[PATCH iproute2-next] ip-xfrm: Add support for OUTPUT_MARK

[PATCH iproute2-next] ip-xfrm: Add support for OUTPUT_MARK

[Subash Abhinov Kasiviswanathan]

This patch adds support for OUTPUT_MARK in xfrm state to exercise the
functionality added by kernel commit 077fbac405bf
("net: xfrm: support setting an output mark.").

Sample output with output-mark -

src 192.168.1.1 dst 192.168.1.2
        proto esp spi 0x00004321 reqid 0 mode tunnel
        replay-window 0 flag af-unspec
        auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
        enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
        output-mark 0x20000

Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
---
 ip/ipxfrm.c        | 5 +++++
 ip/xfrm_state.c    | 9 +++++++++
 man/man8/ip-xfrm.8 | 2 ++
 3 files changed, 16 insertions(+)

diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index 12c2f72..601f9b8 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -956,6 +956,11 @@ void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo,
 		fprintf(fp, "%s %s", (char *)(sctx + 1), _SL_);
 	}
 
+	if (tb[XFRMA_OUTPUT_MARK]) {
+		__u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]);
+
+		fprintf(fp, "\toutput-mark 0x%x %s", output_mark, _SL_);
+	}
 }
 
 void xfrm_policy_info_print(struct xfrm_userpolicy_info *xpinfo,
diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c
index 85d959c..d005802 100644
--- a/ip/xfrm_state.c
+++ b/ip/xfrm_state.c
@@ -61,6 +61,7 @@ static void usage(void)
 	fprintf(stderr, "        [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n");
 	fprintf(stderr, "        [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST ]\n");
 	fprintf(stderr, "        [ offload [dev DEV] dir DIR ]\n");
+	fprintf(stderr, "        [ output-mark OUTPUT-MARK]\n");
 	fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n");
 	fprintf(stderr, "        [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n");
 	fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
@@ -322,6 +323,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
 		struct xfrm_user_sec_ctx sctx;
 		char    str[CTX_BUF_SIZE];
 	} ctx = {};
+	__u32 output_mark = 0;
 
 	while (argc > 0) {
 		if (strcmp(*argv, "mode") == 0) {
@@ -437,6 +439,10 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
 				invarg("value after \"offload dir\" is invalid", *argv);
 				is_offload = false;
 			}
+		} else if (strcmp(*argv, "output-mark") == 0) {
+			NEXT_ARG();
+			if (get_u32(&output_mark, *argv, 0))
+				invarg("value after \"output-mark\" is invalid", *argv);
 		} else {
 			/* try to assume ALGO */
 			int type = xfrm_algotype_getbyname(*argv);
@@ -720,6 +726,9 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv)
 		}
 	}
 
+	if (output_mark != 0)
+		addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark);
+
 	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
 		exit(1);
 
diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8
index 988cc6a..e001596 100644
--- a/man/man8/ip-xfrm.8
+++ b/man/man8/ip-xfrm.8
@@ -59,6 +59,8 @@ ip-xfrm \- transform configuration
 .IR CTX " ]"
 .RB "[ " extra-flag
 .IR EXTRA-FLAG-LIST " ]"
+.RB "[ " output-mark
+.IR OUTPUT-MARK " ]"
 
 .ti -8
 .B "ip xfrm state allocspi"
-- 
1.9.1

Re: [PATCH iproute2-next] ip-xfrm: Add support for OUTPUT_MARK

[Lorenzo Colitti]

On Tue, Jun 12, 2018 at 11:12 AM Subash Abhinov Kasiviswanathan
<subashab@codeaurora.org> wrote:
>
> This patch adds support for OUTPUT_MARK in xfrm state to exercise the
> functionality added by kernel commit 077fbac405bf
> ("net: xfrm: support setting an output mark.").
>
> Sample output with output-mark -
>
> src 192.168.1.1 dst 192.168.1.2
>         proto esp spi 0x00004321 reqid 0 mode tunnel
>         replay-window 0 flag af-unspec
>         auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
>         enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
>         anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
>         output-mark 0x20000

Have you considered putting this earlier up in the output, where the
mark is printed as well?

> +       if (tb[XFRMA_OUTPUT_MARK]) {
> +               __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]);
> +
> +               fprintf(fp, "\toutput-mark 0x%x %s", output_mark, _SL_);
> +       }
>  }

If you wanted to implement the suggestion above, I think you could do
that by moving this code into xfrm_xfrma_print.

Other than that, LGTM.

Acked-by: Lorenzo Colitti <lorenzo@google.com>

Steffen - what's the status of the set_mark patches? Are you holding
them until the tree opens again? If so, then once they go in, we can
just make "set-mark" behave the same as "output-mark" in the iproute2
code, and add support for the mask as well.

Re: [PATCH iproute2-next] ip-xfrm: Add support for OUTPUT_MARK

[Stephen Hemminger]

On Mon, 11 Jun 2018 20:11:33 -0600
Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> wrote:

> This patch adds support for OUTPUT_MARK in xfrm state to exercise the
> functionality added by kernel commit 077fbac405bf
> ("net: xfrm: support setting an output mark.").
> 
> Sample output with output-mark -
> 
> src 192.168.1.1 dst 192.168.1.2
>         proto esp spi 0x00004321 reqid 0 mode tunnel
>         replay-window 0 flag af-unspec
>         auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
>         enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
>         anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
>         output-mark 0x20000
> 
> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

This reminds me. It is time to convert xfrm to json output.

Re: [PATCH iproute2-next] ip-xfrm: Add support for OUTPUT_MARK

[Steffen Klassert]

On Tue, Jun 12, 2018 at 11:33:41AM +0900, Lorenzo Colitti wrote:
> On Tue, Jun 12, 2018 at 11:12 AM Subash Abhinov Kasiviswanathan
> <subashab@codeaurora.org> wrote:
> >
> > This patch adds support for OUTPUT_MARK in xfrm state to exercise the
> > functionality added by kernel commit 077fbac405bf
> > ("net: xfrm: support setting an output mark.").
> >
> > Sample output with output-mark -
> >
> > src 192.168.1.1 dst 192.168.1.2
> >         proto esp spi 0x00004321 reqid 0 mode tunnel
> >         replay-window 0 flag af-unspec
> >         auth-trunc xcbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b211 96
> >         enc cbc(aes) 0x3ed0af408cf5dcbf5d5d9a5fa806b233
> >         anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
> >         output-mark 0x20000
> 
> Have you considered putting this earlier up in the output, where the
> mark is printed as well?
> 
> > +       if (tb[XFRMA_OUTPUT_MARK]) {
> > +               __u32 output_mark = rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]);
> > +
> > +               fprintf(fp, "\toutput-mark 0x%x %s", output_mark, _SL_);
> > +       }
> >  }
> 
> If you wanted to implement the suggestion above, I think you could do
> that by moving this code into xfrm_xfrma_print.
> 
> Other than that, LGTM.
> 
> Acked-by: Lorenzo Colitti <lorenzo@google.com>
> 
> Steffen - what's the status of the set_mark patches? Are you holding
> them until the tree opens again?

Yes, I hold them back until after v4.18-rc1 is released and the
-next trees open again. But I plan to do a RFC version this week,
so that everybody knows about the plan we have.

Re: [PATCH iproute2-next] ip-xfrm: Add support for OUTPUT_MARK

[Subash Abhinov Kasiviswanathan]

> Have you considered putting this earlier up in the output, where the
> mark is printed as well?
> 
>> +       if (tb[XFRMA_OUTPUT_MARK]) {
>> +               __u32 output_mark = 
>> rta_getattr_u32(tb[XFRMA_OUTPUT_MARK]);
>> +
>> +               fprintf(fp, "\toutput-mark 0x%x %s", output_mark, 
>> _SL_);
>> +       }
>>  }
> 
> If you wanted to implement the suggestion above, I think you could do
> that by moving this code into xfrm_xfrma_print.
> 

Hi Lorenzo

I have updated it now in v2.

-- 
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project