diff options
author | Alexey Dobriyan <adobriyan@gmail.com> | 2008-11-25 20:35:44 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-11-25 20:35:44 -0500 |
commit | f6e1e25d703c0a9ba1863384a16851dec52f8e3a (patch) | |
tree | cd89a1a4f3d4f6c54448d922347f4054ea6e04a0 | |
parent | 52479b623d3d41df84c499325b6a8c7915413032 (diff) |
netns xfrm: xfrm_policy_check in netns
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | include/net/xfrm.h | 3 | ||||
-rw-r--r-- | net/xfrm/xfrm_policy.c | 5 |
2 files changed, 5 insertions, 3 deletions
diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 1dc4ff0f4851..158848f55640 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h | |||
@@ -992,12 +992,13 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, | |||
992 | struct sk_buff *skb, | 992 | struct sk_buff *skb, |
993 | unsigned int family, int reverse) | 993 | unsigned int family, int reverse) |
994 | { | 994 | { |
995 | struct net *net = dev_net(skb->dev); | ||
995 | int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); | 996 | int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); |
996 | 997 | ||
997 | if (sk && sk->sk_policy[XFRM_POLICY_IN]) | 998 | if (sk && sk->sk_policy[XFRM_POLICY_IN]) |
998 | return __xfrm_policy_check(sk, ndir, skb, family); | 999 | return __xfrm_policy_check(sk, ndir, skb, family); |
999 | 1000 | ||
1000 | return (!init_net.xfrm.policy_count[dir] && !skb->sp) || | 1001 | return (!net->xfrm.policy_count[dir] && !skb->sp) || |
1001 | (skb->dst->flags & DST_NOPOLICY) || | 1002 | (skb->dst->flags & DST_NOPOLICY) || |
1002 | __xfrm_policy_check(sk, ndir, skb, family); | 1003 | __xfrm_policy_check(sk, ndir, skb, family); |
1003 | } | 1004 | } |
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 7c88a25c7af5..8097c9958cfc 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c | |||
@@ -1894,6 +1894,7 @@ static inline int secpath_has_nontransport(struct sec_path *sp, int k, int *idxp | |||
1894 | int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, | 1894 | int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, |
1895 | unsigned short family) | 1895 | unsigned short family) |
1896 | { | 1896 | { |
1897 | struct net *net = dev_net(skb->dev); | ||
1897 | struct xfrm_policy *pol; | 1898 | struct xfrm_policy *pol; |
1898 | struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; | 1899 | struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; |
1899 | int npols = 0; | 1900 | int npols = 0; |
@@ -1938,7 +1939,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, | |||
1938 | } | 1939 | } |
1939 | 1940 | ||
1940 | if (!pol) | 1941 | if (!pol) |
1941 | pol = flow_cache_lookup(&init_net, &fl, family, fl_dir, | 1942 | pol = flow_cache_lookup(net, &fl, family, fl_dir, |
1942 | xfrm_policy_lookup); | 1943 | xfrm_policy_lookup); |
1943 | 1944 | ||
1944 | if (IS_ERR(pol)) { | 1945 | if (IS_ERR(pol)) { |
@@ -1961,7 +1962,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, | |||
1961 | npols ++; | 1962 | npols ++; |
1962 | #ifdef CONFIG_XFRM_SUB_POLICY | 1963 | #ifdef CONFIG_XFRM_SUB_POLICY |
1963 | if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) { | 1964 | if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) { |
1964 | pols[1] = xfrm_policy_lookup_bytype(&init_net, XFRM_POLICY_TYPE_MAIN, | 1965 | pols[1] = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, |
1965 | &fl, family, | 1966 | &fl, family, |
1966 | XFRM_POLICY_IN); | 1967 | XFRM_POLICY_IN); |
1967 | if (pols[1]) { | 1968 | if (pols[1]) { |