[PATCH ipsec-next] xfrm: update x->lastused for every packet

[PATCH ipsec-next] xfrm: update x->lastused for every packet

[Antony Antony]

x->lastused was only updated for outgoing mobile IPv6 packet.
With this fix update it for every, in and out, packet.

This is useful to check if the a SA is still in use, or when was
the last time an SA was used.  lastused time of in SA can used
to check IPsec path is functional.

Signed-off-by: Antony Antony <antony.antony@secunet.com>
---
 net/xfrm/xfrm_input.c  | 1 +
 net/xfrm/xfrm_output.c | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 70a8c36f0ba6..7978048df837 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -669,6 +669,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
 		x->curlft.bytes += skb->len;
 		x->curlft.packets++;
+		x->lastused = ktime_get_real_seconds();
 
 		spin_unlock(&x->lock);
 
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 9a5e79a38c67..78cb8d0a6a18 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -209,8 +209,6 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
 	__skb_pull(skb, hdr_len);
 	memmove(ipv6_hdr(skb), iph, hdr_len);
 
-	x->lastused = ktime_get_real_seconds();
-
 	return 0;
 #else
 	WARN_ON_ONCE(1);
@@ -534,6 +532,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 
 		x->curlft.bytes += skb->len;
 		x->curlft.packets++;
+		x->lastused = ktime_get_real_seconds();
 
 		spin_unlock_bh(&x->lock);
 
-- 
2.30.2

Re: [PATCH ipsec-next] xfrm: update x->lastused for every packet

[Steffen Klassert]

On Thu, Aug 04, 2022 at 11:17:31AM +0200, Antony Antony wrote:
> x->lastused was only updated for outgoing mobile IPv6 packet.
> With this fix update it for every, in and out, packet.
> 
> This is useful to check if the a SA is still in use, or when was
> the last time an SA was used.  lastused time of in SA can used
> to check IPsec path is functional.
> 
> Signed-off-by: Antony Antony <antony.antony@secunet.com>

Your patch does not apply to current ipsec-next, please
rebase.

Thanks!

Re: [PATCH ipsec-next] xfrm: update x->lastused for every packet

[Antony Antony]

Hi Steffen,

On Tue, Aug 16, 2022 at 11:27:36 +0200, Steffen Klassert wrote:
> On Thu, Aug 04, 2022 at 11:17:31AM +0200, Antony Antony wrote:
> > x->lastused was only updated for outgoing mobile IPv6 packet.
> > With this fix update it for every, in and out, packet.
> > 
> > This is useful to check if the a SA is still in use, or when was
> > the last time an SA was used.  lastused time of in SA can used
> > to check IPsec path is functional.
> > 
> > Signed-off-by: Antony Antony <antony.antony@secunet.com>
> 
> Your patch does not apply to current ipsec-next, please
> rebase.
> 
> Thanks!

thanks for trying to apply this patch to ipsec-next.

I am happy to send a rebased patch, however I suspect ipsec is yet to be
merged into ipsec-next? Why didn't ipsec merge into to "net" before 6.0-rc1?

There is a related patch sitting in in ipsec:
717ada9f10f2 ("Revert "xfrm: update SA curlft.use_time""),

Once that is in ipsec-next this patch would apply.

Would you prefer a rebased patch?

regards,
-antony

Re: [PATCH ipsec-next] xfrm: update x->lastused for every packet

[Steffen Klassert]

On Tue, Aug 16, 2022 at 11:44:45PM +0200, Antony Antony wrote:
> Hi Steffen,
> 
> On Tue, Aug 16, 2022 at 11:27:36 +0200, Steffen Klassert wrote:
> > On Thu, Aug 04, 2022 at 11:17:31AM +0200, Antony Antony wrote:
> > > x->lastused was only updated for outgoing mobile IPv6 packet.
> > > With this fix update it for every, in and out, packet.
> > > 
> > > This is useful to check if the a SA is still in use, or when was
> > > the last time an SA was used.  lastused time of in SA can used
> > > to check IPsec path is functional.
> > > 
> > > Signed-off-by: Antony Antony <antony.antony@secunet.com>
> > 
> > Your patch does not apply to current ipsec-next, please
> > rebase.
> > 
> > Thanks!
> 
> thanks for trying to apply this patch to ipsec-next.
> 
> I am happy to send a rebased patch, however I suspect ipsec is yet to be
> merged into ipsec-next? Why didn't ipsec merge into to "net" before 6.0-rc1?
> 
> There is a related patch sitting in in ipsec:
> 717ada9f10f2 ("Revert "xfrm: update SA curlft.use_time""),
> 
> Once that is in ipsec-next this patch would apply.

This means your patch never applied to ipsec-next. Please always test
your patches with the tree you want to have it applied on.

> Would you prefer a rebased patch?

Please resend once the related patch it merged to ipsec-next.

Thanks!