netns xfrm: per-netns MIBs · tjh.dev/kernel@59c9940

+3

include/net/netns/mib.h

··· 20 20 DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics); 21 21 DEFINE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg_statistics); 22 22 #endif 23 + #ifdef CONFIG_XFRM_STATISTICS 24 + DEFINE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics); 25 + #endif 23 26 }; 24 27 25 28 #endif

+6 -7

include/net/xfrm.h

··· 38 38 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 39 39 40 40 #ifdef CONFIG_XFRM_STATISTICS 41 - DECLARE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics); 42 - #define XFRM_INC_STATS(field) SNMP_INC_STATS(xfrm_statistics, field) 43 - #define XFRM_INC_STATS_BH(field) SNMP_INC_STATS_BH(xfrm_statistics, field) 44 - #define XFRM_INC_STATS_USER(field) SNMP_INC_STATS_USER(xfrm_statistics, field) 41 + #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 42 + #define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field) 43 + #define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field) 45 44 #else 46 - #define XFRM_INC_STATS(field) 47 - #define XFRM_INC_STATS_BH(field) 48 - #define XFRM_INC_STATS_USER(field) 45 + #define XFRM_INC_STATS(net, field) ((void)(net)) 46 + #define XFRM_INC_STATS_BH(net, field) ((void)(net)) 47 + #define XFRM_INC_STATS_USER(net, field) ((void)(net)) 49 48 #endif 50 49 51 50 extern u32 sysctl_xfrm_aevent_etime;

+5 -4

net/ipv6/xfrm6_input.c

··· 58 58 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 59 59 xfrm_address_t *saddr, u8 proto) 60 60 { 61 + struct net *net = dev_net(skb->dev); 61 62 struct xfrm_state *x = NULL; 62 63 int i = 0; 63 64 ··· 68 67 69 68 sp = secpath_dup(skb->sp); 70 69 if (!sp) { 71 - XFRM_INC_STATS(LINUX_MIB_XFRMINERROR); 70 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR); 72 71 goto drop; 73 72 } 74 73 if (skb->sp) ··· 77 76 } 78 77 79 78 if (1 + skb->sp->len == XFRM_MAX_DEPTH) { 80 - XFRM_INC_STATS(LINUX_MIB_XFRMINBUFFERERROR); 79 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 81 80 goto drop; 82 81 } 83 82 ··· 101 100 break; 102 101 } 103 102 104 - x = xfrm_state_lookup_byaddr(&init_net, dst, src, proto, AF_INET6); 103 + x = xfrm_state_lookup_byaddr(net, dst, src, proto, AF_INET6); 105 104 if (!x) 106 105 continue; 107 106 ··· 123 122 } 124 123 125 124 if (!x) { 126 - XFRM_INC_STATS(LINUX_MIB_XFRMINNOSTATES); 125 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); 127 126 xfrm_audit_state_notfound_simple(skb, AF_INET6); 128 127 goto drop; 129 128 }

+11 -11

net/xfrm/xfrm_input.c

··· 128 128 129 129 sp = secpath_dup(skb->sp); 130 130 if (!sp) { 131 - XFRM_INC_STATS(LINUX_MIB_XFRMINERROR); 131 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR); 132 132 goto drop; 133 133 } 134 134 if (skb->sp) ··· 142 142 143 143 seq = 0; 144 144 if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) { 145 - XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR); 145 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR); 146 146 goto drop; 147 147 } 148 148 149 149 do { 150 150 if (skb->sp->len == XFRM_MAX_DEPTH) { 151 - XFRM_INC_STATS(LINUX_MIB_XFRMINBUFFERERROR); 151 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 152 152 goto drop; 153 153 } 154 154 155 155 x = xfrm_state_lookup(net, daddr, spi, nexthdr, family); 156 156 if (x == NULL) { 157 - XFRM_INC_STATS(LINUX_MIB_XFRMINNOSTATES); 157 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); 158 158 xfrm_audit_state_notfound(skb, family, spi, seq); 159 159 goto drop; 160 160 } ··· 163 163 164 164 spin_lock(&x->lock); 165 165 if (unlikely(x->km.state != XFRM_STATE_VALID)) { 166 - XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEINVALID); 166 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID); 167 167 goto drop_unlock; 168 168 } 169 169 170 170 if ((x->encap ? x->encap->encap_type : 0) != encap_type) { 171 - XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMISMATCH); 171 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH); 172 172 goto drop_unlock; 173 173 } 174 174 175 175 if (x->props.replay_window && xfrm_replay_check(x, skb, seq)) { 176 - XFRM_INC_STATS(LINUX_MIB_XFRMINSTATESEQERROR); 176 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR); 177 177 goto drop_unlock; 178 178 } 179 179 180 180 if (xfrm_state_check_expire(x)) { 181 - XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEEXPIRED); 181 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEEXPIRED); 182 182 goto drop_unlock; 183 183 } 184 184 ··· 199 199 x->type->proto); 200 200 x->stats.integrity_failed++; 201 201 } 202 - XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEPROTOERROR); 202 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEPROTOERROR); 203 203 goto drop_unlock; 204 204 } 205 205 ··· 225 225 } 226 226 227 227 if (inner_mode->input(x, skb)) { 228 - XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMODEERROR); 228 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR); 229 229 goto drop; 230 230 } 231 231 ··· 243 243 244 244 err = xfrm_parse_spi(skb, nexthdr, &spi, &seq); 245 245 if (err < 0) { 246 - XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR); 246 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR); 247 247 goto drop; 248 248 } 249 249 } while (!err);

+8 -7

net/xfrm/xfrm_output.c

··· 49 49 do { 50 50 err = xfrm_state_check_space(x, skb); 51 51 if (err) { 52 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); 52 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 53 53 goto error_nolock; 54 54 } 55 55 56 56 err = x->outer_mode->output(x, skb); 57 57 if (err) { 58 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEMODEERROR); 58 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR); 59 59 goto error_nolock; 60 60 } 61 61 62 62 spin_lock_bh(&x->lock); 63 63 err = xfrm_state_check_expire(x); 64 64 if (err) { 65 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEEXPIRED); 65 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); 66 66 goto error; 67 67 } 68 68 69 69 if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { 70 70 XFRM_SKB_CB(skb)->seq.output = ++x->replay.oseq; 71 71 if (unlikely(x->replay.oseq == 0)) { 72 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATESEQERROR); 72 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); 73 73 x->replay.oseq--; 74 74 xfrm_audit_state_replay_overflow(x, skb); 75 75 err = -EOVERFLOW; ··· 90 90 91 91 resume: 92 92 if (err) { 93 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEPROTOERROR); 93 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR); 94 94 goto error_nolock; 95 95 } 96 96 97 97 if (!(skb->dst = dst_pop(dst))) { 98 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); 98 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 99 99 err = -EHOSTUNREACH; 100 100 goto error_nolock; 101 101 } ··· 179 179 180 180 int xfrm_output(struct sk_buff *skb) 181 181 { 182 + struct net *net = dev_net(skb->dst->dev); 182 183 int err; 183 184 184 185 if (skb_is_gso(skb)) ··· 188 187 if (skb->ip_summed == CHECKSUM_PARTIAL) { 189 188 err = skb_checksum_help(skb); 190 189 if (err) { 191 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); 190 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 192 191 kfree_skb(skb); 193 192 return err; 194 193 }

+47 -35

net/xfrm/xfrm_policy.c

··· 36 36 37 37 int sysctl_xfrm_larval_drop __read_mostly = 1; 38 38 39 - #ifdef CONFIG_XFRM_STATISTICS 40 - DEFINE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics) __read_mostly; 41 - EXPORT_SYMBOL(xfrm_statistics); 42 - #endif 43 - 44 39 DEFINE_MUTEX(xfrm_cfg_mutex); 45 40 EXPORT_SYMBOL(xfrm_cfg_mutex); 46 41 ··· 1565 1570 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); 1566 1571 err = PTR_ERR(policy); 1567 1572 if (IS_ERR(policy)) { 1568 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLERROR); 1573 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); 1569 1574 goto dropdst; 1570 1575 } 1571 1576 } ··· 1580 1585 dir, xfrm_policy_lookup); 1581 1586 err = PTR_ERR(policy); 1582 1587 if (IS_ERR(policy)) { 1583 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLERROR); 1588 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); 1584 1589 goto dropdst; 1585 1590 } 1586 1591 } ··· 1603 1608 default: 1604 1609 case XFRM_POLICY_BLOCK: 1605 1610 /* Prohibit the flow */ 1606 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLBLOCK); 1611 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLBLOCK); 1607 1612 err = -EPERM; 1608 1613 goto error; 1609 1614 ··· 1623 1628 */ 1624 1629 dst = xfrm_find_bundle(fl, policy, family); 1625 1630 if (IS_ERR(dst)) { 1626 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1631 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1627 1632 err = PTR_ERR(dst); 1628 1633 goto error; 1629 1634 } ··· 1639 1644 XFRM_POLICY_OUT); 1640 1645 if (pols[1]) { 1641 1646 if (IS_ERR(pols[1])) { 1642 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLERROR); 1647 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); 1643 1648 err = PTR_ERR(pols[1]); 1644 1649 goto error; 1645 1650 } 1646 1651 if (pols[1]->action == XFRM_POLICY_BLOCK) { 1647 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLBLOCK); 1652 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLBLOCK); 1648 1653 err = -EPERM; 1649 1654 goto error; 1650 1655 } ··· 1675 1680 /* EREMOTE tells the caller to generate 1676 1681 * a one-shot blackhole route. 1677 1682 */ 1678 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTNOSTATES); 1683 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1679 1684 xfrm_pol_put(policy); 1680 1685 return -EREMOTE; 1681 1686 } ··· 1691 1696 nx = xfrm_tmpl_resolve(pols, npols, fl, xfrm, family); 1692 1697 1693 1698 if (nx == -EAGAIN && signal_pending(current)) { 1694 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTNOSTATES); 1699 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1695 1700 err = -ERESTART; 1696 1701 goto error; 1697 1702 } ··· 1703 1708 err = nx; 1704 1709 } 1705 1710 if (err < 0) { 1706 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTNOSTATES); 1711 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); 1707 1712 goto error; 1708 1713 } 1709 1714 } ··· 1716 1721 dst = xfrm_bundle_create(policy, xfrm, nx, fl, dst_orig); 1717 1722 err = PTR_ERR(dst); 1718 1723 if (IS_ERR(dst)) { 1719 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLEGENERROR); 1724 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLEGENERROR); 1720 1725 goto error; 1721 1726 } 1722 1727 ··· 1737 1742 dst_free(dst); 1738 1743 1739 1744 if (pol_dead) 1740 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTPOLDEAD); 1745 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLDEAD); 1741 1746 else 1742 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1747 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1743 1748 err = -EHOSTUNREACH; 1744 1749 goto error; 1745 1750 } ··· 1751 1756 if (unlikely(err)) { 1752 1757 write_unlock_bh(&policy->lock); 1753 1758 dst_free(dst); 1754 - XFRM_INC_STATS(LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1759 + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR); 1755 1760 goto error; 1756 1761 } 1757 1762 ··· 1907 1912 fl_dir = policy_to_flow_dir(dir); 1908 1913 1909 1914 if (__xfrm_decode_session(skb, &fl, family, reverse) < 0) { 1910 - XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR); 1915 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR); 1911 1916 return 0; 1912 1917 } 1913 1918 ··· 1920 1925 for (i=skb->sp->len-1; i>=0; i--) { 1921 1926 struct xfrm_state *x = skb->sp->xvec[i]; 1922 1927 if (!xfrm_selector_match(&x->sel, &fl, family)) { 1923 - XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMISMATCH); 1928 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH); 1924 1929 return 0; 1925 1930 } 1926 1931 } ··· 1930 1935 if (sk && sk->sk_policy[dir]) { 1931 1936 pol = xfrm_sk_policy_lookup(sk, dir, &fl); 1932 1937 if (IS_ERR(pol)) { 1933 - XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR); 1938 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 1934 1939 return 0; 1935 1940 } 1936 1941 } ··· 1940 1945 xfrm_policy_lookup); 1941 1946 1942 1947 if (IS_ERR(pol)) { 1943 - XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR); 1948 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 1944 1949 return 0; 1945 1950 } 1946 1951 1947 1952 if (!pol) { 1948 1953 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) { 1949 1954 xfrm_secpath_reject(xerr_idx, skb, &fl); 1950 - XFRM_INC_STATS(LINUX_MIB_XFRMINNOPOLS); 1955 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS); 1951 1956 return 0; 1952 1957 } 1953 1958 return 1; ··· 1964 1969 XFRM_POLICY_IN); 1965 1970 if (pols[1]) { 1966 1971 if (IS_ERR(pols[1])) { 1967 - XFRM_INC_STATS(LINUX_MIB_XFRMINPOLERROR); 1972 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); 1968 1973 return 0; 1969 1974 } 1970 1975 pols[1]->curlft.use_time = get_seconds(); ··· 1988 1993 for (pi = 0; pi < npols; pi++) { 1989 1994 if (pols[pi] != pol && 1990 1995 pols[pi]->action != XFRM_POLICY_ALLOW) { 1991 - XFRM_INC_STATS(LINUX_MIB_XFRMINPOLBLOCK); 1996 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK); 1992 1997 goto reject; 1993 1998 } 1994 1999 if (ti + pols[pi]->xfrm_nr >= XFRM_MAX_DEPTH) { 1995 - XFRM_INC_STATS(LINUX_MIB_XFRMINBUFFERERROR); 2000 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 1996 2001 goto reject_error; 1997 2002 } 1998 2003 for (i = 0; i < pols[pi]->xfrm_nr; i++) ··· 2016 2021 if (k < -1) 2017 2022 /* "-2 - errored_index" returned */ 2018 2023 xerr_idx = -(2+k); 2019 - XFRM_INC_STATS(LINUX_MIB_XFRMINTMPLMISMATCH); 2024 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH); 2020 2025 goto reject; 2021 2026 } 2022 2027 } 2023 2028 2024 2029 if (secpath_has_nontransport(sp, k, &xerr_idx)) { 2025 - XFRM_INC_STATS(LINUX_MIB_XFRMINTMPLMISMATCH); 2030 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH); 2026 2031 goto reject; 2027 2032 } 2028 2033 2029 2034 xfrm_pols_put(pols, npols); 2030 2035 return 1; 2031 2036 } 2032 - XFRM_INC_STATS(LINUX_MIB_XFRMINPOLBLOCK); 2037 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLBLOCK); 2033 2038 2034 2039 reject: 2035 2040 xfrm_secpath_reject(xerr_idx, skb, &fl); ··· 2046 2051 2047 2052 if (xfrm_decode_session(skb, &fl, family) < 0) { 2048 2053 /* XXX: we should have something like FWDHDRERROR here. */ 2049 - XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR); 2054 + XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR); 2050 2055 return 0; 2051 2056 } 2052 2057 ··· 2375 2380 }; 2376 2381 2377 2382 #ifdef CONFIG_XFRM_STATISTICS 2378 - static int __init xfrm_statistics_init(void) 2383 + static int __net_init xfrm_statistics_init(struct net *net) 2379 2384 { 2380 - if (snmp_mib_init((void **)xfrm_statistics, 2385 + if (snmp_mib_init((void **)net->mib.xfrm_statistics, 2381 2386 sizeof(struct linux_xfrm_mib)) < 0) 2382 2387 return -ENOMEM; 2383 2388 return 0; 2389 + } 2390 + 2391 + static void xfrm_statistics_fini(struct net *net) 2392 + { 2393 + snmp_mib_free((void **)net->mib.xfrm_statistics); 2394 + } 2395 + #else 2396 + static int __net_init xfrm_statistics_init(struct net *net) 2397 + { 2398 + return 0; 2399 + } 2400 + 2401 + static void xfrm_statistics_fini(struct net *net) 2402 + { 2384 2403 } 2385 2404 #endif 2386 2405 ··· 2489 2480 { 2490 2481 int rv; 2491 2482 2483 + rv = xfrm_statistics_init(net); 2484 + if (rv < 0) 2485 + goto out_statistics; 2492 2486 rv = xfrm_state_init(net); 2493 2487 if (rv < 0) 2494 2488 goto out_state; ··· 2503 2491 out_policy: 2504 2492 xfrm_state_fini(net); 2505 2493 out_state: 2494 + xfrm_statistics_fini(net); 2495 + out_statistics: 2506 2496 return rv; 2507 2497 } 2508 2498 ··· 2512 2498 { 2513 2499 xfrm_policy_fini(net); 2514 2500 xfrm_state_fini(net); 2501 + xfrm_statistics_fini(net); 2515 2502 } 2516 2503 2517 2504 static struct pernet_operations __net_initdata xfrm_net_ops = { ··· 2523 2508 void __init xfrm_init(void) 2524 2509 { 2525 2510 register_pernet_subsys(&xfrm_net_ops); 2526 - #ifdef CONFIG_XFRM_STATISTICS 2527 - xfrm_statistics_init(); 2528 - #endif 2529 2511 xfrm_input_init(); 2530 2512 #ifdef CONFIG_XFRM_STATISTICS 2531 2513 xfrm_proc_init();

+1 -1

net/xfrm/xfrm_proc.c

··· 62 62 int i; 63 63 for (i=0; xfrm_mib_list[i].name; i++) 64 64 seq_printf(seq, "%-24s\t%lu\n", xfrm_mib_list[i].name, 65 - fold_field((void **)xfrm_statistics, 65 + fold_field((void **)init_net.mib.xfrm_statistics, 66 66 xfrm_mib_list[i].entry)); 67 67 return 0; 68 68 }