diff options
| author | Benedict Wong <benedictwong@google.com> | 2018-09-05 11:00:08 -0700 |
|---|---|---|
| committer | Maciej Żenczykowski <maze@google.com> | 2020-05-08 11:17:27 -0700 |
| commit | 8f8e1c0765092eca27cf24607674bc1618d58b81 (patch) | |
| tree | de0f0a4101c275d5013f9753d6aeb7e5d0f7d908 /net/xfrm/xfrm_state.c | |
| parent | 956f790b17598a82322d09a292a1e56801d250b8 (diff) | |
BACKPORT: xfrm: Allow Output Mark to be Updated Using UPDSA
Allow UPDSA to change "output mark" to permit
policy separation of packet routing decisions from
SA keying in systems that use mark-based routing.
The set mark, used as a routing and firewall mark
for outbound packets, is made update-able which
allows routing decisions to be handled independently
of keying/SA creation. To maintain consistency with
other optional attributes, the output mark is only
updated if sent with a non-zero value.
The per-SA lock and the xfrm_state_lock are taken in
that order to avoid a deadlock with
xfrm_timer_handler(), which also takes the locks in
that order.
Signed-off-by: Nathan Harold <nharold@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 6d8e85ffe17895d7bc632dfbaa9e2e33b22fe873)
Backport resolution required using props.output_mark instead of
props.smark
Change-Id: I08c7bfc114ac9826a8a18f5ac1c3ff17a4e0940b
Signed-off-by: Benedict Wong <benedictwong@google.com>
Bug: 114060045
Diffstat (limited to 'net/xfrm/xfrm_state.c')
| -rw-r--r-- | net/xfrm/xfrm_state.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index d73c66a64226..7d50a371574c 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1357,6 +1357,15 @@ out: if (x1->curlft.use_time) xfrm_state_check_expire(x1); + if (x->props.output_mark) { + spin_lock_bh(&net->xfrm.xfrm_state_lock); + + x1->props.output_mark = x->props.output_mark; + + __xfrm_state_bump_genids(x1); + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + } + err = 0; x->km.state = XFRM_STATE_DEAD; __xfrm_state_put(x); |