Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

Steffen Klassert says:

====================
1) Introduce skb_to_sgvec_nomark function to add further data to the sg list
   without calling sg_unmark_end first. Needed to add extended sequence
   number informations. From Fan Du.

2) Add IPsec extended sequence numbers support to the Authentication Header
   protocol for ipv4 and ipv6. From Fan Du.

3) Make the IPsec flowcache namespace aware, from Fan Du.

4) Avoid creating temporary SA for every packet when no key manager is
   registered. From Horia Geanta.

5) Support filtering of SA dumps to show only the SAs that match a
   given filter. From Nicolas Dichtel.

6) Remove caching of xfrm_policy_sk_bundles. The cached socket policy bundles
   are never used, instead we create a new cache entry whenever xfrm_lookup()
   is called on a socket policy. Most protocols cache the used routes to the
   socket, so this caching is not needed.

7)  Fix a forgotten SADB_X_EXT_FILTER length check in pfkey, from Nicolas
    Dichtel.

8) Cleanup error handling of xfrm_state_clone.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 45 insertions, 11 deletions

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 81e496a2e008..6c5f0949e0ab 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -346,6 +346,10 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
         struct tmp_ext *iph_ext;
+        int seqhi_len = 0;
+        __be32 *seqhi;
+        int sglists = 0;
+        struct scatterlist *seqhisg;
 
         ahp = x->data;
         ahash = ahp->ahash;
@@ -359,15 +363,22 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         if (extlen)
                 extlen += sizeof(*iph_ext);
 
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists = 1;
+                seqhi_len = sizeof(*seqhi);
+        }
         err = -ENOMEM;
-        iph_base = ah_alloc_tmp(ahash, nfrags, IPV6HDR_BASELEN + extlen);
+        iph_base = ah_alloc_tmp(ahash, nfrags + sglists, IPV6HDR_BASELEN +
+                                extlen + seqhi_len);
         if (!iph_base)
                 goto out;
 
         iph_ext = ah_tmp_ext(iph_base);
-        icv = ah_tmp_icv(ahash, iph_ext, extlen);
+        seqhi = (__be32 *)((char *)iph_ext + extlen);
+        icv = ah_tmp_icv(ahash, seqhi, seqhi_len);
         req = ah_tmp_req(ahash, icv);
         sg = ah_req_sg(ahash, req);
+        seqhisg = sg + nfrags;
 
         ah = ip_auth_hdr(skb);
         memset(ah->auth_data, 0, ahp->icv_trunc_len);
@@ -411,10 +422,15 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
 
-        sg_init_table(sg, nfrags);
-        skb_to_sgvec(skb, sg, 0, skb->len);
+        sg_init_table(sg, nfrags + sglists);
+        skb_to_sgvec_nomark(skb, sg, 0, skb->len);
 
-        ahash_request_set_crypt(req, sg, icv, skb->len);
+        if (x->props.flags & XFRM_STATE_ESN) {
+                /* Attach seqhi sg right after packet payload */
+                *seqhi = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
+                sg_set_buf(seqhisg, seqhi, seqhi_len);
+        }
+        ahash_request_set_crypt(req, sg, icv, skb->len + seqhi_len);
         ahash_request_set_callback(req, 0, ah6_output_done, skb);
 
         AH_SKB_CB(skb)->tmp = iph_base;
@@ -514,6 +530,10 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         int nexthdr;
         int nfrags;
         int err = -ENOMEM;
+        int seqhi_len = 0;
+        __be32 *seqhi;
+        int sglists = 0;
+        struct scatterlist *seqhisg;
 
         if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
                 goto out;
@@ -550,14 +570,22 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_push(skb, hdr_len);
 
-        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists = 1;
+                seqhi_len = sizeof(*seqhi);
+        }
+
+        work_iph = ah_alloc_tmp(ahash, nfrags + sglists, hdr_len +
+                                ahp->icv_trunc_len + seqhi_len);
         if (!work_iph)
                 goto out;
 
-        auth_data = ah_tmp_auth(work_iph, hdr_len);
-        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        auth_data = ah_tmp_auth((u8 *)work_iph, hdr_len);
+        seqhi = (__be32 *)(auth_data + ahp->icv_trunc_len);
+        icv = ah_tmp_icv(ahash, seqhi, seqhi_len);
         req = ah_tmp_req(ahash, icv);
         sg = ah_req_sg(ahash, req);
+        seqhisg = sg + nfrags;
 
         memcpy(work_iph, ip6h, hdr_len);
         memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
@@ -572,10 +600,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         ip6h->flow_lbl[2] = 0;
         ip6h->hop_limit   = 0;
 
-        sg_init_table(sg, nfrags);
-        skb_to_sgvec(skb, sg, 0, skb->len);
+        sg_init_table(sg, nfrags + sglists);
+        skb_to_sgvec_nomark(skb, sg, 0, skb->len);
+
+        if (x->props.flags & XFRM_STATE_ESN) {
+                /* Attach seqhi sg right after packet payload */
+                *seqhi = XFRM_SKB_CB(skb)->seq.input.hi;
+                sg_set_buf(seqhisg, seqhi, seqhi_len);
+        }
 
-        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_crypt(req, sg, icv, skb->len + seqhi_len);
         ahash_request_set_callback(req, 0, ah6_input_done, skb);
 
         AH_SKB_CB(skb)->tmp = work_iph;