netdev - Re: [RFC] [PATCH] [XFRM]: Restrict upper layer information by bundle.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20070430.003437.57159715.davem@davemloft.net>
Date:	Mon, 30 Apr 2007 00:34:37 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	nakam@...ux-ipv6.org
Cc:	netdev@...r.kernel.org
Subject: Re: [RFC] [PATCH] [XFRM]: Restrict upper layer information by
 bundle.

From: Masahide NAKAMURA <nakam@...ux-ipv6.org>
Date: Fri,  6 Apr 2007 16:25:39 +0900

> On MIPv6 usage, XFRM sub policy is enabled.
> When main (IPsec) and sub (MIPv6) policy selectors have the same
> address set but different upper layer information (i.e. protocol
> number and its ports or type/code), multiple bundle should be created.
> However, currently we have issue to use the same bundle created for
> the first time with all flows covered by the case.
> 
> It is useful for the bundle to have the upper layer information
> to be restructured correctly if it does not match with the flow.
> 
> 1. Bundle was created by two policies
> Selector from another policy is added to xfrm_dst.
> If the flow does not match the selector, it goes to slow path to
> restructure new bundle by single policy.
> 
> 2. Bundle was created by one policy
> Flow cache is added to xfrm_dst as originated one. If the flow does
> not match the cache, it goes to slow path to try searching another
> policy.
> 
> Signed-off-by: Masahide NAKAMURA <nakam@...ux-ipv6.org>

This is an OK solution for the problem for now.

My senses tell me that there is probably some cleaner way to
handle this problem.  If you come up with a better idea for it,
please feel free to bounce your ideas to me.

Thanks.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html