Index: linux-2.6.22.19/include/net/xfrmudp.h =================================================================== --- /dev/null +++ linux-2.6.22.19/include/net/xfrmudp.h @@ -0,0 +1,10 @@ +/* + * pointer to function for type that xfrm4_input wants, to permit + * decoupling of XFRM from udp.c + */ +#define HAVE_XFRM4_UDP_REGISTER + +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type); +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func + , xfrm4_rcv_encap_t *oldfunc); +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func); Index: linux-2.6.22.19/net/ipv4/Kconfig =================================================================== --- linux-2.6.22.19.orig/net/ipv4/Kconfig +++ linux-2.6.22.19/net/ipv4/Kconfig @@ -266,6 +266,12 @@ config NET_IPGRE_BROADCAST Network), but can be distributed all over the Internet. If you want to do that, say Y here and to "IP multicast routing" below. +config IPSEC_NAT_TRAVERSAL + bool "IPSEC NAT-Traversal (KLIPS compatible)" + depends on INET + ---help--- + Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP. + config IP_MROUTE bool "IP: multicast routing" depends on IP_MULTICAST Index: linux-2.6.22.19/net/ipv4/udp.c =================================================================== --- linux-2.6.22.19.orig/net/ipv4/udp.c +++ linux-2.6.22.19/net/ipv4/udp.c @@ -101,12 +101,15 @@ #include #include #include +#include #include "udp_impl.h" /* * Snmp MIB for the UDP layer */ +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func; + DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly; struct hlist_head udp_hash[UDP_HTABLE_SIZE]; @@ -919,6 +922,42 @@ int udp_disconnect(struct sock *sk, int return 0; } +#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL) + +/* if XFRM isn't a module, then register it directly. */ +#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL) +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap; +#else +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL; +#endif + +int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func + , xfrm4_rcv_encap_t *oldfunc) +{ + if(oldfunc != NULL) { + *oldfunc = xfrm4_rcv_encap_func; + } + +#if 0 + if(xfrm4_rcv_encap_func != NULL) + return -1; +#endif + + xfrm4_rcv_encap_func = func; + return 0; +} + +int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func) +{ + if(xfrm4_rcv_encap_func != func) + return -1; + + xfrm4_rcv_encap_func = NULL; + return 0; +} +#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */ + + /* return: * 1 if the UDP system should process it * 0 if we should drop this packet @@ -926,7 +965,7 @@ int udp_disconnect(struct sock *sk, int */ static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb) { -#ifndef CONFIG_XFRM +#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL) return 1; #else struct udp_sock *up = udp_sk(sk); @@ -941,11 +980,11 @@ static int udp_encap_rcv(struct sock * s /* if we're overly short, let UDP handle it */ len = skb->len - sizeof(struct udphdr); if (len <= 0) - return 1; + return 2; /* if this is not encapsulated socket, then just return now */ if (!encap_type) - return 1; + return 3; /* If this is a paged skb, make sure we pull up * whatever data we need to look at. */ @@ -968,7 +1007,7 @@ static int udp_encap_rcv(struct sock * s len = sizeof(struct udphdr); } else /* Must be an IKE packet.. pass it through */ - return 1; + return 4; break; case UDP_ENCAP_ESPINUDP_NON_IKE: /* Check if this is a keepalive packet. If so, eat it. */ @@ -981,7 +1020,7 @@ static int udp_encap_rcv(struct sock * s len = sizeof(struct udphdr) + 2 * sizeof(u32); } else /* Must be an IKE packet.. pass it through */ - return 1; + return 5; break; } @@ -992,6 +1031,8 @@ static int udp_encap_rcv(struct sock * s */ if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) return 0; + if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) + return 0; /* Now we can update and verify the packet length... */ iph = ip_hdr(skb); @@ -1056,9 +1097,13 @@ int udp_queue_rcv_skb(struct sock * sk, return 0; } if (ret < 0) { - /* process the ESP packet */ - ret = xfrm4_rcv_encap(skb, up->encap_type); - UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag); + if(xfrm4_rcv_encap_func != NULL) { + ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type); + UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag); + } else { + UDP_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag); + ret = 1; + } return -ret; } /* FALLTHROUGH -- it's a UDP Packet */ @@ -1742,3 +1787,9 @@ EXPORT_SYMBOL(udp_poll); EXPORT_SYMBOL(udp_proc_register); EXPORT_SYMBOL(udp_proc_unregister); #endif + +#if defined(CONFIG_IPSEC_NAT_TRAVERSAL) +EXPORT_SYMBOL(udp4_register_esp_rcvencap); +EXPORT_SYMBOL(udp4_unregister_esp_rcvencap); +#endif +