| Message ID | 1356681988-7985-1-git-send-email-roy.qing.li@gmail.com |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | David Miller |
| Headers | show |
From: roy.qing.li@gmail.com Date: Fri, 28 Dec 2012 16:06:28 +0800 > From: Li RongQing <roy.qing.li@gmail.com> > > Remove the check if x->km.state equal to XFRM_STATE_VALID in > xfrm_state_check_expire(), which will be done before call > xfrm_state_check_expire(). > > add a LINUX_MIB_XFRMOUTSTATEINVALID statistic to record the > outbound error due to invalid xfrm state. > > Signed-off-by: Li RongQing <roy.qing.li@gmail.com> I'll let Steffen pick this up when he returns from his holiday break. Please CC: him on all IPSEC changes since he is the primary IPSEC maintainer and is the one who will integrate your IPSEC patches into his ipsec GIT tree. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Fri, Dec 28, 2012 at 03:22:35PM -0800, David Miller wrote: > From: roy.qing.li@gmail.com > Date: Fri, 28 Dec 2012 16:06:28 +0800 > > > From: Li RongQing <roy.qing.li@gmail.com> > > > > Remove the check if x->km.state equal to XFRM_STATE_VALID in > > xfrm_state_check_expire(), which will be done before call > > xfrm_state_check_expire(). > > > > add a LINUX_MIB_XFRMOUTSTATEINVALID statistic to record the > > outbound error due to invalid xfrm state. > > > > Signed-off-by: Li RongQing <roy.qing.li@gmail.com> > > I'll let Steffen pick this up when he returns from his holiday > break. I'll take care of all the pending IPsec patches once I'm back at office on monday. Thanks for your patience. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Fri, Dec 28, 2012 at 04:06:28PM +0800, roy.qing.li@gmail.com wrote: > From: Li RongQing <roy.qing.li@gmail.com> > > Remove the check if x->km.state equal to XFRM_STATE_VALID in > xfrm_state_check_expire(), which will be done before call > xfrm_state_check_expire(). > > add a LINUX_MIB_XFRMOUTSTATEINVALID statistic to record the > outbound error due to invalid xfrm state. > > Signed-off-by: Li RongQing <roy.qing.li@gmail.com> Applied to ipsec-next, Thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h index fdfba23..b49eab8 100644 --- a/include/uapi/linux/snmp.h +++ b/include/uapi/linux/snmp.h @@ -278,6 +278,7 @@ enum LINUX_MIB_XFRMOUTPOLDEAD, /* XfrmOutPolDead */ LINUX_MIB_XFRMOUTPOLERROR, /* XfrmOutPolError */ LINUX_MIB_XFRMFWDHDRERROR, /* XfrmFwdHdrError*/ + LINUX_MIB_XFRMOUTSTATEINVALID, /* XfrmOutStateInvalid */ __LINUX_MIB_XFRMMAX }; diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index 95a338c..3670526 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -61,6 +61,12 @@ static int xfrm_output_one(struct sk_buff *skb, int err) } spin_lock_bh(&x->lock); + + if (unlikely(x->km.state != XFRM_STATE_VALID)) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); + goto error_nolock; + } + err = xfrm_state_check_expire(x); if (err) { XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c index d0a1af8..6039038 100644 --- a/net/xfrm/xfrm_proc.c +++ b/net/xfrm/xfrm_proc.c @@ -43,6 +43,7 @@ static const struct snmp_mib xfrm_mib_list[] = { SNMP_MIB_ITEM("XfrmOutPolDead", LINUX_MIB_XFRMOUTPOLDEAD), SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR), SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR), + SNMP_MIB_ITEM("XfrmOutStateInvalid", LINUX_MIB_XFRMOUTSTATEINVALID), SNMP_MIB_SENTINEL }; diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 3459692..05db236 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1370,9 +1370,6 @@ int xfrm_state_check_expire(struct xfrm_state *x) if (!x->curlft.use_time) x->curlft.use_time = get_seconds(); - if (x->km.state != XFRM_STATE_VALID) - return -EINVAL; - if (x->curlft.bytes >= x->lft.hard_byte_limit || x->curlft.packets >= x->lft.hard_packet_limit) { x->km.state = XFRM_STATE_EXPIRED;