1. 02 May, 2024 1 commit
    • Steffen Klassert's avatar
      Merge remote branch 'xfrm: Introduce direction attribute for SA' · dcf280ea
      Steffen Klassert authored
      Antony Antony says:
      
      ====================
      Inspired by the upcoming IP-TFS patch set, and confusions experienced in
      the past due to lack of direction attribute on SAs, add a new direction
      "dir" attribute. It aims to streamline the SA configuration process and
      enhance the clarity of existing SA attributes.
      
      This patch set introduces the 'dir' attribute to SA, aka xfrm_state,
      ('in' for input or 'out' for output). Alsp add validations of existing
      direction-specific SA attributes during configuration and in the data
      path lookup.
      
      This change would not affect any existing use case or way of configuring
      SA. You will notice improvements when the new 'dir' attribute is set.
      ====================
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      dcf280ea
  2. 01 May, 2024 4 commits
  3. 18 Apr, 2024 1 commit
    • Antony Antony's avatar
      udpencap: Remove Obsolete UDP_ENCAP_ESPINUDP_NON_IKE Support · aeb48a42
      Antony Antony authored
      The UDP_ENCAP_ESPINUDP_NON_IKE mode, introduced into the Linux kernel
      in 2004 [2], has remained inactive and obsolete for an extended period.
      
      This mode was originally defined in an early version of an IETF draft
      [1] from 2001. By the time it was integrated into the kernel in 2004 [2],
      it had already been replaced by UDP_ENCAP_ESPINUDP [3] in later
      versions of draft-ietf-ipsec-udp-encaps, particularly in version 06.
      
      Over time, UDP_ENCAP_ESPINUDP_NON_IKE has lost its relevance, with no
      known use cases.
      
      With this commit, we remove support for UDP_ENCAP_ESPINUDP_NON_IKE,
      simplifying the codebase and eliminating unnecessary complexity.
      Kernel will return an error -ENOPROTOOPT if the userspace tries to set
      this option.
      
      References:
      [1] https://datatracker.ietf.org/doc/html/draft-ietf-ipsec-udp-encaps-00.txt
      
      [2] Commit that added UDP_ENCAP_ESPINUDP_NON_IKE to the Linux historic
          repository.
      
          Author: Andreas Gruenbacher <agruen@suse.de>
          Date: Fri Apr 9 01:47:47 2004 -0700
      
         [IPSEC]: Support draft-ietf-ipsec-udp-encaps-00/01, some ipec impls need it.
      
      [3] Commit that added UDP_ENCAP_ESPINUDP to the Linux historic
          repository.
      
          Author: Derek Atkins <derek@ihtfp.com>
          Date: Wed Apr 2 13:21:02 2003 -0800
      
          [IPSEC]: Implement UDP Encapsulation framework.
      Signed-off-by: default avatarAntony Antony <antony.antony@secunet.com>
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      aeb48a42
  4. 06 Apr, 2024 29 commits
  5. 05 Apr, 2024 5 commits