You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

David S. Miller 14e50e57ae [XFRM]: Allow packet drops during larval state resolution. ... The current IPSEC rule resolution behavior we have does not work for a lot of people, even though technically it's an improvement from the -EAGAIN buisness we had before. Right now we'll block until the key manager resolves the route. That works for simple cases, but many folks would rather packets get silently dropped until the key manager resolves the IPSEC rules. We can't tell these folks to "set the socket non-blocking" because they don't have control over the non-block setting of things like the sockets used to resolve DNS deep inside of the resolver libraries in libc. With that in mind I coded up the patch below with some help from Herbert Xu which provides packet-drop behavior during larval state resolution, controllable via sysctl and off by default. This lays the framework to either: 1) Make this default at some point or... 2) Move this logic into xfrm{4,6}_policy.c and implement the ARP-like resolution queue we've all been dreaming of. The idea would be to queue packets to the policy, then once the larval state is resolved by the key manager we re-resolve the route and push the packets out. The packets would timeout if the rule didn't get resolved in a certain amount of time. Signed-off-by: David S. Miller <davem@davemloft.net>		18 years ago
..
netfilter	[NETFILTER]: Clean up table initialization	18 years ago
Kconfig	…
Makefile	…
addrconf.c	[IPV6]: Ignore ipv6 events on non-IPV6 capable devices.	18 years ago
addrconf_core.c	…
af_inet6.c	…
ah6.c	…
anycast.c	…
datagram.c	[XFRM]: Allow packet drops during larval state resolution.	18 years ago
esp6.c	…
exthdrs.c	[IPV6]: Do no rely on skb->dst before it is assigned.	18 years ago
exthdrs_core.c	…
fib6_rules.c	…
icmp.c	…
inet6_connection_sock.c	…
inet6_hashtables.c	…
ip6_fib.c	…
ip6_flowlabel.c	…
ip6_input.c	[IPV6]: Reverse sense of promisc tests in ip6_mc_input	18 years ago
ip6_output.c	[IPV6]: Send ICMPv6 error on scope violations.	18 years ago
ip6_tunnel.c	…
ipcomp6.c	…
ipv6_sockglue.c	…
mcast.c	…
mip6.c	…
ndisc.c	…
netfilter.c	…
proc.c	…
protocol.c	…
raw.c	[XFRM]: Allow packet drops during larval state resolution.	18 years ago
reassembly.c	…
route.c	[XFRM]: Allow packet drops during larval state resolution.	18 years ago
sit.c	…
sysctl_net_ipv6.c	…
tcp_ipv6.c	[XFRM]: Allow packet drops during larval state resolution.	18 years ago
tunnel6.c	…
udp.c	[XFRM]: Allow packet drops during larval state resolution.	18 years ago
udp_impl.h	[UDP]: Fix AF-specific references in AF-agnostic code.	18 years ago
udplite.c	[UDP]: Fix AF-specific references in AF-agnostic code.	18 years ago
xfrm6_input.c	…
xfrm6_mode_beet.c	…
xfrm6_mode_ro.c	…
xfrm6_mode_transport.c	…
xfrm6_mode_tunnel.c	…
xfrm6_output.c	…
xfrm6_policy.c	…
xfrm6_state.c	…
xfrm6_tunnel.c	…