netdev - Re: [PATCH iproute2 v2] xfrm: enable to manage default policies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5e6586d2-3bbc-1499-a578-77f4a2320801@gmail.com>
Date:   Thu, 21 Oct 2021 16:10:24 -0600
From:   David Ahern <dsahern@...il.com>
To:     nicolas.dichtel@...nd.com, stephen@...workplumber.org
Cc:     netdev@...r.kernel.org, antony.antony@...unet.com,
        steffen.klassert@...unet.com
Subject: Re: [PATCH iproute2 v2] xfrm: enable to manage default policies

On 10/21/21 3:23 PM, Nicolas Dichtel wrote:
> 
> 
> Le 21/10/2021 à 16:55, David Ahern a écrit :
>> On 10/18/21 2:30 AM, Nicolas Dichtel wrote:
>>> diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
>>> index ecd06396eb16..378b4092f26a 100644
>>> --- a/include/uapi/linux/xfrm.h
>>> +++ b/include/uapi/linux/xfrm.h
>>> @@ -213,13 +213,13 @@ enum {
>>>  	XFRM_MSG_GETSPDINFO,
>>>  #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO
>>>  
>>> +	XFRM_MSG_MAPPING,
>>> +#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
>>> +
>>>  	XFRM_MSG_SETDEFAULT,
>>>  #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT
>>>  	XFRM_MSG_GETDEFAULT,
>>>  #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT
>>> -
>>> -	XFRM_MSG_MAPPING,
>>> -#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
>>>  	__XFRM_MSG_MAX
>>>  };
>>>  #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
>>> @@ -514,9 +514,12 @@ struct xfrm_user_offload {
>>>  #define XFRM_OFFLOAD_INBOUND	2
>>>  
>>>  struct xfrm_userpolicy_default {
>>> -#define XFRM_USERPOLICY_DIRMASK_MAX	(sizeof(__u8) * 8)
>>> -	__u8				dirmask;
>>> -	__u8				action;
>>> +#define XFRM_USERPOLICY_UNSPEC	0
>>> +#define XFRM_USERPOLICY_BLOCK	1
>>> +#define XFRM_USERPOLICY_ACCEPT	2
>>> +	__u8				in;
>>> +	__u8				fwd;
>>> +	__u8				out;
>>>  };
>>>  
>>>  /* backwards compatibility for userspace */
>>
>> that is already updated in iproute2-next.
> But this is needed for the iproute2 also. These will be in the linux v5.15 release.

new functionality is added to -next first; that's why it exists.


> 
> [snip]
> 
>>
>> create xfrm_str_to_policy and xfrm_policy_to_str helpers for the
>> conversions between "block" and "accept" to XFRM_USERPOLICY_BLOCK and
>> XFRM_USERPOLICY_ACCEPT and back.
> Ok.
>