[NETNS][IPV6]: Make icmpv6_time sysctl per namespace.

[~andy/linux] / net / ipv6 / icmp.c

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 1659d2fb01fee445eaeae74470cf3c98c56b51b5..5395afe55ca5a0e61b03f07eb10400625d9a0b0a 100644 (file)
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -154,8 +154,6 @@ static int is_ineligible(struct sk_buff *skb)
        return 0;
 }
 
-static int sysctl_icmpv6_time __read_mostly = 1*HZ;
-
 /*
  * Check the ICMP output rate limit
  */
@@ -186,7 +184,7 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
                res = 1;
        } else {
                struct rt6_info *rt = (struct rt6_info *)dst;
-               int tmo = sysctl_icmpv6_time;
+               int tmo = init_net.ipv6.sysctl.icmpv6_time;
 
                /* Give more bandwidth to wider prefixes. */
                if (rt->rt6i_dst.plen < 128)
@@ -644,10 +642,13 @@ static int icmpv6_rcv(struct sk_buff *skb)
        struct icmp6hdr *hdr;
        int type;
 
-       if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb) && skb->sp &&
-           skb->sp->xvec[skb->sp->len - 1]->props.flags & XFRM_STATE_ICMP) {
+       if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                int nh;
 
+               if (!(skb->sp && skb->sp->xvec[skb->sp->len - 1]->props.flags &
+                                XFRM_STATE_ICMP))
+                       goto drop_no_count;
+
                if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(*orig_hdr)))
                        goto drop_no_count;
 
@@ -904,16 +905,26 @@ int icmpv6_err_convert(int type, int code, int *err)
 EXPORT_SYMBOL(icmpv6_err_convert);
 
 #ifdef CONFIG_SYSCTL
-ctl_table ipv6_icmp_table[] = {
+ctl_table ipv6_icmp_table_template[] = {
        {
                .ctl_name       = NET_IPV6_ICMP_RATELIMIT,
                .procname       = "ratelimit",
-               .data           = &sysctl_icmpv6_time,
+               .data           = &init_net.ipv6.sysctl.icmpv6_time,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec
        },
        { .ctl_name = 0 },
 };
+
+struct ctl_table *ipv6_icmp_sysctl_init(struct net *net)
+{
+       struct ctl_table *table;
+
+       table = kmemdup(ipv6_icmp_table_template,
+                       sizeof(ipv6_icmp_table_template),
+                       GFP_KERNEL);
+       return table;
+}
 #endif