diff mbox series

[iproute2-net,v2] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states

Message ID 20201002132238.GA36488@AntonyAntony.local
State Accepted
Delegated to: David Ahern
Headers show
Series [iproute2-net,v2] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states | expand

Commit Message

Antony Antony Oct. 2, 2020, 1:22 p.m. UTC 
The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+)
It is optional and the kernel default is 0xffffffff
It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18)

e.g.
./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \
 auth digest_null 0 enc cipher_null ''
ip xfrm state
src 0.0.0.0 dst 0.0.0.0
	proto esp spi 0x00000000 reqid 0 mode transport
	replay-window 0
	output-mark 0x6/0xab
	auth-trunc digest_null 0x30 0
	enc ecb(cipher_null)
	anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
	sel src 0.0.0.0/0 dst 0.0.0.0/0

Signed-off-by: Antony Antony <antony@phenome.org>
---
 v1 -> v2
  - add man page and usage for mask
--
 ip/xfrm_state.c    | 23 ++++++++++++++++++-----
 man/man8/ip-xfrm.8 |  4 +++-
 2 files changed, 21 insertions(+), 6 deletions(-)

Comments

David Ahern Oct. 7, 2020, 6:11 a.m. UTC | #1 
On 10/2/20 6:22 AM, Antony Antony wrote:
> The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+)
> It is optional and the kernel default is 0xffffffff
> It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18)
> 
> e.g.
> ./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \
>  auth digest_null 0 enc cipher_null ''
> ip xfrm state
> src 0.0.0.0 dst 0.0.0.0
> 	proto esp spi 0x00000000 reqid 0 mode transport
> 	replay-window 0
> 	output-mark 0x6/0xab
> 	auth-trunc digest_null 0x30 0
> 	enc ecb(cipher_null)
> 	anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
> 	sel src 0.0.0.0/0 dst 0.0.0.0/0
> 
> Signed-off-by: Antony Antony <antony@phenome.org>
> ---
>  v1 -> v2
>   - add man page and usage for mask
> --
>  ip/xfrm_state.c    | 23 ++++++++++++++++++-----
>  man/man8/ip-xfrm.8 |  4 +++-
>  2 files changed, 21 insertions(+), 6 deletions(-)
> 
applied to iproute2-next. Thanks
diff mbox series

Patch

diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index ddf784ca..a4f452fa 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -62,7 +62,7 @@  static void usage(void)
 		"        [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"
 		"        [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"
 		"        [ offload [dev DEV] dir DIR ]\n"
-		"        [ output-mark OUTPUT-MARK ]\n"
+		"        [ output-mark OUTPUT-MARK [ mask MASK ] ]\n"
 		"        [ if_id IF_ID ]\n"
 		"Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"
 		"        [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n"
@@ -328,7 +328,7 @@  static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
 		struct xfrm_user_sec_ctx sctx;
 		char    str[CTX_BUF_SIZE];
 	} ctx = {};
-	__u32 output_mark = 0;
+	struct xfrm_mark output_mark = {0, 0};
 	bool is_if_id_set = false;
 	__u32 if_id = 0;
 
@@ -448,8 +448,18 @@  static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
 			}
 		} else if (strcmp(*argv, "output-mark") == 0) {
 			NEXT_ARG();
-			if (get_u32(&output_mark, *argv, 0))
+			if (get_u32(&output_mark.v, *argv, 0))
 				invarg("value after \"output-mark\" is invalid", *argv);
+			if (argc > 1) {
+				NEXT_ARG();
+				if (strcmp(*argv, "mask") == 0) {
+					NEXT_ARG();
+					if (get_u32(&output_mark.m, *argv, 0))
+						invarg("mask value is invalid\n", *argv);
+				} else {
+					PREV_ARG();
+				}
+			}
 		} else if (strcmp(*argv, "if_id") == 0) {
 			NEXT_ARG();
 			if (get_u32(&if_id, *argv, 0))
@@ -741,8 +751,11 @@  static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
 		}
 	}
 
-	if (output_mark)
-		addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark);
+	if (output_mark.v)
+		addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark.v);
+
+	if (output_mark.m)
+		addattr32(&req.n, sizeof(req.buf), XFRMA_SET_MARK_MASK, output_mark.m);
 
 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 		exit(1);
diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8
index 4fa31651..2669b386 100644
--- a/man/man8/ip-xfrm.8
+++ b/man/man8/ip-xfrm.8
@@ -60,7 +60,9 @@  ip-xfrm \- transform configuration
 .RB "[ " extra-flag
 .IR EXTRA-FLAG-LIST " ]"
 .RB "[ " output-mark
-.IR OUTPUT-MARK " ]"
+.IR OUTPUT-MARK
+.RB "[ " mask
+.IR MASK " ] ]"
 .RB "[ " if_id
 .IR IF-ID " ]"