From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nathan Harold Subject: [PATCH ipsec-next] xfrm: Allow Output Mark to be Updated Using UPDSA Date: Wed, 9 May 2018 13:46:26 -0700 Message-ID: <20180509204626.56561-1-nharold@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Nathan Harold To: netdev@vger.kernel.org, nharold@google.com Return-path: Received: from mail-ot0-f202.google.com ([74.125.82.202]:35668 "EHLO mail-ot0-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935279AbeEIUq4 (ORCPT ); Wed, 9 May 2018 16:46:56 -0400 Received: by mail-ot0-f202.google.com with SMTP id 37-v6so26324697otv.2 for ; Wed, 09 May 2018 13:46:56 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: Allow UPDSA to change output_mark to permit policy separation of packet routing decisions from SA keying in systems that use mark-based routing. In the output_mark, used as a routing and firewall mark for outbound packets, is made update-able which allows routing decisions to be handled independently of keying/SA creation. To maintain consistency with other optional attributes, the output mark is only updated if sent with a non-zero value. Once set, the output mark may not be reset to zero, which ensures that updating the SA does not require the mark to be re-sent to avoid the value being clobbered. The per-SA lock and the xfrm_state_lock are taken in that order to avoid a deadlock with xfrm_timer_handler(), which also takes the locks in that order. Signed-off-by: Nathan Harold Change-Id: Ia05c6733a94c1901cd1e54eb7c7e237704678d71 --- net/xfrm/xfrm_state.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index f595797a20ce..5d6085e81030 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1554,6 +1554,13 @@ int xfrm_state_update(struct xfrm_state *x) if (x1->curlft.use_time) xfrm_state_check_expire(x1); + spin_lock_bh(&net->xfrm.xfrm_state_lock); + if (x->props.output_mark) { + x1->props.output_mark = x->props.output_mark; + __xfrm_state_bump_genids(x1); + } + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + err = 0; x->km.state = XFRM_STATE_DEAD; __xfrm_state_put(x); -- 2.17.0.441.gb46fe60e1d-goog