@@ -637,6 +637,13 @@ static void xfrm_tmpl_print(struct xfrm_user_tmpl *tmpls, int len,
}
}
+static void xfrm_output_mark_print(struct rtattr *tb[], FILE *fp)
+{
+ __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]);
+
+ fprintf(fp, "output-mark 0x%x", output_mark);
+}
+
int xfrm_parse_mark(struct xfrm_mark *mark, int *argcp, char ***argvp)
{
int argc = *argcp;
@@ -677,7 +684,15 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family,
struct rtattr *rta = tb[XFRMA_MARK];
struct xfrm_mark *m = RTA_DATA(rta);
- fprintf(fp, "\tmark %#x/%#x", m->v, m->m);
+ fprintf(fp, "\tmark %#x/%#x ", m->v, m->m);
+
+ if (tb[XFRMA_OUTPUT_MARK])
+ xfrm_output_mark_print(tb, fp);
+ fprintf(fp, "%s", _SL_);
+ } else if (tb[XFRMA_OUTPUT_MARK]) {
+ fprintf(fp, "\t");
+
+ xfrm_output_mark_print(tb, fp);
fprintf(fp, "%s", _SL_);
}
@@ -61,6 +61,7 @@ static void usage(void)
fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n");
fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n");
fprintf(stderr, " [ offload [dev DEV] dir DIR ]\n");
+ fprintf(stderr, " [ output-mark OUTPUT-MARK ]\n");
fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n");
fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n");
fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
@@ -322,6 +323,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
struct xfrm_user_sec_ctx sctx;
char str[CTX_BUF_SIZE];
} ctx = {};
+ __u32 output_mark = 0;
while (argc > 0) {
if (strcmp(*argv, "mode") == 0) {
@@ -437,6 +439,10 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
invarg("value after \"offload dir\" is invalid", *argv);
is_offload = false;
}
+ } else if (strcmp(*argv, "output-mark") == 0) {
+ NEXT_ARG();
+ if (get_u32(&output_mark, *argv, 0))
+ invarg("value after \"output-mark\" is invalid", *argv);
} else {
/* try to assume ALGO */
int type = xfrm_algotype_getbyname(*argv);
@@ -720,6 +726,9 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
}
+ if (output_mark)
+ addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark);
+
if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
exit(1);
@@ -59,6 +59,8 @@ ip-xfrm \- transform configuration
.IR CTX " ]"
.RB "[ " extra-flag
.IR EXTRA-FLAG-LIST " ]"
+.RB "[ " output-mark
+.IR OUTPUT-MARK " ]"
.ti -8
.B "ip xfrm state allocspi"
@@ -537,6 +539,15 @@ encapsulates packets with protocol
.RI "using source port " SPORT ", destination port " DPORT
.RI ", and original address " OADDR "."
+.TP
+.I MARK
+used to match xfrm policies and states
+
+.TP
+.I OUTPUT-MARK
+used to set the output mark to influence the routing
+of the packets emitted by the state
+
.sp
.PP
.TS
This patch adds support for OUTPUT_MARK in xfrm state to exercise the functionality added by kernel commit 077fbac405bf ("net: xfrm: support setting an output mark."). Sample output- (with mark and output-mark) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec mark 0x10000/0x3ffff output-mark 0x20000 auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 (with mark only) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec mark 0x10000/0x3ffff auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 (with output-mark only) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec output-mark 0x20000 auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 (no mark and output-mark) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 v1->v2: Moved the XFRMA_OUTPUT_MARK print after XFRMA_MARK in xfrm_xfrma_print() as mentioned by Lorenzo v2->v3: Fix one help formatting error as mentioned by Lorenzo. Keep mark and output-mark on the same line and add man page info as mentioned by David. Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> --- ip/ipxfrm.c | 17 ++++++++++++++++- ip/xfrm_state.c | 9 +++++++++ man/man8/ip-xfrm.8 | 11 +++++++++++ 3 files changed, 36 insertions(+), 1 deletion(-)