Changes in Makefile

4b3faf61 - xfrm: iptfs: add new iptfs xfrm mode impl

Thu, 14 Nov 2024 07:07:03 +0000

xfrm: iptfs: add new iptfs xfrm mode implAdd a new xfrm mode implementing AggFrag/IP-TFS from RFC9347.This utilizes the new xfrm_mode_cbs to implement demand-driven IP-TFSfunctionality. This functionality can be used to increase bandwidthutilization through small packet aggregation, as well as help solve PMTUissues through it's efficient use of fragmentation. Link: https://www.rfc-editor.org/rfc/rfc9347.txtMultiple commits follow to build the functionality into xfrm_iptfs.cSigned-off-by: Christian Hopps Tested-by: Antony Antony Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

f531d13b - xfrm: support sending NAT keepalives in ESP in UDP states

Tue, 28 May 2024 03:29:14 +0000

xfrm: support sending NAT keepalives in ESP in UDP statesAdd the ability to send out RFC-3948 NAT keepalives from the xfrm stack.To use, Userspace sets an XFRM_NAT_KEEPALIVE_INTERVAL integer property whencreating XFRM outbound states which denotes the number of seconds betweenkeepalive messages.Keepalive messages are sent from a per net delayed work which iterates overthe xfrm states. The logic is guarded by the xfrm state spinlock due to thexfrm state walk iterator.Possible future enhancements:- Adding counters to keep track of sent keepalives.- deduplicate NAT keepalives between states sharing the same nat keepalive parameters.- provisioning hardware offloads for devices capable of implementing this.- revise xfrm state list to use an rcu list in order to avoid running this under spinlock.Suggested-by: Paul Wouters Tested-by: Paul Wouters Tested-by: Antony Antony Signed-off-by: Eyal Birger Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

8f0ec8c6 - bpf: xfrm: Add bpf_xdp_get_xfrm_state() kfunc

Thu, 14 Dec 2023 22:49:02 +0000

bpf: xfrm: Add bpf_xdp_get_xfrm_state() kfuncThis commit adds an unstable kfunc helper to access internal xfrm_stateassociated with an SA. This is intended to be used for the upcomingIPsec pcpu work to assign special pcpu SAs to a particular CPU. In otherwords: for custom software RSS.That being said, the function that this kfunc wraps is fairly genericand used for a lot of xfrm tasks. I'm sure people will find useselsewhere over time.This commit also adds a corresponding bpf_xdp_xfrm_state_release() kfuncto release the refcnt acquired by bpf_xdp_get_xfrm_state(). The verifierwill require that all acquired xfrm_state's are released.Co-developed-by: Antony Antony Signed-off-by: Antony Antony Acked-by: Steffen Klassert Signed-off-by: Daniel Xu Link: https://lore.kernel.org/r/a29699c42f5fad456b875c98dd11c6afc3ffb707.1702593901.git.dxu@dxuuu.xyzSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/net/xfrm/Makefile

94151f5a - xfrm: interface: Add unstable helpers for setting/getting XFRM metadata from TC-BPF

Sat, 03 Dec 2022 08:46:57 +0000

xfrm: interface: Add unstable helpers for setting/getting XFRM metadata from TC-BPFThis change adds xfrm metadata helpers using the unstable kfunc callinterface for the TC-BPF hooks. This allows steering traffic towardsdifferent IPsec connections based on logic implemented in bpf programs.This object is built based on the availability of BTF debug info.When setting the xfrm metadata, percpu metadata dsts are used in orderto avoid allocating a metadata dst per packet.In order to guarantee safe module unload, the percpu dsts are allocatedon first use and never freed. The percpu pointer is stored innet/core/filter.c so that it can be reused on module reload.The metadata percpu dsts take ownership of the original skb dsts sothat they may be used as part of the xfrm transmission logic - e.g.for MTU calculations.Signed-off-by: Eyal Birger Link: https://lore.kernel.org/r/20221203084659.1837829-3-eyal.birger@gmail.comSigned-off-by: Martin KaFai Lau List of files: /linux-6.15/net/xfrm/Makefile

ee9a113a - xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c

Sat, 03 Dec 2022 08:46:56 +0000

xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.cThis change allows adding additional files to the xfrm_interface module.Signed-off-by: Eyal Birger Link: https://lore.kernel.org/r/20221203084659.1837829-2-eyal.birger@gmail.comSigned-off-by: Martin KaFai Lau List of files: /linux-6.15/net/xfrm/Makefile

c9e7c76d - xfrm: Provide API to register translator module

Mon, 21 Sep 2020 14:36:51 +0000

xfrm: Provide API to register translator moduleAdd a skeleton for xfrm_compat module and provide API to register it inxfrm_state.ko. struct xfrm_translator will have function pointers totranslate messages received from 32-bit userspace or to be sent to itfrom 64-bit kernel.module_get()/module_put() are used instead of rcu_read_lock() as themodule will vmalloc() memory for translation.The new API is registered with xfrm_state module, not with xfrm_user asthe former needs translator for user_policy set by setsockopt() andxfrm_user already uses functions from xfrm_state.Signed-off-by: Dmitry Safonov Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

26333c37 - xfrm: add IPv6 support for espintcp

Mon, 27 Apr 2020 15:59:35 +0000

xfrm: add IPv6 support for espintcpThis extends espintcp to support IPv6, building on the existing codeand the new UDPv6 encapsulation support. Most of the code is eitherreused directly (stream parser, ULP) or very similar to the IPv4variant (net/ipv6/esp6.c changes).The separation of config options for IPv4 and IPv6 espintcp requires abit of Kconfig gymnastics to enable the core code.Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

e27cca96 - xfrm: add espintcp (RFC 8229)

Mon, 25 Nov 2019 13:49:02 +0000

xfrm: add espintcp (RFC 8229)TCP encapsulation of IKE and IPsec messages (RFC 8229) is implementedas a TCP ULP, overriding in particular the sendmsg and recvmsgoperations. A Stream Parser is used to extract messages out of the TCPstream using the first 2 bytes as length marker. Received IKE messagesare put on "ike_queue", waiting to be dequeued by the custom recvmsgimplementation. Received ESP messages are sent to XFRM, like with UDPencapsulation.Some of this code is taken from the original submission by HerbertXu. Currently, only IPv4 is supported, like for UDP encapsulation.Co-developed-by: Herbert Xu Signed-off-by: Herbert Xu Signed-off-by: Sabrina Dubroca Acked-by: David S. Miller Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

f203b76d - xfrm: Add virtual xfrm interfaces

Tue, 12 Jun 2018 12:07:12 +0000

xfrm: Add virtual xfrm interfacesThis patch adds support for virtual xfrm interfaces.Packets that are routed through such an interfaceare guaranteed to be IPsec transformed or dropped.It is a generic virtual interface that ensures IPsectransformation, no need to know what happens behindthe interface. This means that we can tunnel IPv4 andIPv6 through the same interface and support all xfrmmodes (tunnel, transport and beet) on it.Co-developed-by: Lorenzo Colitti Co-developed-by: Benedict Wong Signed-off-by: Lorenzo Colitti Signed-off-by: Benedict Wong Signed-off-by: Steffen Klassert Acked-by: Shannon Nelson Tested-by: Benedict Wong Tested-by: Antony Antony Reviewed-by: Eyal Birger List of files: /linux-6.15/net/xfrm/Makefile

b2441318 - License cleanup: add SPDX GPL-2.0 license identifier to files with no license

Wed, 01 Nov 2017 14:07:57 +0000

License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseMany source files in the tree are missing licensing information, whichmakes it harder for compliance tools to determine the correct license.By default all files without license information are under the defaultlicense of the kernel, which is GPL version 2.Update the files which contain no license information with the 'GPL-2.0'SPDX license identifier. The SPDX identifier is a legally bindingshorthand, which can be used instead of the full boiler plate text.This patch is based on work done by Thomas Gleixner and Kate Stewart andPhilippe Ombredanne.How this work was done:Patches were generated and checked against linux-4.14-rc6 for a subset ofthe use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information,Further patches will be generated in subsequent months to fix up caseswhere non-standard license headers were used, and references to licensehad to be inferred by heuristics based on keywords.The analysis to determine which SPDX License Identifier to be applied toa file was done in a spreadsheet of side by side results from of theoutput of two independent scanners (ScanCode & Windriver) producing SPDXtag:value files created by Philippe Ombredanne. Philippe prepared thebase worksheet, and did an initial spot review of a few 1000 files.The 4.13 kernel was the starting point of the analysis with 60,537 filesassessed. Kate Stewart did a file by file comparison of the scannerresults in the spreadsheet to determine which SPDX license identifier(s)to be applied to the file. She confirmed any determination that was notimmediately clear with lawyers working with the Linux Foundation.Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines).All documentation files were explicitly excluded.The following heuristics were used to determine which SPDX licenseidentifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time.In total, over 70 hours of logged manual review was done on thespreadsheet to determine the SPDX license identifiers to apply to thesource files by Kate, Philippe, Thomas and, in some cases, confirmationby lawyers working with the Linux Foundation.Kate also obtained a third independent scan of the 4.13 code base fromFOSSology, and compared selected files where the other two scannersdisagreed against that SPDX file, to see if there was new insights. TheWindriver scanner is based on an older version of FOSSology in part, sothey are related.Thomas did random spot checks in about 500 files from the spreadsheetsfor the uapi headers and agreed with SPDX license identifier in thefiles he inspected. For the non-uapi files Thomas did random spot checksin about 15000 files.In initial set of patches against 4.14-rc6, 3 files were found to havecopy/paste license identifier errors, and have been fixed to reflect thecorrect identifier.Additionally Philippe spent 10 hours this week doing a detailed manualinspection and review of the 12,461 patched files from the initial patchversion early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correctThis produced a worksheet with 20 files needing minor correction. Thisworksheet was then exported into 3 different .csv files for thedifferent types of files to be modified.These .csv files were then reviewed by Greg. Thomas wrote a script toparse the csv files and add the proper SPDX tag to the file, in theformat that the file expected. This script was further refined by Gregbased on the output to detect more types of files automatically and todistinguish between header and source .c files (which need differentcomment types.) Finally Greg ran the script using the .csv files togenerate the patches.Reviewed-by: Kate Stewart Reviewed-by: Philippe Ombredanne Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/xfrm/Makefile

b81f884a - xfrm: fix xfrm_dev_event() missing when compile without CONFIG_XFRM_OFFLOAD

Thu, 01 Jun 2017 06:57:56 +0000

xfrm: fix xfrm_dev_event() missing when compile without CONFIG_XFRM_OFFLOADIn commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") wemake xfrm_device.o only compiled when enable option CONFIG_XFRM_OFFLOAD.But this will make xfrm_dev_event() missing if we only enable default XFRMoptions.Then if we set down and unregister an interface with IPsec on it. therewill no xfrm_garbage_collect(), which will cause dev usage count hold andget error like:unregister_netdevice: waiting for to become free. Usage count = 4Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API")Signed-off-by: Hangbin Liu Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

d77e38e6 - xfrm: Add an IPsec hardware offloading API

Fri, 14 Apr 2017 08:06:10 +0000

xfrm: Add an IPsec hardware offloading APIThis patch adds all the bits that are needed to doIPsec hardware offload for IPsec states and ESP packets.We add xfrmdev_ops to the net_device. xfrmdev_ops hasfunction pointers that are needed to manage the xfrmstates in the hardware and to do a per packetoffloading decision.Joint work with:Ilan Tayari Guy Shapiro Yossi Kuperman Signed-off-by: Guy Shapiro Signed-off-by: Ilan Tayari Signed-off-by: Yossi Kuperman Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

21f42cc9 - xfrm: Move device notifications to a sepatate file

Fri, 14 Apr 2017 08:05:53 +0000

xfrm: Move device notifications to a sepatate fileThis is needed for the upcomming IPsec device offloading.Signed-off-by: Steffen Klassert List of files: /linux-6.15/net/xfrm/Makefile

7e152524 - xfrm: make xfrm_algo.c a module

Tue, 15 May 2012 01:57:44 +0000

xfrm: make xfrm_algo.c a moduleBy making this a standalone config option (auto-selected as needed),selecting CRYPTO from here rather than from XFRM (which is boolean)allows the core crypto code to become a module again even when XFRM=y.Signed-off-by: Jan Beulich Signed-off-by: David S. Miller List of files: /linux-6.15/net/xfrm/Makefile

9fdc4883 - xfrm: Move IPsec replay detection functions to a separate file

Tue, 08 Mar 2011 00:08:32 +0000

xfrm: Move IPsec replay detection functions to a separate fileTo support multiple versions of replay detection, we move the replaydetection functions to a separate file and make them accessiblevia function pointers contained in the struct xfrm_replay.Signed-off-by: Steffen Klassert Acked-by: Herbert Xu Signed-off-by: David S. Miller List of files: /linux-6.15/net/xfrm/Makefile

b27aeadb - netns xfrm: per-netns sysctls

Wed, 26 Nov 2008 02:00:48 +0000

netns xfrm: per-netns sysctlsMake net.core.xfrm_aevent_etime net.core.xfrm_acq_expires net.core.xfrm_aevent_rseqth net.core.xfrm_larval_dropsysctls per-netns.For that make net_core_path[] global, register it to prevent two/proc/net/core antries and change initcall position -- xfrm_init() is calledfrom fs_initcall, so this one should be fs_initcall at least.Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller List of files: /linux-6.15/net/xfrm/Makefile

6fccab67 - ipsec: ipcomp - Merge IPComp implementations

Fri, 25 Jul 2008 09:54:40 +0000

ipsec: ipcomp - Merge IPComp implementationsThis patch merges the IPv4/IPv6 IPComp implementations since mostof the code is identical. As a result future enhancements will nolonger need to be duplicated.Signed-off-by: Herbert Xu Signed-off-by: David S. Miller List of files: /linux-6.15/net/xfrm/Makefile

558f82ef - [XFRM]: Define packet dropping statistics.

Fri, 21 Dec 2007 04:42:57 +0000

[XFRM]: Define packet dropping statistics.This statistics is shown factor dropped by transformationat /proc/net/xfrm_stat for developer.It is a counter designed from current transformation source codeand defined as linux private MIB.See Documentation/networking/xfrm_proc.txt for the detail.Signed-off-by: Masahide NAKAMURA Signed-off-by: David S. Miller List of files: /linux-6.15/net/xfrm/Makefile

406ef77c - [IPSEC]: Move common output code to xfrm_output

Tue, 09 Oct 2007 00:16:30 +0000

[IPSEC]: Move common output code to xfrm_outputMost of the code in xfrm4_output_one and xfrm6_output_one are identical sothis patch moves them into a common xfrm_output function which will livein net/xfrm.In fact this would seem to fix a bug as on IPv4 we never reset the networkheader after a transform which may upset netfilter later on.Signed-off-by: Herbert Xu Signed-off-by: David S. Miller List of files: /linux-6.15/net/xfrm/Makefile

44e36b42 - [XFRM]: Extract common hashing code into xfrm_hash.[ch]

Thu, 24 Aug 2006 11:50:50 +0000

[XFRM]: Extract common hashing code into xfrm_hash.[ch]Signed-off-by: David S. Miller List of files: /linux-6.15/net/xfrm/Makefile