netdev - Re: [PATCH net-next v2 3/3] net: evaluate net.ipvX.conf.all.disable_policy and disable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201110151857.0da8a9f5@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Tue, 10 Nov 2020 15:18:57 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Vincent Bernat <vincent@...nat.ch>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        netdev@...r.kernel.org, Jonathan Corbet <corbet@....net>,
        Steffen Klassert <steffen.klassert@...unet.com>
Subject: Re: [PATCH net-next v2 3/3] net: evaluate
 net.ipvX.conf.all.disable_policy and disable_xfrm

On Sat,  7 Nov 2020 20:35:15 +0100 Vincent Bernat wrote:
> The disable_policy and disable_xfrm are a per-interface sysctl to
> disable IPsec policy or encryption on an interface. However, while a
> "all" variant is exposed, it was a noop since it was never evaluated.
> We use the usual "or" logic for this kind of sysctls.
> 
> Signed-off-by: Vincent Bernat <vincent@...nat.ch>

CC Steffen

> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index dc2a399cd9f4..a3b60c41cbad 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -1741,7 +1741,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
>  		flags |= RTCF_LOCAL;
>  
>  	rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST,
> -			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
> +			   IN_DEV_ORCONF(in_dev, NOPOLICY), false);
>  	if (!rth)
>  		return -ENOBUFS;
>  
> @@ -1857,8 +1857,8 @@ static int __mkroute_input(struct sk_buff *skb,
>  	}
>  
>  	rth = rt_dst_alloc(out_dev->dev, 0, res->type,
> -			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
> -			   IN_DEV_CONF_GET(out_dev, NOXFRM));
> +			   IN_DEV_ORCONF(in_dev, NOPOLICY),
> +			   IN_DEV_ORCONF(out_dev, NOXFRM));
>  	if (!rth) {
>  		err = -ENOBUFS;
>  		goto cleanup;
> @@ -2227,7 +2227,7 @@ out:	return err;
>  
>  	rth = rt_dst_alloc(l3mdev_master_dev_rcu(dev) ? : net->loopback_dev,
>  			   flags | RTCF_LOCAL, res->type,
> -			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
> +			   IN_DEV_ORCONF(in_dev, NOPOLICY), false);
>  	if (!rth)
>  		goto e_nobufs;
>  
> @@ -2450,8 +2450,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
>  
>  add:
>  	rth = rt_dst_alloc(dev_out, flags, type,
> -			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
> -			   IN_DEV_CONF_GET(in_dev, NOXFRM));
> +			   IN_DEV_ORCONF(in_dev, NOPOLICY),
> +			   IN_DEV_ORCONF(in_dev, NOXFRM));
>  	if (!rth)
>  		return ERR_PTR(-ENOBUFS);
>