From patchwork Sat Jun 16 02:32:55 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Subash Abhinov Kasiviswanathan X-Patchwork-Id: 930305 X-Patchwork-Delegate: dsahern@gmail.com Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=codeaurora.org header.i=@codeaurora.org header.b="acHXsvX8"; dkim=pass (1024-bit key) header.d=codeaurora.org header.i=@codeaurora.org header.b="H5IT3ACD"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4171cs0QNNz9s47 for ; Sat, 16 Jun 2018 12:33:32 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756117AbeFPCdZ (ORCPT ); Fri, 15 Jun 2018 22:33:25 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:34520 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753779AbeFPCdY (ORCPT ); Fri, 15 Jun 2018 22:33:24 -0400 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id BF096607BB; Sat, 16 Jun 2018 02:33:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1529116403; bh=RBMTiDOwW0oY3Fa+xwj+rGq/xaog9y2Te2jRGb9BA8g=; h=From:To:Cc:Subject:Date:From; b=acHXsvX836k9gGHnZk+qqOMkAD7YJ8VRLpBsg862MZF8DxMd0nMF6GmbrT91SVd8Y 4Po4aySKWe1XZZ632N5VpMCQLGkHjroGWo7kQeqQBUX3VOhYcMZb53V1TXVraI5V/Z aqXLTQNrj0si0WfPAOGHlsszexcrsoAhPXSG/SbE= X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on pdx-caf-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.8 required=2.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED, T_DKIM_INVALID autolearn=no autolearn_force=no version=3.4.0 Received: from subashab-lnx.qualcomm.com (unknown [129.46.15.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: subashab@codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 4DB83602FC; Sat, 16 Jun 2018 02:33:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1529116402; bh=RBMTiDOwW0oY3Fa+xwj+rGq/xaog9y2Te2jRGb9BA8g=; h=From:To:Cc:Subject:Date:From; b=H5IT3ACDNzGCPfkW1s2PKDaBgttdrCLBlCSgjvQWrSuIi4TPo19H3NHgBqBtkJH4h 4jBi++BbmMqhKJlstrEqr+bdKRqxmT4EuPzHy6clOjjMEbw50oolVCUj5O7jLuet75 whgdWySFzUTkUvCyMcrJMgWwFq18UAfrZ1RwmJq8= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 4DB83602FC Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=subashab@codeaurora.org From: Subash Abhinov Kasiviswanathan To: lorenzo@google.com, netdev@vger.kernel.org, stephen@networkplumber.org, dsahern@gmail.com, steffen.klassert@secunet.com Cc: Subash Abhinov Kasiviswanathan Subject: [PATCH iproute2-next v3] ip-xfrm: Add support for OUTPUT_MARK Date: Fri, 15 Jun 2018 20:32:55 -0600 Message-Id: <1529116375-7578-1-git-send-email-subashab@codeaurora.org> X-Mailer: git-send-email 1.9.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This patch adds support for OUTPUT_MARK in xfrm state to exercise the functionality added by kernel commit 077fbac405bf ("net: xfrm: support setting an output mark."). Sample output- (with mark and output-mark) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec mark 0x10000/0x3ffff output-mark 0x20000 auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 (with mark only) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec mark 0x10000/0x3ffff auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 (with output-mark only) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec output-mark 0x20000 auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 (no mark and output-mark) src 192.168.1.1 dst 192.168.1.2 proto esp spi 0x00004321 reqid 0 mode tunnel replay-window 0 flag af-unspec auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96 enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 v1->v2: Moved the XFRMA_OUTPUT_MARK print after XFRMA_MARK in xfrm_xfrma_print() as mentioned by Lorenzo v2->v3: Fix one help formatting error as mentioned by Lorenzo. Keep mark and output-mark on the same line and add man page info as mentioned by David. Signed-off-by: Subash Abhinov Kasiviswanathan --- ip/ipxfrm.c | 17 ++++++++++++++++- ip/xfrm_state.c | 9 +++++++++ man/man8/ip-xfrm.8 | 11 +++++++++++ 3 files changed, 36 insertions(+), 1 deletion(-) diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 12c2f72..17ab4ab 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -637,6 +637,13 @@ static void xfrm_tmpl_print(struct xfrm_user_tmpl *tmpls, int len, } } +static void xfrm_output_mark_print(struct rtattr *tb[], FILE *fp) +{ + __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]); + + fprintf(fp, "output-mark 0x%x", output_mark); +} + int xfrm_parse_mark(struct xfrm_mark *mark, int *argcp, char ***argvp) { int argc = *argcp; @@ -677,7 +684,15 @@ void xfrm_xfrma_print(struct rtattr *tb[], __u16 family, struct rtattr *rta = tb[XFRMA_MARK]; struct xfrm_mark *m = RTA_DATA(rta); - fprintf(fp, "\tmark %#x/%#x", m->v, m->m); + fprintf(fp, "\tmark %#x/%#x ", m->v, m->m); + + if (tb[XFRMA_OUTPUT_MARK]) + xfrm_output_mark_print(tb, fp); + fprintf(fp, "%s", _SL_); + } else if (tb[XFRMA_OUTPUT_MARK]) { + fprintf(fp, "\t"); + + xfrm_output_mark_print(tb, fp); fprintf(fp, "%s", _SL_); } diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index 85d959c..913e9fa 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -61,6 +61,7 @@ static void usage(void) fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"); fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"); fprintf(stderr, " [ offload [dev DEV] dir DIR ]\n"); + fprintf(stderr, " [ output-mark OUTPUT-MARK ]\n"); fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"); fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n"); fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n"); @@ -322,6 +323,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) struct xfrm_user_sec_ctx sctx; char str[CTX_BUF_SIZE]; } ctx = {}; + __u32 output_mark = 0; while (argc > 0) { if (strcmp(*argv, "mode") == 0) { @@ -437,6 +439,10 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) invarg("value after \"offload dir\" is invalid", *argv); is_offload = false; } + } else if (strcmp(*argv, "output-mark") == 0) { + NEXT_ARG(); + if (get_u32(&output_mark, *argv, 0)) + invarg("value after \"output-mark\" is invalid", *argv); } else { /* try to assume ALGO */ int type = xfrm_algotype_getbyname(*argv); @@ -720,6 +726,9 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) } } + if (output_mark) + addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark); + if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0) exit(1); diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8 index 988cc6a..839e06a 100644 --- a/man/man8/ip-xfrm.8 +++ b/man/man8/ip-xfrm.8 @@ -59,6 +59,8 @@ ip-xfrm \- transform configuration .IR CTX " ]" .RB "[ " extra-flag .IR EXTRA-FLAG-LIST " ]" +.RB "[ " output-mark +.IR OUTPUT-MARK " ]" .ti -8 .B "ip xfrm state allocspi" @@ -537,6 +539,15 @@ encapsulates packets with protocol .RI "using source port " SPORT ", destination port " DPORT .RI ", and original address " OADDR "." +.TP +.I MARK +used to match xfrm policies and states + +.TP +.I OUTPUT-MARK +used to set the output mark to influence the routing +of the packets emitted by the state + .sp .PP .TS