netdev - Re: [PATCH iproute2 v2] xfrm: enable to manage default policies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9acfb0e5-872d-e527-9feb-6e9f5cf2f447@6wind.com>
Date:   Thu, 21 Oct 2021 23:23:01 +0200
From:   Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:     David Ahern <dsahern@...il.com>, stephen@...workplumber.org
Cc:     netdev@...r.kernel.org, antony.antony@...unet.com,
        steffen.klassert@...unet.com
Subject: Re: [PATCH iproute2 v2] xfrm: enable to manage default policies



Le 21/10/2021 à 16:55, David Ahern a écrit :
> On 10/18/21 2:30 AM, Nicolas Dichtel wrote:
>> diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
>> index ecd06396eb16..378b4092f26a 100644
>> --- a/include/uapi/linux/xfrm.h
>> +++ b/include/uapi/linux/xfrm.h
>> @@ -213,13 +213,13 @@ enum {
>>  	XFRM_MSG_GETSPDINFO,
>>  #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO
>>  
>> +	XFRM_MSG_MAPPING,
>> +#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
>> +
>>  	XFRM_MSG_SETDEFAULT,
>>  #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT
>>  	XFRM_MSG_GETDEFAULT,
>>  #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT
>> -
>> -	XFRM_MSG_MAPPING,
>> -#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
>>  	__XFRM_MSG_MAX
>>  };
>>  #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
>> @@ -514,9 +514,12 @@ struct xfrm_user_offload {
>>  #define XFRM_OFFLOAD_INBOUND	2
>>  
>>  struct xfrm_userpolicy_default {
>> -#define XFRM_USERPOLICY_DIRMASK_MAX	(sizeof(__u8) * 8)
>> -	__u8				dirmask;
>> -	__u8				action;
>> +#define XFRM_USERPOLICY_UNSPEC	0
>> +#define XFRM_USERPOLICY_BLOCK	1
>> +#define XFRM_USERPOLICY_ACCEPT	2
>> +	__u8				in;
>> +	__u8				fwd;
>> +	__u8				out;
>>  };
>>  
>>  /* backwards compatibility for userspace */
> 
> that is already updated in iproute2-next.
But this is needed for the iproute2 also. These will be in the linux v5.15 release.

[snip]

> 
> create xfrm_str_to_policy and xfrm_policy_to_str helpers for the
> conversions between "block" and "accept" to XFRM_USERPOLICY_BLOCK and
> XFRM_USERPOLICY_ACCEPT and back.
Ok.