Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

Steffen Klassert says:

====================
1) Remove a duplicated call to skb_orphan() in pf_key, from Cong Wang.

2) Prepare xfrm and pf_key for algorithms without pf_key support,
   from Jussi Kivilinna.

3) Fix an unbalanced lock in xfrm_output_one(), from Li RongQing.

4) Add an IPsec state resolution packet queue to handle
   packets that are send before the states are resolved.

5) xfrm4_policy_fini() is unused since 2.6.11, time to remove it.
   From Michal Kubecek.

6) The xfrm gc threshold was configurable just in the initial
   namespace, make it configurable in all namespaces. From
   Michal Kubecek.

7) We currently can not insert policies with mark and mask
   such that some flows would be matched from both policies.
   Allow this if the priorities of these policies are different,
   the one with the higher priority is used in this case.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 46 insertions, 12 deletions

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 3be0ac2c1920..9a459be24af7 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -262,21 +262,56 @@ static struct ctl_table xfrm4_policy_table[] = {
         { }
 };
 
-static struct ctl_table_header *sysctl_hdr;
-#endif
-
-static void __init xfrm4_policy_init(void)
+static int __net_init xfrm4_net_init(struct net *net)
 {
-        xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
+        struct ctl_table *table;
+        struct ctl_table_header *hdr;
+
+        table = xfrm4_policy_table;
+        if (!net_eq(net, &init_net)) {
+                table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL);
+                if (!table)
+                        goto err_alloc;
+
+                table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh;
+        }
+
+        hdr = register_net_sysctl(net, "net/ipv4", table);
+        if (!hdr)
+                goto err_reg;
+
+        net->ipv4.xfrm4_hdr = hdr;
+        return 0;
+
+err_reg:
+        if (!net_eq(net, &init_net))
+                kfree(table);
+err_alloc:
+        return -ENOMEM;
 }
 
-static void __exit xfrm4_policy_fini(void)
+static void __net_exit xfrm4_net_exit(struct net *net)
 {
-#ifdef CONFIG_SYSCTL
-        if (sysctl_hdr)
-                unregister_net_sysctl_table(sysctl_hdr);
+        struct ctl_table *table;
+
+        if (net->ipv4.xfrm4_hdr == NULL)
+                return;
+
+        table = net->ipv4.xfrm4_hdr->ctl_table_arg;
+        unregister_net_sysctl_table(net->ipv4.xfrm4_hdr);
+        if (!net_eq(net, &init_net))
+                kfree(table);
+}
+
+static struct pernet_operations __net_initdata xfrm4_net_ops = {
+        .init   = xfrm4_net_init,
+        .exit   = xfrm4_net_exit,
+};
 #endif
-        xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
+
+static void __init xfrm4_policy_init(void)
+{
+        xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
 }
 
 void __init xfrm4_init(void)
@@ -286,8 +321,7 @@ void __init xfrm4_init(void)
         xfrm4_state_init();
         xfrm4_policy_init();
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv4",
-                                         xfrm4_policy_table);
+        register_pernet_subsys(&xfrm4_net_ops);
 #endif
 }