Skip to content

Commit 42e8e6d

Browse files
davem330davem330
committed
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next
Steffen Klassert says: ==================== 1) Refactor selftests to use an array of structs in xfrm_fill_key(). From Gautam Menghani. 2) Drop an unused argument from xfrm_policy_match. From Hongbin Wang. 3) Support collect metadata mode for xfrm interfaces. From Eyal Birger. 4) Add netlink extack support to xfrm. From Sabrina Dubroca. Please note, there is a merge conflict in: include/net/dst_metadata.h between commit: 0a28bfd ("net/macsec: Add MACsec skb_metadata_dst Tx Data path support") from the net-next tree and commit: 5182a5d ("net: allow storing xfrm interface metadata in metadata_dst") from the ipsec-next tree. Can be solved as done in linux-next. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller <[email protected]>
2 parents 9d43507 + c39596f commit 42e8e6d

File tree

24 files changed

+738
-323
lines changed

24 files changed

+738
-323
lines changed

‎include/net/dst_metadata.h‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ enum metadata_type {
1111
METADATA_IP_TUNNEL,
1212
METADATA_HW_PORT_MUX,
1313
METADATA_MACSEC,
14+
METADATA_XFRM,
1415
};
1516

1617
struct hw_port_info {
@@ -22,13 +23,19 @@ struct macsec_info {
2223
sci_t sci;
2324
};
2425

26+
struct xfrm_md_info {
27+
u32 if_id;
28+
int link;
29+
};
30+
2531
struct metadata_dst {
2632
struct dst_entry dst;
2733
enum metadata_type type;
2834
union {
2935
struct ip_tunnel_info tun_info;
3036
struct hw_port_info port_info;
3137
struct macsec_info macsec_info;
38+
struct xfrm_md_info xfrm_info;
3239
} u;
3340
};
3441

@@ -60,6 +67,27 @@ skb_tunnel_info(const struct sk_buff *skb)
6067
return NULL;
6168
}
6269

70+
static inline struct xfrm_md_info *lwt_xfrm_info(struct lwtunnel_state *lwt)
71+
{
72+
return (struct xfrm_md_info *)lwt->data;
73+
}
74+
75+
static inline struct xfrm_md_info *skb_xfrm_md_info(const struct sk_buff *skb)
76+
{
77+
struct metadata_dst *md_dst = skb_metadata_dst(skb);
78+
struct dst_entry *dst;
79+
80+
if (md_dst && md_dst->type == METADATA_XFRM)
81+
return &md_dst->u.xfrm_info;
82+
83+
dst = skb_dst(skb);
84+
if (dst && dst->lwtstate &&
85+
dst->lwtstate->type == LWTUNNEL_ENCAP_XFRM)
86+
return lwt_xfrm_info(dst->lwtstate);
87+
88+
return NULL;
89+
}
90+
6391
static inline bool skb_valid_dst(const struct sk_buff *skb)
6492
{
6593
struct dst_entry *dst = skb_dst(skb);
@@ -92,6 +120,9 @@ static inline int skb_metadata_dst_cmp(const struct sk_buff *skb_a,
92120
case METADATA_MACSEC:
93121
return memcmp(&a->u.macsec_info, &b->u.macsec_info,
94122
sizeof(a->u.macsec_info));
123+
case METADATA_XFRM:
124+
return memcmp(&a->u.xfrm_info, &b->u.xfrm_info,
125+
sizeof(a->u.xfrm_info));
95126
default:
96127
return 1;
97128
}

‎include/net/ipcomp.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ struct xfrm_state;
2222
int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb);
2323
int ipcomp_output(struct xfrm_state *x, struct sk_buff *skb);
2424
void ipcomp_destroy(struct xfrm_state *x);
25-
int ipcomp_init_state(struct xfrm_state *x);
25+
int ipcomp_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack);
2626

2727
static inline struct ip_comp_hdr *ip_comp_hdr(const struct sk_buff *skb)
2828
{

‎include/net/xfrm.h‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -312,9 +312,15 @@ struct km_event {
312312
struct net *net;
313313
};
314314

315+
struct xfrm_if_decode_session_result {
316+
struct net *net;
317+
u32 if_id;
318+
};
319+
315320
struct xfrm_if_cb {
316-
struct xfrm_if *(*decode_session)(struct sk_buff *skb,
317-
unsigned short family);
321+
bool (*decode_session)(struct sk_buff *skb,
322+
unsigned short family,
323+
struct xfrm_if_decode_session_result *res);
318324
};
319325

320326
void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
@@ -399,7 +405,8 @@ struct xfrm_type {
399405
#define XFRM_TYPE_LOCAL_COADDR 4
400406
#define XFRM_TYPE_REMOTE_COADDR 8
401407

402-
int (*init_state)(struct xfrm_state *x);
408+
int (*init_state)(struct xfrm_state *x,
409+
struct netlink_ext_ack *extack);
403410
void (*destructor)(struct xfrm_state *);
404411
int (*input)(struct xfrm_state *, struct sk_buff *skb);
405412
int (*output)(struct xfrm_state *, struct sk_buff *pskb);
@@ -985,6 +992,7 @@ void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
985992
struct xfrm_if_parms {
986993
int link; /* ifindex of underlying L2 interface */
987994
u32 if_id; /* interface identifyer */
995+
bool collect_md;
988996
};
989997

990998
struct xfrm_if {
@@ -1573,9 +1581,10 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali
15731581
void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
15741582
void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
15751583
u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1576-
int xfrm_init_replay(struct xfrm_state *x);
1584+
int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack);
15771585
u32 xfrm_state_mtu(struct xfrm_state *x, int mtu);
1578-
int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload);
1586+
int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload,
1587+
struct netlink_ext_ack *extack);
15791588
int xfrm_init_state(struct xfrm_state *x);
15801589
int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
15811590
int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
@@ -1879,7 +1888,8 @@ void xfrm_dev_resume(struct sk_buff *skb);
18791888
void xfrm_dev_backlog(struct softnet_data *sd);
18801889
struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
18811890
int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
1882-
struct xfrm_user_offload *xuo);
1891+
struct xfrm_user_offload *xuo,
1892+
struct netlink_ext_ack *extack);
18831893
bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
18841894

18851895
static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
@@ -1942,7 +1952,7 @@ static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_fea
19421952
return skb;
19431953
}
19441954

1945-
static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo)
1955+
static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack)
19461956
{
19471957
return 0;
19481958
}

‎include/uapi/linux/if_link.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,6 +695,7 @@ enum {
695695
IFLA_XFRM_UNSPEC,
696696
IFLA_XFRM_LINK,
697697
IFLA_XFRM_IF_ID,
698+
IFLA_XFRM_COLLECT_METADATA,
698699
__IFLA_XFRM_MAX
699700
};
700701

‎include/uapi/linux/lwtunnel.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ enum lwtunnel_encap_types {
1515
LWTUNNEL_ENCAP_SEG6_LOCAL,
1616
LWTUNNEL_ENCAP_RPL,
1717
LWTUNNEL_ENCAP_IOAM6,
18+
LWTUNNEL_ENCAP_XFRM,
1819
__LWTUNNEL_ENCAP_MAX,
1920
};
2021

@@ -111,4 +112,13 @@ enum {
111112

112113
#define LWT_BPF_MAX_HEADROOM 256
113114

115+
enum {
116+
LWT_XFRM_UNSPEC,
117+
LWT_XFRM_IF_ID,
118+
LWT_XFRM_LINK,
119+
__LWT_XFRM_MAX,
120+
};
121+
122+
#define LWT_XFRM_MAX (__LWT_XFRM_MAX - 1)
123+
114124
#endif /* _UAPI_LWTUNNEL_H_ */

‎net/core/lwtunnel.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ static const char *lwtunnel_encap_str(enum lwtunnel_encap_types encap_type)
5050
return "IOAM6";
5151
case LWTUNNEL_ENCAP_IP6:
5252
case LWTUNNEL_ENCAP_IP:
53+
case LWTUNNEL_ENCAP_XFRM:
5354
case LWTUNNEL_ENCAP_NONE:
5455
case __LWTUNNEL_ENCAP_MAX:
5556
/* should not have got here */

‎net/ipv4/ah4.c‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -471,30 +471,38 @@ static int ah4_err(struct sk_buff *skb, u32 info)
471471
return 0;
472472
}
473473

474-
static int ah_init_state(struct xfrm_state *x)
474+
static int ah_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack)
475475
{
476476
struct ah_data *ahp = NULL;
477477
struct xfrm_algo_desc *aalg_desc;
478478
struct crypto_ahash *ahash;
479479

480-
if (!x->aalg)
480+
if (!x->aalg) {
481+
NL_SET_ERR_MSG(extack, "AH requires a state with an AUTH algorithm");
481482
goto error;
483+
}
482484

483-
if (x->encap)
485+
if (x->encap) {
486+
NL_SET_ERR_MSG(extack, "AH is not compatible with encapsulation");
484487
goto error;
488+
}
485489

486490
ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
487491
if (!ahp)
488492
return -ENOMEM;
489493

490494
ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
491-
if (IS_ERR(ahash))
495+
if (IS_ERR(ahash)) {
496+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
492497
goto error;
498+
}
493499

494500
ahp->ahash = ahash;
495501
if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
496-
(x->aalg->alg_key_len + 7) / 8))
502+
(x->aalg->alg_key_len + 7) / 8)) {
503+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
497504
goto error;
505+
}
498506

499507
/*
500508
* Lookup the algorithm description maintained by xfrm_algo,
@@ -507,10 +515,7 @@ static int ah_init_state(struct xfrm_state *x)
507515

508516
if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
509517
crypto_ahash_digestsize(ahash)) {
510-
pr_info("%s: %s digestsize %u != %u\n",
511-
__func__, x->aalg->alg_name,
512-
crypto_ahash_digestsize(ahash),
513-
aalg_desc->uinfo.auth.icv_fullbits / 8);
518+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
514519
goto error;
515520
}
516521

‎net/ipv4/esp4.c‎

Lines changed: 33 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1008,16 +1008,17 @@ static void esp_destroy(struct xfrm_state *x)
10081008
crypto_free_aead(aead);
10091009
}
10101010

1011-
static int esp_init_aead(struct xfrm_state *x)
1011+
static int esp_init_aead(struct xfrm_state *x, struct netlink_ext_ack *extack)
10121012
{
10131013
char aead_name[CRYPTO_MAX_ALG_NAME];
10141014
struct crypto_aead *aead;
10151015
int err;
10161016

1017-
err = -ENAMETOOLONG;
10181017
if (snprintf(aead_name, CRYPTO_MAX_ALG_NAME, "%s(%s)",
1019-
x->geniv, x->aead->alg_name) >= CRYPTO_MAX_ALG_NAME)
1020-
goto error;
1018+
x->geniv, x->aead->alg_name) >= CRYPTO_MAX_ALG_NAME) {
1019+
NL_SET_ERR_MSG(extack, "Algorithm name is too long");
1020+
return -ENAMETOOLONG;
1021+
}
10211022

10221023
aead = crypto_alloc_aead(aead_name, 0, 0);
10231024
err = PTR_ERR(aead);
@@ -1035,11 +1036,15 @@ static int esp_init_aead(struct xfrm_state *x)
10351036
if (err)
10361037
goto error;
10371038

1039+
return 0;
1040+
10381041
error:
1042+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
10391043
return err;
10401044
}
10411045

1042-
static int esp_init_authenc(struct xfrm_state *x)
1046+
static int esp_init_authenc(struct xfrm_state *x,
1047+
struct netlink_ext_ack *extack)
10431048
{
10441049
struct crypto_aead *aead;
10451050
struct crypto_authenc_key_param *param;
@@ -1050,10 +1055,6 @@ static int esp_init_authenc(struct xfrm_state *x)
10501055
unsigned int keylen;
10511056
int err;
10521057

1053-
err = -EINVAL;
1054-
if (!x->ealg)
1055-
goto error;
1056-
10571058
err = -ENAMETOOLONG;
10581059

10591060
if ((x->props.flags & XFRM_STATE_ESN)) {
@@ -1062,22 +1063,28 @@ static int esp_init_authenc(struct xfrm_state *x)
10621063
x->geniv ?: "", x->geniv ? "(" : "",
10631064
x->aalg ? x->aalg->alg_name : "digest_null",
10641065
x->ealg->alg_name,
1065-
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME)
1066+
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME) {
1067+
NL_SET_ERR_MSG(extack, "Algorithm name is too long");
10661068
goto error;
1069+
}
10671070
} else {
10681071
if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME,
10691072
"%s%sauthenc(%s,%s)%s",
10701073
x->geniv ?: "", x->geniv ? "(" : "",
10711074
x->aalg ? x->aalg->alg_name : "digest_null",
10721075
x->ealg->alg_name,
1073-
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME)
1076+
x->geniv ? ")" : "") >= CRYPTO_MAX_ALG_NAME) {
1077+
NL_SET_ERR_MSG(extack, "Algorithm name is too long");
10741078
goto error;
1079+
}
10751080
}
10761081

10771082
aead = crypto_alloc_aead(authenc_name, 0, 0);
10781083
err = PTR_ERR(aead);
1079-
if (IS_ERR(aead))
1084+
if (IS_ERR(aead)) {
1085+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
10801086
goto error;
1087+
}
10811088

10821089
x->data = aead;
10831090

@@ -1107,17 +1114,16 @@ static int esp_init_authenc(struct xfrm_state *x)
11071114
err = -EINVAL;
11081115
if (aalg_desc->uinfo.auth.icv_fullbits / 8 !=
11091116
crypto_aead_authsize(aead)) {
1110-
pr_info("ESP: %s digestsize %u != %u\n",
1111-
x->aalg->alg_name,
1112-
crypto_aead_authsize(aead),
1113-
aalg_desc->uinfo.auth.icv_fullbits / 8);
1117+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
11141118
goto free_key;
11151119
}
11161120

11171121
err = crypto_aead_setauthsize(
11181122
aead, x->aalg->alg_trunc_len / 8);
1119-
if (err)
1123+
if (err) {
1124+
NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations");
11201125
goto free_key;
1126+
}
11211127
}
11221128

11231129
param->enckeylen = cpu_to_be32((x->ealg->alg_key_len + 7) / 8);
@@ -1132,18 +1138,22 @@ static int esp_init_authenc(struct xfrm_state *x)
11321138
return err;
11331139
}
11341140

1135-
static int esp_init_state(struct xfrm_state *x)
1141+
static int esp_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack)
11361142
{
11371143
struct crypto_aead *aead;
11381144
u32 align;
11391145
int err;
11401146

11411147
x->data = NULL;
11421148

1143-
if (x->aead)
1144-
err = esp_init_aead(x);
1145-
else
1146-
err = esp_init_authenc(x);
1149+
if (x->aead) {
1150+
err = esp_init_aead(x, extack);
1151+
} else if (x->ealg) {
1152+
err = esp_init_authenc(x, extack);
1153+
} else {
1154+
NL_SET_ERR_MSG(extack, "ESP: AEAD or CRYPT must be provided");
1155+
err = -EINVAL;
1156+
}
11471157

11481158
if (err)
11491159
goto error;
@@ -1161,6 +1171,7 @@ static int esp_init_state(struct xfrm_state *x)
11611171

11621172
switch (encap->encap_type) {
11631173
default:
1174+
NL_SET_ERR_MSG(extack, "Unsupported encapsulation type for ESP");
11641175
err = -EINVAL;
11651176
goto error;
11661177
case UDP_ENCAP_ESPINUDP:

0 commit comments

Comments
 (0)