| Message ID | 1528769493-25435-1-git-send-email-subashab@codeaurora.org |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Ahern |
| Headers | show |
| Series | [iproute2-next] ip-xfrm: Add support for OUTPUT_MARK | expand |
On Tue, Jun 12, 2018 at 11:12 AM Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> wrote: > > This patch adds support for OUTPUT_MARK in xfrm state to exercise the > functionality added by kernel commit 077fbac405bf > ("net: xfrm: support setting an output mark."). > > Sample output with output-mark - > > src 192.168.1.1 dst 192.168.1.2 > proto esp spi 0x00004321 reqid 0 mode tunnel > replay-window 0 flag af-unspec > auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 > enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 > anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 > output-mark 0x20000 Have you considered putting this earlier up in the output, where the mark is printed as well? > + if (tb[XFRMA_OUTPUT_MARK]) { > + __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]); > + > + fprintf(fp, "\toutput-mark 0x%x %s", output_mark, _SL_); > + } > } If you wanted to implement the suggestion above, I think you could do that by moving this code into xfrm_xfrma_print. Other than that, LGTM. Acked-by: Lorenzo Colitti <lorenzo@google.com> Steffen - what's the status of the set_mark patches? Are you holding them until the tree opens again? If so, then once they go in, we can just make "set-mark" behave the same as "output-mark" in the iproute2 code, and add support for the mask as well.
On Mon, 11 Jun 2018 20:11:33 -0600 Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> wrote: > This patch adds support for OUTPUT_MARK in xfrm state to exercise the > functionality added by kernel commit 077fbac405bf > ("net: xfrm: support setting an output mark."). > > Sample output with output-mark - > > src 192.168.1.1 dst 192.168.1.2 > proto esp spi 0x00004321 reqid 0 mode tunnel > replay-window 0 flag af-unspec > auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 > enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 > anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 > output-mark 0x20000 > > Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> This reminds me. It is time to convert xfrm to json output.
On Tue, Jun 12, 2018 at 11:33:41AM +0900, Lorenzo Colitti wrote: > On Tue, Jun 12, 2018 at 11:12 AM Subash Abhinov Kasiviswanathan > <subashab@codeaurora.org> wrote: > > > > This patch adds support for OUTPUT_MARK in xfrm state to exercise the > > functionality added by kernel commit 077fbac405bf > > ("net: xfrm: support setting an output mark."). > > > > Sample output with output-mark - > > > > src 192.168.1.1 dst 192.168.1.2 > > proto esp spi 0x00004321 reqid 0 mode tunnel > > replay-window 0 flag af-unspec > > auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 > > enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 > > anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 > > output-mark 0x20000 > > Have you considered putting this earlier up in the output, where the > mark is printed as well? > > > + if (tb[XFRMA_OUTPUT_MARK]) { > > + __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]); > > + > > + fprintf(fp, "\toutput-mark 0x%x %s", output_mark, _SL_); > > + } > > } > > If you wanted to implement the suggestion above, I think you could do > that by moving this code into xfrm_xfrma_print. > > Other than that, LGTM. > > Acked-by: Lorenzo Colitti <lorenzo@google.com> > > Steffen - what's the status of the set_mark patches? Are you holding > them until the tree opens again? Yes, I hold them back until after v4.18-rc1 is released and the -next trees open again. But I plan to do a RFC version this week, so that everybody knows about the plan we have.
> Have you considered putting this earlier up in the output, where the > mark is printed as well? > >> + if (tb[XFRMA_OUTPUT_MARK]) { >> + __u32 output_mark = >> rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]); >> + >> + fprintf(fp, "\toutput-mark 0x%x %s", output_mark, >> _SL_); >> + } >> } > > If you wanted to implement the suggestion above, I think you could do > that by moving this code into xfrm_xfrma_print. > Hi Lorenzo I have updated it now in v2.
diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 12c2f72..601f9b8 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -956,6 +956,11 @@ void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo, fprintf(fp, "%s %s", (char *)(sctx + 1), _SL_); } + if (tb[XFRMA_OUTPUT_MARK]) { + __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]); + + fprintf(fp, "\toutput-mark 0x%x %s", output_mark, _SL_); + } } void xfrm_policy_info_print(struct xfrm_userpolicy_info *xpinfo, diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index 85d959c..d005802 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -61,6 +61,7 @@ static void usage(void) fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"); fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"); fprintf(stderr, " [ offload [dev DEV] dir DIR ]\n"); + fprintf(stderr, " [ output-mark OUTPUT-MARK]\n"); fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"); fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n"); fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n"); @@ -322,6 +323,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) struct xfrm_user_sec_ctx sctx; char str[CTX_BUF_SIZE]; } ctx = {}; + __u32 output_mark = 0; while (argc > 0) { if (strcmp(*argv, "mode") == 0) { @@ -437,6 +439,10 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) invarg("value after \"offload dir\" is invalid", *argv); is_offload = false; } + } else if (strcmp(*argv, "output-mark") == 0) { + NEXT_ARG(); + if (get_u32(&output_mark, *argv, 0)) + invarg("value after \"output-mark\" is invalid", *argv); } else { /* try to assume ALGO */ int type = xfrm_algotype_getbyname(*argv); @@ -720,6 +726,9 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) } } + if (output_mark != 0) + addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark); + if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0) exit(1); diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8 index 988cc6a..e001596 100644 --- a/man/man8/ip-xfrm.8 +++ b/man/man8/ip-xfrm.8 @@ -59,6 +59,8 @@ ip-xfrm \- transform configuration .IR CTX " ]" .RB "[ " extra-flag .IR EXTRA-FLAG-LIST " ]" +.RB "[ " output-mark +.IR OUTPUT-MARK " ]" .ti -8 .B "ip xfrm state allocspi"
This patch adds support for OUTPUT_MARK in xfrm state to exercise the functionality added by kernel commit 077fbac405bf ("net: xfrm: support setting an output mark."). Sample output with output-mark - src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 output-mark 0x20000 Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> --- ip/ipxfrm.c | 5 +++++ ip/xfrm_state.c | 9 +++++++++ man/man8/ip-xfrm.8 | 2 ++ 3 files changed, 16 insertions(+)