kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

xfrm: Allow Set Mark to be Updated Using UPDSA

Browse source 
Allow UPDSA to change "set mark" to permit
policy separation of packet routing decisions from
SA keying in systems that use mark-based routing.

The set mark, used as a routing and firewall mark
for outbound packets, is made update-able which
allows routing decisions to be handled independently
of keying/SA creation. To maintain consistency with
other optional attributes, the set mark is only
updated if sent with a non-zero value.

The per-SA lock and the xfrm_state_lock are taken in
that order to avoid a deadlock with
xfrm_timer_handler(), which also takes the locks in
that order.

Signed-off-by: Nathan Harold <nharold@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Nathan Harold 2018-06-29 15:07:10 -07:00 committed by Steffen Klassert
parent e4db5b61c5
commit 6d8e85ffe1
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
net/xfrm/xfrm_state.c
View file

@ -1562,6 +1562,15 @@ out:
if (x1->curlft.use_time)
xfrm_state_check_expire(x1);
if (x->props.smark.m || x->props.smark.v) {
spin_lock_bh(&net->xfrm.xfrm_state_lock);
x1->props.smark = x->props.smark;
__xfrm_state_bump_genids(x1);
spin_unlock_bh(&net->xfrm.xfrm_state_lock);
}
err = 0;
x->km.state = XFRM_STATE_DEAD;
__xfrm_state_put(x);