summaryrefslogtreecommitdiff
path: root/net/xfrm
diff options
context:
space:
mode:
authorDavid S. Miller <davem@sunset.davemloft.net>2006-08-24 03:18:09 -0700
committerDavid S. Miller <davem@sunset.davemloft.net>2006-09-22 15:08:42 -0700
commit9d4a706d852411154d0c91b9ffb3bec68b94b25c (patch)
tree1613607168baa8b654c300895cd7d0ffb6f18581 /net/xfrm
parentf034b5d4efdfe0fb9e2a1ce1d95fa7914f24de49 (diff)
[XFRM]: Add generation count to xfrm_state and xfrm_dst.
Each xfrm_state inserted gets a new generation counter value. When a bundle is created, the xfrm_dst objects get the current generation counter of the xfrm_state they will attach to at dst->xfrm. xfrm_bundle_ok() will return false if it sees an xfrm_dst with a generation count different from the generation count of the xfrm_state that dst points to. This provides a facility by which to passively and cheaply invalidate cached IPSEC routes during SA database changes. Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm')
-rw-r--r--net/xfrm/xfrm_policy.c2
-rw-r--r--net/xfrm/xfrm_state.c3
2 files changed, 5 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 1732159ffd01..7fc6944ee36f 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1536,6 +1536,8 @@ int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family, int str
return 0;
if (dst->xfrm->km.state != XFRM_STATE_VALID)
return 0;
+ if (xdst->genid != dst->xfrm->genid)
+ return 0;
if (strict && fl && dst->xfrm->props.mode != XFRM_MODE_TUNNEL &&
!xfrm_state_addr_flow_check(dst->xfrm, fl, family))
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 445263c54c94..535d43c14720 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -53,6 +53,7 @@ static struct hlist_head *xfrm_state_byspi __read_mostly;
static unsigned int xfrm_state_hmask __read_mostly;
static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
static unsigned int xfrm_state_num;
+static unsigned int xfrm_state_genid;
static inline unsigned int __xfrm4_dst_hash(xfrm_address_t *addr, unsigned int hmask)
{
@@ -745,6 +746,8 @@ static void __xfrm_state_insert(struct xfrm_state *x)
{
unsigned int h = xfrm_dst_hash(&x->id.daddr, x->props.family);
+ x->genid = ++xfrm_state_genid;
+
hlist_add_head(&x->bydst, xfrm_state_bydst+h);
xfrm_state_hold(x);