target/linux/generic-2.6/patches-2.6.21/120-openswan-2.4.0.kernel-2.6-natt.patch

   1 Index: linux-2.6.21.7/include/net/xfrmudp.h
   2 ===================================================================
   3 --- /dev/null
   4 +++ linux-2.6.21.7/include/net/xfrmudp.h
   5 @@ -0,0 +1,10 @@
   6 +/*
   7 + * pointer to function for type that xfrm4_input wants, to permit
   8 + * decoupling of XFRM from udp.c
   9 + */
  10 +#define HAVE_XFRM4_UDP_REGISTER
  11 +
  12 +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);
  13 +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  14 +                                     , xfrm4_rcv_encap_t *oldfunc);
  15 +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);
  16 Index: linux-2.6.21.7/net/ipv4/Kconfig
  17 ===================================================================
  18 --- linux-2.6.21.7.orig/net/ipv4/Kconfig
  19 +++ linux-2.6.21.7/net/ipv4/Kconfig
  20 @@ -266,6 +266,12 @@ config NET_IPGRE_BROADCAST
  21           Network), but can be distributed all over the Internet. If you want
  22           to do that, say Y here and to "IP multicast routing" below.
  23
  24 +config IPSEC_NAT_TRAVERSAL
  25 +       bool "IPSEC NAT-Traversal (KLIPS compatible)"
  26 +       depends on INET
  27 +       ---help---
  28 +          Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.
  29 +
  30  config IP_MROUTE
  31         bool "IP: multicast routing"
  32         depends on IP_MULTICAST
  33 Index: linux-2.6.21.7/net/ipv4/udp.c
  34 ===================================================================
  35 --- linux-2.6.21.7.orig/net/ipv4/udp.c
  36 +++ linux-2.6.21.7/net/ipv4/udp.c
  37 @@ -101,12 +101,15 @@
  38  #include <net/route.h>
  39  #include <net/checksum.h>
  40  #include <net/xfrm.h>
  41 +#include <net/xfrmudp.h>
  42  #include "udp_impl.h"
  43
  44  /*
  45   *     Snmp MIB for the UDP layer
  46   */
  47
  48 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func;
  49 +
  50  DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly;
  51
  52  struct hlist_head udp_hash[UDP_HTABLE_SIZE];
  53 @@ -915,6 +918,42 @@ int udp_disconnect(struct sock *sk, int
  54         return 0;
  55  }
  56
  57 +#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  58 +
  59 +/* if XFRM isn't a module, then register it directly. */
  60 +#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  61 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap;
  62 +#else
  63 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
  64 +#endif
  65 +
  66 +int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  67 +                              , xfrm4_rcv_encap_t *oldfunc)
  68 +{
  69 +  if(oldfunc != NULL) {
  70 +    *oldfunc = xfrm4_rcv_encap_func;
  71 +  }
  72 +
  73 +#if 0
  74 +  if(xfrm4_rcv_encap_func != NULL)
  75 +    return -1;
  76 +#endif
  77 +
  78 +  xfrm4_rcv_encap_func = func;
  79 +  return 0;
  80 +}
  81 +
  82 +int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func)
  83 +{
  84 +  if(xfrm4_rcv_encap_func != func)
  85 +    return -1;
  86 +
  87 +  xfrm4_rcv_encap_func = NULL;
  88 +  return 0;
  89 +}
  90 +#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */
  91 +
  92 +
  93  /* return:
  94   *     1  if the the UDP system should process it
  95   *     0  if we should drop this packet
  96 @@ -922,7 +961,7 @@ int udp_disconnect(struct sock *sk, int
  97   */
  98  static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
  99  {
 100 -#ifndef CONFIG_XFRM
 101 +#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
 102         return 1;
 103  #else
 104         struct udp_sock *up = udp_sk(sk);
 105 @@ -937,11 +976,11 @@ static int udp_encap_rcv(struct sock * s
 106         /* if we're overly short, let UDP handle it */
 107         len = skb->len - sizeof(struct udphdr);
 108         if (len <= 0)
 109 -               return 1;
 110 +               return 2;
 111
 112         /* if this is not encapsulated socket, then just return now */
 113         if (!encap_type)
 114 -               return 1;
 115 +               return 3;
 116
 117         /* If this is a paged skb, make sure we pull up
 118          * whatever data we need to look at. */
 119 @@ -964,7 +1003,7 @@ static int udp_encap_rcv(struct sock * s
 120                         len = sizeof(struct udphdr);
 121                 } else
 122                         /* Must be an IKE packet.. pass it through */
 123 -                       return 1;
 124 +                       return 4;
 125                 break;
 126         case UDP_ENCAP_ESPINUDP_NON_IKE:
 127                 /* Check if this is a keepalive packet.  If so, eat it. */
 128 @@ -977,7 +1016,7 @@ static int udp_encap_rcv(struct sock * s
 129                         len = sizeof(struct udphdr) + 2 * sizeof(u32);
 130                 } else
 131                         /* Must be an IKE packet.. pass it through */
 132 -                       return 1;
 133 +                       return 5;
 134                 break;
 135         }
 136
 137 @@ -988,6 +1027,8 @@ static int udp_encap_rcv(struct sock * s
 138          */
 139         if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 140                 return 0;
 141 +       if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 142 +               return 0;
 143
 144         /* Now we can update and verify the packet length... */
 145         iph = skb->nh.iph;
 146 @@ -1051,9 +1092,13 @@ int udp_queue_rcv_skb(struct sock * sk,
 147                         return 0;
 148                 }
 149                 if (ret < 0) {
 150 -                       /* process the ESP packet */
 151 -                       ret = xfrm4_rcv_encap(skb, up->encap_type);
 152 -                       UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
 153 +                       if(xfrm4_rcv_encap_func != NULL) {
 154 +                         ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
 155 +                         UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
 156 +                       } else {
 157 +                         UDP_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag);
 158 +                         ret = 1;
 159 +                       }
 160                         return -ret;
 161                 }
 162                 /* FALLTHROUGH -- it's a UDP Packet */
 163 @@ -1733,3 +1778,9 @@ EXPORT_SYMBOL(udp_poll);
 164  EXPORT_SYMBOL(udp_proc_register);
 165  EXPORT_SYMBOL(udp_proc_unregister);
 166  #endif
 167 +
 168 +#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)
 169 +EXPORT_SYMBOL(udp4_register_esp_rcvencap);
 170 +EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);
 171 +#endif
 172 +