Commit 399c180a authored by David S. Miller's avatar David S. Miller

[IPSEC]: Perform SA switchover immediately.

When we insert a new xfrm_state which potentially
subsumes an existing one, make sure all cached
bundles are flushed so that the new SA is used
immediately.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9e999993
...@@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto, ...@@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
extern void xfrm_policy_flush(void); extern void xfrm_policy_flush(void);
extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
extern int xfrm_flush_bundles(void); extern int xfrm_flush_bundles(void);
extern void xfrm_flush_all_bundles(void);
extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family); extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
extern void xfrm_init_pmtu(struct dst_entry *dst); extern void xfrm_init_pmtu(struct dst_entry *dst);
......
...@@ -1014,13 +1014,12 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) ...@@ -1014,13 +1014,12 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
} }
EXPORT_SYMBOL(__xfrm_route_forward); EXPORT_SYMBOL(__xfrm_route_forward);
/* Optimize later using cookies and generation ids. */
static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie) static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
{ {
if (!stale_bundle(dst)) /* If it is marked obsolete, which is how we even get here,
return dst; * then we have purged it from the policy bundle list and we
* did that for a good reason.
*/
return NULL; return NULL;
} }
...@@ -1104,6 +1103,16 @@ int xfrm_flush_bundles(void) ...@@ -1104,6 +1103,16 @@ int xfrm_flush_bundles(void)
return 0; return 0;
} }
static int always_true(struct dst_entry *dst)
{
return 1;
}
void xfrm_flush_all_bundles(void)
{
xfrm_prune_bundles(always_true);
}
void xfrm_init_pmtu(struct dst_entry *dst) void xfrm_init_pmtu(struct dst_entry *dst)
{ {
do { do {
......
...@@ -431,6 +431,8 @@ void xfrm_state_insert(struct xfrm_state *x) ...@@ -431,6 +431,8 @@ void xfrm_state_insert(struct xfrm_state *x)
spin_lock_bh(&xfrm_state_lock); spin_lock_bh(&xfrm_state_lock);
__xfrm_state_insert(x); __xfrm_state_insert(x);
spin_unlock_bh(&xfrm_state_lock); spin_unlock_bh(&xfrm_state_lock);
xfrm_flush_all_bundles();
} }
EXPORT_SYMBOL(xfrm_state_insert); EXPORT_SYMBOL(xfrm_state_insert);
...@@ -478,6 +480,9 @@ out: ...@@ -478,6 +480,9 @@ out:
spin_unlock_bh(&xfrm_state_lock); spin_unlock_bh(&xfrm_state_lock);
xfrm_state_put_afinfo(afinfo); xfrm_state_put_afinfo(afinfo);
if (!err)
xfrm_flush_all_bundles();
if (x1) { if (x1) {
xfrm_state_delete(x1); xfrm_state_delete(x1);
xfrm_state_put(x1); xfrm_state_put(x1);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment