Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 399c180a authored by David S. Miller's avatar David S. Miller
Browse files

[IPSEC]: Perform SA switchover immediately. 



When we insert a new xfrm_state which potentially
subsumes an existing one, make sure all cached
bundles are flushed so that the new SA is used
immediately.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9e999993

include/net/xfrm.h

+1 −0
Original line number Diff line number Diff line
@@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 
extern void xfrm_policy_flush(void);

extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);

extern int xfrm_flush_bundles(void);

extern void xfrm_flush_all_bundles(void);

extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);

extern void xfrm_init_pmtu(struct dst_entry *dst);

net/xfrm/xfrm_policy.c

+14 −5
Original line number Diff line number Diff line
@@ -1014,13 +1014,12 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) 
}

EXPORT_SYMBOL(__xfrm_route_forward);



/* Optimize later using cookies and generation ids. */



static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)

{

	if (!stale_bundle(dst))

		return dst;



	/* If it is marked obsolete, which is how we even get here,

	 * then we have purged it from the policy bundle list and we

	 * did that for a good reason.

	 */

	return NULL;

}
@@ -1104,6 +1103,16 @@ int xfrm_flush_bundles(void) 
	return 0;

}



static int always_true(struct dst_entry *dst)

{

	return 1;

}



void xfrm_flush_all_bundles(void)

{

	xfrm_prune_bundles(always_true);

}



void xfrm_init_pmtu(struct dst_entry *dst)

{

	do {

net/xfrm/xfrm_state.c

+5 −0
Original line number Diff line number Diff line
@@ -431,6 +431,8 @@ void xfrm_state_insert(struct xfrm_state *x) 
	spin_lock_bh(&xfrm_state_lock);

	__xfrm_state_insert(x);

	spin_unlock_bh(&xfrm_state_lock);



	xfrm_flush_all_bundles();

}

EXPORT_SYMBOL(xfrm_state_insert);
@@ -478,6 +480,9 @@ out: 
	spin_unlock_bh(&xfrm_state_lock);

	xfrm_state_put_afinfo(afinfo);



	if (!err)

		xfrm_flush_all_bundles();



	if (x1) {

		xfrm_state_delete(x1);

		xfrm_state_put(x1);