[PATCH iproute2-next v3] ip-xfrm: Add support for OUTPUT_MARK
From: Subash Abhinov Kasiviswanathan <hidden>
Date: 2018-06-16 02:33:24
This patch adds support for OUTPUT_MARK in xfrm state to exercise the
functionality added by kernel commit 077fbac405bf
("net: xfrm: support setting an output mark.").
Sample output-
(with mark and output-mark)
src 192.168.1.1 dst 192.168.1.2
proto esp spi 0x00004321 reqid 0 mode tunnel
replay-window 0 flag af-unspec
mark 0x10000/0x3ffff output-mark 0x20000
auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
(with mark only)
src 192.168.1.1 dst 192.168.1.2
proto esp spi 0x00004321 reqid 0 mode tunnel
replay-window 0 flag af-unspec
mark 0x10000/0x3ffff
auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
(with output-mark only)
src 192.168.1.1 dst 192.168.1.2
proto esp spi 0x00004321 reqid 0 mode tunnel
replay-window 0 flag af-unspec
output-mark 0x20000
auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
(no mark and output-mark)
src 192.168.1.1 dst 192.168.1.2
proto esp spi 0x00004321 reqid 0 mode tunnel
replay-window 0 flag af-unspec
auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
v1->v2: Moved the XFRMA_OUTPUT_MARK print after XFRMA_MARK in
xfrm_xfrma_print() as mentioned by Lorenzo
v2->v3: Fix one help formatting error as mentioned by Lorenzo.
Keep mark and output-mark on the same line and add man page info as
mentioned by David.
Signed-off-by: Subash Abhinov Kasiviswanathan <redacted>
---
ip/ipxfrm.c | 17 ++++++++++++++++-
ip/xfrm_state.c | 9 +++++++++
man/man8/ip-xfrm.8 | 11 +++++++++++
3 files changed, 36 insertions(+), 1 deletion(-)
diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index 12c2f72..17ab4ab 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c@@ -637,6 +637,13 @@ static void xfrm_tmpl_print(struct xfrm_user_tmpl *tmpls, int len, } } +static void xfrm_output_mark_print(struct rtattr *tb[], FILE *fp) +{ + __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]); + + fprintf(fp, "output-mark 0x%x", output_mark); +} + int xfrm_parse_mark(struct xfrm_mark *mark, int *argcp, char ***argvp) { int argc = *argcp;
@@ -677,7 +684,15 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family, struct rtattr *rta = tb[XFRMA_MARK]; struct xfrm_mark *m = RTA_DATA(rta); - fprintf(fp, "\tmark %#x/%#x", m->v, m->m); + fprintf(fp, "\tmark %#x/%#x ", m->v, m->m); + + if (tb[XFRMA_OUTPUT_MARK]) + xfrm_output_mark_print(tb, fp); + fprintf(fp, "%s", _SL_); + } else if (tb[XFRMA_OUTPUT_MARK]) { + fprintf(fp, "\t"); + + xfrm_output_mark_print(tb, fp); fprintf(fp, "%s", _SL_); }
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index 85d959c..913e9fa 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c@@ -61,6 +61,7 @@ static void usage(void) fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"); fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"); fprintf(stderr, " [ offload [dev DEV] dir DIR ]\n"); + fprintf(stderr, " [ output-mark OUTPUT-MARK ]\n"); fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"); fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n"); fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
@@ -322,6 +323,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) struct xfrm_user_sec_ctx sctx; char str[CTX_BUF_SIZE]; } ctx = {}; + __u32 output_mark = 0; while (argc > 0) { if (strcmp(*argv, "mode") == 0) {
@@ -437,6 +439,10 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) invarg("value after \"offload dir\" is invalid", *argv); is_offload = false; } + } else if (strcmp(*argv, "output-mark") == 0) { + NEXT_ARG(); + if (get_u32(&output_mark, *argv, 0)) + invarg("value after \"output-mark\" is invalid", *argv); } else { /* try to assume ALGO */ int type = xfrm_algotype_getbyname(*argv);
@@ -720,6 +726,9 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) } } + if (output_mark) + addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark); + if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0) exit(1);
diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8
index 988cc6a..839e06a 100644
--- a/man/man8/ip-xfrm.8
+++ b/man/man8/ip-xfrm.8@@ -59,6 +59,8 @@ ip-xfrm \- transform configuration .IR CTX " ]" .RB "[ " extra-flag .IR EXTRA-FLAG-LIST " ]" +.RB "[ " output-mark +.IR OUTPUT-MARK " ]" .ti -8 .B "ip xfrm state allocspi"
@@ -537,6 +539,15 @@ encapsulates packets with protocol .RI "using source port " SPORT ", destination port " DPORT .RI ", and original address " OADDR "." +.TP +.I MARK +used to match xfrm policies and states + +.TP +.I OUTPUT-MARK +used to set the output mark to influence the routing +of the packets emitted by the state + .sp .PP .TS
--
1.9.1