* [PATCHv4] fragment locally generated tunnel-mode IPSec6 packets as needed
@ 2010-12-17 21:42 David L Stevens
2010-12-18 2:16 ` Herbert Xu
0 siblings, 1 reply; 6+ messages in thread
From: David L Stevens @ 2010-12-17 21:42 UTC (permalink / raw)
To: Herbert Xu, davem; +Cc: netdev
This patch modifies IPsec6 to fragment IPv6 packets that are
locally generated as needed.
This version of the patch only fragments in tunnel mode, so that fragment
headers will not be obscured by ESP in transport mode.
Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
diff -ruNp linux-2.6.36-rc8/include/net/ip6_route.h linux-2.6.36-rc8DLS/include/net/ip6_route.h
--- linux-2.6.36-rc8/include/net/ip6_route.h 2010-10-14 16:26:43.000000000 -0700
+++ linux-2.6.36-rc8DLS/include/net/ip6_route.h 2010-12-12 09:22:48.582141401 -0800
@@ -164,5 +164,15 @@ static inline int ipv6_unicast_destinati
return rt->rt6i_flags & RTF_LOCAL;
}
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+
+static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+{
+ struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+
+ return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
+ skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+}
+
#endif
#endif
diff -ruNp linux-2.6.36-rc8/net/ipv6/ip6_output.c linux-2.6.36-rc8DLS/net/ipv6/ip6_output.c
--- linux-2.6.36-rc8/net/ipv6/ip6_output.c 2010-10-14 16:26:43.000000000 -0700
+++ linux-2.6.36-rc8DLS/net/ipv6/ip6_output.c 2010-12-14 09:51:45.260779308 -0800
@@ -56,7 +56,7 @@
#include <net/checksum.h>
#include <linux/mroute6.h>
-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
int __ip6_local_out(struct sk_buff *skb)
{
@@ -145,14 +145,6 @@ static int ip6_finish_output2(struct sk_
return -EINVAL;
}
-static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
-{
- struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
-
- return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
- skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
-}
-
static int ip6_finish_output(struct sk_buff *skb)
{
if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
@@ -601,7 +593,7 @@ int ip6_find_1stfragopt(struct sk_buff *
return offset;
}
-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
{
struct sk_buff *frag;
struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
diff -ruNp linux-2.6.36-rc8/net/ipv6/xfrm6_output.c linux-2.6.36-rc8DLS/net/ipv6/xfrm6_output.c
--- linux-2.6.36-rc8/net/ipv6/xfrm6_output.c 2010-10-14 16:26:43.000000000 -0700
+++ linux-2.6.36-rc8DLS/net/ipv6/xfrm6_output.c 2010-12-17 09:28:40.426989866 -0800
@@ -17,6 +17,7 @@
#include <linux/netfilter_ipv6.h>
#include <net/dst.h>
#include <net/ipv6.h>
+#include <net/ip6_route.h>
#include <net/xfrm.h>
int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
@@ -88,8 +89,21 @@ static int xfrm6_output_finish(struct sk
return xfrm_output(skb);
}
+static int __xfrm6_output(struct sk_buff *skb)
+{
+ struct dst_entry *dst = skb_dst(skb);
+ struct xfrm_state *x = dst->xfrm;
+
+ if ((x && x->props.mode == XFRM_MODE_TUNNEL) &&
+ ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
+ dst_allfrag(skb_dst(skb)))) {
+ return ip6_fragment(skb, xfrm6_output_finish);
+ }
+ return xfrm6_output_finish(skb);
+}
+
int xfrm6_output(struct sk_buff *skb)
{
return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL,
- skb_dst(skb)->dev, xfrm6_output_finish);
+ skb_dst(skb)->dev, __xfrm6_output);
}
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCHv4] fragment locally generated tunnel-mode IPSec6 packets as needed
2010-12-17 21:42 [PATCHv4] fragment locally generated tunnel-mode IPSec6 packets as needed David L Stevens
@ 2010-12-18 2:16 ` Herbert Xu
2010-12-18 22:34 ` David Miller
0 siblings, 1 reply; 6+ messages in thread
From: Herbert Xu @ 2010-12-18 2:16 UTC (permalink / raw)
To: David L Stevens; +Cc: davem, netdev
On Fri, Dec 17, 2010 at 01:42:42PM -0800, David L Stevens wrote:
> This patch modifies IPsec6 to fragment IPv6 packets that are
> locally generated as needed.
>
> This version of the patch only fragments in tunnel mode, so that fragment
> headers will not be obscured by ESP in transport mode.
>
> Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Thanks,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCHv4] fragment locally generated tunnel-mode IPSec6 packets as needed
2010-12-18 2:16 ` Herbert Xu
@ 2010-12-18 22:34 ` David Miller
2010-12-19 1:03 ` Herbert Xu
2010-12-19 16:07 ` David Stevens
0 siblings, 2 replies; 6+ messages in thread
From: David Miller @ 2010-12-18 22:34 UTC (permalink / raw)
To: herbert; +Cc: dlstevens, netdev
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Sat, 18 Dec 2010 10:16:06 +0800
> On Fri, Dec 17, 2010 at 01:42:42PM -0800, David L Stevens wrote:
>> This patch modifies IPsec6 to fragment IPv6 packets that are
>> locally generated as needed.
>>
>> This version of the patch only fragments in tunnel mode, so that fragment
>> headers will not be obscured by ESP in transport mode.
>>
>> Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
So is the TAHI test regression caused by v3 fixed here in v4?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCHv4] fragment locally generated tunnel-mode IPSec6 packets as needed
2010-12-18 22:34 ` David Miller
@ 2010-12-19 1:03 ` Herbert Xu
2010-12-19 16:07 ` David Stevens
1 sibling, 0 replies; 6+ messages in thread
From: Herbert Xu @ 2010-12-19 1:03 UTC (permalink / raw)
To: David Miller; +Cc: dlstevens, netdev
On Sat, Dec 18, 2010 at 02:34:23PM -0800, David Miller wrote:
> From: Herbert Xu <herbert@gondor.apana.org.au>
> Date: Sat, 18 Dec 2010 10:16:06 +0800
>
> > On Fri, Dec 17, 2010 at 01:42:42PM -0800, David L Stevens wrote:
> >> This patch modifies IPsec6 to fragment IPv6 packets that are
> >> locally generated as needed.
> >>
> >> This version of the patch only fragments in tunnel mode, so that fragment
> >> headers will not be obscured by ESP in transport mode.
> >>
> >> Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
> >
> > Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
>
> So is the TAHI test regression caused by v3 fixed here in v4?
I think so since that was probably caused by the incorrect
fragmentation of transport-mode packets before encapsulation.
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCHv4] fragment locally generated tunnel-mode IPSec6 packets as needed
2010-12-18 22:34 ` David Miller
2010-12-19 1:03 ` Herbert Xu
@ 2010-12-19 16:07 ` David Stevens
2010-12-20 4:22 ` David Miller
1 sibling, 1 reply; 6+ messages in thread
From: David Stevens @ 2010-12-19 16:07 UTC (permalink / raw)
To: David Miller; +Cc: herbert, netdev
David Miller <davem@davemloft.net> wrote on 12/18/2010 02:34:23 PM:
> So is the TAHI test regression caused by v3 fixed here in v4?
Yes.
+-DLS
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-12-20 4:22 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-12-17 21:42 [PATCHv4] fragment locally generated tunnel-mode IPSec6 packets as needed David L Stevens
2010-12-18 2:16 ` Herbert Xu
2010-12-18 22:34 ` David Miller
2010-12-19 1:03 ` Herbert Xu
2010-12-19 16:07 ` David Stevens
2010-12-20 4:22 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).