- store the current patches for the kernel part somewhere

packaging/utils/nattpatch 2.6

--- /dev/null   Tue Mar 11 13:02:56 2003

+++ nat-t/include/net/xfrmudp.h     Mon Feb  9 13:51:03 2004

@@ -0,0 +1,10 @@

+/*

+ * pointer to function for type that xfrm4_input wants, to permit

+ * decoupling of XFRM from udp.c

+ */

+#define HAVE_XFRM4_UDP_REGISTER

+

+typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);

+extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func

+				      , xfrm4_rcv_encap_t *oldfunc);

+extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func);

--- /distros/kernel/linux-2.6.11.2/net/ipv4/Kconfig	2005-03-09 03:12:33.000000000 -0500

+++ swan26/net/ipv4/Kconfig	2005-04-04 18:46:13.000000000 -0400

@@ -351,2 +351,8 @@

+config IPSEC_NAT_TRAVERSAL

+	bool "IPSEC NAT-Traversal (KLIPS compatible)"

+	depends on INET

+	---help---

+          Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.

+

 config IP_TCPDIAG

--- plain26/net/ipv4/udp.c.orig	2006-01-02 22:21:10.000000000 -0500

+++ plain26/net/ipv4/udp.c	2006-01-10 20:07:21.000000000 -0500

@@ -108,11 +108,14 @@

 #include <net/checksum.h>

 #include <net/xfrm.h>

+#include <net/xfrmudp.h>

 #include "udp_impl.h"

 /*

  *	Snmp MIB for the UDP layer

  */

+static xfrm4_rcv_encap_t xfrm4_rcv_encap_func;

+

 DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly;

 struct hlist_head udp_hash[UDP_HTABLE_SIZE];

@@ -894,6 +897,42 @@

 	sk_common_release(sk);

 }

+#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)

+

+/* if XFRM isn't a module, then register it directly. */

+#if 0 && !defined(CONFIG_XFRM_MODULE) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)

+static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = xfrm4_rcv_encap;

+#else

+static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;

+#endif

+

+int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func

+			       , xfrm4_rcv_encap_t *oldfunc)

+{

+  if(oldfunc != NULL) {

+    *oldfunc = xfrm4_rcv_encap_func;

+  }

+

+#if 0

+  if(xfrm4_rcv_encap_func != NULL)

+    return -1;

+#endif

+

+  xfrm4_rcv_encap_func = func;

+  return 0;

+}

+

+int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func)

+{

+  if(xfrm4_rcv_encap_func != func)

+    return -1;

+

+  xfrm4_rcv_encap_func = NULL;

+  return 0;

+}

+#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */

+

+

 /* return:

  * 	1  if the the UDP system should process it

  *	0  if we should drop this packet

@@ -901,9 +940,9 @@

  */

 static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)

 {

-#ifndef CONFIG_XFRM

+#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)

 	return 1; 

-#else

+#else /* either CONFIG_XFRM or CONFIG_IPSEC_NAT_TRAVERSAL */

 	struct udp_sock *up = udp_sk(sk);

   	struct udphdr *uh = skb->h.uh;

 	struct iphdr *iph;

@@ -915,11 +954,11 @@

 	/* if we're overly short, let UDP handle it */

 	len = skb->len - sizeof(struct udphdr);

 	if (len <= 0)

-		return 1;

+		return 2;

 	/* if this is not encapsulated socket, then just return now */

 	if (!encap_type)

-		return 1;

+		return 3;

 	/* If this is a paged skb, make sure we pull up

 	 * whatever data we need to look at. */

@@ -934,7 +973,7 @@

 			len = sizeof(struct udphdr);

 		} else

 			/* Must be an IKE packet.. pass it through */

-			return 1;

+			return 4;

 		break;

 	case UDP_ENCAP_ESPINUDP_NON_IKE:

 		/* Check if this is a keepalive packet.  If so, eat it. */

@@ -947,7 +986,7 @@

 			len = sizeof(struct udphdr) + 2 * sizeof(u32);

 		} else

 			/* Must be an IKE packet.. pass it through */

-			return 1;

+			return 5;

 		break;

 	}

@@ -1021,10 +1060,14 @@

 			return 0;

 		}

 		if (ret < 0) {

-			/* process the ESP packet */

-			ret = xfrm4_rcv_encap(skb, up->encap_type);

-			UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);

-			return -ret;

+ 			if(xfrm4_rcv_encap_func != NULL) {

+ 			  ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);

+ 			  UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);

+ 			} else {

+ 			  UDP_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag);

+ 			  ret = 1;

+ 			}

+			return ret;

 		}

 		/* FALLTHROUGH -- it's a UDP Packet */

 	}

@@ -1571,3 +1613,9 @@

 EXPORT_SYMBOL(udp_proc_register);

 EXPORT_SYMBOL(udp_proc_unregister);

 #endif

+

+#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)

+EXPORT_SYMBOL(udp4_register_esp_rcvencap);

+EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);

+#endif

+

diff -rdup linux-2.6.20.oorig/include/openswan/ipsec_sa.h linux-2.6.20/include/openswan/ipsec_sa.h

--- linux-2.6.20.oorig/include/openswan/ipsec_sa.h	2007-02-15 12:30:41.000000000 +0100

+++ linux-2.6.20/include/openswan/ipsec_sa.h	2007-02-15 13:32:07.000000000 +0100

@@ -99,10 +99,10 @@ typedef unsigned short int IPsecRefTable

 #define IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)

 #ifdef CONFIG_NETFILTER

-#define IPSEC_SA_REF_HOST_FIELD(x) ((struct sk_buff*)(x))->nfmark

+#define IPSEC_SA_REF_HOST_FIELD(x) ((struct sk_buff*)(x))->mark

 #define IPSEC_SA_REF_HOST_FIELD_TYPE typeof(IPSEC_SA_REF_HOST_FIELD(NULL))

 #else /* CONFIG_NETFILTER */

-/* just make it work for now, it doesn't matter, since there is no nfmark */

+/* just make it work for now, it doesn't matter, since there is no mark */

 #define IPSEC_SA_REF_HOST_FIELD_TYPE unsigned long

 #endif /* CONFIG_NETFILTER */

 #define IPSEC_SA_REF_HOST_FIELD_WIDTH (8 * sizeof(IPSEC_SA_REF_HOST_FIELD_TYPE))

diff -rdup linux-2.6.20.oorig/net/ipsec/ipsec_rcv.c linux-2.6.20/net/ipsec/ipsec_rcv.c

--- linux-2.6.20.oorig/net/ipsec/ipsec_rcv.c	2007-02-15 12:30:41.000000000 +0100

+++ linux-2.6.20/net/ipsec/ipsec_rcv.c	2007-02-15 13:33:32.000000000 +0100

@@ -748,13 +748,13 @@ ipsec_rcv_decap_once(struct ipsec_rcv_st

 #ifdef CONFIG_NETFILTER

 	if(proto == IPPROTO_ESP || proto == IPPROTO_AH) {

-		skb->nfmark = (skb->nfmark & (~(IPsecSAref2NFmark(IPSEC_SA_REF_MASK))))

+		skb->mark = (skb->mark & (~(IPsecSAref2NFmark(IPSEC_SA_REF_MASK))))

 			| IPsecSAref2NFmark(IPsecSA2SAref(irs->ipsp));

 		KLIPS_PRINT(debug_rcv & DB_RX_PKTRX,

 			    "klips_debug:ipsec_rcv: "

-			    "%s SA sets skb->nfmark=0x%x.\n",

+			    "%s SA sets skb->mark=0x%x.\n",

 			    proto == IPPROTO_ESP ? "ESP" : "AH",

-			    (unsigned)skb->nfmark);

+			    (unsigned)skb->mark);

 	}

 #endif /* CONFIG_NETFILTER */

@@ -1102,12 +1102,12 @@ int ipsec_rcv_decap(struct ipsec_rcv_sta

 			goto rcvleave;

 		}

 #ifdef CONFIG_NETFILTER

-		skb->nfmark = (skb->nfmark & (~(IPsecSAref2NFmark(IPSEC_SA_REF_TABLE_MASK))))

+		skb->mark = (skb->mark & (~(IPsecSAref2NFmark(IPSEC_SA_REF_TABLE_MASK))))

 			| IPsecSAref2NFmark(IPsecSA2SAref(ipsp));

 		KLIPS_PRINT(debug_rcv & DB_RX_PKTRX,

 			    "klips_debug:ipsec_rcv: "

-			    "IPIP SA sets skb->nfmark=0x%x.\n",

-			    (unsigned)skb->nfmark);

+			    "IPIP SA sets skb->mark=0x%x.\n",

+			    (unsigned)skb->mark);

 #endif /* CONFIG_NETFILTER */

 	}

--- linux-2.6.20.oorig/net/ipsec/ipsec_alg_cryptoapi.c	2007-02-15 12:30:41.000000000 +0100

+++ linux-2.6.20/net/ipsec/ipsec_alg_cryptoapi.c	2007-02-15 13:47:07.000000000 +0100

@@ -197,7 +197,7 @@ static struct ipsec_alg_capi_cipher alg_

  */

 int setup_cipher(const char *ciphername)

 {

-	return crypto_alg_available(ciphername, 0);

+	return crypto_has_alg(ciphername, 0, CRYPTO_ALG_ASYNC);

 }

 /*

--- linux-2.6.20.oorig/net/ipsec/pfkey_v2.c	2007-02-15 12:30:41.000000000 +0100

+++ linux-2.6.20/net/ipsec/pfkey_v2.c	2007-02-15 13:37:22.000000000 +0100

@@ -1503,7 +1503,7 @@ pfkey_cleanup(void)

         printk(KERN_INFO "klips_info:pfkey_cleanup: "

 	       "shutting down PF_KEY domain sockets.\n");

-        error |= sock_unregister(PF_KEY);

+        sock_unregister(PF_KEY);

 	error |= supported_remove_all(SADB_SATYPE_AH);

 	error |= supported_remove_all(SADB_SATYPE_ESP);