[PATCH ipsec-next] xfrm: Allow xfrmi if_id to be updated by UPDSA

[PATCH ipsec-next] xfrm: Allow xfrmi if_id to be updated by UPDSA

[Nathan Harold]

Allow attaching an SA to an xfrm interface id after
the creation of the SA, so that tasks such as keying
which must be done as the SA is created, can remain
separate from the decision on how to route traffic
from an SA. This permits SA creation to be decomposed
in to three separate steps:
1) allocation of a SPI
2) algorithm and key negotiation
3) insertion into the data path

Signed-off-by: Nathan Harold <nharold@google.com>
---
 net/xfrm/xfrm_state.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 27c84e63c7ff..c4c563d9be47 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1562,10 +1562,14 @@ int xfrm_state_update(struct xfrm_state *x)
 		if (x1->curlft.use_time)
 			xfrm_state_check_expire(x1);
 
-		if (x->props.smark.m || x->props.smark.v) {
+		if (x->props.smark.m || x->props.smark.v || x->if_id) {
 			spin_lock_bh(&net->xfrm.xfrm_state_lock);
 
-			x1->props.smark = x->props.smark;
+			if (x->props.smark.m || x->props.smark.v)
+				x1->props.smark = x->props.smark;
+
+			if (x->if_id)
+				x1->if_id = x->if_id;
 
 			__xfrm_state_bump_genids(x1);
 			spin_unlock_bh(&net->xfrm.xfrm_state_lock);
-- 
2.18.0.233.g985f88cf7e-goog

Re: [PATCH ipsec-next] xfrm: Allow xfrmi if_id to be updated by UPDSA

[Steffen Klassert]

On Thu, Jul 19, 2018 at 07:07:47PM -0700, Nathan Harold wrote:
> Allow attaching an SA to an xfrm interface id after
> the creation of the SA, so that tasks such as keying
> which must be done as the SA is created, can remain
> separate from the decision on how to route traffic
> from an SA. This permits SA creation to be decomposed
> in to three separate steps:
> 1) allocation of a SPI
> 2) algorithm and key negotiation
> 3) insertion into the data path
> 
> Signed-off-by: Nathan Harold <nharold@google.com>

Applied to ipsec-next, thanks Nathan!