Commit efedce33 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

Merge branch 'xfrm: policy: replace session decode with flow dissector' 



Florian Westphal says:

============
Remove the ipv4+ipv6 session decode functions and use generic flow
dissector to populate the flowi for the policy lookup.

Changes since v2:
- first patch broke CONFIG_XFRM=n builds

Changes since v1:
- Can't use skb_flow_dissect(), we might see skbs that have neither
  skb->sk nor skb->dev set. Flow dissector WARN()s in this case, it
  tries to check for a bpf program assigned in that net namespace.

Add a preparation patch to pass down 'struct net' in
xfrm_decode_session so its available for use in patch 3.

Changes since RFC:

- Drop mobility header support.  I don't think that anyone uses
  this.  MOBIKE doesn't appear to need this either.
- Drop fl6->flowlabel assignment, original code leaves it as 0.

There is no reason for this change other than to remove code.
============

Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parents e377240a 7a020709

include/net/xfrm.h

+6 −6
Original line number Diff line number Diff line
@@ -1207,20 +1207,20 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 
	return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);

}



int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,

int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,

			  unsigned int family, int reverse);



static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,

static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl,

				      unsigned int family)

{

	return __xfrm_decode_session(skb, fl, family, 0);

	return __xfrm_decode_session(net, skb, fl, family, 0);

}



static inline int xfrm_decode_session_reverse(struct sk_buff *skb,

static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,

					      struct flowi *fl,

					      unsigned int family)

{

	return __xfrm_decode_session(skb, fl, family, 1);

	return __xfrm_decode_session(net, skb, fl, family, 1);

}



int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
@@ -1296,7 +1296,7 @@ static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *sk 
{

	return 1;

}

static inline int xfrm_decode_session_reverse(struct sk_buff *skb,

static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb,

					      struct flowi *fl,

					      unsigned int family)

{

net/ipv4/icmp.c

+1 −1
Original line number Diff line number Diff line
@@ -517,7 +517,7 @@ static struct rtable *icmp_route_lookup(struct net *net, 
	} else

		return rt;



	err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);

	err = xfrm_decode_session_reverse(net, skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);

	if (err)

		goto relookup_failed;

net/ipv4/ip_vti.c

+2 −2
Original line number Diff line number Diff line
@@ -288,11 +288,11 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) 
	switch (skb->protocol) {

	case htons(ETH_P_IP):

		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));

		xfrm_decode_session(skb, &fl, AF_INET);

		xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET);

		break;

	case htons(ETH_P_IPV6):

		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));

		xfrm_decode_session(skb, &fl, AF_INET6);

		xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET6);

		break;

	default:

		goto tx_err;

net/ipv4/netfilter.c

+1 −1
Original line number Diff line number Diff line
@@ -62,7 +62,7 @@ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, un 


#ifdef CONFIG_XFRM

	if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&

	    xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {

	    xfrm_decode_session(net, skb, flowi4_to_flowi(&fl4), AF_INET) == 0) {

		struct dst_entry *dst = skb_dst(skb);

		skb_dst_set(skb, NULL);

		dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0);

net/ipv6/icmp.c

+1 −1
Original line number Diff line number Diff line
@@ -385,7 +385,7 @@ static struct dst_entry *icmpv6_route_lookup(struct net *net, 
			return dst;

	}



	err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);

	err = xfrm_decode_session_reverse(net, skb, flowi6_to_flowi(&fl2), AF_INET6);

	if (err)

		goto relookup_failed;