Commit 64102d34 authored Sep 05, 2018 by Benedict Wong

BACKPORT: xfrm: Allow Output Mark to be Updated Using UPDSA



Allow UPDSA to change "output mark" to permit
policy separation of packet routing decisions from
SA keying in systems that use mark-based routing.

The set mark, used as a routing and firewall mark
for outbound packets, is made update-able which
allows routing decisions to be handled independently
of keying/SA creation. To maintain consistency with
other optional attributes, the output mark is only
updated if sent with a non-zero value.

The per-SA lock and the xfrm_state_lock are taken in
that order to avoid a deadlock with
xfrm_timer_handler(), which also takes the locks in
that order.

Signed-off-by: Nathan Harold <nharold@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

(cherry picked from commit 6d8e85ffe17895d7bc632dfbaa9e2e33b22fe873)
Backport resolution required using props.output_mark instead of
props.smark

Change-Id: I08c7bfc114ac9826a8a18f5ac1c3ff17a4e0940b
Signed-off-by: Benedict Wong <benedictwong@google.com>
Bug: 114060045

parent 1bdb20fc

net/xfrm/xfrm_state.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -1357,6 +1357,15 @@ out:
		if (x1->curlft.use_time)
		xfrm_state_check_expire(x1);

		if (x->props.output_mark) {
		spin_lock_bh(&net->xfrm.xfrm_state_lock);

		x1->props.output_mark = x->props.output_mark;

		__xfrm_state_bump_genids(x1);
		spin_unlock_bh(&net->xfrm.xfrm_state_lock);
		}

		err = 0;
		x->km.state = XFRM_STATE_DEAD;
		__xfrm_state_put(x);