linux-kernel - Re: [net-next v2] netfilter: add segment routing header 'srh' match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 8 Jan 2018 14:54:26 +0100
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Ahmed AbdelSalam <amsalam20@...il.com>
Cc:     davem@...emloft.net, linux-kernel@...r.kernel.org,
        netfilter-devel@...r.kernel.org, coreteam@...filter.org
Subject: Re: [net-next v2] netfilter: add segment routing header 'srh' match

On Mon, Jan 08, 2018 at 02:45:16PM +0100, Ahmed AbdelSalam wrote:
> 
> > On 8 Jan 2018, at 14:37, Pablo Neira Ayuso <pablo@...filter.org> wrote:
> > 
> > On Sun, Jan 07, 2018 at 07:22:02PM +0100, Ahmed Abdelsalam wrote:
> >> It allows matching packets based on Segment Routing Header
> >> (SRH) information.
> >> The implementation considers revision 7 of the SRH draft.
> >> https://tools.ietf.org/html/draft-ietf-6man-segment-routing-header-07
> >> 
> >> Currently supported match options include:
> >> (1) Next Header
> >> (2) Hdr Ext Len
> >> (3) Segments Left
> >> (4) Last Entry
> >> (5) Tag value of SRH
> > 
> > net/ipv6/netfilter/ip6t_srh.c: In function ‘srh_mt6’:
> > net/ipv6/netfilter/ip6t_srh.c:115:10: error: ‘struct ipv6_sr_hdr’ has
> > no member named ‘tag’
> >     !(srh->tag == srhinfo->tag)))
> >          ^
> > net/ipv6/netfilter/ip6t_srh.c:26:4: note: in definition of macro
> > ‘NF_SRH_INVF’
> >  ((boolean) ^ !!((ptr)->mt_invflags & (flag)))
> >    ^
> > 
> > Something breaks compilation here.
> 
> 
> This patch is based on David Miller net-next tree. 
> The reason for the compilation error is that you don’t have in your tree the following patch
> ipv6: sr: update the struct ipv6_sr_hdr (https://patchwork.ozlabs.org/patch/838198/ <https://patchwork.ozlabs.org/patch/838198/>). 
> In this patch the “tag” field was introduced to replace the reserved bits of SRH

OK. I'll included this in the next batch, once nf-next gets in sync
with net-next.

Thanks for explaining.