Re: IPSec: Policy dst bundles exhausting storage
From: Tom Lendacky <hidden>
Date: 2003-06-17 20:40:12
I think this is a bit overkill, can you redo this patch without this? No problem... here's the new patch. Thanks, Tom diff -ur linux-2.5.71-orig/net/ipv6/xfrm6_policy.c linux-2.5.71-new/net/ipv6/xfrm6_policy.c
--- linux-2.5.71-orig/net/ipv6/xfrm6_policy.c 2003-06-14 14:18:02.000000000 -0500
+++ linux-2.5.71-new/net/ipv6/xfrm6_policy.c 2003-06-17 15:34:48.000000000 -0500@@ -60,8 +60,16 @@ read_lock_bh(&policy->lock); for (dst = policy->bundles; dst; dst = dst->next) { struct xfrm_dst *xdst = (struct xfrm_dst*)dst; - if (!ipv6_addr_cmp(&xdst->u.rt6.rt6i_dst.addr, &fl->fl6_dst) && - !ipv6_addr_cmp(&xdst->u.rt6.rt6i_src.addr, &fl->fl6_src) && + struct in6_addr fl_dst_prefix, fl_src_prefix; + + ipv6_addr_prefix(&fl_dst_prefix, + &fl->fl6_dst, + xdst->u.rt6.rt6i_dst.plen); + ipv6_addr_prefix(&fl_src_prefix, + &fl->fl6_src, + xdst->u.rt6.rt6i_src.plen); + if (!ipv6_addr_cmp(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) && + !ipv6_addr_cmp(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) && __xfrm6_bundle_ok(xdst, fl)) { dst_clone(dst); break;
@@ -133,7 +141,6 @@ dst_prev->child = &rt->u.dst; for (dst_prev = dst; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) { struct xfrm_dst *x = (struct xfrm_dst*)dst_prev; - x->u.rt.fl = *fl; dst_prev->dev = rt->u.dst.dev; if (rt->u.dst.dev)
@@ -157,6 +164,8 @@ x->u.rt6.rt6i_node = rt0->rt6i_node; x->u.rt6.rt6i_gateway = rt0->rt6i_gateway; memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway)); + x->u.rt6.rt6i_dst = rt0->rt6i_dst; + x->u.rt6.rt6i_src = rt0->rt6i_src; header_len -= x->u.dst.xfrm->props.header_len; trailer_len -= x->u.dst.xfrm->props.trailer_len; }