|
@@ -1187,24 +1187,6 @@ __xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir
|
|
|
return xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family, dir);
|
|
return xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family, dir);
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
-static int flow_to_policy_dir(int dir)
|
|
|
|
|
-{
|
|
|
|
|
- if (XFRM_POLICY_IN == FLOW_DIR_IN &&
|
|
|
|
|
- XFRM_POLICY_OUT == FLOW_DIR_OUT &&
|
|
|
|
|
- XFRM_POLICY_FWD == FLOW_DIR_FWD)
|
|
|
|
|
- return dir;
|
|
|
|
|
-
|
|
|
|
|
- switch (dir) {
|
|
|
|
|
- default:
|
|
|
|
|
- case FLOW_DIR_IN:
|
|
|
|
|
- return XFRM_POLICY_IN;
|
|
|
|
|
- case FLOW_DIR_OUT:
|
|
|
|
|
- return XFRM_POLICY_OUT;
|
|
|
|
|
- case FLOW_DIR_FWD:
|
|
|
|
|
- return XFRM_POLICY_FWD;
|
|
|
|
|
- }
|
|
|
|
|
-}
|
|
|
|
|
-
|
|
|
|
|
static struct flow_cache_object *
|
|
static struct flow_cache_object *
|
|
|
xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family,
|
|
xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family,
|
|
|
u8 dir, struct flow_cache_object *old_obj, void *ctx)
|
|
u8 dir, struct flow_cache_object *old_obj, void *ctx)
|
|
@@ -1214,7 +1196,7 @@ xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family,
|
|
|
if (old_obj)
|
|
if (old_obj)
|
|
|
xfrm_pol_put(container_of(old_obj, struct xfrm_policy, flo));
|
|
xfrm_pol_put(container_of(old_obj, struct xfrm_policy, flo));
|
|
|
|
|
|
|
|
- pol = __xfrm_policy_lookup(net, fl, family, flow_to_policy_dir(dir));
|
|
|
|
|
|
|
+ pol = __xfrm_policy_lookup(net, fl, family, dir);
|
|
|
if (IS_ERR_OR_NULL(pol))
|
|
if (IS_ERR_OR_NULL(pol))
|
|
|
return ERR_CAST(pol);
|
|
return ERR_CAST(pol);
|
|
|
|
|
|
|
@@ -1225,23 +1207,6 @@ xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family,
|
|
|
return &pol->flo;
|
|
return &pol->flo;
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
-static inline int policy_to_flow_dir(int dir)
|
|
|
|
|
-{
|
|
|
|
|
- if (XFRM_POLICY_IN == FLOW_DIR_IN &&
|
|
|
|
|
- XFRM_POLICY_OUT == FLOW_DIR_OUT &&
|
|
|
|
|
- XFRM_POLICY_FWD == FLOW_DIR_FWD)
|
|
|
|
|
- return dir;
|
|
|
|
|
- switch (dir) {
|
|
|
|
|
- default:
|
|
|
|
|
- case XFRM_POLICY_IN:
|
|
|
|
|
- return FLOW_DIR_IN;
|
|
|
|
|
- case XFRM_POLICY_OUT:
|
|
|
|
|
- return FLOW_DIR_OUT;
|
|
|
|
|
- case XFRM_POLICY_FWD:
|
|
|
|
|
- return FLOW_DIR_FWD;
|
|
|
|
|
- }
|
|
|
|
|
-}
|
|
|
|
|
-
|
|
|
|
|
static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
|
|
static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
|
|
|
const struct flowi *fl, u16 family)
|
|
const struct flowi *fl, u16 family)
|
|
|
{
|
|
{
|
|
@@ -1261,7 +1226,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
|
|
|
}
|
|
}
|
|
|
err = security_xfrm_policy_lookup(pol->security,
|
|
err = security_xfrm_policy_lookup(pol->security,
|
|
|
fl->flowi_secid,
|
|
fl->flowi_secid,
|
|
|
- policy_to_flow_dir(dir));
|
|
|
|
|
|
|
+ dir);
|
|
|
if (!err) {
|
|
if (!err) {
|
|
|
if (!xfrm_pol_hold_rcu(pol))
|
|
if (!xfrm_pol_hold_rcu(pol))
|
|
|
goto again;
|
|
goto again;
|
|
@@ -2063,8 +2028,7 @@ xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
|
|
|
/* Resolve policies to use if we couldn't get them from
|
|
/* Resolve policies to use if we couldn't get them from
|
|
|
* previous cache entry */
|
|
* previous cache entry */
|
|
|
num_pols = 1;
|
|
num_pols = 1;
|
|
|
- pols[0] = __xfrm_policy_lookup(net, fl, family,
|
|
|
|
|
- flow_to_policy_dir(dir));
|
|
|
|
|
|
|
+ pols[0] = __xfrm_policy_lookup(net, fl, family, dir);
|
|
|
err = xfrm_expand_policies(fl, family, pols,
|
|
err = xfrm_expand_policies(fl, family, pols,
|
|
|
&num_pols, &num_xfrms);
|
|
&num_pols, &num_xfrms);
|
|
|
if (err < 0)
|
|
if (err < 0)
|
|
@@ -2142,7 +2106,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
|
|
|
struct xfrm_dst *xdst;
|
|
struct xfrm_dst *xdst;
|
|
|
struct dst_entry *dst, *route;
|
|
struct dst_entry *dst, *route;
|
|
|
u16 family = dst_orig->ops->family;
|
|
u16 family = dst_orig->ops->family;
|
|
|
- u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
|
|
|
|
|
|
|
+ u8 dir = XFRM_POLICY_OUT;
|
|
|
int i, err, num_pols, num_xfrms = 0, drop_pols = 0;
|
|
int i, err, num_pols, num_xfrms = 0, drop_pols = 0;
|
|
|
|
|
|
|
|
dst = NULL;
|
|
dst = NULL;
|
|
@@ -2399,12 +2363,10 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
|
|
|
int pi;
|
|
int pi;
|
|
|
int reverse;
|
|
int reverse;
|
|
|
struct flowi fl;
|
|
struct flowi fl;
|
|
|
- u8 fl_dir;
|
|
|
|
|
int xerr_idx = -1;
|
|
int xerr_idx = -1;
|
|
|
|
|
|
|
|
reverse = dir & ~XFRM_POLICY_MASK;
|
|
reverse = dir & ~XFRM_POLICY_MASK;
|
|
|
dir &= XFRM_POLICY_MASK;
|
|
dir &= XFRM_POLICY_MASK;
|
|
|
- fl_dir = policy_to_flow_dir(dir);
|
|
|
|
|
|
|
|
|
|
if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) {
|
|
if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) {
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
|