From: Nathan Harold <nharold@google.com>
To: netdev@vger.kernel.org, nharold@google.com
Cc: Nathan Harold <nharold@google.com>
Subject: [PATCH ipsec-next] xfrm: Allow Output Mark to be Updated Using UPDSA
Date: Wed, 9 May 2018 13:46:26 -0700 [thread overview]
Message-ID: <20180509204626.56561-1-nharold@google.com> (raw)
Allow UPDSA to change output_mark to permit
policy separation of packet routing decisions from
SA keying in systems that use mark-based routing.
In the output_mark, used as a routing and firewall
mark for outbound packets, is made update-able which
allows routing decisions to be handled independently
of keying/SA creation. To maintain consistency with
other optional attributes, the output mark is only
updated if sent with a non-zero value. Once set, the
output mark may not be reset to zero, which ensures
that updating the SA does not require the mark to
be re-sent to avoid the value being clobbered.
The per-SA lock and the xfrm_state_lock are taken in
that order to avoid a deadlock with
xfrm_timer_handler(), which also takes the locks in
that order.
Signed-off-by: Nathan Harold <nharold@google.com>
Change-Id: Ia05c6733a94c1901cd1e54eb7c7e237704678d71
---
net/xfrm/xfrm_state.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f595797a20ce..5d6085e81030 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1554,6 +1554,13 @@ int xfrm_state_update(struct xfrm_state *x)
if (x1->curlft.use_time)
xfrm_state_check_expire(x1);
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ if (x->props.output_mark) {
+ x1->props.output_mark = x->props.output_mark;
+ __xfrm_state_bump_genids(x1);
+ }
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
err = 0;
x->km.state = XFRM_STATE_DEAD;
__xfrm_state_put(x);
--
2.17.0.441.gb46fe60e1d-goog
next reply other threads:[~2018-05-09 20:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-09 20:46 Nathan Harold [this message]
2018-05-10 5:44 ` [PATCH ipsec-next] xfrm: Allow Output Mark to be Updated Using UPDSA Eyal Birger
2018-05-10 18:14 ` Nathan Harold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180509204626.56561-1-nharold@google.com \
--to=nharold@google.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.