netdev - Re: [PATCH v3 net-next 1/1] net: Add new protocol attribute to IP addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b4a22e7a-7566-372f-6fe6-1e293f523c76@kernel.org>
Date:   Tue, 15 Feb 2022 09:46:17 -0700
From:   David Ahern <dsahern@...nel.org>
To:     Jacques de Laval <Jacques.De.Laval@...termo.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH v3 net-next 1/1] net: Add new protocol attribute to IP
 addresses

On 2/14/22 8:59 AM, Jacques de Laval wrote:
> This patch adds a new protocol attribute to IPv4 and IPv6 addresses.
> Inspiration was taken from the protocol attribute of routes. User space
> applications like iproute2 can set/get the protocol with the Netlink API.
> 
> The attribute is stored as an 8-bit unsigned integer.
> 
> The protocol attribute is set by kernel for these categories:
> 
> - IPv4 and IPv6 loopback addresses
> - IPv6 addresses generated from router announcements
> - IPv6 link local addresses
> 
> User space may pass custom protocols, not defined by the kernel.
> 
> Grouping addresses on their origin is useful in scenarios where you want
> to distinguish between addresses based on who added them, e.g. kernel
> vs. user space.
> 
> Tagging addresses with a string label is an existing feature that could be
> used as a solution. Unfortunately the max length of a label is
> 15 characters, and for compatibility reasons the label must be prefixed
> with the name of the device followed by a colon. Since device names also
> have a max length of 15 characters, only -1 characters is guaranteed to be
> available for any origin tag, which is not that much.
> 
> A reference implementation of user space setting and getting protocols
> is available for iproute2:
> 
> https://github.com/westermo/iproute2/commit/9a6ea18bd79f47f293e5edc7780f315ea42ff540
> 
> Signed-off-by: Jacques de Laval <Jacques.De.Laval@...termo.com>
> 
> ---
> v1 -> v2:
>   - Move ifa_prot to existing holes in structs (David)
>   - Change __u8 to u8 (Jakub)
>   - Define and use constants for addresses set by kernel (David)
> v2 -> v3:
>   - Document userspace attribute in comment (David)
>   - Fix comment formatting (David)
>   - Don't set IFAPROT_KERNEL_LO in inet_set_ifa, could be userspace
>     initiated (David)
>   - Only set protocol attribute if specified (David)
> ---
>  include/linux/inetdevice.h   |  1 +
>  include/net/addrconf.h       |  2 ++
>  include/net/if_inet6.h       |  2 ++
>  include/uapi/linux/if_addr.h |  9 ++++++++-
>  net/ipv4/devinet.c           |  7 +++++++
>  net/ipv6/addrconf.c          | 27 +++++++++++++++++++++------
>  6 files changed, 41 insertions(+), 7 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@...nel.org>