summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorFan Du <fan.du@windriver.com>2014-01-18 09:55:27 +0800
committerSteffen Klassert <steffen.klassert@secunet.com>2014-02-12 07:02:11 +0100
commitca925cf1534ebcec332c08719a7dee6ee1782ce4 (patch)
treeaed605af36fd62ad4c5daeeac095312c96f66996 /security
parent01714109ea7e7ff4142f98a91114a97a91d34cdf (diff)
downloadlinux-ca925cf1534ebcec332c08719a7dee6ee1782ce4.tar.gz
linux-ca925cf1534ebcec332c08719a7dee6ee1782ce4.tar.bz2
linux-ca925cf1534ebcec332c08719a7dee6ee1782ce4.zip
flowcache: Make flow cache name space aware
Inserting a entry into flowcache, or flushing flowcache should be based on per net scope. The reason to do so is flushing operation from fat netns crammed with flow entries will also making the slim netns with only a few flow cache entries go away in original implementation. Since flowcache is tightly coupled with IPsec, so it would be easier to put flow cache global parameters into xfrm namespace part. And one last thing needs to do is bumping flow cache genid, and flush flow cache should also be made in per net style. Signed-off-by: Fan Du <fan.du@windriver.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'security')
-rw-r--r--security/selinux/include/xfrm.h5
1 files changed, 3 insertions, 2 deletions
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 48c3cc94c168..dfe3fda7e5f7 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -45,10 +45,11 @@ static inline void selinux_xfrm_notify_policyload(void)
{
struct net *net;
- atomic_inc(&flow_cache_genid);
rtnl_lock();
- for_each_net(net)
+ for_each_net(net) {
+ atomic_inc(&net->xfrm.flow_cache_genid);
rt_genid_bump_all(net);
+ }
rtnl_unlock();
}
#else