linux_dsm_epyc7002/net/ipv6
Lorenzo Colitti 077fbac405 net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.

Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.

This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:

1. The xfrm mark is used to match xfrm policies and states, while
   the xfrm output mark is used to set the mark (and influence
   the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
   the originating socket or transformed packet, but the output
   mark is arbitrary and depends only on the state.

The use of a separate mark provides additional flexibility. For
example:

- A packet subject to two transforms (e.g., transport mode inside
  tunnel mode) can have two different output marks applied to it,
  one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
  emitted by an IPsec tunnel can be routed based on a mark that
  is determined by the tunnel, not by the marks of the
  unencrypted packets.
- Support for setting the output marks can be introduced without
  breaking any existing setups that employ both mark-based
  routing and xfrm tunnel mode. Simply changing the code to use
  the xfrm mark for routing output packets could xfrm mark could
  change behaviour in a way that breaks these setups.

If the output mark is unspecified or set to zero, the mark is not
set or changed.

Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-11 07:03:00 +02:00
..
ila Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-06-15 11:59:32 -04:00
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2017-06-30 06:27:09 -07:00
addrconf_core.c Ipvlan should return an error when an address is already in use. 2017-06-09 12:26:07 -04:00
addrconf.c net, ipv6: convert inet6_ifaddr.refcnt from atomic_t to refcount_t 2017-07-04 01:29:04 -07:00
addrlabel.c net, ipv6: convert ip6addrlbl_entry.refcnt from atomic_t to refcount_t 2017-07-04 01:29:04 -07:00
af_inet6.c ipv6: Avoid going through ->sk_net to access the netns 2017-07-31 18:01:33 -07:00
ah6.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2017-06-23 14:17:31 -04:00
anycast.c net, ipv6: convert ifacaddr6.aca_refcnt from atomic_t to refcount_t 2017-07-04 01:29:04 -07:00
calipso.c net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t 2017-07-04 22:35:16 +01:00
datagram.c net: convert sock.sk_refcnt from atomic_t to refcount_t 2017-07-01 07:39:08 -07:00
esp6_offload.c xfrm: Auto-load xfrm offload modules 2017-08-02 11:00:15 +02:00
esp6.c esp6: Fix RX checksum after header pull 2017-08-02 11:00:15 +02:00
exthdrs_core.c
exthdrs_offload.c
exthdrs.c udp6: fix jumbogram reception 2017-07-31 22:01:21 -07:00
fib6_rules.c ipv6: Do not leak throw route references 2017-06-20 15:34:02 -04:00
fou6.c fou: make local function static 2017-05-21 13:42:36 -04:00
icmp.c net: don't global ICMP rate limit packets originating from loopback 2017-06-14 15:33:58 -04:00
inet6_connection_sock.c
inet6_hashtables.c net: convert sock.sk_refcnt from atomic_t to refcount_t 2017-07-01 07:39:08 -07:00
ip6_checksum.c
ip6_fib.c net: ipv6: Compare lwstate in detecting duplicate nexthops 2017-07-06 10:48:01 +01:00
ip6_flowlabel.c
ip6_gre.c Revert "ipv6: constify inet6_protocol structures" 2017-08-01 10:03:17 -07:00
ip6_icmp.c
ip6_input.c
ip6_offload.c ipv6: Fix leak in ipv6_gso_segment(). 2017-06-04 21:41:10 -04:00
ip6_offload.h
ip6_output.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-08-01 10:07:50 -07:00
ip6_tunnel.c net: add netlink_ext_ack argument to rtnl_link_ops.validate 2017-06-26 23:13:22 -04:00
ip6_udp_tunnel.c
ip6_vti.c vti: revert flush x-netns xfrm cache when vti interface is removed 2017-07-18 11:13:41 -07:00
ip6mr.c ip6mr: add netlink notifications on mrt6msg cache reports 2017-06-21 11:22:53 -04:00
ipcomp6.c
ipv6_sockglue.c Merge branch 'work.memdup_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-07-05 16:05:24 -07:00
Kconfig
Makefile
mcast_snoop.c
mcast.c net, ipv6: convert ifmcaddr6.mca_refcnt from atomic_t to refcount_t 2017-07-04 01:29:04 -07:00
mip6.c
ndisc.c networking: make skb_put & friends return void pointers 2017-06-16 11:48:39 -04:00
netfilter.c
output_core.c ipv6: avoid overflow of offset in ip6_find_1stfragopt 2017-07-19 22:50:14 -07:00
ping.c net: ping: do not abuse udp_poll() 2017-06-04 22:56:55 -04:00
proc.c proc: snmp6: Use correct type in memset 2017-06-12 09:53:14 -04:00
protocol.c
raw.c net: ping: do not abuse udp_poll() 2017-06-04 22:56:55 -04:00
reassembly.c
route.c net: ipv6: Compare lwstate in detecting duplicate nexthops 2017-07-06 10:48:01 +01:00
seg6_hmac.c
seg6_iptunnel.c net: add extack arg to lwtunnel build state 2017-05-30 11:55:32 -04:00
seg6.c ipv6: drop unused variables in seg6_genl_dumphac 2017-05-21 13:42:36 -04:00
sit.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-06-30 12:43:08 -04:00
syncookies.c ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check() 2017-07-18 11:22:51 -07:00
sysctl_net_ipv6.c
tcp_ipv6.c Revert "ipv6: constify inet6_protocol structures" 2017-08-01 10:03:17 -07:00
tcpv6_offload.c
tunnel6.c
udp_impl.h udp: make *udp*_queue_rcv_skb() functions static 2017-05-18 10:23:33 -04:00
udp_offload.c inet: Remove software UFO fragmenting code. 2017-07-17 09:52:58 -07:00
udp.c Revert "ipv6: constify inet6_protocol structures" 2017-08-01 10:03:17 -07:00
udplite.c
xfrm6_input.c xfrm6: Fix CHECKSUM_COMPLETE after IPv6 header push 2017-08-02 11:00:15 +02:00
xfrm6_mode_beet.c networking: make skb_pull & friends return void pointers 2017-06-16 11:48:39 -04:00
xfrm6_mode_ro.c ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() 2017-06-02 13:57:27 -04:00
xfrm6_mode_transport.c ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() 2017-06-02 13:57:27 -04:00
xfrm6_mode_tunnel.c
xfrm6_output.c
xfrm6_policy.c net: xfrm: support setting an output mark. 2017-08-11 07:03:00 +02:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c net, ipv6: convert xfrm6_tunnel_spi.refcnt from atomic_t to refcount_t 2017-07-04 01:29:04 -07:00