Skip to content

Commit

Permalink
netns xfrm: lookup in netns
Browse files Browse the repository at this point in the history 
Pass netns to xfrm_lookup()/__xfrm_lookup(). For that pass netns
to flow_cache_lookup() and resolver callback.

Take it from socket or netdevice. Stub DECnet to init_net.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Alexey Dobriyan authored and David S. Miller committed Nov 26, 2008
1 parent cdcbca7 commit 52479b6
Show file tree
Hide file tree
Showing 22 changed files with 75 additions and 67 deletions.
16 changes: 8 additions & 8 deletions include/net/dst.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -291,21 +291,21 @@ enum {

struct flowi;
#ifndef CONFIG_XFRM
static inline int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
struct sock *sk, int flags)
static inline int xfrm_lookup(struct net *net, struct dst_entry **dst_p,
struct flowi *fl, struct sock *sk, int flags)
{
return 0;
}
static inline int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
struct sock *sk, int flags)
static inline int __xfrm_lookup(struct net *net, struct dst_entry **dst_p,
struct flowi *fl, struct sock *sk, int flags)
{
return 0;
}
#else
extern int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
struct sock *sk, int flags);
extern int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
struct sock *sk, int flags);
extern int xfrm_lookup(struct net *net, struct dst_entry **dst_p,
struct flowi *fl, struct sock *sk, int flags);
extern int __xfrm_lookup(struct net *net, struct dst_entry **dst_p,
struct flowi *fl, struct sock *sk, int flags);
#endif
#endif

Expand Down
9 changes: 5 additions & 4 deletions include/net/flow.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,12 +84,13 @@ struct flowi {
#define FLOW_DIR_OUT 1
#define FLOW_DIR_FWD 2

struct net;
struct sock;
typedef int (*flow_resolve_t)(struct flowi *key, u16 family, u8 dir,
void **objp, atomic_t **obj_refp);
typedef int (*flow_resolve_t)(struct net *net, struct flowi *key, u16 family,
u8 dir, void **objp, atomic_t **obj_refp);

extern void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
flow_resolve_t resolver);
extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
u8 dir, flow_resolve_t resolver);
extern void flow_cache_flush(void);
extern atomic_t flow_cache_genid;

Expand Down
4 changes: 2 additions & 2 deletions net/core/flow.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ static int flow_key_compare(struct flowi *key1, struct flowi *key2)
return 0;
}

void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family, u8 dir,
flow_resolve_t resolver)
{
struct flow_cache_entry *fle, **head;
Expand Down Expand Up @@ -225,7 +225,7 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
void *obj;
atomic_t *obj_ref;

err = resolver(key, family, dir, &obj, &obj_ref);
err = resolver(net, key, family, dir, &obj, &obj_ref);

if (fle && !err) {
fle->genid = atomic_read(&flow_cache_genid);
Expand Down
10 changes: 5 additions & 5 deletions net/dccp/ipv6.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
goto out;
}

err = xfrm_lookup(&dst, &fl, sk, 0);
err = xfrm_lookup(net, &dst, &fl, sk, 0);
if (err < 0) {
sk->sk_err_soft = -err;
goto out;
Expand Down Expand Up @@ -279,7 +279,7 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

err = xfrm_lookup(&dst, &fl, sk, 0);
err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0);
if (err < 0)
goto done;

Expand Down Expand Up @@ -343,7 +343,7 @@ static void dccp_v6_ctl_send_reset(struct sock *sk, struct sk_buff *rxskb)

/* sk = NULL, but it is safe for now. RST socket required. */
if (!ip6_dst_lookup(ctl_sk, &skb->dst, &fl)) {
if (xfrm_lookup(&skb->dst, &fl, NULL, 0) >= 0) {
if (xfrm_lookup(net, &skb->dst, &fl, NULL, 0) >= 0) {
ip6_xmit(ctl_sk, skb, &fl, NULL, 0);
DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS);
DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS);
Expand Down Expand Up @@ -569,7 +569,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
goto out;
}

Expand Down Expand Up @@ -1004,7 +1004,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT);
err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
if (err < 0) {
if (err == -EREMOTE)
err = ip6_dst_blackhole(sk, &dst, &fl);
Expand Down
6 changes: 3 additions & 3 deletions net/decnet/dn_route.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1184,7 +1184,7 @@ static int dn_route_output_key(struct dst_entry **pprt, struct flowi *flp, int f

err = __dn_route_output_key(pprt, flp, flags);
if (err == 0 && flp->proto) {
err = xfrm_lookup(pprt, flp, NULL, 0);
err = xfrm_lookup(&init_net, pprt, flp, NULL, 0);
}
return err;
}
Expand All @@ -1195,8 +1195,8 @@ int dn_route_output_sock(struct dst_entry **pprt, struct flowi *fl, struct sock

err = __dn_route_output_key(pprt, fl, flags & MSG_TRYHARD);
if (err == 0 && fl->proto) {
err = xfrm_lookup(pprt, fl, sk, (flags & MSG_DONTWAIT) ?
0 : XFRM_LOOKUP_WAIT);
err = xfrm_lookup(&init_net, pprt, fl, sk,
(flags & MSG_DONTWAIT) ? 0 : XFRM_LOOKUP_WAIT);
}
return err;
}
Expand Down
4 changes: 2 additions & 2 deletions net/ipv4/icmp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -562,7 +562,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
/* No need to clone since we're just using its address. */
rt2 = rt;

err = xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0);
err = xfrm_lookup(net, (struct dst_entry **)&rt, &fl, NULL, 0);
switch (err) {
case 0:
if (rt != rt2)
Expand Down Expand Up @@ -601,7 +601,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
if (err)
goto relookup_failed;

err = xfrm_lookup((struct dst_entry **)&rt2, &fl, NULL,
err = xfrm_lookup(net, (struct dst_entry **)&rt2, &fl, NULL,
XFRM_LOOKUP_ICMP);
switch (err) {
case 0:
Expand Down
4 changes: 2 additions & 2 deletions net/ipv4/netfilter.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
#ifdef CONFIG_XFRM
if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
xfrm_decode_session(skb, &fl, AF_INET) == 0)
if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
if (xfrm_lookup(net, &skb->dst, &fl, skb->sk, 0))
return -1;
#endif

Expand Down Expand Up @@ -97,7 +97,7 @@ int ip_xfrm_me_harder(struct sk_buff *skb)
dst = ((struct xfrm_dst *)dst)->route;
dst_hold(dst);

if (xfrm_lookup(&dst, &fl, skb->sk, 0) < 0)
if (xfrm_lookup(dev_net(dst->dev), &dst, &fl, skb->sk, 0) < 0)
return -1;

dst_release(skb->dst);
Expand Down
2 changes: 1 addition & 1 deletion net/ipv4/route.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2761,7 +2761,7 @@ int ip_route_output_flow(struct net *net, struct rtable **rp, struct flowi *flp,
flp->fl4_src = (*rp)->rt_src;
if (!flp->fl4_dst)
flp->fl4_dst = (*rp)->rt_dst;
err = __xfrm_lookup((struct dst_entry **)rp, flp, sk,
err = __xfrm_lookup(net, (struct dst_entry **)rp, flp, sk,
flags ? XFRM_LOOKUP_WAIT : 0);
if (err == -EREMOTE)
err = ipv4_dst_blackhole(net, rp, flp);
Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/af_inet6.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -637,7 +637,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
sk->sk_err_soft = -err;
return err;
}
Expand Down
3 changes: 2 additions & 1 deletion net/ipv6/datagram.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,8 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
if (err < 0) {
if (err == -EREMOTE)
err = ip6_dst_blackhole(sk, &dst, &fl);
if (err < 0)
Expand Down
6 changes: 3 additions & 3 deletions net/ipv6/icmp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -427,7 +427,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
/* No need to clone since we're just using its address. */
dst2 = dst;

err = xfrm_lookup(&dst, &fl, sk, 0);
err = xfrm_lookup(net, &dst, &fl, sk, 0);
switch (err) {
case 0:
if (dst != dst2)
Expand All @@ -446,7 +446,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
if (ip6_dst_lookup(sk, &dst2, &fl))
goto relookup_failed;

err = xfrm_lookup(&dst2, &fl, sk, XFRM_LOOKUP_ICMP);
err = xfrm_lookup(net, &dst2, &fl, sk, XFRM_LOOKUP_ICMP);
switch (err) {
case 0:
dst_release(dst);
Expand Down Expand Up @@ -552,7 +552,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
err = ip6_dst_lookup(sk, &dst, &fl);
if (err)
goto out;
if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0)
goto out;

if (ipv6_addr_is_multicast(&fl.fl6_dst))
Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/inet6_connection_sock.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -219,7 +219,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
sk->sk_route_caps = 0;
kfree_skb(skb);
return err;
Expand Down
5 changes: 3 additions & 2 deletions net/ipv6/ip6_tunnel.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -846,6 +846,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
int encap_limit,
__u32 *pmtu)
{
struct net *net = dev_net(dev);
struct ip6_tnl *t = netdev_priv(dev);
struct net_device_stats *stats = &t->dev->stats;
struct ipv6hdr *ipv6h = ipv6_hdr(skb);
Expand All @@ -861,9 +862,9 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
if ((dst = ip6_tnl_dst_check(t)) != NULL)
dst_hold(dst);
else {
dst = ip6_route_output(dev_net(dev), NULL, fl);
dst = ip6_route_output(net, NULL, fl);

if (dst->error || xfrm_lookup(&dst, fl, NULL, 0) < 0)
if (dst->error || xfrm_lookup(net, &dst, fl, NULL, 0) < 0)
goto tx_err_link_failure;
}

Expand Down
4 changes: 2 additions & 2 deletions net/ipv6/mcast.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1466,7 +1466,7 @@ static void mld_sendpack(struct sk_buff *skb)
&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
skb->dev->ifindex);

err = xfrm_lookup(&skb->dst, &fl, NULL, 0);
err = xfrm_lookup(net, &skb->dst, &fl, NULL, 0);
if (err)
goto err_out;

Expand Down Expand Up @@ -1831,7 +1831,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
skb->dev->ifindex);

err = xfrm_lookup(&skb->dst, &fl, NULL, 0);
err = xfrm_lookup(net, &skb->dst, &fl, NULL, 0);
if (err)
goto err_out;

Expand Down
4 changes: 2 additions & 2 deletions net/ipv6/ndisc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -524,7 +524,7 @@ void ndisc_send_skb(struct sk_buff *skb,
return;
}

err = xfrm_lookup(&dst, &fl, NULL, 0);
err = xfrm_lookup(net, &dst, &fl, NULL, 0);
if (err < 0) {
kfree_skb(skb);
return;
Expand Down Expand Up @@ -1524,7 +1524,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
if (dst == NULL)
return;

err = xfrm_lookup(&dst, &fl, NULL, 0);
err = xfrm_lookup(net, &dst, &fl, NULL, 0);
if (err)
return;

Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/netfilter.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
#ifdef CONFIG_XFRM
if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
xfrm_decode_session(skb, &fl, AF_INET6) == 0)
if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
if (xfrm_lookup(net, &skb->dst, &fl, skb->sk, 0))
return -1;
#endif

Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/netfilter/ip6t_REJECT.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
dst = ip6_route_output(net, NULL, &fl);
if (dst == NULL)
return;
if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))
return;

hh_len = (dst->dev->hard_header_len + 15)&~15;
Expand Down
3 changes: 2 additions & 1 deletion net/ipv6/raw.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -860,7 +860,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
if (err < 0) {
if (err == -EREMOTE)
err = ip6_dst_blackhole(sk, &dst, &fl);
if (err < 0)
Expand Down
2 changes: 1 addition & 1 deletion net/ipv6/syncookies.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -259,7 +259,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)

if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);
if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
goto out_free;
}

Expand Down
11 changes: 6 additions & 5 deletions net/ipv6/tcp_ipv6.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
if (err < 0) {
if (err == -EREMOTE)
err = ip6_dst_blackhole(sk, &dst, &fl);
if (err < 0)
Expand Down Expand Up @@ -390,7 +391,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
goto out;
}

if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
sk->sk_err_soft = -err;
goto out;
}
Expand Down Expand Up @@ -492,7 +493,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
goto done;
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);
if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
goto done;

skb = tcp_make_synack(sk, dst, req);
Expand Down Expand Up @@ -1018,7 +1019,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
* namespace
*/
if (!ip6_dst_lookup(ctl_sk, &buff->dst, &fl)) {
if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
if (xfrm_lookup(net, &buff->dst, &fl, NULL, 0) >= 0) {
ip6_xmit(ctl_sk, buff, &fl, NULL, 0);
TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
if (rst)
Expand Down Expand Up @@ -1316,7 +1317,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
goto out;
}

Expand Down
3 changes: 2 additions & 1 deletion net/ipv6/udp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -849,7 +849,8 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);

if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
if (err < 0) {
if (err == -EREMOTE)
err = ip6_dst_blackhole(sk, &dst, &fl);
if (err < 0)
Expand Down
Loading

0 comments on commit 52479b6

Please sign in to comment.