netdev - RFC: consistent disable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 04 Dec 2006 15:59:54 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Linux Netdev List <netdev@...r.kernel.org>
Subject: RFC: consistent disable_xfrm behaviour

Currently the behaviour of disable_xfrm is inconsistent between
locally generated and forwarded packets. For locally generated
packets disable_xfrm disables the policy lookup if it is set on
the output device, for forwarded traffic however it looks at the
input device. This makes it impossible to disable xfrm on all
devices but a dummy device and use normal routing to direct
traffic to that device.

The Documentation is not exactly clear about whether the input
or output device is meant, but the way I read it talks about
the output device as well (since encryption is only done at
output):

disable_xfrm - BOOLEAN

        Disable IPSEC encryption on this interface, whatever the policy

Opinions?

View attachment "x" of type "text/plain" (402 bytes)