summaryrefslogtreecommitdiffstats
path: root/include/net
diff options
context:
space:
mode:
authorPaul Moore <pmoore@redhat.com>2013-05-29 09:36:25 +0200
committerDavid S. Miller <davem@davemloft.net>2013-06-01 02:30:07 +0200
commite4c1721642bbd42d8142f4811cde0588c28db51d (patch)
tree8f7750f6065dcb5d2bd727174fb9f4e3cd8fccf3 /include/net
parentudp6: Fix udp fragmentation for tunnel traffic. (diff)
downloadlinux-e4c1721642bbd42d8142f4811cde0588c28db51d.tar.xz
linux-e4c1721642bbd42d8142f4811cde0588c28db51d.zip
xfrm: force a garbage collection after deleting a policy
In some cases after deleting a policy from the SPD the policy would remain in the dst/flow/route cache for an extended period of time which caused problems for SELinux as its dynamic network access controls key off of the number of XFRM policy and state entries. This patch corrects this problem by forcing a XFRM garbage collection whenever a policy is sucessfully removed. Reported-by: Ondrej Moris <omoris@redhat.com> Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
-rw-r--r--include/net/xfrm.h5
1 files changed, 5 insertions, 0 deletions
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index ae16531d0d35..94ce082b29dc 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1160,6 +1160,8 @@ static inline void xfrm_sk_free_policy(struct sock *sk)
}
}
+extern void xfrm_garbage_collect(struct net *net);
+
#else
static inline void xfrm_sk_free_policy(struct sock *sk) {}
@@ -1194,6 +1196,9 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
{
return 1;
}
+static inline void xfrm_garbage_collect(struct net *net)
+{
+}
#endif
static __inline__