Commit e0376d00 authored by David S. Miller's avatar David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

Steffen Klassert says:

====================
1) Remove a duplicated call to skb_orphan() in pf_key, from Cong Wang.

2) Prepare xfrm and pf_key for algorithms without pf_key support,
   from Jussi Kivilinna.

3) Fix an unbalanced lock in xfrm_output_one(), from Li RongQing.

4) Add an IPsec state resolution packet queue to handle
   packets that are send before the states are resolved.

5) xfrm4_policy_fini() is unused since 2.6.11, time to remove it.
   From Michal Kubecek.

6) The xfrm gc threshold was configurable just in the initial
   namespace, make it configurable in all namespaces. From
   Michal Kubecek.

7) We currently can not insert policies with mark and mask
   such that some flows would be matched from both policies.
   Allow this if the priorities of these policies are different,
   the one with the higher priority is used in this case.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 15004cab 7cb8a939
...@@ -61,6 +61,7 @@ struct dst_entry { ...@@ -61,6 +61,7 @@ struct dst_entry {
#define DST_NOPEER 0x0040 #define DST_NOPEER 0x0040
#define DST_FAKE_RTABLE 0x0080 #define DST_FAKE_RTABLE 0x0080
#define DST_XFRM_TUNNEL 0x0100 #define DST_XFRM_TUNNEL 0x0100
#define DST_XFRM_QUEUE 0x0200
unsigned short pending_confirm; unsigned short pending_confirm;
......
...@@ -22,6 +22,7 @@ struct netns_ipv4 { ...@@ -22,6 +22,7 @@ struct netns_ipv4 {
struct ctl_table_header *frags_hdr; struct ctl_table_header *frags_hdr;
struct ctl_table_header *ipv4_hdr; struct ctl_table_header *ipv4_hdr;
struct ctl_table_header *route_hdr; struct ctl_table_header *route_hdr;
struct ctl_table_header *xfrm4_hdr;
#endif #endif
struct ipv4_devconf *devconf_all; struct ipv4_devconf *devconf_all;
struct ipv4_devconf *devconf_dflt; struct ipv4_devconf *devconf_dflt;
......
...@@ -16,6 +16,7 @@ struct netns_sysctl_ipv6 { ...@@ -16,6 +16,7 @@ struct netns_sysctl_ipv6 {
struct ctl_table_header *route_hdr; struct ctl_table_header *route_hdr;
struct ctl_table_header *icmp_hdr; struct ctl_table_header *icmp_hdr;
struct ctl_table_header *frags_hdr; struct ctl_table_header *frags_hdr;
struct ctl_table_header *xfrm6_hdr;
#endif #endif
int bindv6only; int bindv6only;
int flush_delay; int flush_delay;
......
...@@ -501,6 +501,12 @@ struct xfrm_policy_walk { ...@@ -501,6 +501,12 @@ struct xfrm_policy_walk {
u32 seq; u32 seq;
}; };
struct xfrm_policy_queue {
struct sk_buff_head hold_queue;
struct timer_list hold_timer;
unsigned long timeout;
};
struct xfrm_policy { struct xfrm_policy {
#ifdef CONFIG_NET_NS #ifdef CONFIG_NET_NS
struct net *xp_net; struct net *xp_net;
...@@ -522,6 +528,7 @@ struct xfrm_policy { ...@@ -522,6 +528,7 @@ struct xfrm_policy {
struct xfrm_lifetime_cfg lft; struct xfrm_lifetime_cfg lft;
struct xfrm_lifetime_cur curlft; struct xfrm_lifetime_cur curlft;
struct xfrm_policy_walk_entry walk; struct xfrm_policy_walk_entry walk;
struct xfrm_policy_queue polq;
u8 type; u8 type;
u8 action; u8 action;
u8 flags; u8 flags;
...@@ -1320,6 +1327,7 @@ struct xfrm_algo_desc { ...@@ -1320,6 +1327,7 @@ struct xfrm_algo_desc {
char *name; char *name;
char *compat; char *compat;
u8 available:1; u8 available:1;
u8 pfkey_supported:1;
union { union {
struct xfrm_algo_aead_info aead; struct xfrm_algo_aead_info aead;
struct xfrm_algo_auth_info auth; struct xfrm_algo_auth_info auth;
...@@ -1561,8 +1569,8 @@ extern void xfrm_input_init(void); ...@@ -1561,8 +1569,8 @@ extern void xfrm_input_init(void);
extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
extern void xfrm_probe_algs(void); extern void xfrm_probe_algs(void);
extern int xfrm_count_auth_supported(void); extern int xfrm_count_pfkey_auth_supported(void);
extern int xfrm_count_enc_supported(void); extern int xfrm_count_pfkey_enc_supported(void);
extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
......
...@@ -262,21 +262,56 @@ static struct ctl_table xfrm4_policy_table[] = { ...@@ -262,21 +262,56 @@ static struct ctl_table xfrm4_policy_table[] = {
{ } { }
}; };
static struct ctl_table_header *sysctl_hdr; static int __net_init xfrm4_net_init(struct net *net)
#endif
static void __init xfrm4_policy_init(void)
{ {
xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); struct ctl_table *table;
struct ctl_table_header *hdr;
table = xfrm4_policy_table;
if (!net_eq(net, &init_net)) {
table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL);
if (!table)
goto err_alloc;
table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh;
}
hdr = register_net_sysctl(net, "net/ipv4", table);
if (!hdr)
goto err_reg;
net->ipv4.xfrm4_hdr = hdr;
return 0;
err_reg:
if (!net_eq(net, &init_net))
kfree(table);
err_alloc:
return -ENOMEM;
} }
static void __exit xfrm4_policy_fini(void) static void __net_exit xfrm4_net_exit(struct net *net)
{ {
#ifdef CONFIG_SYSCTL struct ctl_table *table;
if (sysctl_hdr)
unregister_net_sysctl_table(sysctl_hdr); if (net->ipv4.xfrm4_hdr == NULL)
return;
table = net->ipv4.xfrm4_hdr->ctl_table_arg;
unregister_net_sysctl_table(net->ipv4.xfrm4_hdr);
if (!net_eq(net, &init_net))
kfree(table);
}
static struct pernet_operations __net_initdata xfrm4_net_ops = {
.init = xfrm4_net_init,
.exit = xfrm4_net_exit,
};
#endif #endif
xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
static void __init xfrm4_policy_init(void)
{
xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
} }
void __init xfrm4_init(void) void __init xfrm4_init(void)
...@@ -286,8 +321,7 @@ void __init xfrm4_init(void) ...@@ -286,8 +321,7 @@ void __init xfrm4_init(void)
xfrm4_state_init(); xfrm4_state_init();
xfrm4_policy_init(); xfrm4_policy_init();
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
sysctl_hdr = register_net_sysctl(&init_net, "net/ipv4", register_pernet_subsys(&xfrm4_net_ops);
xfrm4_policy_table);
#endif #endif
} }
...@@ -320,7 +320,51 @@ static struct ctl_table xfrm6_policy_table[] = { ...@@ -320,7 +320,51 @@ static struct ctl_table xfrm6_policy_table[] = {
{ } { }
}; };
static struct ctl_table_header *sysctl_hdr; static int __net_init xfrm6_net_init(struct net *net)
{
struct ctl_table *table;
struct ctl_table_header *hdr;
table = xfrm6_policy_table;
if (!net_eq(net, &init_net)) {
table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
if (!table)
goto err_alloc;
table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
}
hdr = register_net_sysctl(net, "net/ipv6", table);
if (!hdr)
goto err_reg;
net->ipv6.sysctl.xfrm6_hdr = hdr;
return 0;
err_reg:
if (!net_eq(net, &init_net))
kfree(table);
err_alloc:
return -ENOMEM;
}
static void __net_exit xfrm6_net_exit(struct net *net)
{
struct ctl_table *table;
if (net->ipv6.sysctl.xfrm6_hdr == NULL)
return;
table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
if (!net_eq(net, &init_net))
kfree(table);
}
static struct pernet_operations xfrm6_net_ops = {
.init = xfrm6_net_init,
.exit = xfrm6_net_exit,
};
#endif #endif
int __init xfrm6_init(void) int __init xfrm6_init(void)
...@@ -339,8 +383,7 @@ int __init xfrm6_init(void) ...@@ -339,8 +383,7 @@ int __init xfrm6_init(void)
goto out_policy; goto out_policy;
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
sysctl_hdr = register_net_sysctl(&init_net, "net/ipv6", register_pernet_subsys(&xfrm6_net_ops);
xfrm6_policy_table);
#endif #endif
out: out:
return ret; return ret;
...@@ -352,8 +395,7 @@ int __init xfrm6_init(void) ...@@ -352,8 +395,7 @@ int __init xfrm6_init(void)
void xfrm6_fini(void) void xfrm6_fini(void)
{ {
#ifdef CONFIG_SYSCTL #ifdef CONFIG_SYSCTL
if (sysctl_hdr) unregister_pernet_subsys(&xfrm6_net_ops);
unregister_net_sysctl_table(sysctl_hdr);
#endif #endif
xfrm6_policy_fini(); xfrm6_policy_fini();
xfrm6_state_fini(); xfrm6_state_fini();
......
...@@ -203,7 +203,6 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, ...@@ -203,7 +203,6 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
} }
if (*skb2 != NULL) { if (*skb2 != NULL) {
if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) { if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
skb_orphan(*skb2);
skb_set_owner_r(*skb2, sk); skb_set_owner_r(*skb2, sk);
skb_queue_tail(&sk->sk_receive_queue, *skb2); skb_queue_tail(&sk->sk_receive_queue, *skb2);
sk->sk_data_ready(sk, (*skb2)->len); sk->sk_data_ready(sk, (*skb2)->len);
...@@ -816,18 +815,21 @@ static struct sk_buff *__pfkey_xfrm_state2msg(const struct xfrm_state *x, ...@@ -816,18 +815,21 @@ static struct sk_buff *__pfkey_xfrm_state2msg(const struct xfrm_state *x,
sa->sadb_sa_auth = 0; sa->sadb_sa_auth = 0;
if (x->aalg) { if (x->aalg) {
struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0); struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
sa->sadb_sa_auth = a ? a->desc.sadb_alg_id : 0; sa->sadb_sa_auth = (a && a->pfkey_supported) ?
a->desc.sadb_alg_id : 0;
} }
sa->sadb_sa_encrypt = 0; sa->sadb_sa_encrypt = 0;
BUG_ON(x->ealg && x->calg); BUG_ON(x->ealg && x->calg);
if (x->ealg) { if (x->ealg) {
struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0); struct xfrm_algo_desc *a = xfrm_ealg_get_byname(x->ealg->alg_name, 0);
sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
a->desc.sadb_alg_id : 0;
} }
/* KAME compatible: sadb_sa_encrypt is overloaded with calg id */ /* KAME compatible: sadb_sa_encrypt is overloaded with calg id */
if (x->calg) { if (x->calg) {
struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0); struct xfrm_algo_desc *a = xfrm_calg_get_byname(x->calg->alg_name, 0);
sa->sadb_sa_encrypt = a ? a->desc.sadb_alg_id : 0; sa->sadb_sa_encrypt = (a && a->pfkey_supported) ?
a->desc.sadb_alg_id : 0;
} }
sa->sadb_sa_flags = 0; sa->sadb_sa_flags = 0;
...@@ -1138,7 +1140,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, ...@@ -1138,7 +1140,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
if (sa->sadb_sa_auth) { if (sa->sadb_sa_auth) {
int keysize = 0; int keysize = 0;
struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth); struct xfrm_algo_desc *a = xfrm_aalg_get_byid(sa->sadb_sa_auth);
if (!a) { if (!a || !a->pfkey_supported) {
err = -ENOSYS; err = -ENOSYS;
goto out; goto out;
} }
...@@ -1160,7 +1162,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, ...@@ -1160,7 +1162,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
if (sa->sadb_sa_encrypt) { if (sa->sadb_sa_encrypt) {
if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) { if (hdr->sadb_msg_satype == SADB_X_SATYPE_IPCOMP) {
struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt); struct xfrm_algo_desc *a = xfrm_calg_get_byid(sa->sadb_sa_encrypt);
if (!a) { if (!a || !a->pfkey_supported) {
err = -ENOSYS; err = -ENOSYS;
goto out; goto out;
} }
...@@ -1172,7 +1174,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, ...@@ -1172,7 +1174,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
} else { } else {
int keysize = 0; int keysize = 0;
struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt); struct xfrm_algo_desc *a = xfrm_ealg_get_byid(sa->sadb_sa_encrypt);
if (!a) { if (!a || !a->pfkey_supported) {
err = -ENOSYS; err = -ENOSYS;
goto out; goto out;
} }
...@@ -1578,13 +1580,13 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig, ...@@ -1578,13 +1580,13 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
struct sadb_msg *hdr; struct sadb_msg *hdr;
int len, auth_len, enc_len, i; int len, auth_len, enc_len, i;
auth_len = xfrm_count_auth_supported(); auth_len = xfrm_count_pfkey_auth_supported();
if (auth_len) { if (auth_len) {
auth_len *= sizeof(struct sadb_alg); auth_len *= sizeof(struct sadb_alg);
auth_len += sizeof(struct sadb_supported); auth_len += sizeof(struct sadb_supported);
} }
enc_len = xfrm_count_enc_supported(); enc_len = xfrm_count_pfkey_enc_supported();
if (enc_len) { if (enc_len) {
enc_len *= sizeof(struct sadb_alg); enc_len *= sizeof(struct sadb_alg);
enc_len += sizeof(struct sadb_supported); enc_len += sizeof(struct sadb_supported);
...@@ -1615,6 +1617,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig, ...@@ -1615,6 +1617,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
if (!aalg) if (!aalg)
break; break;
if (!aalg->pfkey_supported)
continue;
if (aalg->available) if (aalg->available)
*ap++ = aalg->desc; *ap++ = aalg->desc;
} }
...@@ -1634,6 +1638,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig, ...@@ -1634,6 +1638,8 @@ static struct sk_buff *compose_sadb_supported(const struct sadb_msg *orig,
struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i); struct xfrm_algo_desc *ealg = xfrm_ealg_get_byidx(i);
if (!ealg) if (!ealg)
break; break;
if (!ealg->pfkey_supported)
continue;
if (ealg->available) if (ealg->available)
*ap++ = ealg->desc; *ap++ = ealg->desc;
} }
...@@ -2825,6 +2831,8 @@ static int count_ah_combs(const struct xfrm_tmpl *t) ...@@ -2825,6 +2831,8 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i); const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(i);
if (!aalg) if (!aalg)
break; break;
if (!aalg->pfkey_supported)
continue;
if (aalg_tmpl_set(t, aalg) && aalg->available) if (aalg_tmpl_set(t, aalg) && aalg->available)
sz += sizeof(struct sadb_comb); sz += sizeof(struct sadb_comb);
} }
...@@ -2840,6 +2848,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t) ...@@ -2840,6 +2848,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
if (!ealg) if (!ealg)
break; break;
if (!ealg->pfkey_supported)
continue;
if (!(ealg_tmpl_set(t, ealg) && ealg->available)) if (!(ealg_tmpl_set(t, ealg) && ealg->available))
continue; continue;
...@@ -2848,6 +2859,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t) ...@@ -2848,6 +2859,9 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
if (!aalg) if (!aalg)
break; break;
if (!aalg->pfkey_supported)
continue;
if (aalg_tmpl_set(t, aalg) && aalg->available) if (aalg_tmpl_set(t, aalg) && aalg->available)
sz += sizeof(struct sadb_comb); sz += sizeof(struct sadb_comb);
} }
...@@ -2871,6 +2885,9 @@ static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) ...@@ -2871,6 +2885,9 @@ static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
if (!aalg) if (!aalg)
break; break;
if (!aalg->pfkey_supported)
continue;
if (aalg_tmpl_set(t, aalg) && aalg->available) { if (aalg_tmpl_set(t, aalg) && aalg->available) {
struct sadb_comb *c; struct sadb_comb *c;
c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
...@@ -2903,6 +2920,9 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) ...@@ -2903,6 +2920,9 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
if (!ealg) if (!ealg)
break; break;
if (!ealg->pfkey_supported)
continue;
if (!(ealg_tmpl_set(t, ealg) && ealg->available)) if (!(ealg_tmpl_set(t, ealg) && ealg->available))
continue; continue;
...@@ -2911,6 +2931,8 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) ...@@ -2911,6 +2931,8 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k); const struct xfrm_algo_desc *aalg = xfrm_aalg_get_byidx(k);
if (!aalg) if (!aalg)
break; break;
if (!aalg->pfkey_supported)
continue;
if (!(aalg_tmpl_set(t, aalg) && aalg->available)) if (!(aalg_tmpl_set(t, aalg) && aalg->available))
continue; continue;
c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb)); c = (struct sadb_comb*)skb_put(skb, sizeof(struct sadb_comb));
......
...@@ -35,6 +35,8 @@ static struct xfrm_algo_desc aead_list[] = { ...@@ -35,6 +35,8 @@ static struct xfrm_algo_desc aead_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8, .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -51,6 +53,8 @@ static struct xfrm_algo_desc aead_list[] = { ...@@ -51,6 +53,8 @@ static struct xfrm_algo_desc aead_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12, .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -67,6 +71,8 @@ static struct xfrm_algo_desc aead_list[] = { ...@@ -67,6 +71,8 @@ static struct xfrm_algo_desc aead_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16, .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -83,6 +89,8 @@ static struct xfrm_algo_desc aead_list[] = { ...@@ -83,6 +89,8 @@ static struct xfrm_algo_desc aead_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8, .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -99,6 +107,8 @@ static struct xfrm_algo_desc aead_list[] = { ...@@ -99,6 +107,8 @@ static struct xfrm_algo_desc aead_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12, .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -115,6 +125,8 @@ static struct xfrm_algo_desc aead_list[] = { ...@@ -115,6 +125,8 @@ static struct xfrm_algo_desc aead_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AES_CCM_ICV16, .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV16,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -131,6 +143,8 @@ static struct xfrm_algo_desc aead_list[] = { ...@@ -131,6 +143,8 @@ static struct xfrm_algo_desc aead_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_NULL_AES_GMAC, .sadb_alg_id = SADB_X_EALG_NULL_AES_GMAC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -151,6 +165,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -151,6 +165,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_AALG_NULL, .sadb_alg_id = SADB_X_AALG_NULL,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -169,6 +185,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -169,6 +185,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_AALG_MD5HMAC, .sadb_alg_id = SADB_AALG_MD5HMAC,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -187,6 +205,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -187,6 +205,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_AALG_SHA1HMAC, .sadb_alg_id = SADB_AALG_SHA1HMAC,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -205,6 +225,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -205,6 +225,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_AALG_SHA2_256HMAC, .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -222,6 +244,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -222,6 +244,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_AALG_SHA2_384HMAC, .sadb_alg_id = SADB_X_AALG_SHA2_384HMAC,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -239,6 +263,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -239,6 +263,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_AALG_SHA2_512HMAC, .sadb_alg_id = SADB_X_AALG_SHA2_512HMAC,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -257,6 +283,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -257,6 +283,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC, .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -274,6 +302,8 @@ static struct xfrm_algo_desc aalg_list[] = { ...@@ -274,6 +302,8 @@ static struct xfrm_algo_desc aalg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC, .sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -295,6 +325,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -295,6 +325,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_EALG_NULL, .sadb_alg_id = SADB_EALG_NULL,
.sadb_alg_ivlen = 0, .sadb_alg_ivlen = 0,
...@@ -313,6 +345,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -313,6 +345,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_EALG_DESCBC, .sadb_alg_id = SADB_EALG_DESCBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -331,6 +365,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -331,6 +365,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_EALG_3DESCBC, .sadb_alg_id = SADB_EALG_3DESCBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -349,6 +385,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -349,6 +385,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_CASTCBC, .sadb_alg_id = SADB_X_EALG_CASTCBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -367,6 +405,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -367,6 +405,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_BLOWFISHCBC, .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -385,6 +425,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -385,6 +425,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AESCBC, .sadb_alg_id = SADB_X_EALG_AESCBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -403,6 +445,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -403,6 +445,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_SERPENTCBC, .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -421,6 +465,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -421,6 +465,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_CAMELLIACBC, .sadb_alg_id = SADB_X_EALG_CAMELLIACBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -439,6 +485,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -439,6 +485,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_TWOFISHCBC, .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -456,6 +504,8 @@ static struct xfrm_algo_desc ealg_list[] = { ...@@ -456,6 +504,8 @@ static struct xfrm_algo_desc ealg_list[] = {
} }
}, },
.pfkey_supported = 1,
.desc = { .desc = {
.sadb_alg_id = SADB_X_EALG_AESCTR, .sadb_alg_id = SADB_X_EALG_AESCTR,
.sadb_alg_ivlen = 8, .sadb_alg_ivlen = 8,
...@@ -473,6 +523,7 @@ static struct xfrm_algo_desc calg_list[] = { ...@@ -473,6 +523,7 @@ static struct xfrm_algo_desc calg_list[] = {
.threshold = 90, .threshold = 90,
} }
}, },
.pfkey_supported = 1,
.desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE } .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
}, },
{ {
...@@ -482,6 +533,7 @@ static struct xfrm_algo_desc calg_list[] = { ...@@ -482,6 +533,7 @@ static struct xfrm_algo_desc calg_list[] = {
.threshold = 90, .threshold = 90,
} }
}, },
.pfkey_supported = 1,
.desc = { .sadb_alg_id = SADB_X_CALG_LZS } .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
}, },
{ {
...@@ -491,6 +543,7 @@ static struct xfrm_algo_desc calg_list[] = { ...@@ -491,6 +543,7 @@ static struct xfrm_algo_desc calg_list[] = {
.threshold = 50, .threshold = 50,
} }
}, },
.pfkey_supported = 1,
.desc = { .sadb_alg_id = SADB_X_CALG_LZJH } .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
}, },
}; };
...@@ -714,27 +767,27 @@ void xfrm_probe_algs(void) ...@@ -714,27 +767,27 @@ void xfrm_probe_algs(void)
} }
EXPORT_SYMBOL_GPL(xfrm_probe_algs); EXPORT_SYMBOL_GPL(xfrm_probe_algs);
int xfrm_count_auth_supported(void) int xfrm_count_pfkey_auth_supported(void)
{ {
int i, n; int i, n;
for (i = 0, n = 0; i < aalg_entries(); i++) for (i = 0, n = 0; i < aalg_entries(); i++)
if (aalg_list[i].available) if (aalg_list[i].available && aalg_list[i].pfkey_supported)
n++; n++;
return n; return n;
} }
EXPORT_SYMBOL_GPL(xfrm_count_auth_supported); EXPORT_SYMBOL_GPL(xfrm_count_pfkey_auth_supported);
int xfrm_count_enc_supported(void) int xfrm_count_pfkey_enc_supported(void)
{ {
int i, n; int i, n;
for (i = 0, n = 0; i < ealg_entries(); i++) for (i = 0, n = 0; i < ealg_entries(); i++)
if (ealg_list[i].available) if (ealg_list[i].available && ealg_list[i].pfkey_supported)
n++; n++;
return n; return n;
} }
EXPORT_SYMBOL_GPL(xfrm_count_enc_supported); EXPORT_SYMBOL_GPL(xfrm_count_pfkey_enc_supported);
#if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE) #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
......
...@@ -64,7 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err) ...@@ -64,7 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
if (unlikely(x->km.state != XFRM_STATE_VALID)) { if (unlikely(x->km.state != XFRM_STATE_VALID)) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
goto error_nolock; goto error;
} }
err = xfrm_state_check_expire(x); err = xfrm_state_check_expire(x);
......
...@@ -35,6 +35,10 @@ ...@@ -35,6 +35,10 @@
#include "xfrm_hash.h" #include "xfrm_hash.h"
#define XFRM_QUEUE_TMO_MIN ((unsigned)(HZ/10))
#define XFRM_QUEUE_TMO_MAX ((unsigned)(60*HZ))
#define XFRM_MAX_QUEUE_LEN 100
DEFINE_MUTEX(xfrm_cfg_mutex); DEFINE_MUTEX(xfrm_cfg_mutex);
EXPORT_SYMBOL(xfrm_cfg_mutex); EXPORT_SYMBOL(xfrm_cfg_mutex);
...@@ -51,7 +55,7 @@ static struct kmem_cache *xfrm_dst_cache __read_mostly; ...@@ -51,7 +55,7 @@ static struct kmem_cache *xfrm_dst_cache __read_mostly;
static void xfrm_init_pmtu(struct dst_entry *dst); static void xfrm_init_pmtu(struct dst_entry *dst);
static int stale_bundle(struct dst_entry *dst); static int stale_bundle(struct dst_entry *dst);
static int xfrm_bundle_ok(struct xfrm_dst *xdst); static int xfrm_bundle_ok(struct xfrm_dst *xdst);
static void xfrm_policy_queue_process(unsigned long arg);
static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
int dir); int dir);
...@@ -287,8 +291,11 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp) ...@@ -287,8 +291,11 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
INIT_HLIST_NODE(&policy->byidx); INIT_HLIST_NODE(&policy->byidx);
rwlock_init(&policy->lock); rwlock_init(&policy->lock);
atomic_set(&policy->refcnt, 1); atomic_set(&policy->refcnt, 1);
skb_queue_head_init(&policy->polq.hold_queue);
setup_timer(&policy->timer, xfrm_policy_timer, setup_timer(&policy->timer, xfrm_policy_timer,
(unsigned long)policy); (unsigned long)policy);
setup_timer(&policy->polq.hold_timer, xfrm_policy_queue_process,
(unsigned long)policy);
policy->flo.ops = &xfrm_policy_fc_ops; policy->flo.ops = &xfrm_policy_fc_ops;
} }
return policy; return policy;
...@@ -309,6 +316,16 @@ void xfrm_policy_destroy(struct xfrm_policy *policy) ...@@ -309,6 +316,16 @@ void xfrm_policy_destroy(struct xfrm_policy *policy)
} }
EXPORT_SYMBOL(xfrm_policy_destroy); EXPORT_SYMBOL(xfrm_policy_destroy);
static void xfrm_queue_purge(struct sk_buff_head *list)
{
struct sk_buff *skb;
while ((skb = skb_dequeue(list)) != NULL) {
dev_put(skb->dev);
kfree_skb(skb);
}
}
/* Rule must be locked. Release descentant resources, announce /* Rule must be locked. Release descentant resources, announce
* entry dead. The rule must be unlinked from lists to the moment. * entry dead. The rule must be unlinked from lists to the moment.
*/ */
...@@ -319,6 +336,9 @@ static void xfrm_policy_kill(struct xfrm_policy *policy) ...@@ -319,6 +336,9 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
atomic_inc(&policy->genid); atomic_inc(&policy->genid);
del_timer(&policy->polq.hold_timer);
xfrm_queue_purge(&policy->polq.hold_queue);
if (del_timer(&policy->timer)) if (del_timer(&policy->timer))
xfrm_pol_put(policy); xfrm_pol_put(policy);
...@@ -562,6 +582,46 @@ static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s ...@@ -562,6 +582,46 @@ static inline int selector_cmp(struct xfrm_selector *s1, struct xfrm_selector *s
return 0; return 0;
} }
static void xfrm_policy_requeue(struct xfrm_policy *old,
struct xfrm_policy *new)
{
struct xfrm_policy_queue *pq = &old->polq;
struct sk_buff_head list;
__skb_queue_head_init(&list);
spin_lock_bh(&pq->hold_queue.lock);
skb_queue_splice_init(&pq->hold_queue, &list);
del_timer(&pq->hold_timer);
spin_unlock_bh(&pq->hold_queue.lock);
if (skb_queue_empty(&list))
return;
pq = &new->polq;
spin_lock_bh(&pq->hold_queue.lock);
skb_queue_splice(&list, &pq->hold_queue);
pq->timeout = XFRM_QUEUE_TMO_MIN;
mod_timer(&pq->hold_timer, jiffies);
spin_unlock_bh(&pq->hold_queue.lock);
}
static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
struct xfrm_policy *pol)
{
u32 mark = policy->mark.v & policy->mark.m;
if (policy->mark.v == pol->mark.v && policy->mark.m == pol->mark.m)
return true;
if ((mark & pol->mark.m) == pol->mark.v &&
policy->priority == pol->priority)
return true;
return false;
}
int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
{ {
struct net *net = xp_net(policy); struct net *net = xp_net(policy);
...@@ -569,7 +629,6 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) ...@@ -569,7 +629,6 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
struct xfrm_policy *delpol; struct xfrm_policy *delpol;
struct hlist_head *chain; struct hlist_head *chain;
struct hlist_node *entry, *newpos; struct hlist_node *entry, *newpos;
u32 mark = policy->mark.v & policy->mark.m;
write_lock_bh(&xfrm_policy_lock); write_lock_bh(&xfrm_policy_lock);
chain = policy_hash_bysel(net, &policy->selector, policy->family, dir); chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
...@@ -578,7 +637,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) ...@@ -578,7 +637,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
hlist_for_each_entry(pol, entry, chain, bydst) { hlist_for_each_entry(pol, entry, chain, bydst) {
if (pol->type == policy->type && if (pol->type == policy->type &&
!selector_cmp(&pol->selector, &policy->selector) && !selector_cmp(&pol->selector, &policy->selector) &&
(mark & pol->mark.m) == pol->mark.v && xfrm_policy_mark_match(policy, pol) &&
xfrm_sec_ctx_match(pol->security, policy->security) && xfrm_sec_ctx_match(pol->security, policy->security) &&
!WARN_ON(delpol)) { !WARN_ON(delpol)) {
if (excl) { if (excl) {
...@@ -603,8 +662,10 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) ...@@ -603,8 +662,10 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
net->xfrm.policy_count[dir]++; net->xfrm.policy_count[dir]++;
atomic_inc(&flow_cache_genid); atomic_inc(&flow_cache_genid);
rt_genid_bump(net); rt_genid_bump(net);
if (delpol) if (delpol) {
xfrm_policy_requeue(delpol, policy);
__xfrm_policy_unlink(delpol, dir); __xfrm_policy_unlink(delpol, dir);
}
policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir); policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index)); hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index));
policy->curlft.add_time = get_seconds(); policy->curlft.add_time = get_seconds();
...@@ -1115,11 +1176,15 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) ...@@ -1115,11 +1176,15 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir); pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir);
__xfrm_policy_link(pol, XFRM_POLICY_MAX+dir); __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
} }
if (old_pol) if (old_pol) {
if (pol)
xfrm_policy_requeue(old_pol, pol);
/* Unlinking succeeds always. This is the only function /* Unlinking succeeds always. This is the only function
* allowed to delete or replace socket policy. * allowed to delete or replace socket policy.
*/ */
__xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir); __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
}
write_unlock_bh(&xfrm_policy_lock); write_unlock_bh(&xfrm_policy_lock);
if (old_pol) { if (old_pol) {
...@@ -1310,6 +1375,8 @@ static struct flow_cache_object *xfrm_bundle_flo_get(struct flow_cache_object *f ...@@ -1310,6 +1375,8 @@ static struct flow_cache_object *xfrm_bundle_flo_get(struct flow_cache_object *f
* It means we need to try again resolving. */ * It means we need to try again resolving. */
if (xdst->num_xfrms > 0) if (xdst->num_xfrms > 0)
return NULL; return NULL;
} else if (dst->flags & DST_XFRM_QUEUE) {
return NULL;
} else { } else {
/* Real bundle */ /* Real bundle */
if (stale_bundle(dst)) if (stale_bundle(dst))
...@@ -1673,6 +1740,171 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, ...@@ -1673,6 +1740,171 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
return xdst; return xdst;
} }
static void xfrm_policy_queue_process(unsigned long arg)
{
int err = 0;
struct sk_buff *skb;
struct sock *sk;
struct dst_entry *dst;
struct net_device *dev;
struct xfrm_policy *pol = (struct xfrm_policy *)arg;
struct xfrm_policy_queue *pq = &pol->polq;
struct flowi fl;
struct sk_buff_head list;
spin_lock(&pq->hold_queue.lock);
skb = skb_peek(&pq->hold_queue);
dst = skb_dst(skb);
sk = skb->sk;
xfrm_decode_session(skb, &fl, dst->ops->family);
spin_unlock(&pq->hold_queue.lock);
dst_hold(dst->path);
dst = xfrm_lookup(xp_net(pol), dst->path, &fl,
sk, 0);
if (IS_ERR(dst))
goto purge_queue;
if (dst->flags & DST_XFRM_QUEUE) {
dst_release(dst);
if (pq->timeout >= XFRM_QUEUE_TMO_MAX)
goto purge_queue;
pq->timeout = pq->timeout << 1;
mod_timer(&pq->hold_timer, jiffies + pq->timeout);
return;
}
dst_release(dst);
__skb_queue_head_init(&list);
spin_lock(&pq->hold_queue.lock);
pq->timeout = 0;
skb_queue_splice_init(&pq->hold_queue, &list);
spin_unlock(&pq->hold_queue.lock);
while (!skb_queue_empty(&list)) {
skb = __skb_dequeue(&list);
xfrm_decode_session(skb, &fl, skb_dst(skb)->ops->family);
dst_hold(skb_dst(skb)->path);
dst = xfrm_lookup(xp_net(pol), skb_dst(skb)->path,
&fl, skb->sk, 0);
if (IS_ERR(dst)) {
dev_put(skb->dev);
kfree_skb(skb);
continue;
}
nf_reset(skb);
skb_dst_drop(skb);
skb_dst_set(skb, dst);
dev = skb->dev;
err = dst_output(skb);
dev_put(dev);
}
return;
purge_queue:
pq->timeout = 0;
xfrm_queue_purge(&pq->hold_queue);
}
static int xdst_queue_output(struct sk_buff *skb)
{
unsigned long sched_next;
struct dst_entry *dst = skb_dst(skb);
struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
struct xfrm_policy_queue *pq = &xdst->pols[0]->polq;
if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
kfree_skb(skb);
return -EAGAIN;
}
skb_dst_force(skb);
dev_hold(skb->dev);
spin_lock_bh(&pq->hold_queue.lock);
if (!pq->timeout)
pq->timeout = XFRM_QUEUE_TMO_MIN;
sched_next = jiffies + pq->timeout;
if (del_timer(&pq->hold_timer)) {
if (time_before(pq->hold_timer.expires, sched_next))
sched_next = pq->hold_timer.expires;
}
__skb_queue_tail(&pq->hold_queue, skb);
mod_timer(&pq->hold_timer, sched_next);
spin_unlock_bh(&pq->hold_queue.lock);
return 0;
}
static struct xfrm_dst *xfrm_create_dummy_bundle(struct net *net,
struct dst_entry *dst,
const struct flowi *fl,
int num_xfrms,
u16 family)
{
int err;
struct net_device *dev;
struct dst_entry *dst1;
struct xfrm_dst *xdst;
xdst = xfrm_alloc_dst(net, family);
if (IS_ERR(xdst))
return xdst;
if (net->xfrm.sysctl_larval_drop || num_xfrms <= 0 ||
(fl->flowi_flags & FLOWI_FLAG_CAN_SLEEP))
return xdst;
dst1 = &xdst->u.dst;
dst_hold(dst);
xdst->route = dst;
dst_copy_metrics(dst1, dst);
dst1->obsolete = DST_OBSOLETE_FORCE_CHK;
dst1->flags |= DST_HOST | DST_XFRM_QUEUE;
dst1->lastuse = jiffies;
dst1->input = dst_discard;
dst1->output = xdst_queue_output;
dst_hold(dst);
dst1->child = dst;
dst1->path = dst;
xfrm_init_path((struct xfrm_dst *)dst1, dst, 0);
err = -ENODEV;
dev = dst->dev;
if (!dev)
goto free_dst;
err = xfrm_fill_dst(xdst, dev, fl);
if (err)
goto free_dst;
out:
return xdst;
free_dst:
dst_release(dst1);
xdst = ERR_PTR(err);
goto out;
}
static struct flow_cache_object * static struct flow_cache_object *
xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir, xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
struct flow_cache_object *oldflo, void *ctx) struct flow_cache_object *oldflo, void *ctx)
...@@ -1751,7 +1983,7 @@ xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir, ...@@ -1751,7 +1983,7 @@ xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
/* We found policies, but there's no bundles to instantiate: /* We found policies, but there's no bundles to instantiate:
* either because the policy blocks, has no transformations or * either because the policy blocks, has no transformations or
* we could not build template (no xfrm_states).*/ * we could not build template (no xfrm_states).*/
xdst = xfrm_alloc_dst(net, family); xdst = xfrm_create_dummy_bundle(net, dst_orig, fl, num_xfrms, family);
if (IS_ERR(xdst)) { if (IS_ERR(xdst)) {
xfrm_pols_put(pols, num_pols); xfrm_pols_put(pols, num_pols);
return ERR_CAST(xdst); return ERR_CAST(xdst);
...@@ -2359,6 +2591,9 @@ static int xfrm_bundle_ok(struct xfrm_dst *first) ...@@ -2359,6 +2591,9 @@ static int xfrm_bundle_ok(struct xfrm_dst *first)
(dst->dev && !netif_running(dst->dev))) (dst->dev && !netif_running(dst->dev)))
return 0; return 0;
if (dst->flags & DST_XFRM_QUEUE)
return 1;
last = NULL; last = NULL;
do { do {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment