netdev - Re: IPsec workshop at netdev01?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 7 Jan 2015 13:55:54 +0100
From:	Florian Westphal <fw@...len.de>
To:	Steffen Klassert <steffen.klassert@...unet.com>
Cc:	Florian Westphal <fw@...len.de>, netdev@...r.kernel.org,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	David Miller <davem@...emloft.net>
Subject: Re: IPsec workshop at netdev01?

Steffen Klassert <steffen.klassert@...unet.com> wrote:
> On Tue, Jan 06, 2015 at 06:00:26PM +0100, Florian Westphal wrote:
> > Steffen Klassert <steffen.klassert@...unet.com> wrote:
> > > - We still lack a 32/64 bit compatibiltiy layer for IPsec, this issue
> > >   comes up from time to time. Some solutions were proposed in the past
> > >   but all had problems. The current behaviour is broken if someone tries
> > >   to configure IPsec with 32 bit tools on a 64 bit machine. Can we get
> > >   this right somehow or is it better to just return an error in this case?
> > 
> > FWIW I think
> > http://patchwork.ozlabs.org/patch/49465/
> > 
> > came closest to achieving full CONFIG_COMPAT support; since netlink is
> > no longer async now I'm not sure we'd still need additonal 32-compat syscalls
> > to make compat work for all cases.
> > 
> > So "its ugly as hell" is probably the only problem that is hard to avoid ;-)
> 
> Yeah, and it will be no fun to maintain it...

Not sure, you'd have to make sure that no new attributes introduce need
to add another compat hack.

The best argument against supporting it is that this problem
has existed for so long that there arguably isn't much demand
(else, such patch would have been merged years ago).

i686 userland with x86_64 kernel should be rare nowadays, and
x32 seems to require 8byte aligned 64bit integers so that would work
as-is.

> So the question is still, do we really need/want it or should we
> tell that this is not supported. We just can't leave it as it is.
> We allow to configure with 32 bit tools, but the result is crap.

Perhaps one could add only some of the patches from that series,
i.e. allow xfrm netlink to detect when its dealing with a message
from i686 task (so it can fail right away)?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html