Hello! > with #include in two places, > perhaps that broke it? No. You may simply delete this, I forgot it in two places. > No packet leaves the interface. This looks like bypass not working. Yes, connect() is broken... The patch is enclosed. Alternatively, you could allow connections to remote isakmp ports via policy. Alexey ===== include/net/route.h 1.14 vs edited ===== --- 1.14/include/net/route.h Tue Nov 5 18:17:12 2002 +++ edited/include/net/route.h Mon Nov 11 02:10:03 2002 @@ -140,7 +140,9 @@ return ip_tos2prio[IPTOS_TOS(tos)>>1]; } -static inline int ip_route_connect(struct rtable **rp, u32 dst, u32 src, u32 tos, int oif, u8 protocol, u16 sport, u16 dport) +static inline int ip_route_connect(struct rtable **rp, u32 dst, + u32 src, u32 tos, int oif, u8 protocol, + u16 sport, u16 dport, struct sock *sk) { struct flowi fl = { .oif = oif, .nl_u = { .ip4_u = { .daddr = dst, @@ -161,10 +163,11 @@ ip_rt_put(*rp); *rp = NULL; } - return ip_route_output_key(rp, &fl); + return ip_route_output_flow(rp, &fl, sk, 0); } -static inline int ip_route_newports(struct rtable **rp, u16 sport, u16 dport) +static inline int ip_route_newports(struct rtable **rp, u16 sport, u16 dport, + struct sock *sk) { if (sport != (*rp)->fl.uli_u.ports.sport || dport != (*rp)->fl.uli_u.ports.dport) { @@ -175,7 +178,7 @@ fl.uli_u.ports.dport = dport; ip_rt_put(*rp); *rp = NULL; - return ip_route_output_key(rp, &fl); + return ip_route_output_flow(rp, &fl, sk, 0); } return 0; } ===== include/net/xfrm.h 1.4 vs edited ===== --- 1.4/include/net/xfrm.h Fri Nov 8 11:34:37 2002 +++ edited/include/net/xfrm.h Mon Nov 11 03:04:17 2002 @@ -8,6 +8,9 @@ #include #include +extern struct semaphore xfrm_cfg_sem; + + /* Organization of SPD aka "XFRM rules" ------------------------------------ @@ -320,7 +323,7 @@ extern int xfrm_unregister_km(struct xfrm_mgr *km); -extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX]; +extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2]; static inline void xfrm_pol_hold(struct xfrm_policy *policy) { @@ -429,16 +432,16 @@ return 0; } -extern void __xfrm_sk_free_policy(struct xfrm_policy *); +extern void __xfrm_sk_free_policy(struct xfrm_policy *, int dir); static inline void xfrm_sk_free_policy(struct sock *sk) { if (unlikely(sk->policy[0] != NULL)) { - __xfrm_sk_free_policy(sk->policy[0]); + __xfrm_sk_free_policy(sk->policy[0], 0); sk->policy[0] = NULL; } if (unlikely(sk->policy[1] != NULL)) { - __xfrm_sk_free_policy(sk->policy[1]); + __xfrm_sk_free_policy(sk->policy[1], 1); sk->policy[1] = NULL; } } ===== net/netsyms.c 1.36 vs edited ===== --- 1.36/net/netsyms.c Tue Nov 5 19:03:39 2002 +++ edited/net/netsyms.c Sat Nov 9 08:24:30 2002 @@ -283,6 +283,7 @@ EXPORT_SYMBOL(dlci_ioctl_hook); #endif +EXPORT_SYMBOL(xfrm_cfg_sem); EXPORT_SYMBOL(xfrm_policy_alloc); EXPORT_SYMBOL(__xfrm_policy_destroy); EXPORT_SYMBOL(xfrm_policy_lookup); ===== net/ipv4/ip_output.c 1.23 vs edited ===== --- 1.23/net/ipv4/ip_output.c Tue Nov 5 18:17:12 2002 +++ edited/net/ipv4/ip_output.c Sat Nov 9 08:39:54 2002 @@ -815,14 +815,16 @@ alloclen = maxfraglen; else alloclen = datalen + fragheaderlen; - if (!(flags & MSG_DONTWAIT) || transhdrlen) { + if (transhdrlen) { skb = sock_alloc_send_skb(sk, alloclen + hh_len + 15, (flags & MSG_DONTWAIT), &err); } else { - skb = sock_wmalloc(sk, - alloclen + hh_len + 15, 1, - sk->allocation); + skb = NULL; + if (atomic_read(&sk->wmem_alloc) <= 2*sk->sndbuf) + skb = sock_wmalloc(sk, + alloclen + hh_len + 15, 1, + sk->allocation); if (unlikely(skb == NULL)) err = -ENOBUFS; } ===== net/ipv4/tcp_ipv4.c 1.35 vs edited ===== --- 1.35/net/ipv4/tcp_ipv4.c Tue Nov 5 18:17:12 2002 +++ edited/net/ipv4/tcp_ipv4.c Mon Nov 11 02:19:20 2002 @@ -780,7 +780,7 @@ tmp = ip_route_connect(&rt, nexthop, inet->saddr, RT_CONN_FLAGS(sk), sk->bound_dev_if, IPPROTO_TCP, - inet->sport, usin->sin_port); + inet->sport, usin->sin_port, sk); if (tmp < 0) return tmp; @@ -837,7 +837,7 @@ if (err) goto failure; - err = ip_route_newports(&rt, inet->sport, inet->dport); + err = ip_route_newports(&rt, inet->sport, inet->dport, sk); if (err) goto failure; @@ -1896,7 +1896,7 @@ RT_TOS(inet->tos) | sk->localroute, sk->bound_dev_if, IPPROTO_TCP, - inet->sport, inet->dport); + inet->sport, inet->dport, sk); if (err) return err; ===== net/ipv4/udp.c 1.26 vs edited ===== --- 1.26/net/ipv4/udp.c Tue Nov 5 18:17:12 2002 +++ edited/net/ipv4/udp.c Mon Nov 11 02:10:02 2002 @@ -884,7 +884,7 @@ err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr, RT_CONN_FLAGS(sk), oif, IPPROTO_UDP, - inet->sport, usin->sin_port); + inet->sport, usin->sin_port, sk); if (err) return err; if ((rt->rt_flags&RTCF_BROADCAST) && !sk->broadcast) { ===== net/ipv4/xfrm_policy.c 1.9 vs edited ===== --- 1.9/net/ipv4/xfrm_policy.c Fri Nov 8 18:09:21 2002 +++ edited/net/ipv4/xfrm_policy.c Mon Nov 11 04:09:26 2002 @@ -1,10 +1,12 @@ #include #include +DECLARE_MUTEX(xfrm_cfg_sem); + static u32 xfrm_policy_genid; static rwlock_t xfrm_policy_lock = RW_LOCK_UNLOCKED; -struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX]; +struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2]; extern struct dst_ops xfrm4_dst_ops; @@ -263,10 +265,13 @@ { u32 idx; struct xfrm_policy *p; - static u32 pol_id; + static u32 idx_generator; for (;;) { - idx = (++pol_id ? : ++pol_id); + idx = (idx_generator | dir); + idx_generator += 8; + if (idx == 0) + idx = 8; for (p = xfrm_policy_list[dir]; p; p = p->next) { if (p->index == idx) break; @@ -300,6 +305,7 @@ write_unlock_bh(&xfrm_policy_lock); if (pol) { + atomic_dec(&pol->refcnt); xfrm_policy_kill(pol); xfrm_pol_put(pol); } @@ -328,7 +334,7 @@ struct xfrm_policy *pol, **p; write_lock_bh(&xfrm_policy_lock); - for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL; p = &pol->next) { + for (p = &xfrm_policy_list[id & 7]; (pol=*p)!=NULL; p = &pol->next) { if (pol->index == id) { if (delete) *p = pol->next; @@ -375,7 +381,7 @@ int error = 0; read_lock(&xfrm_policy_lock); - for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { + for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) { for (xp = xfrm_policy_list[dir]; xp; xp = xp->next) count++; } @@ -385,9 +391,9 @@ goto out; } - for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { + for (dir = 0; dir < 2*XFRM_POLICY_MAX; dir++) { for (xp = xfrm_policy_list[dir]; xp; xp = xp->next) { - error = func(xp, dir, --count, data); + error = func(xp, dir%XFRM_POLICY_MAX, --count, data); if (error) goto out; } @@ -423,18 +429,37 @@ struct xfrm_policy *pol; read_lock(&xfrm_policy_lock); - for (pol = sk->policy[dir]; pol; pol = pol->next) { - struct xfrm_selector *sel = &pol->selector; - - if (xfrm4_selector_match(sel, fl)) { + if ((pol = sk->policy[dir]) != NULL) { + if (xfrm4_selector_match(&pol->selector, fl)) atomic_inc(&pol->refcnt); - break; - } + else + pol = NULL; } read_unlock(&xfrm_policy_lock); return pol; } +void xfrm_sk_policy_link(struct xfrm_policy *pol, int dir) +{ + pol->next = xfrm_policy_list[XFRM_POLICY_MAX+dir]; + xfrm_policy_list[XFRM_POLICY_MAX+dir] = pol; + atomic_inc(&pol->refcnt); +} + +void xfrm_sk_policy_unlink(struct xfrm_policy *pol, int dir) +{ + struct xfrm_policy **polp; + + for (polp = &xfrm_policy_list[XFRM_POLICY_MAX+dir]; + *polp != NULL; polp = &(*polp)->next) { + if (*polp == pol) { + *polp = pol->next; + atomic_dec(&pol->refcnt); + return; + } + } +} + int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) { struct xfrm_policy *old_pol; @@ -442,6 +467,13 @@ write_lock_bh(&xfrm_policy_lock); old_pol = sk->policy[dir]; sk->policy[dir] = pol; + if (pol) { + pol->curlft.add_time = (unsigned long)xtime.tv_sec; + pol->index = xfrm_gen_index(XFRM_POLICY_MAX+dir); + xfrm_sk_policy_link(pol, dir); + } + if (old_pol) + xfrm_sk_policy_unlink(old_pol, dir); write_unlock_bh(&xfrm_policy_lock); if (old_pol) { @@ -451,7 +483,7 @@ return 0; } -static struct xfrm_policy *clone_policy(struct xfrm_policy *old) +static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir) { struct xfrm_policy *newp = xfrm_policy_alloc(GFP_ATOMIC); @@ -462,8 +494,12 @@ newp->action = old->action; newp->flags = old->flags; newp->xfrm_nr = old->xfrm_nr; + newp->index = old->index; memcpy(newp->xfrm_vec, old->xfrm_vec, newp->xfrm_nr*sizeof(struct xfrm_tmpl)); + write_lock_bh(&xfrm_policy_lock); + xfrm_sk_policy_link(newp, dir); + write_unlock_bh(&xfrm_policy_lock); } return newp; } @@ -475,15 +511,19 @@ p1 = sk->policy[1]; sk->policy[0] = NULL; sk->policy[1] = NULL; - if (p0 && (sk->policy[0] = clone_policy(p0)) == NULL) + if (p0 && (sk->policy[0] = clone_policy(p0, 0)) == NULL) return -ENOMEM; - if (p1 && (sk->policy[1] = clone_policy(p1)) == NULL) + if (p1 && (sk->policy[1] = clone_policy(p1, 1)) == NULL) return -ENOMEM; return 0; } -void __xfrm_sk_free_policy(struct xfrm_policy *pol) +void __xfrm_sk_free_policy(struct xfrm_policy *pol, int dir) { + write_lock_bh(&xfrm_policy_lock); + xfrm_sk_policy_unlink(pol, dir); + write_unlock_bh(&xfrm_policy_lock); + xfrm_policy_kill(pol); xfrm_pol_put(pol); } @@ -888,7 +928,7 @@ pol = NULL; if (sk && sk->policy[dir]) - pol =xfrm_sk_policy_lookup(sk, dir, &fl); + pol = xfrm_sk_policy_lookup(sk, dir, &fl); if (!pol) pol = flow_lookup(dir, &fl); @@ -985,7 +1025,7 @@ struct dst_entry *dst, **dstp, *gc_list = NULL; read_lock_bh(&xfrm_policy_lock); - for (i=0; inext) { write_lock(&pol->lock); dstp = &pol->bundles; @@ -1028,7 +1068,7 @@ struct dst_entry *dst, **dstp, *gc_list = NULL; read_lock_bh(&xfrm_policy_lock); - for (i=0; inext) { write_lock(&pol->lock); dstp = &pol->bundles; ===== net/ipv4/xfrm_state.c 1.5 vs edited ===== --- 1.5/net/ipv4/xfrm_state.c Fri Nov 8 11:34:37 2002 +++ edited/net/ipv4/xfrm_state.c Sat Nov 9 07:44:41 2002 @@ -213,6 +213,7 @@ spin_lock_bh(&xfrm_state_lock); list_for_each_entry(x, xfrm_state_bydst+h, bydst) { if (daddr == x->id.daddr.xfrm4_addr && + x->props.reqid == tmpl->reqid && (saddr == x->props.saddr.xfrm4_addr || !saddr || !x->props.saddr.xfrm4_addr) && tmpl->mode == x->props.mode && tmpl->id.proto == x->id.proto) { @@ -278,6 +279,7 @@ if (x->props.saddr.xfrm4_addr == 0) x->props.saddr.xfrm4_addr = saddr; x->props.mode = tmpl->mode; + x->props.reqid = tmpl->reqid; if (km_query(x, tmpl, pol) == 0) { x->km.state = XFRM_STATE_ACQ; @@ -398,7 +400,7 @@ mode == x->props.mode && proto == x->id.proto && saddr == x->props.saddr.xfrm4_addr && - (!reqid || reqid == x->props.reqid)) { + reqid == x->props.reqid) { if (!x0) x0 = x; if (x->km.state != XFRM_STATE_ACQ) ===== net/key/af_key.c 1.6 vs edited ===== --- 1.6/net/key/af_key.c Fri Nov 8 11:34:37 2002 +++ edited/net/key/af_key.c Mon Nov 11 04:06:23 2002 @@ -30,6 +30,7 @@ #define _X2KEY(x) ((x) == XFRM_INF ? 0 : (x)) #define _KEY2X(x) ((x) == 0 ? XFRM_INF : (x)) + /* List of all pfkey sockets. */ static struct sock * pfkey_table; static DECLARE_WAIT_QUEUE_HEAD(pfkey_table_wait); @@ -871,10 +872,6 @@ !!ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) return ERR_PTR(-EINVAL); - /* XXX Do we need this check ? */ - if (((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_SRC-1])->sadb_address_prefixlen != 32 || - ((struct sadb_address *) ext_hdrs[SADB_EXT_ADDRESS_DST-1])->sadb_address_prefixlen != 32) - return ERR_PTR(-EINVAL); proto = pfkey_satype2proto(hdr->sadb_msg_satype); if (proto == 0) return ERR_PTR(-EINVAL); @@ -1379,6 +1376,34 @@ return 0; } +static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr) +{ + int i; + u16 reqid = *(u16*)ptr; + + for (i=0; ixfrm_nr; i++) { + if (xp->xfrm_vec[i].reqid == reqid) + return -EEXIST; + } + return 0; +} + +static u16 gen_reqid(void) +{ + u16 start; + static u16 reqid = IPSEC_MANUAL_REQID_MAX; + + start = reqid; + do { + ++reqid; + if (reqid == 0) + reqid = IPSEC_MANUAL_REQID_MAX+1; + if (xfrm_policy_walk(check_reqid, (void*)&reqid) != -EEXIST) + return reqid; + } while (reqid != start); + return 0; +} + static int parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) { @@ -1395,7 +1420,14 @@ t->mode = rq->sadb_x_ipsecrequest_mode-1; if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) t->optional = 1; - t->reqid = rq->sadb_x_ipsecrequest_reqid; + else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) { + t->reqid = rq->sadb_x_ipsecrequest_reqid; + if (t->reqid > IPSEC_MANUAL_REQID_MAX) + t->reqid = 0; + if (!t->reqid && !(t->reqid = gen_reqid())) + return -ENOBUFS; + } + /* addresses present only in tunnel mode */ if (t->mode) { addr = (void*)(rq+1); @@ -1544,6 +1576,8 @@ rq->sadb_x_ipsecrequest_proto = t->id.proto; rq->sadb_x_ipsecrequest_mode = t->mode+1; rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE; + if (t->reqid) + rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE; if (t->optional) rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_USE; rq->sadb_x_ipsecrequest_reqid = t->reqid; @@ -1590,7 +1624,6 @@ if (xp == NULL) return -ENOBUFS; - xp->index = pol->sadb_x_policy_id; xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); @@ -2013,6 +2046,18 @@ return 0; } +static u32 get_acqseq(void) +{ + u32 res; + static u32 acqseq; + static spinlock_t acqseq_lock = SPIN_LOCK_UNLOCKED; + + spin_lock_bh(&acqseq_lock); + res = (++acqseq ? : ++acqseq); + spin_unlock_bh(&acqseq_lock); + return res; +} + static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *xp, int dir) { struct sk_buff *skb; @@ -2020,7 +2065,6 @@ struct sadb_address *addr; struct sadb_x_policy *pol; int size; - static u32 acqseq; size = sizeof(struct sadb_msg) + sizeof(struct sadb_address)*2 + @@ -2043,10 +2087,9 @@ hdr->sadb_msg_len = size / sizeof(uint64_t); hdr->sadb_msg_errno = 0; hdr->sadb_msg_reserved = 0; - hdr->sadb_msg_seq = (++acqseq ? : ++acqseq); - x->km.seq = acqseq; + hdr->sadb_msg_seq = x->km.seq = get_acqseq(); hdr->sadb_msg_pid = 0; - + /* src address */ addr = (struct sadb_address*) skb_put(skb, sizeof(struct sadb_address)+sizeof(struct sockaddr_in)); @@ -2076,7 +2119,7 @@ ((struct sockaddr_in*)(addr + 1))->sin_addr.s_addr = x->id.daddr.xfrm4_addr; ((struct sockaddr_in*)(addr + 1))->sin_port = 0; - + pol = (struct sadb_x_policy *) skb_put(skb, sizeof(struct sadb_x_policy)); pol->sadb_x_policy_len = sizeof(struct sadb_x_policy)/sizeof(uint64_t); pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; @@ -2119,7 +2162,6 @@ return NULL; } - xp->index = pol->sadb_x_policy_id; xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ? XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW); @@ -2171,7 +2213,9 @@ if (!hdr) goto out; + down(&xfrm_cfg_sem); err = pfkey_process(sk, skb, hdr); + up(&xfrm_cfg_sem); out: if (err && hdr && pfkey_error(hdr, err, sk) == 0) @@ -2179,7 +2223,7 @@ if (skb) kfree_skb(skb); - return err; + return err ? : len; } static int pfkey_recvmsg(struct kiocb *kiocb,