| Message ID | cover.1561457281.git.sd@queasysnail.net |
|---|---|
| Headers | show |
| Series | ipsec: add TCP encapsulation support (RFC 8229) | expand |
Hi Steffen, 2019-06-25, 12:11:33 +0200, Sabrina Dubroca wrote: > This patchset introduces support for TCP encapsulation of IKE and ESP > messages, as defined by RFC 8229 [0]. It is an evolution of what > Herbert Xu proposed in January 2018 [1] that addresses the main > criticism against it, by not interfering with the TCP implementation > at all. The networking stack now has infrastructure for this: TCP ULPs > and Stream Parsers. Have you had a chance to look at this? I was going to rebase and resend, but the patches still apply to ipsec-next and net-next (patch 2 is already in net-next as commit bd95e678e0f6). Thanks,
On Fri, Aug 16, 2019 at 04:18:14PM +0200, Sabrina Dubroca wrote: > Hi Steffen, > > 2019-06-25, 12:11:33 +0200, Sabrina Dubroca wrote: > > This patchset introduces support for TCP encapsulation of IKE and ESP > > messages, as defined by RFC 8229 [0]. It is an evolution of what > > Herbert Xu proposed in January 2018 [1] that addresses the main > > criticism against it, by not interfering with the TCP implementation > > at all. The networking stack now has infrastructure for this: TCP ULPs > > and Stream Parsers. > > Have you had a chance to look at this? I was going to rebase and > resend, but the patches still apply to ipsec-next and net-next (patch > 2 is already in net-next as commit bd95e678e0f6). I had a look and I have no general objection against this. If you think the patchset is ready for inclusion, just remove the RFC and resend it. I'll have a closer on it look then.
2019-08-21, 08:59:11 +0200, Steffen Klassert wrote: > On Fri, Aug 16, 2019 at 04:18:14PM +0200, Sabrina Dubroca wrote: > > Hi Steffen, > > > > 2019-06-25, 12:11:33 +0200, Sabrina Dubroca wrote: > > > This patchset introduces support for TCP encapsulation of IKE and ESP > > > messages, as defined by RFC 8229 [0]. It is an evolution of what > > > Herbert Xu proposed in January 2018 [1] that addresses the main > > > criticism against it, by not interfering with the TCP implementation > > > at all. The networking stack now has infrastructure for this: TCP ULPs > > > and Stream Parsers. > > > > Have you had a chance to look at this? I was going to rebase and > > resend, but the patches still apply to ipsec-next and net-next (patch > > 2 is already in net-next as commit bd95e678e0f6). > > I had a look and I have no general objection against this. If you > think the patchset is ready for inclusion, just remove the RFC and > resend it. I'll have a closer on it look then. Ok, thanks, I'll repost.
This patchset introduces support for TCP encapsulation of IKE and ESP messages, as defined by RFC 8229 [0]. It is an evolution of what Herbert Xu proposed in January 2018 [1] that addresses the main criticism against it, by not interfering with the TCP implementation at all. The networking stack now has infrastructure for this: TCP ULPs and Stream Parsers. The first patches are preparation and refactoring, and the final patch adds the feature. The main omission in this submission is IPv6 support. ESP encapsulation over UDP with IPv6 is currently not supported in the kernel either, as UDP encapsulation is aimed at NAT traversal, and NAT is not frequently used with IPv6. Some of the code is taken directly, or slightly modified, from Herbert Xu's original submission [1]. The ULP and strparser pieces are new. This work was presented and discussed at the IPsec workshop and netdev 0x13 conference [2] in Prague, last March. [0] https://tools.ietf.org/html/rfc8229 [1] https://patchwork.ozlabs.org/patch/859107/ [2] https://netdevconf.org/0x13/session.html?talk-ipsec-encap Herbert Xu (1): skbuff: Avoid sleeping in skb_send_sock_locked Sabrina Dubroca (6): net: add queue argument to __skb_wait_for_more_packets and __skb_{,try_}recv_datagram xfrm: introduce xfrm_trans_queue_net xfrm: add route lookup to xfrm4_rcv_encap esp4: prepare esp_input_done2 for non-UDP encapsulation esp4: split esp_output_udp_encap and introduce esp_output_encap xfrm: add espintcp (RFC 8229) include/linux/skbuff.h | 11 +- include/net/espintcp.h | 38 +++ include/net/xfrm.h | 4 + include/uapi/linux/udp.h | 1 + net/core/datagram.c | 26 +- net/core/skbuff.c | 1 + net/ipv4/esp4.c | 262 ++++++++++++++++++-- net/ipv4/udp.c | 3 +- net/ipv4/xfrm4_protocol.c | 9 + net/unix/af_unix.c | 7 +- net/xfrm/Kconfig | 9 + net/xfrm/Makefile | 1 + net/xfrm/espintcp.c | 505 ++++++++++++++++++++++++++++++++++++++ net/xfrm/xfrm_input.c | 21 +- net/xfrm/xfrm_policy.c | 7 + net/xfrm/xfrm_state.c | 3 + 16 files changed, 862 insertions(+), 46 deletions(-) create mode 100644 include/net/espintcp.h create mode 100644 net/xfrm/espintcp.c