[PATCH net-next] xfrm: Force SA to be lookup again if SA in acquire state

If SA is in the process of acquiring, which indicates this SA is more
promising and precise than the fall back option, i.e. using wild card
source address for searching less suitable SA.

So, here bail out, and try again.

Signed-off-by: Fan Du <redacted>
---
 net/xfrm/xfrm_state.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index b9c3f9e..e1373d5 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c

@@ -815,7 +815,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 			xfrm_state_look_at(pol, x, fl, encap_family,
 					   &best, &acquire_in_progress, &error);
 	}
-	if (best)
+	if (best || acquire_in_progress)
 		goto found;
 
 	h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);

-- 
1.7.9.5

On Mon, Sep 23, 2013 at 05:18:25PM +0800, Fan Du wrote:

If SA is in the process of acquiring, which indicates this SA is more
promising and precise than the fall back option, i.e. using wild card
source address for searching less suitable SA.

So, here bail out, and try again.

Signed-off-by: Fan Du <redacted>

This looks ok, I'll take this into ipsec-next as soon as I can
update the tree.

On Thu, Sep 26, 2013 at 11:03:01AM +0200, Steffen Klassert wrote:

On Mon, Sep 23, 2013 at 05:18:25PM +0800, Fan Du wrote:

quoted

If SA is in the process of acquiring, which indicates this SA is more
promising and precise than the fall back option, i.e. using wild card
source address for searching less suitable SA.

So, here bail out, and try again.

Signed-off-by: Fan Du <redacted>

This looks ok, I'll take this into ipsec-next as soon as I can
update the tree.

Now applied to ipsec-next, thanks!