linux-kernel - Re: [nf-next v2] netfilter: extend SRH matching for previous, next and last SID

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 6 May 2018 23:32:45 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Ahmed Abdelsalam <amsalam20@...il.com>
Cc:     fw@...len.de, davem@...emloft.net, linux-kernel@...r.kernel.org,
        netfilter-devel@...r.kernel.org, coreteam@...filter.org
Subject: Re: [nf-next v2] netfilter: extend SRH matching for previous, next
 and last SID

On Wed, Apr 25, 2018 at 05:30:24AM -0500, Ahmed Abdelsalam wrote:
> IPv6 Segment Routing Header (SRH) contains a list of SIDs to be crossed
> by SR encapsulated packet. Each SID is encoded as an IPv6 prefix.
> 
> When a Firewall receives an SR encapsulated packet, it should be able
> to identify which node previously processed the packet (previous SID),
> which node is going to process the packet next (next SID), and which
> node is the last to process the packet (last SID) which represent the
> final destination of the packet in case of inline SR mode.
> 
> An example use-case of using these features could be SID list that
> includes two firewalls. When the second firewall receives a packet,
> it can check whether the packet has been processed by the first firewall
> or not. Based on that check, it decides to apply all rules, apply just
> subset of the rules, or totally skip all rules and forward the packet to
> the next SID.
> 
> This patch extends SRH match to support matching previous SID, next SID,
> and last SID.

Applied, thanks Ahmed.