kernel/git/stable/linux-stable.git/net/xfrm, branch linux-2.6.26.y

ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space

2008-10-09T03:23:08+00:00

[ Upstream commit d01dbeb6af7a0848063033f73c3d146fec7451f3 ] We're never supposed to shrink the headroom or tailroom. In fact, shrinking the headroom is a fatal action. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

ipsec: Fix deadlock in xfrm_state management.

2008-09-08T11:44:29+00:00

[ Upstream commit 37b08e34a98c664bea86e3fae718ac45a46b7276 ] Ever since commit 4c563f7669c10a12354b72b518c2287ffc6ebfb3 ("[XFRM]: Speed up xfrm_policy and xfrm_state walking") it is illegal to call __xfrm_state_destroy (and thus xfrm_state_put()) with xfrm_state_lock held. If we do, we'll deadlock since we have the lock already and __xfrm_state_destroy() tries to take it again. Fix this by pushing the xfrm_state_put() calls after the lock is dropped. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info

2008-07-10T23:55:37+00:00

Add a XFRM_STATE_AF_UNSPEC flag to handle the AF_UNSPEC behavior for the selector family. Userspace applications can set this flag to leave the selector family of the xfrm_state unspecified. This can be used to to handle inter family tunnels if the selector is not set from userspace. Signed-off-by: Steffen Klassert Acked-by: Herbert Xu Signed-off-by: David S. Miller

xfrm: xfrm_algo: correct usage of RIPEMD-160

2008-06-04T19:04:55+00:00

This patch fixes the usage of RIPEMD-160 in xfrm_algo which in turn allows hmac(rmd160) to be used as authentication mechanism in IPsec ESP and AH (see RFC 2857). Signed-off-by: Adrian-Ken Rueegsegger Acked-by: Herbert Xu Signed-off-by: David S. Miller

xfrm_user: Remove zero length key checks.

2008-05-22T00:36:21+00:00

The crypto layer will determine whether that is valid or not. Suggested by Herbert Xu, based upon a report and patch by Martin Willi. Signed-off-by: David S. Miller Acked-by: Herbert Xu

net: Allow netdevices to specify needed head/tailroom

2008-05-13T03:48:31+00:00

This patch adds needed_headroom/needed_tailroom members to struct net_device and updates many places that allocate sbks to use them. Not all of them can be converted though, and I'm sure I missed some (I mostly grepped for LL_RESERVED_SPACE) Signed-off-by: Johannes Berg Signed-off-by: David S. Miller

Merge branch 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current

2008-04-29T18:41:22+00:00

* 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current: [PATCH] new predicate - AUDIT_FILETYPE [patch 2/2] Use find_task_by_vpid in audit code [patch 1/2] audit: let userspace fully control TTY input auditing [PATCH 2/2] audit: fix sparse shadowed variable warnings [PATCH 1/2] audit: move extern declarations to audit.h Audit: MAINTAINERS update Audit: increase the maximum length of the key field Audit: standardize string audit interfaces Audit: stop deadlock from signals under load Audit: save audit_backlog_limit audit messages in case auditd comes back Audit: collect sessionid in netlink messages Audit: end printk with newline

Remove duplicated unlikely() in IS_ERR()

2008-04-29T15:06:25+00:00

Some drivers have duplicated unlikely() macros. IS_ERR() already has unlikely() in itself. This patch cleans up such pointless code. Signed-off-by: Hirofumi Nakagawa Acked-by: David S. Miller Acked-by: Jeff Garzik Cc: Paul Clements Cc: Richard Purdie Cc: Alessandro Zummo Cc: David Brownell Cc: James Bottomley Cc: Michael Halcrow Cc: Anton Altaparmakov Cc: Al Viro Cc: Carsten Otte Cc: Patrick McHardy Cc: Paul Mundt Cc: Jaroslav Kysela Cc: Takashi Iwai Acked-by: Mike Frysinger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Audit: collect sessionid in netlink messages

2008-04-28T10:18:03+00:00

Previously I added sessionid output to all audit messages where it was available but we still didn't know the sessionid of the sender of netlink messages. This patch adds that information to netlink messages so we can audit who sent netlink messages. Signed-off-by: Eric Paris Signed-off-by: Al Viro

[IPSEC]: Use digest_null directly for auth

2008-04-27T21:26:52+00:00

Previously digest_null had no setkey function which meant that we used hmac(digest_null) for IPsec since IPsec always calls setkey. Now that digest_null has a setkey we no longer need to do that. In fact when only confidentiality is specified for ESP we already use digest_null directly. However, when the null algorithm is explicitly specified by the user we still opt for hmac(digest_null). This patch removes this discrepancy. I have not added a new compat name for it because by chance it wasn't actualy possible for the user to specify the name hmac(digest_null) due to a key length check in xfrm_user (which I found out when testing that compat name :) Signed-off-by: Herbert Xu Signed-off-by: David S. Miller