Commit c1df7d80 authored by Natanael Copa's avatar Natanael Copa

main/linux-grsec: upgrade to 2.2.1-2.6.38.1-test2

parent a0b58819
From cc9ff19da9bf76a2f70bcb80225a1c587c162e52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Wed, 3 Nov 2010 04:41:38 +0000
Subject: [PATCH] xfrm: use gre key as flow upper protocol info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The GRE Key field is intended to be used for identifying an individual
traffic flow within a tunnel. It is useful to be able to have XFRM
policy selector matches to have different policies for different
GRE tunnels.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
include/net/flow.h | 2 ++
include/net/xfrm.h | 6 ++++++
net/ipv4/ip_gre.c | 12 +++++++-----
net/ipv4/xfrm4_policy.c | 15 +++++++++++++++
4 files changed, 30 insertions(+), 5 deletions(-)
diff --git a/include/net/flow.h b/include/net/flow.h
index 0ac3fb5..7196e68 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -67,6 +67,7 @@ struct flowi {
} dnports;
__be32 spi;
+ __be32 gre_key;
struct {
__u8 type;
@@ -78,6 +79,7 @@ struct flowi {
#define fl_icmp_code uli_u.icmpt.code
#define fl_ipsec_spi uli_u.spi
#define fl_mh_type uli_u.mht.type
+#define fl_gre_key uli_u.gre_key
__u32 secid; /* used by xfrm; see secid.txt */
} __attribute__((__aligned__(BITS_PER_LONG/8)));
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index bcfb6b2..54b2832 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -805,6 +805,9 @@ __be16 xfrm_flowi_sport(struct flowi *fl)
case IPPROTO_MH:
port = htons(fl->fl_mh_type);
break;
+ case IPPROTO_GRE:
+ port = htonl(fl->fl_gre_key) >> 16;
+ break;
default:
port = 0; /*XXX*/
}
@@ -826,6 +829,9 @@ __be16 xfrm_flowi_dport(struct flowi *fl)
case IPPROTO_ICMPV6:
port = htons(fl->fl_icmp_code);
break;
+ case IPPROTO_GRE:
+ port = htonl(fl->fl_gre_key) & 0xffff;
+ break;
default:
port = 0; /*XXX*/
}
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cab2057..aace653 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -779,9 +779,9 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
.tos = RT_TOS(tos)
}
},
- .proto = IPPROTO_GRE
- }
-;
+ .proto = IPPROTO_GRE,
+ .fl_gre_key = tunnel->parms.o_key
+ };
if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
dev->stats.tx_carrier_errors++;
goto tx_error;
@@ -958,7 +958,8 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
.tos = RT_TOS(iph->tos)
}
},
- .proto = IPPROTO_GRE
+ .proto = IPPROTO_GRE,
+ .fl_gre_key = tunnel->parms.o_key
};
struct rtable *rt;
@@ -1223,7 +1224,8 @@ static int ipgre_open(struct net_device *dev)
.tos = RT_TOS(t->parms.iph.tos)
}
},
- .proto = IPPROTO_GRE
+ .proto = IPPROTO_GRE,
+ .fl_gre_key = t->parms.o_key
};
struct rtable *rt;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index dd1fd8c..4a8c533 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -11,6 +11,7 @@
#include <linux/err.h>
#include <linux/kernel.h>
#include <linux/inetdevice.h>
+#include <linux/if_tunnel.h>
#include <net/dst.h>
#include <net/xfrm.h>
#include <net/ip.h>
@@ -154,6 +155,20 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
}
break;
+
+ case IPPROTO_GRE:
+ if (pskb_may_pull(skb, xprth + 12 - skb->data)) {
+ __be16 *greflags = (__be16 *)xprth;
+ __be32 *gre_hdr = (__be32 *)xprth;
+
+ if (greflags[0] & GRE_KEY) {
+ if (greflags[0] & GRE_CSUM)
+ gre_hdr++;
+ fl->fl_gre_key = gre_hdr[1];
+ }
+ }
+ break;
+
default:
fl->fl_ipsec_spi = 0;
break;
--
1.7.4.1
......@@ -2,8 +2,8 @@
_flavor=grsec
pkgname=linux-${_flavor}
pkgver=2.6.37.4
_kernver=2.6.37
pkgver=2.6.38.1
_kernver=2.6.38
pkgrel=1
pkgdesc="Linux kernel with grsecurity"
url=http://grsecurity.net
......@@ -14,10 +14,8 @@ _config=${config:-kernelconfig.${CARCH}}
install=
source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
grsecurity-2.2.1-2.6.37.4-201103211735.patch
grsec-2.2.1-2.6.38.1-test2.patch
0001-xfrm-use-gre-key-as-flow-upper-protocol-info.patch
xfrm-fix-gre-key-endianess.patch
0004-arp-flush-arp-cache-on-device-change.patch
kernelconfig.x86
......@@ -137,11 +135,9 @@ dev() {
"$subpkgdir"/lib/modules/${_abi_release}/build
}
md5sums="c8ee37b4fdccdb651e0603d35350b434 linux-2.6.37.tar.bz2
5e5ad9a86f9a29cd2c1b8a171d89f9aa patch-2.6.37.4.bz2
c899986fc86ab17b6a1ffb34be54bfe5 grsecurity-2.2.1-2.6.37.4-201103211735.patch
3152851c31bfa8c54660dbb84d75b38d 0001-xfrm-use-gre-key-as-flow-upper-protocol-info.patch
ea7a7eb2775b71ae5ef24d029a4905bd xfrm-fix-gre-key-endianess.patch
md5sums="7d471477bfa67546f902da62227fa976 linux-2.6.38.tar.bz2
bd2be4d0465345e4e9355d6773f5f6fe patch-2.6.38.1.bz2
684cd563504e2fc24de28eccb333d2c9 grsec-2.2.1-2.6.38.1-test2.patch
776adeeb5272093574f8836c5037dd7d 0004-arp-flush-arp-cache-on-device-change.patch
b656125e88071f44be887e8b91f74aa7 kernelconfig.x86
7c928ec82f2a4845be52d5dd12c97a8c kernelconfig.x86_64"
697e8f0b6569195f9f43f40f30bedf07 kernelconfig.x86
015190bc0022b1f9aad42a7cc2d5625a kernelconfig.x86_64"
This diff is collapsed.
This diff is collapsed.
From aa285b1740f5b13e5a2606a927f3129954583d78 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Tue, 23 Nov 2010 04:03:45 +0000
Subject: [PATCH] xfrm: fix gre key endianess
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit
fl->fl_gre_key is network byte order contrary to fl->fl_icmp_*.
Make xfrm_flowi_{s|d}port return network byte order values for gre
key too.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
include/net/xfrm.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 54b2832..7fa5b00 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -806,7 +806,7 @@ __be16 xfrm_flowi_sport(struct flowi *fl)
port = htons(fl->fl_mh_type);
break;
case IPPROTO_GRE:
- port = htonl(fl->fl_gre_key) >> 16;
+ port = htons(ntohl(fl->fl_gre_key) >> 16);
break;
default:
port = 0; /*XXX*/
@@ -830,7 +830,7 @@ __be16 xfrm_flowi_dport(struct flowi *fl)
port = htons(fl->fl_icmp_code);
break;
case IPPROTO_GRE:
- port = htonl(fl->fl_gre_key) & 0xffff;
+ port = htons(ntohl(fl->fl_gre_key) & 0xffff);
break;
default:
port = 0; /*XXX*/
--
1.7.3.2
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment