policy-sleep-2.6.17.14.patch

Host Identity Protocol on Linux is an implemetation of the Host Identity Protocol (HIP) and the rela

diff -urN linux-2.6.17.14/include/linux/xfrm.h linux-2.6.17.14-sleep/include/linux/xfrm.h
--- linux-2.6.17.14/include/linux/xfrm.h	2006-12-20 01:41:18.000000000 +0200
+++ linux-2.6.17.14-sleep/include/linux/xfrm.h	2006-12-20 01:42:22.000000000 +0200
@@ -43,6 +43,12 @@
 #define XFRM_SC_ALG_RESERVED 0
 #define XFRM_SC_ALG_SELINUX 1
 
+/* Transport layer flag  passed to xfrm_lookup. If set, the userspace
+   process sleeps in a waitqueue until key management daemon has 
+   finished setting up security associations. This workaround exists 
+   until we have queues for outgoing IPsec packets. */
+#define XFRM_LOOKUP_SLEEP (!in_atomic() && !in_softirq())
+
 /* Selector, used as selector both on policy rules (SPD) and SAs. */
 
 struct xfrm_selector
diff -urN linux-2.6.17.14/include/net/xfrm.h linux-2.6.17.14-sleep/include/net/xfrm.h
--- linux-2.6.17.14/include/net/xfrm.h	2006-12-20 01:41:18.000000000 +0200
+++ linux-2.6.17.14-sleep/include/net/xfrm.h	2006-12-20 01:43:22.000000000 +0200
@@ -223,7 +223,7 @@
 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
 extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
-#define XFRM_ACQ_EXPIRES	30
+#define XFRM_ACQ_EXPIRES	3
 
 struct xfrm_tmpl;
 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
diff -urN linux-2.6.17.14/net/ipv4/route.c linux-2.6.17.14-sleep/net/ipv4/route.c
--- linux-2.6.17.14/net/ipv4/route.c	2006-10-13 21:55:04.000000000 +0300
+++ linux-2.6.17.14-sleep/net/ipv4/route.c	2006-12-20 01:49:45.000000000 +0200
@@ -108,6 +108,7 @@
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
+#include <linux/xfrm.h>
 
 #define RT_FL_TOS(oldflp) \
     ((u32)(oldflp->fl4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))
@@ -2618,7 +2619,7 @@
 
 int ip_route_output_key(struct rtable **rp, struct flowi *flp)
 {
-	return ip_route_output_flow(rp, flp, NULL, 0);
+	return ip_route_output_flow(rp, flp, NULL, XFRM_LOOKUP_SLEEP);
 }
 
 static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
diff -urN linux-2.6.17.14/net/ipv6/icmp.c linux-2.6.17.14-sleep/net/ipv6/icmp.c
--- linux-2.6.17.14/net/ipv6/icmp.c	2006-10-13 21:55:04.000000000 +0300
+++ linux-2.6.17.14-sleep/net/ipv6/icmp.c	2006-12-20 01:42:22.000000000 +0200
@@ -64,6 +64,7 @@
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
 #include <net/icmp.h>
+#include <linux/xfrm.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -389,7 +390,7 @@
 		goto out_dst_release;
 	}
 
-	if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+	if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0)
 		goto out;
 
 	if (ipv6_addr_is_multicast(&fl.fl6_dst))
diff -urN linux-2.6.17.14/net/ipv6/tcp_ipv6.c linux-2.6.17.14-sleep/net/ipv6/tcp_ipv6.c
--- linux-2.6.17.14/net/ipv6/tcp_ipv6.c	2006-10-13 21:55:04.000000000 +0300
+++ linux-2.6.17.14-sleep/net/ipv6/tcp_ipv6.c	2006-12-20 01:42:22.000000000 +0200
@@ -258,7 +258,7 @@
 	if (final_p)
 		ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-	if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+	if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0)
 		goto failure;
 
 	if (saddr == NULL) {
diff -urN linux-2.6.17.14/net/ipv6/udp.c linux-2.6.17.14-sleep/net/ipv6/udp.c
--- linux-2.6.17.14/net/ipv6/udp.c	2006-10-13 21:55:04.000000000 +0300
+++ linux-2.6.17.14-sleep/net/ipv6/udp.c	2006-12-20 01:42:22.000000000 +0200
@@ -789,7 +789,7 @@
 	if (final_p)
 		ipv6_addr_copy(&fl->fl6_dst, final_p);
 
-	if ((err = xfrm_lookup(&dst, fl, sk, 0)) < 0)
+	if ((err = xfrm_lookup(&dst, fl, sk, XFRM_LOOKUP_SLEEP)) < 0)
 		goto out;
 
 	if (hlimit < 0) {