From: Nathan Harold <nharold@google•com>
To: netdev@vger•kernel.org, nharold@google•com
Cc: Nathan Harold <nharold@google•com>
Subject: [PATCH ipsec-next] xfrm: Allow Output Mark to be Updated Using UPDSA
Date: Wed, 9 May 2018 13:46:26 -0700 [thread overview]
Message-ID: <20180509204626.56561-1-nharold@google.com> (raw)
Allow UPDSA to change output_mark to permit
policy separation of packet routing decisions from
SA keying in systems that use mark-based routing.
In the output_mark, used as a routing and firewall
mark for outbound packets, is made update-able which
allows routing decisions to be handled independently
of keying/SA creation. To maintain consistency with
other optional attributes, the output mark is only
updated if sent with a non-zero value. Once set, the
output mark may not be reset to zero, which ensures
that updating the SA does not require the mark to
be re-sent to avoid the value being clobbered.
The per-SA lock and the xfrm_state_lock are taken in
that order to avoid a deadlock with
xfrm_timer_handler(), which also takes the locks in
that order.
Signed-off-by: Nathan Harold <nharold@google•com>
Change-Id: Ia05c6733a94c1901cd1e54eb7c7e237704678d71
---
net/xfrm/xfrm_state.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f595797a20ce..5d6085e81030 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1554,6 +1554,13 @@ int xfrm_state_update(struct xfrm_state *x)
if (x1->curlft.use_time)
xfrm_state_check_expire(x1);
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ if (x->props.output_mark) {
+ x1->props.output_mark = x->props.output_mark;
+ __xfrm_state_bump_genids(x1);
+ }
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
err = 0;
x->km.state = XFRM_STATE_DEAD;
__xfrm_state_put(x);
--
2.17.0.441.gb46fe60e1d-goog
next reply other threads:[~2018-05-09 20:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-09 20:46 Nathan Harold [this message]
2018-05-10 5:44 ` [PATCH ipsec-next] xfrm: Allow Output Mark to be Updated Using UPDSA Eyal Birger
2018-05-10 18:14 ` Nathan Harold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180509204626.56561-1-nharold@google.com \
--to=nharold@google$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox