target/linux/generic-2.6/patches/120-openswan-2.4.0.kernel-2.6-natt.patch

   1 diff -Nur linux-2.6.21.1/include/net/xfrmudp.h linux-2.6.21.1-owrt/include/net/xfrmudp.h
   2 --- linux-2.6.21.1/include/net/xfrmudp.h        1970-01-01 01:00:00.000000000 +0100
   3 +++ linux-2.6.21.1-owrt/include/net/xfrmudp.h   2007-05-14 11:26:11.000000000 +0200
   4 @@ -0,0 +1,10 @@
   5 +/*
   6 + * pointer to function for type that xfrm4_input wants, to permit
   7 + * decoupling of XFRM from udp.c
   8 + */
   9 +#define HAVE_XFRM4_UDP_REGISTER
  10 +
  11 +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);
  12 +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  13 +                                     , xfrm4_rcv_encap_t *oldfunc);
  14 +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);
  15 diff -Nur linux-2.6.21.1/net/ipv4/Kconfig linux-2.6.21.1-owrt/net/ipv4/Kconfig
  16 --- linux-2.6.21.1/net/ipv4/Kconfig     2007-04-27 23:49:26.000000000 +0200
  17 +++ linux-2.6.21.1-owrt/net/ipv4/Kconfig        2007-05-14 11:26:11.000000000 +0200
  18 @@ -266,6 +266,12 @@
  19           Network), but can be distributed all over the Internet. If you want
  20           to do that, say Y here and to "IP multicast routing" below.
  21
  22 +config IPSEC_NAT_TRAVERSAL
  23 +       bool "IPSEC NAT-Traversal (KLIPS compatible)"
  24 +       depends on INET
  25 +       ---help---
  26 +          Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.
  27 +
  28  config IP_MROUTE
  29         bool "IP: multicast routing"
  30         depends on IP_MULTICAST
  31 diff -Nur linux-2.6.21.1/net/ipv4/udp.c linux-2.6.21.1-owrt/net/ipv4/udp.c
  32 --- linux-2.6.21.1/net/ipv4/udp.c       2007-04-27 23:49:26.000000000 +0200
  33 +++ linux-2.6.21.1-owrt/net/ipv4/udp.c  2007-05-14 11:42:44.000000000 +0200
  34 @@ -101,12 +101,15 @@
  35  #include <net/route.h>
  36  #include <net/checksum.h>
  37  #include <net/xfrm.h>
  38 +#include <net/xfrmudp.h>
  39  #include "udp_impl.h"
  40
  41  /*
  42   *     Snmp MIB for the UDP layer
  43   */
  44
  45 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func;
  46 +
  47  DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly;
  48
  49  struct hlist_head udp_hash[UDP_HTABLE_SIZE];
  50 @@ -915,6 +918,42 @@
  51         return 0;
  52  }
  53
  54 +#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  55 +
  56 +/* if XFRM isn't a module, then register it directly. */
  57 +#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  58 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap;
  59 +#else
  60 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
  61 +#endif
  62 +
  63 +int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  64 +                              , xfrm4_rcv_encap_t *oldfunc)
  65 +{
  66 +  if(oldfunc != NULL) {
  67 +    *oldfunc = xfrm4_rcv_encap_func;
  68 +  }
  69 +
  70 +#if 0
  71 +  if(xfrm4_rcv_encap_func != NULL)
  72 +    return -1;
  73 +#endif
  74 +
  75 +  xfrm4_rcv_encap_func = func;
  76 +  return 0;
  77 +}
  78 +
  79 +int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func)
  80 +{
  81 +  if(xfrm4_rcv_encap_func != func)
  82 +    return -1;
  83 +
  84 +  xfrm4_rcv_encap_func = NULL;
  85 +  return 0;
  86 +}
  87 +#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */
  88 +
  89 +
  90  /* return:
  91   *     1  if the the UDP system should process it
  92   *     0  if we should drop this packet
  93 @@ -922,7 +961,7 @@
  94   */
  95  static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
  96  {
  97 -#ifndef CONFIG_XFRM
  98 +#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  99         return 1;
 100  #else
 101         struct udp_sock *up = udp_sk(sk);
 102 @@ -937,11 +976,11 @@
 103         /* if we're overly short, let UDP handle it */
 104         len = skb->len - sizeof(struct udphdr);
 105         if (len <= 0)
 106 -               return 1;
 107 +               return 2;
 108
 109         /* if this is not encapsulated socket, then just return now */
 110         if (!encap_type)
 111 -               return 1;
 112 +               return 3;
 113
 114         /* If this is a paged skb, make sure we pull up
 115          * whatever data we need to look at. */
 116 @@ -964,7 +1003,7 @@
 117                         len = sizeof(struct udphdr);
 118                 } else
 119                         /* Must be an IKE packet.. pass it through */
 120 -                       return 1;
 121 +                       return 4;
 122                 break;
 123         case UDP_ENCAP_ESPINUDP_NON_IKE:
 124                 /* Check if this is a keepalive packet.  If so, eat it. */
 125 @@ -977,7 +1016,7 @@
 126                         len = sizeof(struct udphdr) + 2 * sizeof(u32);
 127                 } else
 128                         /* Must be an IKE packet.. pass it through */
 129 -                       return 1;
 130 +                       return 5;
 131                 break;
 132         }
 133
 134 @@ -988,6 +1027,8 @@
 135          */
 136         if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 137                 return 0;
 138 +       if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 139 +               return 0;
 140
 141         /* Now we can update and verify the packet length... */
 142         iph = skb->nh.iph;
 143 @@ -1051,9 +1092,13 @@
 144                         return 0;
 145                 }
 146                 if (ret < 0) {
 147 -                       /* process the ESP packet */
 148 -                       ret = xfrm4_rcv_encap(skb, up->encap_type);
 149 -                       UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
 150 +                       if(xfrm4_rcv_encap_func != NULL) {
 151 +                         ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
 152 +                         UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
 153 +                       } else {
 154 +                         UDP_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag);
 155 +                         ret = 1;
 156 +                       }
 157                         return -ret;
 158                 }
 159                 /* FALLTHROUGH -- it's a UDP Packet */
 160 @@ -1733,3 +1778,9 @@
 161  EXPORT_SYMBOL(udp_proc_register);
 162  EXPORT_SYMBOL(udp_proc_unregister);
 163  #endif
 164 +
 165 +#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)
 166 +EXPORT_SYMBOL(udp4_register_esp_rcvencap);
 167 +EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);
 168 +#endif
 169 +