netdev - Re: [PATCH next v2 6/7] xfrm: Use l3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 10 Mar 2016 10:48:08 +0100
From:	Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:	Mahesh Bandewar <mahesh@...dewar.net>,
	David Miller <davem@...emloft.net>
Cc:	Mahesh Bandewar <maheshb@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	netdev <netdev@...r.kernel.org>, Tim Hockin <thockin@...gle.com>,
	Alex Pollitt <alex.pollitt@...aswitch.com>,
	Matthew Dupre <matthew.dupre@...aswitch.com>,
	Steffen Klassert <steffen.klassert@...unet.com>
Subject: Re: [PATCH next v2 6/7] xfrm: Use l3_dev for xfrm policy checks.

+ Steffen

Le 09/03/2016 22:50, Mahesh Bandewar a écrit :
> From: Mahesh Bandewar <maheshb@...gle.com>
>
> IPsec, whether it's tunnel mode or transport mode, is still a
> function of L3 so all the decisions should be based on the L3
> device.
>
> Signed-off-by: Mahesh Bandewar <maheshb@...gle.com>
> CC: Eric Dumazet <edumazet@...gle.com>
> CC: Tim Hockin <thockin@...gle.com>
> CC: Alex Pollitt <alex.pollitt@...aswitch.com>
> CC: Matthew Dupre <matthew.dupre@...aswitch.com>
> ---
>   include/net/xfrm.h     | 2 +-
>   net/xfrm/xfrm_policy.c | 4 ++--
>   2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/xfrm.h b/include/net/xfrm.h
> index d6f6e5006ee9..30f9a351c3b9 100644
> --- a/include/net/xfrm.h
> +++ b/include/net/xfrm.h
> @@ -1067,7 +1067,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
>   				       struct sk_buff *skb,
>   				       unsigned int family, int reverse)
>   {
> -	struct net *net = dev_net(skb->dev);
> +	struct net *net = dev_net(netif_get_l3_dev(skb->dev));
>   	int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
>
>   	if (sk && sk->sk_policy[XFRM_POLICY_IN])
> diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
> index b5e665b3cfb0..c5942744f2e3 100644
> --- a/net/xfrm/xfrm_policy.c
> +++ b/net/xfrm/xfrm_policy.c
> @@ -2462,7 +2462,7 @@ static inline int secpath_has_nontransport(const struct sec_path *sp, int k, int
>   int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
>   			unsigned short family)
>   {
> -	struct net *net = dev_net(skb->dev);
> +	struct net *net = dev_net(netif_get_l3_dev(skb->dev));
>   	struct xfrm_policy *pol;
>   	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
>   	int npols = 0;
> @@ -2620,7 +2620,7 @@ EXPORT_SYMBOL(__xfrm_policy_check);
>
>   int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
>   {
> -	struct net *net = dev_net(skb->dev);
> +	struct net *net = dev_net(netif_get_l3_dev(skb->dev));
>   	struct flowi fl;
>   	struct dst_entry *dst;
>   	int res = 1;
>