Re: [PATCH ipsec-next v9 00/16] xfrm: XFRM_MSG_MIGRATE_STATE new netlink message

[Steffen Klassert <steffen.klassert@secunet.com>]

On Tue, May 26, 2026 at 09:05:38PM +0200, Antony Antony wrote:
> The current XFRM_MSG_MIGRATE interface is tightly coupled to policy and
> SA migration, and it lacks the information required to reliably migrate
> individual SAs. This makes it unsuitable for IKEv2 deployments,
> dual-stack setups (IPv4/IPv6), and scenarios where policies are managed
> externally (e.g., by daemons other than the IKE daemon).
> 
> Mandatory SA selector list
> The current API requires a non-empty SA selector list, which does not
> reflect the IKEv2 use case.
> A single Child SA may correspond to multiple policies,
> and SA discovery already occurs via address and reqid matching. With
> dual-stack Child SAs this leads to excessive churn: the current method
> would have to be called up to six times (in/out/fwd × v4/v6) on SA,
> while the new method only requires two calls.
> 
> Selectors lack SPI (and marks)
> XFRM_MSG_MIGRATE cannot uniquely identify an SA when multiple SAs share
> the same policies (per-CPU SAs, SELinux label-based SAs, etc.). Without
> the SPI, the kernel may update the wrong SA instance.
> 
> Reqid cannot be changed
> Some implementations allocate reqids based on traffic selectors. In
> host-to-host or selector-changing scenarios, the reqid must change,
> which the current API cannot express.
> 
> Because strongSwan and other implementations manage policies
> independently of the kernel, an interface that updates only a specific
> SA - with complete and unambiguous identification - is required.
> 
> SA Selector, x->sel, can't be changed, especially Transport mode.
> 
> XFRM_MSG_MIGRATE_STATE provides that interface. It supports migration
> of a single SA via xfrm_usersa_id (including SPI) and we fix
> encap removal in this patch set, reqid updates, address changes,
> and other SA-specific parameters. It avoids the structural limitations
> of XFRM_MSG_MIGRATE and provides a simpler, extensible mechanism for
> precise per-SA migration without involving policies.
> This method also allows migtrating SA selectors typically used with
> host-to-host in Transport mode.
> 
> New migration steps: first install block policy, remove the old policy,
> call XFRM_MSG_MIGRATE_STATE for each state, then re-install the
> policies and remove the block policy.
> 
> If the target SA tuple (daddr, SPI, proto, family) is already
> occupied, the operation returns -EEXIST. In this case the original
> SA is not preserved. Userspace must handle -EEXIST by
> re-establishing the SA at the IKE level and manage policies.
> 
> ---
> v8->v9: address v8 review Sabrina and Steffen
> 	- split const xuo cleanup
> 	- input validation
> 
> Link to v8: https://lore.kernel.org/all/migrate-state-v8-0-4578fb016965@secunet.com/
> v7->v8: - removed the unknown-flags validation block
> 
> Link to v7: https://patch.msgid.link/migrate-state-v7-14-44eb2440b91c@secunet.com
> v6->v7: - add SA selectoor migration
> 	- fixes to commit messages
> 	- white space removal
> 
> Link to v6: https://lore.kernel.org/r/migrate-state-v6-0-9df9764ddb9e@secunet.com
> v5->v6: - add mark to look up SA.
> 	- restrict netlink attributes in new method
> 	- address review feedback from Sabrina
> 	- add new patch to fix existing inter-family address comparison
> 	- add extack xfrm_state_init()
> 	- Feedback from Yan : omit-to-inherit add migrating marks
> 	- Drop missing __rcu annotation on nlsk, Sabrina has a better patch
> 
> Link to v5: https://lore.kernel.org/all/cover.1769509130.git.antony.antony@secunet.com/
> v4->v5: add synchronize after migrate and delete it inside a lock
> 	- split xfrm_state_migrate into create and install functions
> 
> Link to v4: https://lore.kernel.org/all/cover.1768811736.git.antony.antony@secunet.com/
> v3->v4: add patch to fix pre-existing missing __rcu annotation on nlsk
> 
> v2->v3: - fix commit message formatting
> 
> Link to v2: https://lore.kernel.org/all/cover.1768462955.git.antony.antony@secunet.com/
> 
> Lint to v1: https://lore.kernel.org/all/cover.1767964254.git.antony@moon.secunet.de/
> v1->v2: dropped 6/6. That check is already there where the func is called
> 	- merged patch 4/6 and 5/6, to fix use uninitialized value
> 	- fix commit messages
> 
> ---
> Antony Antony (16):
>       xfrm: remove redundant assignments
>       xfrm: add extack to xfrm_init_state
>       xfrm: allow migration from UDP encapsulated to non-encapsulated ESP
>       xfrm: fix NAT-related field inheritance in SA migration
>       xfrm: rename reqid in xfrm_migrate
>       xfrm: split xfrm_state_migrate into create and install functions
>       xfrm: check family before comparing addresses in migrate
>       xfrm: add state synchronization after migration
>       xfrm: add error messages to state migration
>       xfrm: move encap and xuo into struct xfrm_migrate
>       xfrm: refactor XFRMA_MTIMER_THRESH validation into a helper
>       xfrm: extract address family and selector validation helpers
>       xfrm: make xfrm_dev_state_add xuo parameter const
>       xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration
>       xfrm: restrict netlink attributes for XFRM_MSG_MIGRATE_STATE
>       xfrm: add documentation for XFRM_MSG_MIGRATE_STATE

Series appled, thanks a lot for your effort Antony!