1. 27 12月, 2005 2 次提交
  2. 25 12月, 2005 13 次提交
  3. 24 12月, 2005 10 次提交
  4. 23 12月, 2005 13 次提交
  5. 22 12月, 2005 2 次提交
    • D
    • D
      [IPSEC]: Fix policy updates missed by sockets · 9b78a82c
      David S. Miller 提交于
      The problem is that when new policies are inserted, sockets do not see
      the update (but all new route lookups do).
      
      This bug is related to the SA insertion stale route issue solved
      recently, and this policy visibility problem can be fixed in a similar
      way.
      
      The fix is to flush out the bundles of all policies deeper than the
      policy being inserted.  Consider beginning state of "outgoing"
      direction policy list:
      
      	policy A --> policy B --> policy C --> policy D
      
      First, realize that inserting a policy into a list only potentially
      changes IPSEC routes for that direction.  Therefore we need not bother
      considering the policies for other directions.  We need only consider
      the existing policies in the list we are doing the inserting.
      
      Consider new policy "B'", inserted after B.
      
      	policy A --> policy B --> policy B' --> policy C --> policy D
      
      Two rules:
      
      1) If policy A or policy B matched before the insertion, they
         appear before B' and thus would still match after inserting
         B'
      
      2) Policy C and D, now "shadowed" and after policy B', potentially
         contain stale routes because policy B' might be selected
         instead of them.
      
      Therefore we only need flush routes assosciated with policies
      appearing after a newly inserted policy, if any.
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9b78a82c