linux-kernel - Re: [PATCH net-next 02/11] tools: ynl-gen: generate nested array policies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4ef5406d68805d6b176a0078ed0bf21b00052264.camel@sipsolutions.net>
Date: Mon, 08 Sep 2025 15:22:40 +0200
From: Johannes Berg <johannes@...solutions.net>
To: Asbjørn Sloth Tønnesen	
 <ast@...erby.net>, "Keller, Jacob E" <jacob.e.keller@...el.com>, "Jason A.
 Donenfeld" <Jason@...c4.com>, "David S. Miller" <davem@...emloft.net>, Eric
 Dumazet <edumazet@...gle.com>,  Jakub Kicinski	 <kuba@...nel.org>, Paolo
 Abeni <pabeni@...hat.com>
Cc: Donald Hunter <donald.hunter@...il.com>, Simon Horman
 <horms@...nel.org>,  Andrew Lunn <andrew+netdev@...n.ch>,
 "wireguard@...ts.zx2c4.com" <wireguard@...ts.zx2c4.com>, 
 "netdev@...r.kernel.org"	 <netdev@...r.kernel.org>,
 "linux-kernel@...r.kernel.org"	 <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net-next 02/11] tools: ynl-gen: generate nested array
 policies

On Mon, 2025-09-08 at 09:08 +0000, Asbjørn Sloth Tønnesen wrote:
> 
> Thank you for the consensus write up. Should we prohibit indexed-array with sub-type
> nest for families with a genetlink protocol?
> 
> It is currently only used in families with a netlink-raw or genetlink-legacy protocol.

I have no strong opinion on that, but I guess maybe so? At least print
out a warning for anyone who's trying to add such a new thing perhaps,
so that new stuff that isn't just a port (to ynl) or annotation of
existing APIs doesn't add it.

> > I can't get rid of the nested array types in nl80211 though, of course.
> 
> Wireguard is already in the same boat. [...]

Oh, sorry. I didn't look at the linked patch and thought it was adding
such a new thing. Looking now, I see it just makes the policy validate
it instead of (only) doing it in the code. (FWIW, in the code you could
then also set the policy argument for nla_parse_nested() calls to NULL.)

> Given that, as Jacob pointed out, there are more families with nested arrays in
> their YNL spec, than those using NLA_NESTED_ARRAY, then it appears that there
> are more families already in the boat.

Right.

johannes