@@ -693,6 +693,7 @@ enum {
IFLA_XFRM_UNSPEC,
IFLA_XFRM_LINK,
IFLA_XFRM_IF_ID,
+ IFLA_XFRM_COLLECT_METADATA,
__IFLA_XFRM_MAX
};
@@ -18,6 +18,7 @@ static void xfrm_print_help(struct link_util *lu, int argc, char **argv,
{
fprintf(f,
"Usage: ... %-4s dev [ PHYS_DEV ] [ if_id IF-ID ]\n"
+ " [ external ]\n"
"\n"
"Where: IF-ID := { 0x1..0xffffffff }\n",
lu->id);
@@ -27,6 +28,7 @@ static int xfrm_parse_opt(struct link_util *lu, int argc, char **argv,
struct nlmsghdr *n)
{
unsigned int link = 0;
+ bool metadata = false;
__u32 if_id = 0;
while (argc > 0) {
@@ -43,6 +45,8 @@ static int xfrm_parse_opt(struct link_util *lu, int argc, char **argv,
invarg("if_id value is invalid", *argv);
else
addattr32(n, 1024, IFLA_XFRM_IF_ID, if_id);
+ } else if (!matches(*argv, "external")) {
+ metadata = true;
} else {
xfrm_print_help(lu, argc, argv, stderr);
return -1;
@@ -50,6 +54,15 @@ static int xfrm_parse_opt(struct link_util *lu, int argc, char **argv,
argc--; argv++;
}
+ if (metadata) {
+ if (if_id || link) {
+ fprintf(stderr, "xfrmi: both 'external' and if_id/link cannot be specified\n");
+ return -1;
+ }
+ addattr(n, 1024, IFLA_XFRM_COLLECT_METADATA);
+ return 0;
+ }
+
if (!if_id)
missarg("IF_ID");
@@ -65,6 +78,11 @@ static void xfrm_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
if (!tb)
return;
+ if (tb[IFLA_XFRM_COLLECT_METADATA]) {
+ print_bool(PRINT_ANY, "external", "external ", true);
+ return;
+ }
+
if (tb[IFLA_XFRM_IF_ID]) {
__u32 id = rta_getattr_u32(tb[IFLA_XFRM_IF_ID]);
@@ -1957,6 +1957,7 @@ For a link of type
the following additional arguments are supported:
.BI "ip link add " DEVICE " type xfrm dev " PHYS_DEV " [ if_id " IF_ID " ]"
+.BR "[ external ]"
.in +8
.sp
@@ -1969,6 +1970,12 @@ the following additional arguments are supported:
policies. Policies must be configured with the same key. If not set, the key defaults to
0 and will match any policies which similarly do not have a lookup key configuration.
+.sp
+.BI external
+- make this device externally controlled. This flag is mutually exclusive with the
+.BR dev " and " if_id
+options.
+
.in -8
.TP
Support for collect metadata mode was introduced in kernel commit abc340b38ba2 ("xfrm: interface: support collect metadata mode") This commit adds support for creating xfrm interfaces in this mode. Example use: ip link add ipsec1 type xfrm external Signed-off-by: Eyal Birger <eyal.birger@gmail.com> --- include/uapi/linux/if_link.h | 1 + ip/link_xfrm.c | 18 ++++++++++++++++++ man/man8/ip-link.8.in | 7 +++++++ 3 files changed, 26 insertions(+)