netdev - Re: [PATCH iproute2 v2] xfrm: enable to manage default policies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Oct 2021 15:25:26 -0700
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     Nicolas Dichtel <nicolas.dichtel@...nd.com>
Cc:     David Ahern <dsahern@...il.com>, netdev@...r.kernel.org,
        antony.antony@...unet.com, steffen.klassert@...unet.com
Subject: Re: [PATCH iproute2 v2] xfrm: enable to manage default policies

On Thu, 21 Oct 2021 23:23:01 +0200
Nicolas Dichtel <nicolas.dichtel@...nd.com> wrote:

> Le 21/10/2021 à 16:55, David Ahern a écrit :
> > On 10/18/21 2:30 AM, Nicolas Dichtel wrote:  
> >> diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
> >> index ecd06396eb16..378b4092f26a 100644
> >> --- a/include/uapi/linux/xfrm.h
> >> +++ b/include/uapi/linux/xfrm.h
> >> @@ -213,13 +213,13 @@ enum {
> >>  	XFRM_MSG_GETSPDINFO,
> >>  #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO
> >>  
> >> +	XFRM_MSG_MAPPING,
> >> +#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
> >> +
> >>  	XFRM_MSG_SETDEFAULT,
> >>  #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT
> >>  	XFRM_MSG_GETDEFAULT,
> >>  #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT
> >> -
> >> -	XFRM_MSG_MAPPING,
> >> -#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
> >>  	__XFRM_MSG_MAX
> >>  };
> >>  #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
> >> @@ -514,9 +514,12 @@ struct xfrm_user_offload {
> >>  #define XFRM_OFFLOAD_INBOUND	2
> >>  
> >>  struct xfrm_userpolicy_default {
> >> -#define XFRM_USERPOLICY_DIRMASK_MAX	(sizeof(__u8) * 8)
> >> -	__u8				dirmask;
> >> -	__u8				action;
> >> +#define XFRM_USERPOLICY_UNSPEC	0
> >> +#define XFRM_USERPOLICY_BLOCK	1
> >> +#define XFRM_USERPOLICY_ACCEPT	2
> >> +	__u8				in;
> >> +	__u8				fwd;
> >> +	__u8				out;
> >>  };
> >>  
> >>  /* backwards compatibility for userspace */  
> > 
> > that is already updated in iproute2-next.  
> But this is needed for the iproute2 also. These will be in the linux v5.15 release.

Yes the header is already in iproute2 just not the code to use it.

PS: Need a volunteer to update ip xfrm to print in JSON like the
rest of ip sub commands.