netdev - [PATCH iproute2-next 1/2] ip: xfrm: support "external" (`collect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221003091212.4017603-2-eyal.birger@gmail.com>
Date:   Mon,  3 Oct 2022 12:12:11 +0300
From:   Eyal Birger <eyal.birger@...il.com>
To:     netdev@...r.kernel.org
Cc:     dsahern@...il.com, stephen@...workplumber.org,
        steffen.klassert@...unet.com, nicolas.dichtel@...nd.com,
        razor@...ckwall.org, Eyal Birger <eyal.birger@...il.com>
Subject: [PATCH iproute2-next 1/2] ip: xfrm: support "external" (`collect_md`) mode in xfrm interfaces

Support for collect metadata mode was introduced in kernel commit
abc340b38ba2 ("xfrm: interface: support collect metadata mode")

This commit adds support for creating xfrm interfaces in this
mode.

Example use:

ip link add ipsec1 type xfrm external

Signed-off-by: Eyal Birger <eyal.birger@...il.com>
---
 include/uapi/linux/if_link.h |  1 +
 ip/link_xfrm.c               | 18 ++++++++++++++++++
 man/man8/ip-link.8.in        |  7 +++++++
 3 files changed, 26 insertions(+)

diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 7494cffb..153fcb96 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -693,6 +693,7 @@ enum {
 	IFLA_XFRM_UNSPEC,
 	IFLA_XFRM_LINK,
 	IFLA_XFRM_IF_ID,
+	IFLA_XFRM_COLLECT_METADATA,
 	__IFLA_XFRM_MAX
 };
 
diff --git a/ip/link_xfrm.c b/ip/link_xfrm.c
index f6c961e6..7046eb99 100644
--- a/ip/link_xfrm.c
+++ b/ip/link_xfrm.c
@@ -18,6 +18,7 @@ static void xfrm_print_help(struct link_util *lu, int argc, char **argv,
 {
 	fprintf(f,
 		"Usage: ... %-4s dev [ PHYS_DEV ] [ if_id IF-ID ]\n"
+		"		[ external ]\n"
 		"\n"
 		"Where: IF-ID := { 0x1..0xffffffff }\n",
 		lu->id);
@@ -27,6 +28,7 @@ static int xfrm_parse_opt(struct link_util *lu, int argc, char **argv,
 			  struct nlmsghdr *n)
 {
 	unsigned int link = 0;
+	bool metadata = false;
 	__u32 if_id = 0;
 
 	while (argc > 0) {
@@ -43,6 +45,8 @@ static int xfrm_parse_opt(struct link_util *lu, int argc, char **argv,
 				invarg("if_id value is invalid", *argv);
 			else
 				addattr32(n, 1024, IFLA_XFRM_IF_ID, if_id);
+		} else if (!matches(*argv, "external")) {
+			metadata = true;
 		} else {
 			xfrm_print_help(lu, argc, argv, stderr);
 			return -1;
@@ -50,6 +54,15 @@ static int xfrm_parse_opt(struct link_util *lu, int argc, char **argv,
 		argc--; argv++;
 	}
 
+	if (metadata) {
+		if (if_id || link) {
+			fprintf(stderr, "xfrmi: both 'external' and if_id/link cannot be specified\n");
+			return -1;
+		}
+		addattr(n, 1024, IFLA_XFRM_COLLECT_METADATA);
+		return 0;
+	}
+
 	if (!if_id)
 		missarg("IF_ID");
 
@@ -65,6 +78,11 @@ static void xfrm_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
 	if (!tb)
 		return;
 
+	if (tb[IFLA_XFRM_COLLECT_METADATA]) {
+		print_bool(PRINT_ANY, "external", "external ", true);
+		return;
+	}
+
 	if (tb[IFLA_XFRM_IF_ID]) {
 		__u32 id = rta_getattr_u32(tb[IFLA_XFRM_IF_ID]);
 
diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
index fc9d62fc..6dcc8504 100644
--- a/man/man8/ip-link.8.in
+++ b/man/man8/ip-link.8.in
@@ -1957,6 +1957,7 @@ For a link of type
 the following additional arguments are supported:
 
 .BI "ip link add " DEVICE " type xfrm dev " PHYS_DEV " [ if_id " IF_ID " ]"
+.BR "[ external ]"
 
 .in +8
 .sp
@@ -1969,6 +1970,12 @@ the following additional arguments are supported:
 policies. Policies must be configured with the same key. If not set, the key defaults to
 0 and will match any policies which similarly do not have a lookup key configuration.
 
+.sp
+.BI external
+- make this device externally controlled. This flag is mutually exclusive with the
+.BR dev " and " if_id
+options.
+
 .in -8
 
 .TP
-- 
2.34.1