summaryrefslogtreecommitdiff
path: root/include/net/dst.h
diff options
context:
space:
mode:
authorSteffen Klassert <steffen.klassert@secunet.com>2014-09-16 12:08:40 +0400
committerSteffen Klassert <steffen.klassert@secunet.com>2014-09-16 12:08:40 +0400
commitf92ee61982d6da15a9e49664ecd6405a15a2ee56 (patch)
tree014f5e6b027f1446b5bda041382b30262868bf86 /include/net/dst.h
parent95cd6f488d164de462a8279e802a0ad05c33d167 (diff)
downloadlinux-f92ee61982d6da15a9e49664ecd6405a15a2ee56.tar.xz
xfrm: Generate blackhole routes only from route lookup functions
Currently we genarate a blackhole route route whenever we have matching policies but can not resolve the states. Here we assume that dst_output() is called to kill the balckholed packets. Unfortunately this assumption is not true in all cases, so it is possible that these packets leave the system unwanted. We fix this by generating blackhole routes only from the route lookup functions, here we can guarantee a call to dst_output() afterwards. Fixes: 2774c131b1d ("xfrm: Handle blackhole route creation via afinfo.") Reported-by: Konstantinos Kolelis <k.kolelis@sirrix.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'include/net/dst.h')
-rw-r--r--include/net/dst.h15
1 files changed, 14 insertions, 1 deletions
diff --git a/include/net/dst.h b/include/net/dst.h
index 71c60f42be48..fa11c904d219 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -490,7 +490,16 @@ static inline struct dst_entry *xfrm_lookup(struct net *net,
int flags)
{
return dst_orig;
-}
+}
+
+static inline struct dst_entry *xfrm_lookup_route(struct net *net,
+ struct dst_entry *dst_orig,
+ const struct flowi *fl,
+ struct sock *sk,
+ int flags)
+{
+ return dst_orig;
+}
static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
{
@@ -502,6 +511,10 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
const struct flowi *fl, struct sock *sk,
int flags);
+struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
+ const struct flowi *fl, struct sock *sk,
+ int flags);
+
/* skb attached with this dst needs transformation if dst->xfrm is valid */
static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
{