lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 09 Jan 2015 13:30:38 +0800 From: Fan Du <fengyuleidian0615@...il.com> To: Steffen Klassert <steffen.klassert@...unet.com> CC: netdev@...r.kernel.org, Jamal Hadi Salim <jhs@...atatu.com>, Herbert Xu <herbert@...dor.apana.org.au>, David Miller <davem@...emloft.net>, "Du, Fan" <fan.du@...el.com> Subject: Re: IPsec workshop at netdev01? 于 2015年01月06日 18:19, Steffen Klassert 写道: > Is there any interest in doing an IPsec workshop at netdev01? > > This mail is to probe if we can gather enough discussion topics to run > such a workshop. So if someone is interested to attend and/or has a > related discussion topic, please let me know. > > The idea to do this workshop came yesterday, so I'm still collecting > topics I'm interested in. Some things that came immediately to my mind > are: > > - Our IPsec policy/state lookups are still hashlist based on slowpath with > a flowcache to do fast lookups for traffic flows we have already seen. > This flowcache has similar issues like the ipv4 routing chache had. > Is the flowcache an appropriate lookup method on the long run or should > we at least think about an additional alternative lookup method? > > - We still lack a 32/64 bit compatibiltiy layer for IPsec, this issue > comes up from time to time. Some solutions were proposed in the past > but all had problems. The current behaviour is broken if someone tries > to configure IPsec with 32 bit tools on a 64 bit machine. Can we get > this right somehow or is it better to just return an error in this case? Before a clean solution show up, I think it's better to warn user in some way like http://patchwork.ozlabs.org/patch/323842/ did. Otherwise, many people who stuck there will always spend time and try to fix this issue in whatever way. > - Changing the system time can lead to unexpected SA lifetime changes. The > discussion on the list did not lead to a conclusion on how to fix this. > What is the best way to get this fixed? I rise this issue long ago before, the culprit is SA lifetime is marked by wall clock. In a reasonable way it should be marked as monotonic boot time(counting suspend time as well). Then every thing will be work correctly. I have such a patch works correctly. EXCEPT: SA migration, where SA lifetime comes from outside. I didn't look at SA migration part though, so any comments? Steffen -- No zuo no die but I have to try. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists