netdev - Re: [net-next 1/1] net: seg6: Add support for SRv6 Headend Reduced Encapsulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Jun 2022 20:45:18 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Anton Makarov <antonmakarov11235@...il.com>
Cc:     davem@...emloft.net, netdev@...r.kernel.org,
        david.lebrun@...ouvain.be,
        Anton Makarov <anton.makarov11235@...il.com>
Subject: Re: [net-next 1/1] net: seg6: Add support for SRv6 Headend Reduced
 Encapsulation

On Wed,  8 Jun 2022 14:26:46 +0300 Anton Makarov wrote:
> SRv6 Headend H.Encaps.Red and H.Encaps.L2.Red behaviors are implemented
> accordingly to RFC 8986. The H.Encaps.Red is an optimization of
> The H.Encaps behavior. The H.Encaps.L2.Red is an optimization of
> the H.Encaps.L2 behavior. Both new behaviors reduce the length of
> the SRH by excluding the first SID in the SRH of the pushed IPv6 header.
> The first SID is only placed in the Destination Address field
> of the pushed IPv6 header.
> 
> The push of the SRH is omitted when the SRv6 Policy only contains
> one segment.

missing byte swaps (install sparse and build with C=1 to catch it):

net/ipv6/seg6_iptunnel.c:237:56: warning: incorrect type in argument 1 (different base types)
net/ipv6/seg6_iptunnel.c:237:56:    expected restricted __be32 [usertype] flowinfo
net/ipv6/seg6_iptunnel.c:237:56:    got unsigned char [usertype] tos

Other random notes on things that jumped out:

> +	memset(skb->cb, 0, 48);

sizeof() is better

> +EXPORT_SYMBOL_GPL(seg6_do_srh_encap_red);

Why the export, this function should be static it seems, it's only used
in a since C source.