netdev - Re: [PATCHv2 net-next 0/5] pktgen IPsec support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 10 Dec 2013 09:19:09 +0800
From:	Fan Du <fan.du@...driver.com>
To:	David Miller <davem@...emloft.net>
CC:	<steffen.klassert@...unet.com>, <netdev@...r.kernel.org>
Subject: Re: [PATCHv2 net-next 0/5] pktgen IPsec support



On 2013年12月10日 08:58, David Miller wrote:
> From: Fan Du<fan.du@...driver.com>
> Date: Fri, 6 Dec 2013 17:53:29 +0800
>
>> Hi, Dave/Steffen
>>
>> Current pktgen IPsec supports only transport/ESP combinnation,
>> and it's buggy before I fixed transformed IP header/length issue
>> a few days ago.
>>
>> This patchset enables user to do almost any IPsec transformation,
>> both transport/tunnel mode, and AH/ESP/IPcomp type.
>>
>> Below configuration has been tested, and using Wireshark could decrypt
>> out plain text in good formation without any checksum/auth errors:
>>
>> Mode/TYPE	AH	ESP
>> Transport	x	x
>> Tunnel		x	x
>>
>> ChangeLog
>> v2:
>>    Rebase patchset against newest net-next.
>>    Patch1: Remove adding rebundant empty line spotted by Sergei.
>>    Patch2: Use only one dst pointing into itself to save space.
>
> I don't like how you've arranged this.
>
> The existing mechanism might be used by someone, and in patch #1
> you just remove it.
>
> It's fixed, but so what?  It might useful for someone.


How it could be usable first and then useful for someone before my fix
9e921193884dd85b4cd68aa18598d8c2f9ad85b9
({pktgen, xfrm} Correct xfrm state lock usage when transforming)???

Do you really know what this fix does?

> You must make your changes such that existing setups still
> work, you can't just break things on people.
>

The broken things is the original patch, not this patchset,
any people try to use pktgen with IPsec enabled could spot it's not working.
and any up comping make-working patch won't break anything!


-- 
浮沉随浪只记今朝笑

--fan
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html