From mboxrd@z Thu Jan 1 00:00:00 1970 From: Benedict Wong Subject: [PATCH ipsec, resend 0/1] xfrm: set-mark default behavior changes Date: Fri, 11 Jan 2019 12:14:11 -0800 Message-ID: <20190111201412.176246-1-benedictwong@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Cc: nharold@google.com, benedictwong@google.com, lorenzo@google.com, maze@google.com To: netdev@vger.kernel.org Return-path: Received: from mail-pl1-f202.google.com ([209.85.214.202]:47079 "EHLO mail-pl1-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725767AbfAKWDM (ORCPT ); Fri, 11 Jan 2019 17:03:12 -0500 Received: by mail-pl1-f202.google.com with SMTP id t10so9038914plo.13 for ; Fri, 11 Jan 2019 14:03:12 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: A behavior change introduced in 9b42c1f179a6 (=E2=80=9Cxfrm: Extend the output_mark to support input direction and masking=E2=80=9D) results in a change in: 1. Default outbound behavior with regards to route lookup marks, and 2. Inbound behavior for SAs used to decapsulate packets when the output mark (as specified in 4.14 to 4.18) is set. This patch set restores the previous default outbound behavior, resolving (1), but behavior change (2) will require more discussion. Specifically, in (2), a SA with a "output mark" set will now have that Mark imposed on the inbound packet (As opposed to the previous output-mark behavior where the inbound packet's mark would not be touched). This is less of a concern, as it is limited to the case where: 1. SA output mark is set 2. SA is using non-transport mode 3. SA is configured for inbound decapsulation (local dst IP) Critically, conditions 1 and 3 imply a configuration that output mark was not designed to support. The only valid use case for this seems to be the loopback case (as IP addresses would apply bidirectionally). As such, we believe that this behavioral change is acceptable as is. Benedict Wong (1): xfrm: Make set-mark default behavior backward compatible net/xfrm/xfrm_policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --=20 2.20.1.97.g81188d93c3-goog