target/linux/generic-2.6/patches-2.6.22/120-openswan-2.4.0.kernel-2.6-natt.patch

   1 --- /dev/null
   2 +++ b/include/net/xfrmudp.h
   3 @@ -0,0 +1,10 @@
   4 +/*
   5 + * pointer to function for type that xfrm4_input wants, to permit
   6 + * decoupling of XFRM from udp.c
   7 + */
   8 +#define HAVE_XFRM4_UDP_REGISTER
   9 +
  10 +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);
  11 +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  12 +                                     , xfrm4_rcv_encap_t *oldfunc);
  13 +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);
  14 --- a/net/ipv4/Kconfig
  15 +++ b/net/ipv4/Kconfig
  16 @@ -266,6 +266,12 @@
  17           Network), but can be distributed all over the Internet. If you want
  18           to do that, say Y here and to "IP multicast routing" below.
  19
  20 +config IPSEC_NAT_TRAVERSAL
  21 +       bool "IPSEC NAT-Traversal (KLIPS compatible)"
  22 +       depends on INET
  23 +       ---help---
  24 +          Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.
  25 +
  26  config IP_MROUTE
  27         bool "IP: multicast routing"
  28         depends on IP_MULTICAST
  29 --- a/net/ipv4/udp.c
  30 +++ b/net/ipv4/udp.c
  31 @@ -101,12 +101,15 @@
  32  #include <net/route.h>
  33  #include <net/checksum.h>
  34  #include <net/xfrm.h>
  35 +#include <net/xfrmudp.h>
  36  #include "udp_impl.h"
  37
  38  /*
  39   *     Snmp MIB for the UDP layer
  40   */
  41
  42 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func;
  43 +
  44  DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly;
  45
  46  struct hlist_head udp_hash[UDP_HTABLE_SIZE];
  47 @@ -919,6 +922,42 @@
  48         return 0;
  49  }
  50
  51 +#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  52 +
  53 +/* if XFRM isn't a module, then register it directly. */
  54 +#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  55 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap;
  56 +#else
  57 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
  58 +#endif
  59 +
  60 +int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  61 +                              , xfrm4_rcv_encap_t *oldfunc)
  62 +{
  63 +  if(oldfunc != NULL) {
  64 +    *oldfunc = xfrm4_rcv_encap_func;
  65 +  }
  66 +
  67 +#if 0
  68 +  if(xfrm4_rcv_encap_func != NULL)
  69 +    return -1;
  70 +#endif
  71 +
  72 +  xfrm4_rcv_encap_func = func;
  73 +  return 0;
  74 +}
  75 +
  76 +int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func)
  77 +{
  78 +  if(xfrm4_rcv_encap_func != func)
  79 +    return -1;
  80 +
  81 +  xfrm4_rcv_encap_func = NULL;
  82 +  return 0;
  83 +}
  84 +#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */
  85 +
  86 +
  87  /* return:
  88   *     1  if the UDP system should process it
  89   *     0  if we should drop this packet
  90 @@ -926,7 +965,7 @@
  91   */
  92  static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
  93  {
  94 -#ifndef CONFIG_XFRM
  95 +#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  96         return 1;
  97  #else
  98         struct udp_sock *up = udp_sk(sk);
  99 @@ -941,11 +980,11 @@
 100         /* if we're overly short, let UDP handle it */
 101         len = skb->len - sizeof(struct udphdr);
 102         if (len <= 0)
 103 -               return 1;
 104 +               return 2;
 105
 106         /* if this is not encapsulated socket, then just return now */
 107         if (!encap_type)
 108 -               return 1;
 109 +               return 3;
 110
 111         /* If this is a paged skb, make sure we pull up
 112          * whatever data we need to look at. */
 113 @@ -968,7 +1007,7 @@
 114                         len = sizeof(struct udphdr);
 115                 } else
 116                         /* Must be an IKE packet.. pass it through */
 117 -                       return 1;
 118 +                       return 4;
 119                 break;
 120         case UDP_ENCAP_ESPINUDP_NON_IKE:
 121                 /* Check if this is a keepalive packet.  If so, eat it. */
 122 @@ -981,7 +1020,7 @@
 123                         len = sizeof(struct udphdr) + 2 * sizeof(u32);
 124                 } else
 125                         /* Must be an IKE packet.. pass it through */
 126 -                       return 1;
 127 +                       return 5;
 128                 break;
 129         }
 130
 131 @@ -992,6 +1031,8 @@
 132          */
 133         if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 134                 return 0;
 135 +       if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 136 +               return 0;
 137
 138         /* Now we can update and verify the packet length... */
 139         iph = ip_hdr(skb);
 140 @@ -1056,9 +1097,13 @@
 141                         return 0;
 142                 }
 143                 if (ret < 0) {
 144 -                       /* process the ESP packet */
 145 -                       ret = xfrm4_rcv_encap(skb, up->encap_type);
 146 -                       UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
 147 +                       if(xfrm4_rcv_encap_func != NULL) {
 148 +                         ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
 149 +                         UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
 150 +                       } else {
 151 +                         UDP_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag);
 152 +                         ret = 1;
 153 +                       }
 154                         return -ret;
 155                 }
 156                 /* FALLTHROUGH -- it's a UDP Packet */
 157 @@ -1742,3 +1787,9 @@
 158  EXPORT_SYMBOL(udp_proc_register);
 159  EXPORT_SYMBOL(udp_proc_unregister);
 160  #endif
 161 +
 162 +#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)
 163 +EXPORT_SYMBOL(udp4_register_esp_rcvencap);
 164 +EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);
 165 +#endif
 166 +