dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

netns xfrm: per-netns inexact policies 

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Alexey Dobriyan 2008-11-25 17:23:26 -08:00 committed by David S. Miller
parent 8100bea7d6
commit 8b18f8eaf9
2 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/netns/xfrm.h
View File

@ -4,6 +4,7 @@
#include <linux/list.h>
#include <linux/wait.h>
#include <linux/workqueue.h>
#include <linux/xfrm.h>
struct netns_xfrm {
struct list_head state_all;
@ -29,6 +30,7 @@ struct netns_xfrm {
struct list_head policy_all;
struct hlist_head *policy_byidx;
unsigned int policy_idx_hmask;
struct hlist_head policy_inexact[XFRM_POLICY_MAX * 2];
};
#endif

20
net/xfrm/xfrm_policy.c
View File

@ -327,7 +327,6 @@ struct xfrm_policy_hash {
unsigned int hmask;
};
static struct hlist_head xfrm_policy_inexact[XFRM_POLICY_MAX*2];
static struct xfrm_policy_hash xfrm_policy_bydst[XFRM_POLICY_MAX*2] __read_mostly;
static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024;
@ -342,7 +341,7 @@ static struct hlist_head *policy_hash_bysel(struct xfrm_selector *sel, unsigned
unsigned int hash = __sel_hash(sel, family, hmask);
return (hash == hmask + 1 ?
&xfrm_policy_inexact[dir] :
&init_net.xfrm.policy_inexact[dir] :
xfrm_policy_bydst[dir].table + hash);
}
@ -752,7 +751,7 @@ xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
int i;
hlist_for_each_entry(pol, entry,
&xfrm_policy_inexact[dir], bydst) {
&init_net.xfrm.policy_inexact[dir], bydst) {
if (pol->type != type)
continue;
err = security_xfrm_policy_delete(pol->security);
@ -810,7 +809,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
killed = 0;
again1:
hlist_for_each_entry(pol, entry,
&xfrm_policy_inexact[dir], bydst) {
&init_net.xfrm.policy_inexact[dir], bydst) {
if (pol->type != type)
continue;
hlist_del(&pol->bydst);
@ -983,7 +982,7 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
break;
}
}
chain = &xfrm_policy_inexact[dir];
chain = &init_net.xfrm.policy_inexact[dir];
hlist_for_each_entry(pol, entry, chain, bydst) {
err = xfrm_policy_match(pol, fl, type, family, dir);
if (err) {
@ -2152,7 +2151,7 @@ static void xfrm_prune_bundles(int (*func)(struct dst_entry *))
int i;
hlist_for_each_entry(pol, entry,
&xfrm_policy_inexact[dir], bydst)
&init_net.xfrm.policy_inexact[dir], bydst)
prune_one_bundle(pol, func, &gc_list);
table = xfrm_policy_bydst[dir].table;
@ -2414,7 +2413,7 @@ static int __net_init xfrm_policy_init(struct net *net)
for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
struct xfrm_policy_hash *htab;
INIT_HLIST_HEAD(&xfrm_policy_inexact[dir]);
INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
htab = &xfrm_policy_bydst[dir];
htab->table = xfrm_hash_alloc(sz);
@ -2435,9 +2434,14 @@ out_byidx:
static void xfrm_policy_fini(struct net *net)
{
unsigned int sz;
int dir;
WARN_ON(!list_empty(&net->xfrm.policy_all));
for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir]));
}
sz = (net->xfrm.policy_idx_hmask + 1) * sizeof(struct hlist_head);
WARN_ON(!hlist_empty(net->xfrm.policy_byidx));
xfrm_hash_free(net->xfrm.policy_byidx, sz);
@ -2590,7 +2594,7 @@ static struct xfrm_policy * xfrm_migrate_policy_find(struct xfrm_selector *sel,
break;
}
}
chain = &xfrm_policy_inexact[dir];
chain = &init_net.xfrm.policy_inexact[dir];
hlist_for_each_entry(pol, entry, chain, bydst) {
if (xfrm_migrate_selector_match(sel, &pol->selector) &&
pol->type == type &&