proxmox-mirrors/mirror_iproute2
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_iproute2 synced 2025-10-19 05:02:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states

Browse Source 
The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+)
It is optional and the kernel default is 0xffffffff
It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18)

e.g.
./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \
 auth digest_null 0 enc cipher_null ''
ip xfrm state
src 0.0.0.0 dst 0.0.0.0
	proto esp spi 0x00000000 reqid 0 mode transport
	replay-window 0
	output-mark 0x6/0xab
	auth-trunc digest_null 0x30 0
	enc ecb(cipher_null)
	anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
	sel src 0.0.0.0/0 dst 0.0.0.0/0

Signed-off-by: Antony Antony <antony@phenome.org>
Signed-off-by: David Ahern <dsahern@gmail.com>
This commit is contained in:
Antony Antony 2020-10-02 15:22:38 +02:00 committed by David Ahern
parent 8dc1db80e4
commit 4322b13c8d
2 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
ip/xfrm_state.c
View File

@ -62,7 +62,7 @@ static void usage(void)
" [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"
" [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"
" [ offload [dev DEV] dir DIR ]\n"
" [ output-mark OUTPUT-MARK ]\n"
" [ output-mark OUTPUT-MARK [ mask MASK ] ]\n"
" [ if_id IF_ID ]\n"
"Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"
" [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n"
@ -328,7 +328,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
struct xfrm_user_sec_ctx sctx;
char str[CTX_BUF_SIZE];
} ctx = {};
__u32 output_mark = 0;
struct xfrm_mark output_mark = {0, 0};
bool is_if_id_set = false;
__u32 if_id = 0;
@ -448,8 +448,18 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
} else if (strcmp(*argv, "output-mark") == 0) {
NEXT_ARG();
if (get_u32(&output_mark, *argv, 0))
if (get_u32(&output_mark.v, *argv, 0))
invarg("value after \"output-mark\" is invalid", *argv);
if (argc > 1) {
NEXT_ARG();
if (strcmp(*argv, "mask") == 0) {
NEXT_ARG();
if (get_u32(&output_mark.m, *argv, 0))
invarg("mask value is invalid\n", *argv);
} else {
PREV_ARG();
}
}
} else if (strcmp(*argv, "if_id") == 0) {
NEXT_ARG();
if (get_u32(&if_id, *argv, 0))
@ -741,8 +751,11 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
}
if (output_mark)
addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark);
if (output_mark.v)
addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark.v);
if (output_mark.m)
addattr32(&req.n, sizeof(req.buf), XFRMA_SET_MARK_MASK, output_mark.m);
if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
exit(1);

4
man/man8/ip-xfrm.8
View File

@ -60,7 +60,9 @@ ip-xfrm \- transform configuration
.RB "[ " extra-flag
.IR EXTRA-FLAG-LIST " ]"
.RB "[ " output-mark
.IR OUTPUT-MARK " ]"
.IR OUTPUT-MARK
.RB "[ " mask
.IR MASK " ] ]"
.RB "[ " if_id
.IR IF-ID " ]"