* [PATCH iproute2-next] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states
@ 2020-09-30 4:37 Antony Antony
2020-10-02 13:22 ` [PATCH iproute2-net v2] " Antony Antony
0 siblings, 1 reply; 3+ messages in thread
From: Antony Antony @ 2020-09-30 4:37 UTC (permalink / raw)
To: stephen, David Ahern; +Cc: netdev
The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+)
It is optional and the kernel default is 0xffffffff
It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18)
e.g.
./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \
auth digest_null 0 enc cipher_null ''
ip xfrm state
src 0.0.0.0 dst 0.0.0.0
proto esp spi 0x00000000 reqid 0 mode transport
replay-window 0
output-mark 0x6/0xab
auth-trunc digest_null 0x30 0
enc ecb(cipher_null)
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 0.0.0.0/0 dst 0.0.0.0/0
Signed-off-by: Antony Antony <antony@phenome.org>
---
ip/xfrm_state.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index ddf784ca..779ccf0e 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -328,7 +328,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
struct xfrm_user_sec_ctx sctx;
char str[CTX_BUF_SIZE];
} ctx = {};
- __u32 output_mark = 0;
+ struct xfrm_mark output_mark = {0, 0};
bool is_if_id_set = false;
__u32 if_id = 0;
@@ -448,8 +448,18 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
} else if (strcmp(*argv, "output-mark") == 0) {
NEXT_ARG();
- if (get_u32(&output_mark, *argv, 0))
+ if (get_u32(&output_mark.v, *argv, 0))
invarg("value after \"output-mark\" is invalid", *argv);
+ if (argc > 1) {
+ NEXT_ARG();
+ if (strcmp(*argv, "mask") == 0) {
+ NEXT_ARG();
+ if (get_u32(&output_mark.m, *argv, 0))
+ invarg("mask value is invalid\n", *argv);
+ } else {
+ PREV_ARG();
+ }
+ }
} else if (strcmp(*argv, "if_id") == 0) {
NEXT_ARG();
if (get_u32(&if_id, *argv, 0))
@@ -741,8 +751,11 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
}
- if (output_mark)
- addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark);
+ if (output_mark.v)
+ addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark.v);
+
+ if (output_mark.m)
+ addattr32(&req.n, sizeof(req.buf), XFRMA_SET_MARK_MASK, output_mark.m);
if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
exit(1);
--
2.21.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH iproute2-net v2] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states
2020-09-30 4:37 [PATCH iproute2-next] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states Antony Antony
@ 2020-10-02 13:22 ` Antony Antony
2020-10-07 6:11 ` David Ahern
0 siblings, 1 reply; 3+ messages in thread
From: Antony Antony @ 2020-10-02 13:22 UTC (permalink / raw)
To: Stephen Hemminger, David Ahern; +Cc: netdev
The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+)
It is optional and the kernel default is 0xffffffff
It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18)
e.g.
./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \
auth digest_null 0 enc cipher_null ''
ip xfrm state
src 0.0.0.0 dst 0.0.0.0
proto esp spi 0x00000000 reqid 0 mode transport
replay-window 0
output-mark 0x6/0xab
auth-trunc digest_null 0x30 0
enc ecb(cipher_null)
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 0.0.0.0/0 dst 0.0.0.0/0
Signed-off-by: Antony Antony <antony@phenome.org>
---
v1 -> v2
- add man page and usage for mask
--
ip/xfrm_state.c | 23 ++++++++++++++++++-----
man/man8/ip-xfrm.8 | 4 +++-
2 files changed, 21 insertions(+), 6 deletions(-)
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index ddf784ca..a4f452fa 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -62,7 +62,7 @@ static void usage(void)
" [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n"
" [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n"
" [ offload [dev DEV] dir DIR ]\n"
- " [ output-mark OUTPUT-MARK ]\n"
+ " [ output-mark OUTPUT-MARK [ mask MASK ] ]\n"
" [ if_id IF_ID ]\n"
"Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n"
" [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n"
@@ -328,7 +328,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
struct xfrm_user_sec_ctx sctx;
char str[CTX_BUF_SIZE];
} ctx = {};
- __u32 output_mark = 0;
+ struct xfrm_mark output_mark = {0, 0};
bool is_if_id_set = false;
__u32 if_id = 0;
@@ -448,8 +448,18 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
} else if (strcmp(*argv, "output-mark") == 0) {
NEXT_ARG();
- if (get_u32(&output_mark, *argv, 0))
+ if (get_u32(&output_mark.v, *argv, 0))
invarg("value after \"output-mark\" is invalid", *argv);
+ if (argc > 1) {
+ NEXT_ARG();
+ if (strcmp(*argv, "mask") == 0) {
+ NEXT_ARG();
+ if (get_u32(&output_mark.m, *argv, 0))
+ invarg("mask value is invalid\n", *argv);
+ } else {
+ PREV_ARG();
+ }
+ }
} else if (strcmp(*argv, "if_id") == 0) {
NEXT_ARG();
if (get_u32(&if_id, *argv, 0))
@@ -741,8 +751,11 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
}
}
- if (output_mark)
- addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark);
+ if (output_mark.v)
+ addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark.v);
+
+ if (output_mark.m)
+ addattr32(&req.n, sizeof(req.buf), XFRMA_SET_MARK_MASK, output_mark.m);
if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
exit(1);
diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8
index 4fa31651..2669b386 100644
--- a/man/man8/ip-xfrm.8
+++ b/man/man8/ip-xfrm.8
@@ -60,7 +60,9 @@ ip-xfrm \- transform configuration
.RB "[ " extra-flag
.IR EXTRA-FLAG-LIST " ]"
.RB "[ " output-mark
-.IR OUTPUT-MARK " ]"
+.IR OUTPUT-MARK
+.RB "[ " mask
+.IR MASK " ] ]"
.RB "[ " if_id
.IR IF-ID " ]"
--
2.21.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH iproute2-net v2] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states
2020-10-02 13:22 ` [PATCH iproute2-net v2] " Antony Antony
@ 2020-10-07 6:11 ` David Ahern
0 siblings, 0 replies; 3+ messages in thread
From: David Ahern @ 2020-10-07 6:11 UTC (permalink / raw)
To: Antony Antony, Stephen Hemminger, David Ahern; +Cc: netdev
On 10/2/20 6:22 AM, Antony Antony wrote:
> The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+)
> It is optional and the kernel default is 0xffffffff
> It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18)
>
> e.g.
> ./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \
> auth digest_null 0 enc cipher_null ''
> ip xfrm state
> src 0.0.0.0 dst 0.0.0.0
> proto esp spi 0x00000000 reqid 0 mode transport
> replay-window 0
> output-mark 0x6/0xab
> auth-trunc digest_null 0x30 0
> enc ecb(cipher_null)
> anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
> sel src 0.0.0.0/0 dst 0.0.0.0/0
>
> Signed-off-by: Antony Antony <antony@phenome.org>
> ---
> v1 -> v2
> - add man page and usage for mask
> --
> ip/xfrm_state.c | 23 ++++++++++++++++++-----
> man/man8/ip-xfrm.8 | 4 +++-
> 2 files changed, 21 insertions(+), 6 deletions(-)
>
applied to iproute2-next. Thanks
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-10-07 6:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-30 4:37 [PATCH iproute2-next] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states Antony Antony
2020-10-02 13:22 ` [PATCH iproute2-net v2] " Antony Antony
2020-10-07 6:11 ` David Ahern
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).