lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 19 Sep 2020 12:38:30 +0200 From: Antony Antony <antony@...nome.org> To: Stephen Hemminger <stephen@...workplumber.org> Cc: Antony Antony <antony@...nome.org>, netdev@...r.kernel.org Subject: [PATCH iproute2-next RFC] ip xfrm: support setting XFRMA_SET_MARK_MASK attribute in states The XFRMA_SET_MARK_MASK attribute can be set in states (4.19+) It is the mask of XFRMA_SET_MARK(a.k.a. XFRMA_OUTPUT_MARK in 4.18) It is optional and the kernel default is 0xffffffff e.g. ./ip/ip xfrm state add output-mark 0x6 mask 0xab proto esp \ auth digest_null 0 enc cipher_null '' ip xfrm state src 0.0.0.0 dst 0.0.0.0 proto esp spi 0x00000000 reqid 0 mode transport replay-window 0 output-mark 0x6/0xab auth-trunc digest_null 0x30 0 enc ecb(cipher_null) anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0 NOTE: a disadavantage of this version: error message would be the same for the option 'mark' and 'output-mark' e.g ./ip/ip xfrm state add output-mark 0xZZ mask 0xab proto \ esp auth digest_null 0 enc cipher_null '' Error: argument "0xZZ" is wrong: MARK value is invalid ./ip/ip xfrm state add mark 0xZZ mask 0xab proto esp auth \ digest_null 0 enc cipher_null '' Error: argument "0xZZ" is wrong: MARK value is invalid Signed-off-by: Antony Antony <antony@...nome.org> --- ip/xfrm_state.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/ip/xfrm_state.c b/ip/xfrm_state.c index ddf784ca..a258a1a5 100644 --- a/ip/xfrm_state.c +++ b/ip/xfrm_state.c @@ -328,7 +328,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) struct xfrm_user_sec_ctx sctx; char str[CTX_BUF_SIZE]; } ctx = {}; - __u32 output_mark = 0; + struct xfrm_mark output_mark = {0, 0}; bool is_if_id_set = false; __u32 if_id = 0; @@ -447,9 +447,7 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) is_offload = false; } } else if (strcmp(*argv, "output-mark") == 0) { - NEXT_ARG(); - if (get_u32(&output_mark, *argv, 0)) - invarg("value after \"output-mark\" is invalid", *argv); + xfrm_parse_mark(&output_mark, &argc, &argv); } else if (strcmp(*argv, "if_id") == 0) { NEXT_ARG(); if (get_u32(&if_id, *argv, 0)) @@ -741,8 +739,11 @@ static int xfrm_state_modify(int cmd, unsigned int flags, int argc, char **argv) } } - if (output_mark) - addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark); + if (output_mark.v) + addattr32(&req.n, sizeof(req.buf), XFRMA_OUTPUT_MARK, output_mark.v); + if (output_mark.m) + addattr32(&req.n, sizeof(req.buf), XFRMA_SET_MARK_MASK, + output_mark.m); if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0) exit(1); -- 2.21.3
Powered by blists - more mailing lists