linux-kernel - Re: [PATCH net-next v7 28/28] net: WireGuard secure network tunnel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHmME9qyEuO8Or=oACw49ijWBUo2BTmKe55ByA8Xz=5zT6jCpQ@mail.gmail.com>
Date:   Mon, 8 Oct 2018 03:06:17 +0200
From:   "Jason A. Donenfeld" <Jason@...c4.com>
To:     esyr@...hat.com
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Netdev <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH net-next v7 28/28] net: WireGuard secure network tunnel

Hey Eugene,

On Sat, Oct 6, 2018 at 9:43 PM Eugene Syromiatnikov <esyr@...hat.com> wrote:
>
> On Sat, Oct 06, 2018 at 04:57:09AM +0200, Jason A. Donenfeld wrote:
> > +static int get_allowedips(void *ctx, const u8 *ip, u8 cidr, int family)
> > +{
> > +     struct allowedips_ctx *actx = ctx;
> > +     struct nlattr *allowedip_nest;
> > +
> > +     allowedip_nest = nla_nest_start(actx->skb, actx->i++);
>
> Second parameter of nl_nest_start is an attribute type; (ab)using it as
> array index leads to special handling of such structures in parsers.
> It's better to have some type like WGDEVICE_A_PEER_ITEM and provide an
> additional attribute inside it for index (WGPEER_A_INDEX?).
> See, for example, commit v4.12-rc1~119^2~131 ("nbd: add a status netlink
> command").
>
> > +static int get_peer(struct wireguard_peer *peer, unsigned int index,
> > +                 struct allowedips_cursor *rt_cursor, struct sk_buff *skb)
> > +{
> > +     struct nlattr *allowedips_nest, *peer_nest = nla_nest_start(skb, index);
>
> Same here.

Good point. Actually the index aspect is totally arbitrary and not
useful at all, and so that part can just be entirely excised.

Jason