netdev - Re: [PATCH iproute2 v2] xfrm: enable to manage default policies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1ee8e8ec-734b-eec7-1826-340c0d48f26e@gmail.com>
Date:   Thu, 21 Oct 2021 08:55:46 -0600
From:   David Ahern <dsahern@...il.com>
To:     Nicolas Dichtel <nicolas.dichtel@...nd.com>,
        stephen@...workplumber.org
Cc:     netdev@...r.kernel.org, antony.antony@...unet.com,
        steffen.klassert@...unet.com
Subject: Re: [PATCH iproute2 v2] xfrm: enable to manage default policies

On 10/18/21 2:30 AM, Nicolas Dichtel wrote:
> diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
> index ecd06396eb16..378b4092f26a 100644
> --- a/include/uapi/linux/xfrm.h
> +++ b/include/uapi/linux/xfrm.h
> @@ -213,13 +213,13 @@ enum {
>  	XFRM_MSG_GETSPDINFO,
>  #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO
>  
> +	XFRM_MSG_MAPPING,
> +#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
> +
>  	XFRM_MSG_SETDEFAULT,
>  #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT
>  	XFRM_MSG_GETDEFAULT,
>  #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT
> -
> -	XFRM_MSG_MAPPING,
> -#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
>  	__XFRM_MSG_MAX
>  };
>  #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
> @@ -514,9 +514,12 @@ struct xfrm_user_offload {
>  #define XFRM_OFFLOAD_INBOUND	2
>  
>  struct xfrm_userpolicy_default {
> -#define XFRM_USERPOLICY_DIRMASK_MAX	(sizeof(__u8) * 8)
> -	__u8				dirmask;
> -	__u8				action;
> +#define XFRM_USERPOLICY_UNSPEC	0
> +#define XFRM_USERPOLICY_BLOCK	1
> +#define XFRM_USERPOLICY_ACCEPT	2
> +	__u8				in;
> +	__u8				fwd;
> +	__u8				out;
>  };
>  
>  /* backwards compatibility for userspace */

that is already updated in iproute2-next.


> diff --git a/ip/xfrm_policy.c b/ip/xfrm_policy.c
> index 7cc00e7c2f5b..744f331ff564 100644
> --- a/ip/xfrm_policy.c
> +++ b/ip/xfrm_policy.c
> @@ -1124,6 +1126,121 @@ static int xfrm_spd_getinfo(int argc, char **argv)
>  	return 0;
>  }
>  
> +static int xfrm_spd_setdefault(int argc, char **argv)
> +{
> +	struct rtnl_handle rth;
> +	struct {
> +		struct nlmsghdr			n;
> +		struct xfrm_userpolicy_default  up;
> +	} req = {
> +		.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_default)),
> +		.n.nlmsg_flags = NLM_F_REQUEST,
> +		.n.nlmsg_type = XFRM_MSG_SETDEFAULT,
> +	};
> +
> +	while (argc > 0) {
> +		if (strcmp(*argv, "in") == 0) {
> +			if (req.up.in)
> +				duparg("in", *argv);
> +
> +			NEXT_ARG();
> +			if (strcmp(*argv, "block") == 0)
> +				req.up.in = XFRM_USERPOLICY_BLOCK;
> +			else if (strcmp(*argv, "accept") == 0)
> +				req.up.in = XFRM_USERPOLICY_ACCEPT;
> +			else
> +				invarg("in policy value is invalid", *argv);
> +		} else if (strcmp(*argv, "fwd") == 0) {
> +			if (req.up.fwd)
> +				duparg("fwd", *argv);
> +
> +			NEXT_ARG();
> +			if (strcmp(*argv, "block") == 0)
> +				req.up.fwd = XFRM_USERPOLICY_BLOCK;
> +			else if (strcmp(*argv, "accept") == 0)
> +				req.up.fwd = XFRM_USERPOLICY_ACCEPT;
> +			else
> +				invarg("fwd policy value is invalid", *argv);
> +		} else if (strcmp(*argv, "out") == 0) {
> +			if (req.up.out)
> +				duparg("out", *argv);
> +
> +			NEXT_ARG();
> +			if (strcmp(*argv, "block") == 0)
> +				req.up.out = XFRM_USERPOLICY_BLOCK;
> +			else if (strcmp(*argv, "accept") == 0)
> +				req.up.out = XFRM_USERPOLICY_ACCEPT;
> +			else
> +				invarg("out policy value is invalid", *argv);
> +		} else {
> +			invarg("unknown direction", *argv);
> +		}
> +
> +		argc--; argv++;
> +	}
> +
> +	if (rtnl_open_byproto(&rth, 0, NETLINK_XFRM) < 0)
> +		exit(1);
> +
> +	if (rtnl_talk(&rth, &req.n, NULL) < 0)
> +		exit(2);
> +
> +	rtnl_close(&rth);
> +
> +	return 0;
> +}
> +
> +int xfrm_policy_default_print(struct nlmsghdr *n, FILE *fp)
> +{
> +	struct xfrm_userpolicy_default *up = NLMSG_DATA(n);
> +	int len = n->nlmsg_len - NLMSG_SPACE(sizeof(*up));
> +
> +	if (len < 0) {
> +		fprintf(stderr,
> +			"BUG: short nlmsg len %u (expect %lu) for XFRM_MSG_GETDEFAULT\n",
> +			n->nlmsg_len, NLMSG_SPACE(sizeof(*up)));
> +		return -1;
> +	}
> +
> +	fprintf(fp, "Default policies:\n");
> +	fprintf(fp, " in:  %s\n",
> +		up->in == XFRM_USERPOLICY_BLOCK ? "block" : "accept");
> +	fprintf(fp, " fwd: %s\n",
> +		up->fwd == XFRM_USERPOLICY_BLOCK ? "block" : "accept");
> +	fprintf(fp, " out: %s\n",
> +		up->out == XFRM_USERPOLICY_BLOCK ? "block" : "accept");
> +	fflush(fp);
> +
> +	return 0;
> +}
> +

create xfrm_str_to_policy and xfrm_policy_to_str helpers for the
conversions between "block" and "accept" to XFRM_USERPOLICY_BLOCK and
XFRM_USERPOLICY_ACCEPT and back.