finally move buildroot-ng to trunk
[openwrt/staging/dedeckeh.git] / target / linux / generic-2.6 / patches / 102-openswan-2.4.0.kernel-2.6-natt.patch
1 diff -Nur linux-2.6.16/include/net/xfrmudp.h linux-2.6.16-owrt/include/net/xfrmudp.h
2 --- linux-2.6.16/include/net/xfrmudp.h 1970-01-01 01:00:00.000000000 +0100
3 +++ linux-2.6.16-owrt/include/net/xfrmudp.h 2006-03-22 21:39:54.000000000 +0100
4 @@ -0,0 +1,10 @@
5 +/*
6 + * pointer to function for type that xfrm4_input wants, to permit
7 + * decoupling of XFRM from udp.c
8 + */
9 +#define HAVE_XFRM4_UDP_REGISTER
10 +
11 +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);
12 +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
13 + , xfrm4_rcv_encap_t *oldfunc);
14 +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);
15 diff -Nur linux-2.6.16/net/ipv4/Kconfig linux-2.6.16-owrt/net/ipv4/Kconfig
16 --- linux-2.6.16/net/ipv4/Kconfig 2006-03-20 06:53:29.000000000 +0100
17 +++ linux-2.6.16-owrt/net/ipv4/Kconfig 2006-03-22 21:49:04.000000000 +0100
18 @@ -271,6 +271,12 @@
19 Network), but can be distributed all over the Internet. If you want
20 to do that, say Y here and to "IP multicast routing" below.
21
22 +config IPSEC_NAT_TRAVERSAL
23 + bool "IPSEC NAT-Traversal (KLIPS compatible)"
24 + depends on INET
25 + ---help---
26 + Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.
27 +
28 config IP_MROUTE
29 bool "IP: multicast routing"
30 depends on IP_MULTICAST
31 diff -Nur linux-2.6.16/net/ipv4/udp.c linux-2.6.16-owrt/net/ipv4/udp.c
32 --- linux-2.6.16/net/ipv4/udp.c 2006-03-20 06:53:29.000000000 +0100
33 +++ linux-2.6.16-owrt/net/ipv4/udp.c 2006-03-22 21:39:54.000000000 +0100
34 @@ -109,11 +109,14 @@
35 #include <net/inet_common.h>
36 #include <net/checksum.h>
37 #include <net/xfrm.h>
38 +#include <net/xfrmudp.h>
39
40 /*
41 * Snmp MIB for the UDP layer
42 */
43
44 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func;
45 +
46 DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly;
47
48 struct hlist_head udp_hash[UDP_HTABLE_SIZE];
49 @@ -882,6 +885,42 @@
50 sk_common_release(sk);
51 }
52
53 +#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
54 +
55 +/* if XFRM isn't a module, then register it directly. */
56 +#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
57 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap;
58 +#else
59 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
60 +#endif
61 +
62 +int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
63 + , xfrm4_rcv_encap_t *oldfunc)
64 +{
65 + if(oldfunc != NULL) {
66 + *oldfunc = xfrm4_rcv_encap_func;
67 + }
68 +
69 +#if 0
70 + if(xfrm4_rcv_encap_func != NULL)
71 + return -1;
72 +#endif
73 +
74 + xfrm4_rcv_encap_func = func;
75 + return 0;
76 +}
77 +
78 +int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func)
79 +{
80 + if(xfrm4_rcv_encap_func != func)
81 + return -1;
82 +
83 + xfrm4_rcv_encap_func = NULL;
84 + return 0;
85 +}
86 +#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */
87 +
88 +
89 /* return:
90 * 1 if the the UDP system should process it
91 * 0 if we should drop this packet
92 @@ -889,9 +928,9 @@
93 */
94 static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
95 {
96 -#ifndef CONFIG_XFRM
97 +#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
98 return 1;
99 -#else
100 +#else /* either CONFIG_XFRM or CONFIG_IPSEC_NAT_TRAVERSAL */
101 struct udp_sock *up = udp_sk(sk);
102 struct udphdr *uh = skb->h.uh;
103 struct iphdr *iph;
104 @@ -903,11 +942,11 @@
105
106 /* if we're overly short, let UDP handle it */
107 if (udpdata > skb->tail)
108 - return 1;
109 + return 2;
110
111 /* if this is not encapsulated socket, then just return now */
112 if (!encap_type)
113 - return 1;
114 + return 3;
115
116 len = skb->tail - udpdata;
117
118 @@ -922,7 +961,7 @@
119 len = sizeof(struct udphdr);
120 } else
121 /* Must be an IKE packet.. pass it through */
122 - return 1;
123 + return 4;
124 break;
125 case UDP_ENCAP_ESPINUDP_NON_IKE:
126 /* Check if this is a keepalive packet. If so, eat it. */
127 @@ -935,7 +974,7 @@
128 len = sizeof(struct udphdr) + 2 * sizeof(u32);
129 } else
130 /* Must be an IKE packet.. pass it through */
131 - return 1;
132 + return 5;
133 break;
134 }
135
136 @@ -946,6 +985,8 @@
137 */
138 if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
139 return 0;
140 + if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
141 + return 0;
142
143 /* Now we can update and verify the packet length... */
144 iph = skb->nh.iph;
145 @@ -1010,9 +1051,13 @@
146 return 0;
147 }
148 if (ret < 0) {
149 - /* process the ESP packet */
150 - ret = xfrm4_rcv_encap(skb, up->encap_type);
151 - UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
152 + if(xfrm4_rcv_encap_func != NULL) {
153 + ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
154 + UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
155 + } else {
156 + UDP_INC_STATS_BH(UDP_MIB_INERRORS);
157 + ret = 1;
158 + }
159 return -ret;
160 }
161 /* FALLTHROUGH -- it's a UDP Packet */
162 @@ -1559,3 +1604,9 @@
163 EXPORT_SYMBOL(udp_proc_register);
164 EXPORT_SYMBOL(udp_proc_unregister);
165 #endif
166 +
167 +#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)
168 +EXPORT_SYMBOL(udp4_register_esp_rcvencap);
169 +EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);
170 +#endif
171 +