• Steffen Klassert's avatar
    xfrm: Add a state resolution packet queue · a0073fe1
    Steffen Klassert authored
    As the default, we blackhole packets until the key manager resolves
    the states. This patch implements a packet queue where IPsec packets
    are queued until the states are resolved. We generate a dummy xfrm
    bundle, the output routine of the returned route enqueues the packet
    to a per policy queue and arms a timer that checks for state resolution
    when dst_output() is called. Once the states are resolved, the packets
    are sent out of the queue. If the states are not resolved after some
    time, the queue is flushed.
    
    This patch keeps the defaut behaviour to blackhole packets as long
    as we have no states. To enable the packet queue the sysctl
    xfrm_larval_drop must be switched off.
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    a0073fe1
dst.h 11.4 KB