Commit 0e602451 authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by David S. Miller

netns xfrm: state flush in netns

Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 98806f75
...@@ -1363,7 +1363,7 @@ struct xfrmk_spdinfo { ...@@ -1363,7 +1363,7 @@ struct xfrmk_spdinfo {
extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq); extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
extern int xfrm_state_delete(struct xfrm_state *x); extern int xfrm_state_delete(struct xfrm_state *x);
extern int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info); extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si); extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si);
extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si); extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si);
extern int xfrm_replay_check(struct xfrm_state *x, extern int xfrm_replay_check(struct xfrm_state *x,
......
...@@ -1732,7 +1732,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd ...@@ -1732,7 +1732,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
audit_info.loginuid = audit_get_loginuid(current); audit_info.loginuid = audit_get_loginuid(current);
audit_info.sessionid = audit_get_sessionid(current); audit_info.sessionid = audit_get_sessionid(current);
audit_info.secid = 0; audit_info.secid = 0;
err = xfrm_state_flush(proto, &audit_info); err = xfrm_state_flush(&init_net, proto, &audit_info);
if (err) if (err)
return err; return err;
c.data.proto = proto; c.data.proto = proto;
......
...@@ -576,15 +576,15 @@ EXPORT_SYMBOL(xfrm_state_delete); ...@@ -576,15 +576,15 @@ EXPORT_SYMBOL(xfrm_state_delete);
#ifdef CONFIG_SECURITY_NETWORK_XFRM #ifdef CONFIG_SECURITY_NETWORK_XFRM
static inline int static inline int
xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info) xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
{ {
int i, err = 0; int i, err = 0;
for (i = 0; i <= init_net.xfrm.state_hmask; i++) { for (i = 0; i <= net->xfrm.state_hmask; i++) {
struct hlist_node *entry; struct hlist_node *entry;
struct xfrm_state *x; struct xfrm_state *x;
hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+i, bydst) { hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
if (xfrm_id_proto_match(x->id.proto, proto) && if (xfrm_id_proto_match(x->id.proto, proto) &&
(err = security_xfrm_state_delete(x)) != 0) { (err = security_xfrm_state_delete(x)) != 0) {
xfrm_audit_state_delete(x, 0, xfrm_audit_state_delete(x, 0,
...@@ -600,26 +600,26 @@ xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info) ...@@ -600,26 +600,26 @@ xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
} }
#else #else
static inline int static inline int
xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info) xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info)
{ {
return 0; return 0;
} }
#endif #endif
int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info) int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
{ {
int i, err = 0; int i, err = 0;
spin_lock_bh(&xfrm_state_lock); spin_lock_bh(&xfrm_state_lock);
err = xfrm_state_flush_secctx_check(proto, audit_info); err = xfrm_state_flush_secctx_check(net, proto, audit_info);
if (err) if (err)
goto out; goto out;
for (i = 0; i <= init_net.xfrm.state_hmask; i++) { for (i = 0; i <= net->xfrm.state_hmask; i++) {
struct hlist_node *entry; struct hlist_node *entry;
struct xfrm_state *x; struct xfrm_state *x;
restart: restart:
hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+i, bydst) { hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
if (!xfrm_state_kern(x) && if (!xfrm_state_kern(x) &&
xfrm_id_proto_match(x->id.proto, proto)) { xfrm_id_proto_match(x->id.proto, proto)) {
xfrm_state_hold(x); xfrm_state_hold(x);
...@@ -641,7 +641,7 @@ int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info) ...@@ -641,7 +641,7 @@ int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
out: out:
spin_unlock_bh(&xfrm_state_lock); spin_unlock_bh(&xfrm_state_lock);
wake_up(&init_net.xfrm.km_waitq); wake_up(&net->xfrm.km_waitq);
return err; return err;
} }
EXPORT_SYMBOL(xfrm_state_flush); EXPORT_SYMBOL(xfrm_state_flush);
......
...@@ -1398,7 +1398,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -1398,7 +1398,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
audit_info.loginuid = NETLINK_CB(skb).loginuid; audit_info.loginuid = NETLINK_CB(skb).loginuid;
audit_info.sessionid = NETLINK_CB(skb).sessionid; audit_info.sessionid = NETLINK_CB(skb).sessionid;
audit_info.secid = NETLINK_CB(skb).sid; audit_info.secid = NETLINK_CB(skb).sid;
err = xfrm_state_flush(p->proto, &audit_info); err = xfrm_state_flush(&init_net, p->proto, &audit_info);
if (err) if (err)
return err; return err;
c.data.proto = p->proto; c.data.proto = p->proto;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment