@@ -328,7 +328,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
struct xfrm_user_sec_ctx sctx;
char str[CTX_BUF_SIZE];
} ctx = {};
- __u32 output_mark = 0;
+ struct xfrm_mark output_mark = {0, 0};
bool is_if_id_set = false;
__u32 if_id = 0;
@@ -447,9 +447,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
is_offload = false;
}
} else if (strcmp(*argv, "output-mark") == 0) {
- NEXT_ARG();
- if (get_u32(&output_mark, *argv, 0))
- invarg("value after \"output-mark\" is invalid", *argv);
+ xfrm_parse_mark(&output_mark, &argc, &argv);
} else if (strcmp(*argv, "if_id") == 0) {
NEXT_ARG();
if (get_u32(&if_id, *argv, 0))
@@ -741,8 +739,11 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
}
- if (output_mark)
- addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark);
+ if (output_mark.v)
+ addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark.v);
+ if (output_mark.m)
+ addattr32(&req.n, sizeof(req.buf), XFRMA_SET_MARK_MASK,
+ output_mark.m);
if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
exit(1);
The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+) It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18) It is optional and the kernel default is 0xffffffff e.g. ./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \ auth digest_null 0 enc cipher_null '' ip xfrm state src 0.0.0.0 dst 0.0.0.0 proto esp spi 0x00000000 reqid 0 mode transport replay-window 0 output-mark 0x6/0xab auth-trunc digest_null 0x30 0 enc ecb(cipher_null) anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0 NOTE: a disadavantage of this version: error message would be the same for the option 'mark' and 'output-mark' e.g ./ip/ip xfrm state add output-mark 0xZZ mask 0xab proto \ esp auth digest_null 0 enc cipher_null '' Error: argument "0xZZ" is wrong: MARK value is invalid ./ip/ip xfrm state add mark 0xZZ mask 0xab proto esp auth \ digest_null 0 enc cipher_null '' Error: argument "0xZZ" is wrong: MARK value is invalid Signed-off-by: Antony Antony <antony@phenome.org> --- ip/xfrm_state.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)