 18:20:19 +0100 > here is a patch to fix alignment of IPv4 AH. Note that this break > compatiblity for some algorithms (like SHA256) with old kernels > ... but upstream cannot use SHA256 on IPv4, for example, with a target > that is RFC compliant. > > I don't know what is the best way to fix this. We cannot just start rejecting the old 8-byte alignment on input if Linux has been using an 8-byte alignment since day one. If you want this change to be considered seriously, you need to relax the AH4 input check. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits 2011-01-22 4:20 ` David Miller @ 2011-01-28 4:51 ` Herbert Xu 2011-01-28 8:51 ` Nicolas Dichtel 0 siblings, 1 reply; 11+ messages in thread From: Herbert Xu @ 2011-01-28 4:51 UTC (permalink / raw) To: David Miller; +Cc: nicolas.dichtel, netdev, christophe.gouault David Miller <davem@davemloft.net> wrote: > > We cannot just start rejecting the old 8-byte alignment on input if > Linux has been using an 8-byte alignment since day one. > > If you want this change to be considered seriously, you need to relax > the AH4 input check. I second your sentiment. However, in this particular case it would appear that our old implementation was also overly strict in rejecting 32-bit alignment so even if we relax it now it still wouldn't work with an old implementation once we reduce the padding on output (unless you traffic was one-way only). So perhaps an SA configuration flag is needed? Cheers, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits 2011-01-28 4:51 ` Herbert Xu @ 2011-01-28 8:51 ` Nicolas Dichtel 2011-01-28 19:46 ` David Miller 0 siblings, 1 reply; 11+ messages in thread From: Nicolas Dichtel @ 2011-01-28 8:51 UTC (permalink / raw) To: Herbert Xu; +Cc: David Miller, netdev, christophe.gouault On 28/01/2011 05:51, Herbert Xu wrote: > David Miller<davem@davemloft.net> wrote: >> >> We cannot just start rejecting the old 8-byte alignment on input if >> Linux has been using an 8-byte alignment since day one. >> >> If you want this change to be considered seriously, you need to relax >> the AH4 input check. > > I second your sentiment. However, in this particular case it > would appear that our old implementation was also overly strict > in rejecting 32-bit alignment so even if we relax it now it still > wouldn't work with an old implementation once we reduce the padding > on output (unless you traffic was one-way only). Yes, this was my initial problem. > > So perhaps an SA configuration flag is needed? I agree. If David is ok, I will update the patch. Regards, Nicolas ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits 2011-01-28 8:51 ` Nicolas Dichtel @ 2011-01-28 19:46 ` David Miller 2011-02-02 16:29 ` [PATCH] ipsec: allow to align IPv4 AH " Nicolas Dichtel 2011-02-02 16:30 ` [PATCH] iproute2: allow to specify truncation bits on auth algo Nicolas Dichtel 0 siblings, 2 replies; 11+ messages in thread From: David Miller @ 2011-01-28 19:46 UTC (permalink / raw) To: nicolas.dichtel; +Cc: herbert, netdev, christophe.gouault From: Nicolas Dichtel <nicolas.dichtel@6wind.com> Date: Fri, 28 Jan 2011 09:51:40 +0100 > On 28/01/2011 05:51, Herbert Xu wrote: >> So perhaps an SA configuration flag is needed? > I agree. If David is ok, I will update the patch. Sounds good to me. ^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH] ipsec: allow to align IPv4 AH on 32 bits 2011-01-28 19:46 ` David Miller @ 2011-02-02 16:29 ` Nicolas Dichtel 2011-02-08 22:00 ` David Miller 2011-02-02 16:30 ` [PATCH] iproute2: allow to specify truncation bits on auth algo Nicolas Dichtel 1 sibling, 1 reply; 11+ messages in thread From: Nicolas Dichtel @ 2011-02-02 16:29 UTC (permalink / raw) To: David Miller; +Cc: herbert, netdev, christophe.gouault [-- Attachment #1: Type: text/plain, Size: 388 bytes --] On 28/01/2011 20:46, David Miller wrote: > From: Nicolas Dichtel<nicolas.dichtel@6wind.com> > Date: Fri, 28 Jan 2011 09:51:40 +0100 > >> On 28/01/2011 05:51, Herbert Xu wrote: >>> So perhaps an SA configuration flag is needed? >> I agree. If David is ok, I will update the patch. > > Sounds good to me. Here is the new patch. The patch for iproute2 in the next email. Regards, Nicolas [-- Attachment #2: 0001-ipsec-allow-to-align-IPv4-AH-on-32-bits.patch --] [-- Type: text/x-patch, Size: 3736 bytes --] >From 1772aa5401b24f4cb4cc10b038becdeb2c687531 Mon Sep 17 00:00:00 2001 From: Dang Hongwu <hongwu.dang@6wind.com> Date: Wed, 22 Dec 2010 11:38:47 -0500 Subject: [PATCH] ipsec: allow to align IPv4 AH on 32 bits The Linux IPv4 AH stack aligns the AH header on a 64 bit boundary (like in IPv6). This is not RFC compliant (see RFC4302, Section 3.3.3.2.1), it should be aligned on 32 bits. For most of the authentication algorithms, the ICV size is 96 bits. The AH header alignment on 32 or 64 bits gives the same results. However for SHA-256-128 for instance, the wrong 64 bit alignment results in adding useless padding in IPv4 AH, which is forbidden by the RFC. To avoid breaking backward compatibility, we use a new flag (XFRM_STATE_ALIGN4) do change original behavior. Initial patch from Dang Hongwu <hongwu.dang@6wind.com> and Christophe Gouault <christophe.gouault@6wind.com>. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> --- include/linux/xfrm.h | 1 + include/net/xfrm.h | 1 + net/ipv4/ah4.c | 25 +++++++++++++++++++------ 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h index 930fdd2..b93d6f5 100644 --- a/include/linux/xfrm.h +++ b/include/linux/xfrm.h @@ -350,6 +350,7 @@ struct xfrm_usersa_info { #define XFRM_STATE_WILDRECV 8 #define XFRM_STATE_ICMP 16 #define XFRM_STATE_AF_UNSPEC 32 +#define XFRM_STATE_ALIGN4 64 }; struct xfrm_usersa_id { diff --git a/include/net/xfrm.h b/include/net/xfrm.h index b9f385d..1f6e8a0 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -36,6 +36,7 @@ #define XFRM_PROTO_ROUTING IPPROTO_ROUTING #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS +#define XFRM_ALIGN4(len) (((len) + 3) & ~3) #define XFRM_ALIGN8(len) (((len) + 7) & ~7) #define MODULE_ALIAS_XFRM_MODE(family, encap) \ MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c index 86961be..325053d 100644 --- a/net/ipv4/ah4.c +++ b/net/ipv4/ah4.c @@ -201,7 +201,10 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb) top_iph->ttl = 0; top_iph->check = 0; - ah->hdrlen = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; + if (x->props.flags & XFRM_STATE_ALIGN4) + ah->hdrlen = (XFRM_ALIGN4(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; + else + ah->hdrlen = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; ah->reserved = 0; ah->spi = x->id.spi; @@ -299,9 +302,15 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) nexthdr = ah->nexthdr; ah_hlen = (ah->hdrlen + 2) << 2; - if (ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_full_len) && - ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len)) - goto out; + if (x->props.flags & XFRM_STATE_ALIGN4) { + if (ah_hlen != XFRM_ALIGN4(sizeof(*ah) + ahp->icv_full_len) && + ah_hlen != XFRM_ALIGN4(sizeof(*ah) + ahp->icv_trunc_len)) + goto out; + } else { + if (ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_full_len) && + ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len)) + goto out; + } if (!pskb_may_pull(skb, ah_hlen)) goto out; @@ -450,8 +459,12 @@ static int ah_init_state(struct xfrm_state *x) BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN); - x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + - ahp->icv_trunc_len); + if (x->props.flags & XFRM_STATE_ALIGN4) + x->props.header_len = XFRM_ALIGN4(sizeof(struct ip_auth_hdr) + + ahp->icv_trunc_len); + else + x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + + ahp->icv_trunc_len); if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); x->data = ahp; -- 1.5.6.5 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH] ipsec: allow to align IPv4 AH on 32 bits 2011-02-02 16:29 ` [PATCH] ipsec: allow to align IPv4 AH " Nicolas Dichtel @ 2011-02-08 22:00 ` David Miller 0 siblings, 0 replies; 11+ messages in thread From: David Miller @ 2011-02-08 22:00 UTC (permalink / raw) To: nicolas.dichtel; +Cc: herbert, netdev, christophe.gouault From: Nicolas Dichtel <nicolas.dichtel@6wind.com> Date: Wed, 02 Feb 2011 17:29:02 +0100 > On 28/01/2011 20:46, David Miller wrote: >> From: Nicolas Dichtel<nicolas.dichtel@6wind.com> >> Date: Fri, 28 Jan 2011 09:51:40 +0100 >> >>> On 28/01/2011 05:51, Herbert Xu wrote: >>>> So perhaps an SA configuration flag is needed? >>> I agree. If David is ok, I will update the patch. >> >> Sounds good to me. > > Here is the new patch. I've applied this to net-next-2.6, thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH] iproute2: allow to specify truncation bits on auth algo 2011-01-28 19:46 ` David Miller 2011-02-02 16:29 ` [PATCH] ipsec: allow to align IPv4 AH " Nicolas Dichtel @ 2011-02-02 16:30 ` Nicolas Dichtel 2011-02-02 16:34 ` Nicolas Dichtel 1 sibling, 1 reply; 11+ messages in thread From: Nicolas Dichtel @ 2011-02-02 16:30 UTC (permalink / raw) To: David Miller; +Cc: herbert, netdev, christophe.gouault [-- Attachment #1: Type: text/plain, Size: 350 bytes --] On 28/01/2011 20:46, David Miller wrote: > From: Nicolas Dichtel<nicolas.dichtel@6wind.com> > Date: Fri, 28 Jan 2011 09:51:40 +0100 > >> On 28/01/2011 05:51, Herbert Xu wrote: >>> So perhaps an SA configuration flag is needed? >> I agree. If David is ok, I will update the patch. > > Sounds good to me. And the patch for iproute2. Regards, Nicolas [-- Attachment #2: 0001-iproute2-allow-to-specify-truncation-bits-on-auth-a.patch --] [-- Type: text/x-patch, Size: 5896 bytes --] >From e0d84548d363cfa46a03719bc318ef52fa5ca98f Mon Sep 17 00:00:00 2001 From: Nicolas Dichtel <nicolas.dichtel@6wind.com> Date: Thu, 23 Dec 2010 06:48:12 -0500 Subject: [PATCH] iproute2: allow to specify truncation bits on auth algo Attribute XFRMA_ALG_AUTH_TRUNC can be used to specify truncation bits, so we add a new algo type: auth-trunc. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> --- ip/ipxfrm.c | 28 +++++++++++++++++++++++++++- ip/xfrm_state.c | 50 +++++++++++++++++++++++++++++++++----------------- 2 files changed, 60 insertions(+), 18 deletions(-) diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index ba7360f..591f7bf 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -155,6 +155,7 @@ const char *strxf_xfrmproto(__u8 proto) static const struct typeent algo_types[]= { { "enc", XFRMA_ALG_CRYPT }, { "auth", XFRMA_ALG_AUTH }, { "comp", XFRMA_ALG_COMP }, { "aead", XFRMA_ALG_AEAD }, + { "auth-trunc", XFRMA_ALG_AUTH_TRUNC }, { NULL, -1 } }; @@ -570,6 +571,25 @@ static void xfrm_aead_print(struct xfrm_algo_aead *algo, int len, fprintf(fp, "%s", _SL_); } +static void xfrm_auth_trunc_print(struct xfrm_algo_auth *algo, int len, + FILE *fp, const char *prefix) +{ + struct { + struct xfrm_algo algo; + char key[algo->alg_key_len / 8]; + } base; + + memcpy(base.algo.alg_name, algo->alg_name, sizeof(base.algo.alg_name)); + base.algo.alg_key_len = algo->alg_key_len; + memcpy(base.algo.alg_key, algo->alg_key, algo->alg_key_len / 8); + + __xfrm_algo_print(&base.algo, XFRMA_ALG_AUTH_TRUNC, len, fp, prefix, 0); + + fprintf(fp, " %d", algo->alg_trunc_len); + + fprintf(fp, "%s", _SL_); +} + static void xfrm_tmpl_print(struct xfrm_user_tmpl *tmpls, int len, __u16 family, FILE *fp, const char *prefix) { @@ -677,12 +697,18 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family, fprintf(fp, "\tmark %d/0x%x\n", m->v, m->m); } - if (tb[XFRMA_ALG_AUTH]) { + if (tb[XFRMA_ALG_AUTH] && !tb[XFRMA_ALG_AUTH_TRUNC]) { struct rtattr *rta = tb[XFRMA_ALG_AUTH]; xfrm_algo_print((struct xfrm_algo *) RTA_DATA(rta), XFRMA_ALG_AUTH, RTA_PAYLOAD(rta), fp, prefix); } + if (tb[XFRMA_ALG_AUTH_TRUNC]) { + struct rtattr *rta = tb[XFRMA_ALG_AUTH_TRUNC]; + xfrm_auth_trunc_print((struct xfrm_algo_auth *) RTA_DATA(rta), + RTA_PAYLOAD(rta), fp, prefix); + } + if (tb[XFRMA_ALG_AEAD]) { struct rtattr *rta = tb[XFRMA_ALG_AEAD]; xfrm_aead_print((struct xfrm_algo_aead *)RTA_DATA(rta), diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index 70f0a0b..5260d85 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -83,18 +83,19 @@ static void usage(void) //fprintf(stderr, "REQID - number(default=0)\n"); fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n"); - fprintf(stderr, "FLAG := [ noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec ]\n"); + fprintf(stderr, "FLAG := [ noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 ]\n"); fprintf(stderr, "ENCAP := ENCAP-TYPE SPORT DPORT OADDR\n"); fprintf(stderr, "ENCAP-TYPE := espinudp | espinudp-nonike\n"); fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] | [ ALGO ]\n"); fprintf(stderr, "ALGO := ALGO_TYPE ALGO_NAME ALGO_KEY " - "[ ALGO_ICV_LEN ]\n"); + "[ ALGO_ICV_LEN | ALGO_TRUNC_LEN ]\n"); fprintf(stderr, "ALGO_TYPE := [ "); fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AEAD)); fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT)); fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AUTH)); + fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AUTH_TRUNC)); fprintf(stderr, "%s ", strxf_algotype(XFRMA_ALG_COMP)); fprintf(stderr, "]\n"); @@ -342,6 +343,7 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) case XFRMA_ALG_AEAD: case XFRMA_ALG_CRYPT: case XFRMA_ALG_AUTH: + case XFRMA_ALG_AUTH_TRUNC: case XFRMA_ALG_COMP: { /* ALGO */ @@ -349,11 +351,12 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) union { struct xfrm_algo alg; struct xfrm_algo_aead aead; + struct xfrm_algo_auth auth; } u; char buf[XFRM_ALGO_KEY_BUF_SIZE]; } alg = {}; int len; - __u32 icvlen; + __u32 icvlen, trunclen; char *name; char *key; char *buf; @@ -370,6 +373,7 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) ealgop = *argv; break; case XFRMA_ALG_AUTH: + case XFRMA_ALG_AUTH_TRUNC: if (aalgop) duparg("ALGOTYPE", *argv); aalgop = *argv; @@ -397,21 +401,33 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv) buf = alg.u.alg.alg_key; len = sizeof(alg.u.alg); - if (type != XFRMA_ALG_AEAD) - goto parse_algo; - - if (!NEXT_ARG_OK()) - missarg("ALGOICVLEN"); - NEXT_ARG(); - if (get_u32(&icvlen, *argv, 0)) - invarg("\"aead\" ICV length is invalid", - *argv); - alg.u.aead.alg_icv_len = icvlen; - - buf = alg.u.aead.alg_key; - len = sizeof(alg.u.aead); + switch (type) { + case XFRMA_ALG_AEAD: + if (!NEXT_ARG_OK()) + missarg("ALGOICVLEN"); + NEXT_ARG(); + if (get_u32(&icvlen, *argv, 0)) + invarg("\"aead\" ICV length is invalid", + *argv); + alg.u.aead.alg_icv_len = icvlen; + + buf = alg.u.aead.alg_key; + len = sizeof(alg.u.aead); + break; + case XFRMA_ALG_AUTH_TRUNC: + if (!NEXT_ARG_OK()) + missarg("ALGOTRUNCLEN"); + NEXT_ARG(); + if (get_u32(&trunclen, *argv, 0)) + invarg("\"auth\" trunc length is invalid", + *argv); + alg.u.auth.alg_trunc_len = trunclen; + + buf = alg.u.auth.alg_key; + len = sizeof(alg.u.auth); + break; + } -parse_algo: xfrm_algo_parse((void *)&alg, type, name, key, buf, sizeof(alg.buf)); len += alg.u.alg.alg_key_len; -- 1.5.6.5 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH] iproute2: allow to specify truncation bits on auth algo 2011-02-02 16:30 ` [PATCH] iproute2: allow to specify truncation bits on auth algo Nicolas Dichtel @ 2011-02-02 16:34 ` Nicolas Dichtel 2011-02-28 13:46 ` Nicolas Dichtel 0 siblings, 1 reply; 11+ messages in thread From: Nicolas Dichtel @ 2011-02-02 16:34 UTC (permalink / raw) Cc: David Miller, herbert, netdev, christophe.gouault [-- Attachment #1: Type: text/plain, Size: 463 bytes --] On 02/02/2011 17:30, Nicolas Dichtel wrote: > On 28/01/2011 20:46, David Miller wrote: >> From: Nicolas Dichtel<nicolas.dichtel@6wind.com> >> Date: Fri, 28 Jan 2011 09:51:40 +0100 >> >>> On 28/01/2011 05:51, Herbert Xu wrote: >>>> So perhaps an SA configuration flag is needed? >>> I agree. If David is ok, I will update the patch. >> >> Sounds good to me. > And the patch for iproute2. Sorry, two patches were mixed :( Here is the right one. Regards, Nicolas [-- Attachment #2: 0001-iproute2-add-support-of-flag-XFRM_STATE_ALIGN4.patch --] [-- Type: text/x-patch, Size: 2232 bytes --] >From fe61b9c3564b2f9504bca652cdea80ff3b5a2743 Mon Sep 17 00:00:00 2001 From: Nicolas Dichtel <nicolas.dichtel@6wind.com> Date: Tue, 1 Feb 2011 07:29:54 -0500 Subject: [PATCH] iproute2: add support of flag XFRM_STATE_ALIGN4 Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> --- include/linux/xfrm.h | 1 + ip/ipxfrm.c | 1 + ip/xfrm_state.c | 4 +++- 3 files changed, 5 insertions(+), 1 deletions(-) diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h index 07f2b63..8b2d220 100644 --- a/include/linux/xfrm.h +++ b/include/linux/xfrm.h @@ -349,6 +349,7 @@ struct xfrm_usersa_info { #define XFRM_STATE_WILDRECV 8 #define XFRM_STATE_ICMP 16 #define XFRM_STATE_AF_UNSPEC 32 +#define XFRM_STATE_ALIGN4 64 }; struct xfrm_usersa_id { diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 9753822..ba7360f 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -828,6 +828,7 @@ void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo, XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_WILDRECV, "wildrecv"); XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ICMP, "icmp"); XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_AF_UNSPEC, "af-unspec"); + XFRM_FLAG_PRINT(fp, flags, XFRM_STATE_ALIGN4, "align4"); if (flags) fprintf(fp, "%x", flags); } diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index 38d4039..e8c7c96 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -83,7 +83,7 @@ static void usage(void) //fprintf(stderr, "REQID - number(default=0)\n"); fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n"); - fprintf(stderr, "FLAG := [ noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec ]\n"); + fprintf(stderr, "FLAG := [ noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 ]\n"); fprintf(stderr, "ENCAP := ENCAP-TYPE SPORT DPORT OADDR\n"); fprintf(stderr, "ENCAP-TYPE := espinudp | espinudp-nonike\n"); @@ -214,6 +214,8 @@ static int xfrm_state_flag_parse(__u8 *flags, int *argcp, char ***argvp) *flags |= XFRM_STATE_ICMP; else if (strcmp(*argv, "af-unspec") == 0) *flags |= XFRM_STATE_AF_UNSPEC; + else if (strcmp(*argv, "align4") == 0) + *flags |= XFRM_STATE_ALIGN4; else { PREV_ARG(); /* back track */ break; -- 1.5.6.5 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH] iproute2: allow to specify truncation bits on auth algo 2011-02-02 16:34 ` Nicolas Dichtel @ 2011-02-28 13:46 ` Nicolas Dichtel 2011-02-28 15:48 ` Stephen Hemminger 0 siblings, 1 reply; 11+ messages in thread From: Nicolas Dichtel @ 2011-02-28 13:46 UTC (permalink / raw) To: Stephen Hemminger; +Cc: David Miller, herbert, netdev, christophe.gouault Hi, what is the status of this patch? It has been set to 'Superseded' in the patchwork tool (http://patchwork.ozlabs.org/patch/81486/). Kernel headers have been updated in iproute2, should I resend the patch? Regards, Nicolas On 02/02/2011 17:34, Nicolas Dichtel wrote: > On 02/02/2011 17:30, Nicolas Dichtel wrote: >> On 28/01/2011 20:46, David Miller wrote: >>> From: Nicolas Dichtel<nicolas.dichtel@6wind.com> >>> Date: Fri, 28 Jan 2011 09:51:40 +0100 >>> >>>> On 28/01/2011 05:51, Herbert Xu wrote: >>>>> So perhaps an SA configuration flag is needed? >>>> I agree. If David is ok, I will update the patch. >>> >>> Sounds good to me. >> And the patch for iproute2. > Sorry, two patches were mixed :( > > Here is the right one. > > > Regards, > Nicolas ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] iproute2: allow to specify truncation bits on auth algo 2011-02-28 13:46 ` Nicolas Dichtel @ 2011-02-28 15:48 ` Stephen Hemminger 0 siblings, 0 replies; 11+ messages in thread From: Stephen Hemminger @ 2011-02-28 15:48 UTC (permalink / raw) To: nicolas.dichtel; +Cc: David Miller, herbert, netdev, christophe.gouault It is in net-next branch of iproute -- ^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2011-02-28 15:48 UTC | newest] Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2011-01-13 17:20 [RFC PATCH] ipsec: fix IPv4 AH alignment on 32 bits Nicolas Dichtel 2011-01-22 4:20 ` David Miller 2011-01-28 4:51 ` Herbert Xu 2011-01-28 8:51 ` Nicolas Dichtel 2011-01-28 19:46 ` David Miller 2011-02-02 16:29 ` [PATCH] ipsec: allow to align IPv4 AH " Nicolas Dichtel 2011-02-08 22:00 ` David Miller 2011-02-02 16:30 ` [PATCH] iproute2: allow to specify truncation bits on auth algo Nicolas Dichtel 2011-02-02 16:34 ` Nicolas Dichtel 2011-02-28 13:46 ` Nicolas Dichtel 2011-02-28 15:48 ` Stephen Hemminger
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.