netdev - Re: [PATCH bpf-next,v3 0/2] bpf: add helper for getting xfrm states

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f91bd727-e76f-c636-9bf5-e06909a9f353@iogearbox.net>
Date:   Tue, 24 Apr 2018 23:53:40 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Eyal Birger <eyal.birger@...il.com>, netdev@...r.kernel.org
Cc:     shmulik@...anetworks.com, ast@...nel.org
Subject: Re: [PATCH bpf-next,v3 0/2] bpf: add helper for getting xfrm states

On 04/24/2018 04:50 PM, Eyal Birger wrote:
> This patchset adds support for fetching XFRM state information from
> an eBPF program called from TC.
> 
> The first patch introduces a helper for fetching an XFRM state from the
> skb's secpath. The XFRM state is modeled using a new virtual struct which
> contains the SPI, peer address, and reqid values of the state; This struct
> can be extended in the future to provide additional state information.
> 
> The second patch adds a test example in test_tunnel_bpf.sh. The sample
> validates the correct extraction of state information by the eBPF program.
> 
> ---
> v3:
>   - Kept SPI and peer IPv4 address in state in network byte order
>     following suggestion from Alexei Starovoitov
> v2:
>   - Fixed two comments by Daniel Borkmann:
>     - disallow reserved flags in helper call
>     - avoid compiling in helper code when CONFIG_XFRM is off

Applied to bpf-next, thanks Eyal!