Commit e4c17216 authored by Paul Moore's avatar Paul Moore Committed by David S. Miller
Browse files

xfrm: force a garbage collection after deleting a policy 



In some cases after deleting a policy from the SPD the policy would
remain in the dst/flow/route cache for an extended period of time
which caused problems for SELinux as its dynamic network access
controls key off of the number of XFRM policy and state entries.
This patch corrects this problem by forcing a XFRM garbage collection
whenever a policy is sucessfully removed.

Reported-by: default avatarOndrej Moris <omoris@redhat.com>
Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1e2bd517

include/net/xfrm.h

+5 −0
Original line number Diff line number Diff line
@@ -1160,6 +1160,8 @@ static inline void xfrm_sk_free_policy(struct sock *sk) 
	}

}



extern void xfrm_garbage_collect(struct net *net);



#else



static inline void xfrm_sk_free_policy(struct sock *sk) {}
@@ -1194,6 +1196,9 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 
{

	return 1;

}

static inline void xfrm_garbage_collect(struct net *net)

{

}

#endif



static __inline__

net/key/af_key.c

+4 −0
Original line number Diff line number Diff line
@@ -2366,6 +2366,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa 


out:

	xfrm_pol_put(xp);

	if (err == 0)

		xfrm_garbage_collect(net);

	return err;

}
@@ -2615,6 +2617,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_ 


out:

	xfrm_pol_put(xp);

	if (delete && err == 0)

		xfrm_garbage_collect(net);

	return err;

}

net/xfrm/xfrm_policy.c

+2 −1
Original line number Diff line number Diff line
@@ -2557,11 +2557,12 @@ static void __xfrm_garbage_collect(struct net *net) 
	}

}



static void xfrm_garbage_collect(struct net *net)

void xfrm_garbage_collect(struct net *net)

{

	flow_cache_flush();

	__xfrm_garbage_collect(net);

}

EXPORT_SYMBOL(xfrm_garbage_collect);



static void xfrm_garbage_collect_deferred(struct net *net)

{

net/xfrm/xfrm_user.c

+2 −0
Original line number Diff line number Diff line
@@ -1681,6 +1681,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 


out:

	xfrm_pol_put(xp);

	if (delete && err == 0)

		xfrm_garbage_collect(net);

	return err;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE