diff -Naur linux-2.6.16.54-0.2.5/include/net/xfrmudp.h linux-2.6.16.54-0.2.5.osw2.5.60s/include/net/xfrmudp.h --- linux-2.6.16.54-0.2.5/include/net/xfrmudp.h 1969-12-31 19:00:00.000000000 -0500 +++ linux-2.6.16.54-0.2.5.osw2.5.60s/include/net/xfrmudp.h 2008-07-03 00:48:48.000000000 -0400 @@ -0,0 +1,10 @@ +/* + * pointer to function for type that xfrm4_input wants, to permit + * decoupling of XFRM from udp.c + */ +#define HAVE_XFRM4_UDP_REGISTER + +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type); +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func + , xfrm4_rcv_encap_t *oldfunc); +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func); diff -Naur linux-2.6.16.54-0.2.5/net/ipv4/Kconfig linux-2.6.16.54-0.2.5.osw2.5.60s/net/ipv4/Kconfig --- linux-2.6.16.54-0.2.5/net/ipv4/Kconfig 2008-06-04 23:44:38.000000000 -0400 +++ linux-2.6.16.54-0.2.5.osw2.5.60s/net/ipv4/Kconfig 2008-07-03 00:48:48.000000000 -0400 @@ -367,6 +367,12 @@ If unsure, say N. +config IPSEC_NAT_TRAVERSAL + bool "IPSEC NAT-Traversal (KLIPS compatible)" + depends on INET + ---help--- + Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP. + config INET_AH tristate "IP: AH transformation" select XFRM diff -Naur linux-2.6.16.54-0.2.5/net/ipv4/af_inet.c linux-2.6.16.54-0.2.5.osw2.5.60s/net/ipv4/af_inet.c --- linux-2.6.16.54-0.2.5/net/ipv4/af_inet.c 2008-06-04 23:44:47.000000000 -0400 +++ linux-2.6.16.54-0.2.5.osw2.5.60s/net/ipv4/af_inet.c 2008-07-03 00:49:29.000000000 -0400 @@ -1309,6 +1309,18 @@ #if defined(CONFIG_IP_MROUTE) ip_mr_init(); #endif + +#if defined(CONFIG_KLIPS) + { + extern int ipsec_klips_init(void); + /* + * Initialise AF_INET ESP and AH protocol support including + * e-routing and SA tables + */ + ipsec_klips_init(); + } +#endif /* CONFIG_IPSEC */ + /* * Initialise per-cpu ipv4 mibs */ diff -Naur linux-2.6.16.54-0.2.5/net/ipv4/udp.c linux-2.6.16.54-0.2.5.osw2.5.60s/net/ipv4/udp.c --- linux-2.6.16.54-0.2.5/net/ipv4/udp.c 2008-06-04 23:44:38.000000000 -0400 +++ linux-2.6.16.54-0.2.5.osw2.5.60s/net/ipv4/udp.c 2008-07-03 00:48:52.000000000 -0400 @@ -109,11 +109,14 @@ #include #include #include +#include /* * Snmp MIB for the UDP layer */ +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func; + DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly; struct hlist_head udp_hash[UDP_HTABLE_SIZE]; @@ -882,6 +891,42 @@ sk_common_release(sk); } +#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL) + +/* if XFRM isn't a module, then register it directly. */ +#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL) +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap; +#else +static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL; +#endif + +int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func + , xfrm4_rcv_encap_t *oldfunc) +{ + if(oldfunc != NULL) { + *oldfunc = xfrm4_rcv_encap_func; + } + +#if 0 + if(xfrm4_rcv_encap_func != NULL) + return -1; +#endif + + xfrm4_rcv_encap_func = func; + return 0; +} + +int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func) +{ + if(xfrm4_rcv_encap_func != func) + return -1; + + xfrm4_rcv_encap_func = NULL; + return 0; +} +#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */ + + /* return: * 1 if the the UDP system should process it * 0 if we should drop this packet @@ -889,9 +934,9 @@ */ static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb) { -#ifndef CONFIG_XFRM +#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL) return 1; -#else +#else /* either CONFIG_XFRM or CONFIG_IPSEC_NAT_TRAVERSAL */ struct udp_sock *up = udp_sk(sk); struct udphdr *uh; struct iphdr *iph; @@ -1019,9 +1064,13 @@ return 0; } if (ret < 0) { - /* process the ESP packet */ - ret = xfrm4_rcv_encap(skb, up->encap_type); - UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS); + if(xfrm4_rcv_encap_func != NULL) { + ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type); + UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS); + } else { + UDP_INC_STATS_BH(UDP_MIB_INERRORS); + ret = 1; + } return -ret; } /* FALLTHROUGH -- it's a UDP Packet */ @@ -1569,3 +1618,9 @@ EXPORT_SYMBOL(udp_proc_register); EXPORT_SYMBOL(udp_proc_unregister); #endif + +#if defined(CONFIG_IPSEC_NAT_TRAVERSAL) +EXPORT_SYMBOL(udp4_register_esp_rcvencap); +EXPORT_SYMBOL(udp4_unregister_esp_rcvencap); +#endif + diff -Naur linux-2.6.16.54-0.2.5/net/xfrmudp.h linux-2.6.16.54-0.2.5.osw2.5.60s/net/xfrmudp.h --- linux-2.6.16.54-0.2.5/net/xfrmudp.h 1969-12-31 19:00:00.000000000 -0500 +++ linux-2.6.16.54-0.2.5.osw2.5.60s/net/xfrmudp.h 2008-07-03 00:48:48.000000000 -0400 @@ -0,0 +1,10 @@ +/* + * pointer to function for type that xfrm4_input wants, to permit + * decoupling of XFRM from udp.c + */ +#define HAVE_XFRM4_UDP_REGISTER + +typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type); +extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func + , xfrm4_rcv_encap_t *oldfunc); +extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);