Steffen Klassert says: ==================== 1) Introduce skb_to_sgvec_nomark function to add further data to the sg list without calling sg_unmark_end first. Needed to add extended sequence number informations. From Fan Du. 2) Add IPsec extended sequence numbers support to the Authentication Header protocol for ipv4 and ipv6. From Fan Du. 3) Make the IPsec flowcache namespace aware, from Fan Du. 4) Avoid creating temporary SA for every packet when no key manager is registered. From Horia Geanta. 5) Support filtering of SA dumps to show only the SAs that match a given filter. From Nicolas Dichtel. 6) Remove caching of xfrm_policy_sk_bundles. The cached socket policy bundles are never used, instead we create a new cache entry whenever xfrm_lookup() is called on a socket policy. Most protocols cache the used routes to the socket, so this caching is not needed. 7) Fix a forgotten SADB_X_EXT_FILTER length check in pfkey, from Nicolas Dichtel. 8) Cleanup error handling of xfrm_state_clone. ====================
Showing the changes to include/uapi/linux (2 of 17 files). Show all
Unified · Split
| @@ -235,6 +235,18 @@ struct sadb_x_kmaddress { · 234 unmodified lines | ||
| 235 | 235 | } __attribute__((packed)); |
| 236 | 236 | /* sizeof(struct sadb_x_kmaddress) == 8 */ |
| 237 | 237 | |
| 238 | +/* To specify the SA dump filter */ | |
| 239 | +struct sadb_x_filter { | |
| 240 | + __u16 sadb_x_filter_len; | |
| 241 | + __u16 sadb_x_filter_exttype; | |
| 242 | + __u32 sadb_x_filter_saddr[4]; | |
| 243 | + __u32 sadb_x_filter_daddr[4]; | |
| 244 | + __u16 sadb_x_filter_family; | |
| 245 | + __u8 sadb_x_filter_splen; | |
| 246 | + __u8 sadb_x_filter_dplen; | |
| 247 | +} __attribute__((packed)); | |
| 248 | +/* sizeof(struct sadb_x_filter) == 40 */ | |
| 249 | + | |
| 238 | 250 | /* Message types */ |
| 239 | 251 | #define SADB_RESERVED 0 |
| 240 | 252 | #define SADB_GETSPI 1 |
| @@ -358,7 +370,8 @@ struct sadb_x_kmaddress { · 117 unmodified lines | ||
| 358 | 370 | #define SADB_X_EXT_SEC_CTX 24 |
| 359 | 371 | /* Used with MIGRATE to pass @ to IKE for negotiation */ |
| 360 | 372 | #define SADB_X_EXT_KMADDRESS 25 |
| 361 | −#define SADB_EXT_MAX 25 | |
| 373 | +#define SADB_X_EXT_FILTER 26 | |
| 374 | +#define SADB_EXT_MAX 26 | |
| 362 | 375 | |
| 363 | 376 | /* Identity Extension values */ |
| 364 | 377 | #define SADB_IDENTTYPE_RESERVED 0 |
| @@ -298,6 +298,8 @@ enum xfrm_attr_type_t { · 297 unmodified lines | ||
| 298 | 298 | XFRMA_TFCPAD, /* __u32 */ |
| 299 | 299 | XFRMA_REPLAY_ESN_VAL, /* struct xfrm_replay_esn */ |
| 300 | 300 | XFRMA_SA_EXTRA_FLAGS, /* __u32 */ |
| 301 | + XFRMA_PROTO, /* __u8 */ | |
| 302 | + XFRMA_FILTER, /* struct xfrm_filter */ | |
| 301 | 303 | __XFRMA_MAX |
| 302 | 304 | |
| 303 | 305 | #define XFRMA_MAX (__XFRMA_MAX - 1) |
| @@ -474,6 +476,14 @@ struct xfrm_user_mapping { · 170 unmodified lines | ||
| 474 | 476 | __be16 new_sport; |
| 475 | 477 | }; |
| 476 | 478 | |
| 479 | +struct xfrm_filter { | |
| 480 | + xfrm_address_t saddr; | |
| 481 | + xfrm_address_t daddr; | |
| 482 | + __u16 family; | |
| 483 | + __u8 splen; | |
| 484 | + __u8 dplen; | |
| 485 | +}; | |
| 486 | + | |
| 477 | 487 | #ifndef __KERNEL__ |
| 478 | 488 | /* backwards compatibility for userspace */ |
| 479 | 489 | #define XFRMGRP_ACQUIRE 1 |