diff options
| author |   David Lebrun <david.lebrun@uclouvain.be> | 2016-11-08 14:57:42 +0100 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2016-11-09 20:40:06 -0500 |
| commit | bf355b8d2c30a289232042cacc1cfaea4923936c (patch) | |
| tree | e7f1a5472ac6ac4c5b6c46ff4fe54d9bb9c4ab0f /net/ipv6/Makefile | |
| parent | ipv6: sr: add support for SRH encapsulation and injection with lwtunnels (diff) | |
| download | linux-dev-bf355b8d2c30a289232042cacc1cfaea4923936c.tar.xz linux-dev-bf355b8d2c30a289232042cacc1cfaea4923936c.zip | |
ipv6: sr: add core files for SR HMAC support
This patch adds the necessary functions to compute and check the HMAC signature
of an SR-enabled packet. Two HMAC algorithms are supported: hmac(sha1) and
hmac(sha256).
In order to avoid dynamic memory allocation for each HMAC computation,
a per-cpu ring buffer is allocated for this purpose.
A new per-interface sysctl called seg6_require_hmac is added, allowing a
user-defined policy for processing HMAC-signed SR-enabled packets.
A value of -1 means that the HMAC field will always be ignored.
A value of 0 means that if an HMAC field is present, its validity will
be enforced (the packet is dropped is the signature is incorrect).
Finally, a value of 1 means that any SR-enabled packet that does not
contain an HMAC signature or whose signature is incorrect will be dropped.
Signed-off-by: David Lebrun <david.lebrun@uclouvain.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/Makefile')
| -rw-r--r-- | net/ipv6/Makefile | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile index 59ee92fb3689..129cad2ba960 100644 --- a/net/ipv6/Makefile +++ b/net/ipv6/Makefile @@ -44,6 +44,7 @@ obj-$(CONFIG_IPV6_SIT) += sit.o obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o obj-$(CONFIG_IPV6_GRE) += ip6_gre.o obj-$(CONFIG_IPV6_FOU) += fou6.o +obj-$(CONFIG_IPV6_SEG6_HMAC) += seg6_hmac.o obj-y += addrconf_core.o exthdrs_core.o ip6_checksum.o ip6_icmp.o obj-$(CONFIG_INET) += output_core.o protocol.o $(ipv6-offload) |