@@ -753,6 +753,16 @@ static int xfrm_policy_keep(const struct sockaddr_nl *who,
xpid->dir = xpinfo->dir;
xpid->index = xpinfo->index;
+ if (tb[XFRMA_MARK]) {
+ int r = addattr_l(new_n, xb->size, XFRMA_MARK,
+ RTA_DATA(tb[XFRMA_MARK]),
+ RTA_PAYLOAD(tb[XFRMA_MARK]));
+ if (r < 0) {
+ fprintf(stderr, "%s: XFRMA_MARK failed\n", __func__);
+ exit(1);
+ }
+ }
+
xb->offset += new_n->nlmsg_len;
xb->nlmsg_count++;
@@ -1081,6 +1081,7 @@ static int xfrm_state_keep(const struct sockaddr_nl *who,
int len = n->nlmsg_len;
struct nlmsghdr *new_n;
struct xfrm_usersa_id *xsid;
+ struct rtattr *tb[XFRMA_MAX+1];
if (n->nlmsg_type != XFRM_MSG_NEWSA) {
fprintf(stderr, "Not a state: %08x %08x %08x\n",
@@ -1117,6 +1118,18 @@ static int xfrm_state_keep(const struct sockaddr_nl *who,
addattr_l(new_n, xb->size, XFRMA_SRCADDR, &xsinfo->saddr,
sizeof(xsid->daddr));
+ parse_rtattr(tb, XFRMA_MAX, XFRMS_RTA(xsinfo), len);
+
+ if (tb[XFRMA_MARK]) {
+ int r = addattr_l(new_n, xb->size, XFRMA_MARK,
+ RTA_DATA(tb[XFRMA_MARK]),
+ RTA_PAYLOAD(tb[XFRMA_MARK]));
+ if (r < 0) {
+ fprintf(stderr, "%s: XFRMA_MARK failed\n", __func__);
+ exit(1);
+ }
+ }
+
xb->offset += new_n->nlmsg_len;
xb->nlmsg_count++;
Using 'ip deleteall' with policies that have marks, fails unless you eplicitely specify the mark values. This is very uncomfortable when bulk-deleting policies and states. With this patch all relevant states and policies are wiped by 'ip deleteall' regardless of their mark values. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> --- ip/xfrm_policy.c | 10 ++++++++++ ip/xfrm_state.c | 13 +++++++++++++ 2 files changed, 23 insertions(+)