linux/net/xfrm
David S. Miller d49c73c729 [IPSEC]: Validate properly in xfrm_dst_check()
If dst->obsolete is -1, this is a signal from the
bundle creator that we want the XFRM dst and the
dsts that it references to be validated on every
use.

I misunderstood this intention when I changed
xfrm_dst_check() to always return NULL.

Now, when we purge a dst entry, by running dst_free()
on it.  This will set the dst->obsolete to a positive
integer, and we want to return NULL in that case so
that the socket does a relookup for the route.

Thus, if dst->obsolete<0, let stale_bundle() validate
the state, else always return NULL.

In general, we need to do things more intelligently
here because we flush too much state during rule
changes.  Herbert Xu has some ideas wherein the key
manager gives us some help in this area.  We can also
use smarter state management algorithms inside of
the kernel as well.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-13 18:55:53 -07:00
..
Kconfig [NET]: move config options out to individual protocols 2005-07-11 21:13:56 -07:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
xfrm_algo.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
xfrm_input.c [NET]: Fix "ntohl(ntohs" bugs 2006-05-22 16:53:22 -07:00
xfrm_policy.c [IPSEC]: Validate properly in xfrm_dst_check() 2006-08-13 18:55:53 -07:00
xfrm_state.c [NET]: Conversions from kmalloc+memset to k(z|c)alloc. 2006-07-21 14:51:30 -07:00
xfrm_user.c [NETLINK]: Encapsulate eff_cap usage within security framework. 2006-06-29 16:57:55 -07:00