target/linux/generic-2.6/patches/102-openswan-2.4.0.kernel-2.6-natt.patch

   1 diff -Nur linux-2.6.16/include/net/xfrmudp.h linux-2.6.16-owrt/include/net/xfrmudp.h
   2 --- linux-2.6.16/include/net/xfrmudp.h  1970-01-01 01:00:00.000000000 +0100
   3 +++ linux-2.6.16-owrt/include/net/xfrmudp.h     2006-03-22 21:39:54.000000000 +0100
   4 @@ -0,0 +1,10 @@
   5 +/*
   6 + * pointer to function for type that xfrm4_input wants, to permit
   7 + * decoupling of XFRM from udp.c
   8 + */
   9 +#define HAVE_XFRM4_UDP_REGISTER
  10 +
  11 +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);
  12 +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  13 +                                     , xfrm4_rcv_encap_t *oldfunc);
  14 +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);
  15 diff -Nur linux-2.6.16/net/ipv4/Kconfig linux-2.6.16-owrt/net/ipv4/Kconfig
  16 --- linux-2.6.16/net/ipv4/Kconfig       2006-03-20 06:53:29.000000000 +0100
  17 +++ linux-2.6.16-owrt/net/ipv4/Kconfig  2006-03-22 21:49:04.000000000 +0100
  18 @@ -271,6 +271,12 @@
  19           Network), but can be distributed all over the Internet. If you want
  20           to do that, say Y here and to "IP multicast routing" below.
  21
  22 +config IPSEC_NAT_TRAVERSAL
  23 +       bool "IPSEC NAT-Traversal (KLIPS compatible)"
  24 +       depends on INET
  25 +       ---help---
  26 +          Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.
  27 +
  28  config IP_MROUTE
  29         bool "IP: multicast routing"
  30         depends on IP_MULTICAST
  31 diff -Nur linux-2.6.16/net/ipv4/udp.c linux-2.6.16-owrt/net/ipv4/udp.c
  32 --- linux-2.6.16/net/ipv4/udp.c 2006-03-20 06:53:29.000000000 +0100
  33 +++ linux-2.6.16-owrt/net/ipv4/udp.c    2006-03-22 21:39:54.000000000 +0100
  34 @@ -109,11 +109,14 @@
  35  #include <net/inet_common.h>
  36  #include <net/checksum.h>
  37  #include <net/xfrm.h>
  38 +#include <net/xfrmudp.h>
  39
  40  /*
  41   *     Snmp MIB for the UDP layer
  42   */
  43
  44 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func;
  45 +
  46  DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly;
  47
  48  struct hlist_head udp_hash[UDP_HTABLE_SIZE];
  49 @@ -882,6 +885,42 @@
  50         sk_common_release(sk);
  51  }
  52
  53 +#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  54 +
  55 +/* if XFRM isn't a module, then register it directly. */
  56 +#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  57 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap;
  58 +#else
  59 +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
  60 +#endif
  61 +
  62 +int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
  63 +                              , xfrm4_rcv_encap_t *oldfunc)
  64 +{
  65 +  if(oldfunc != NULL) {
  66 +    *oldfunc = xfrm4_rcv_encap_func;
  67 +  }
  68 +
  69 +#if 0
  70 +  if(xfrm4_rcv_encap_func != NULL)
  71 +    return -1;
  72 +#endif
  73 +
  74 +  xfrm4_rcv_encap_func = func;
  75 +  return 0;
  76 +}
  77 +
  78 +int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func)
  79 +{
  80 +  if(xfrm4_rcv_encap_func != func)
  81 +    return -1;
  82 +
  83 +  xfrm4_rcv_encap_func = NULL;
  84 +  return 0;
  85 +}
  86 +#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */
  87 +
  88 +
  89  /* return:
  90   *     1  if the the UDP system should process it
  91   *     0  if we should drop this packet
  92 @@ -889,9 +928,9 @@
  93   */
  94  static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
  95  {
  96 -#ifndef CONFIG_XFRM
  97 +#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  98         return 1;
  99 -#else
 100 +#else /* either CONFIG_XFRM or CONFIG_IPSEC_NAT_TRAVERSAL */
 101         struct udp_sock *up = udp_sk(sk);
 102         struct udphdr *uh = skb->h.uh;
 103         struct iphdr *iph;
 104 @@ -903,11 +942,11 @@
 105
 106         /* if we're overly short, let UDP handle it */
 107         if (udpdata > skb->tail)
 108 -               return 1;
 109 +               return 2;
 110
 111         /* if this is not encapsulated socket, then just return now */
 112         if (!encap_type)
 113 -               return 1;
 114 +               return 3;
 115
 116         len = skb->tail - udpdata;
 117
 118 @@ -922,7 +961,7 @@
 119                         len = sizeof(struct udphdr);
 120                 } else
 121                         /* Must be an IKE packet.. pass it through */
 122 -                       return 1;
 123 +                       return 4;
 124                 break;
 125         case UDP_ENCAP_ESPINUDP_NON_IKE:
 126                 /* Check if this is a keepalive packet.  If so, eat it. */
 127 @@ -935,7 +974,7 @@
 128                         len = sizeof(struct udphdr) + 2 * sizeof(u32);
 129                 } else
 130                         /* Must be an IKE packet.. pass it through */
 131 -                       return 1;
 132 +                       return 5;
 133                 break;
 134         }
 135
 136 @@ -946,6 +985,8 @@
 137          */
 138         if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 139                 return 0;
 140 +       if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 141 +               return 0;
 142
 143         /* Now we can update and verify the packet length... */
 144         iph = skb->nh.iph;
 145 @@ -1010,9 +1051,13 @@
 146                         return 0;
 147                 }
 148                 if (ret < 0) {
 149 -                       /* process the ESP packet */
 150 -                       ret = xfrm4_rcv_encap(skb, up->encap_type);
 151 -                       UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
 152 +                       if(xfrm4_rcv_encap_func != NULL) {
 153 +                         ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
 154 +                         UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
 155 +                       } else {
 156 +                         UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 157 +                         ret = 1;
 158 +                       }
 159                         return -ret;
 160                 }
 161                 /* FALLTHROUGH -- it's a UDP Packet */
 162 @@ -1559,3 +1604,9 @@
 163  EXPORT_SYMBOL(udp_proc_register);
 164  EXPORT_SYMBOL(udp_proc_unregister);
 165  #endif
 166 +
 167 +#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)
 168 +EXPORT_SYMBOL(udp4_register_esp_rcvencap);
 169 +EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);
 170 +#endif
 171 +