lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <05b2126c-1307-e866-9791-234426e3322a@6wind.com> Date: Fri, 26 Aug 2022 13:58:14 +0200 From: Nicolas Dichtel <nicolas.dichtel@...nd.com> To: Eyal Birger <eyal.birger@...il.com>, davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, steffen.klassert@...unet.com, herbert@...dor.apana.org.au, dsahern@...nel.org, contact@...elbtn.com, pablo@...filter.org, razor@...ckwall.org, daniel@...earbox.net Cc: netdev@...r.kernel.org, bpf@...r.kernel.org Subject: Re: [PATCH ipsec-next,v4 3/3] xfrm: lwtunnel: add lwtunnel support for xfrm interfaces in collect_md mode Le 26/08/2022 à 13:47, Eyal Birger a écrit : > Allow specifying the xfrm interface if_id and link as part of a route > metadata using the lwtunnel infrastructure. > > This allows for example using a single xfrm interface in collect_md > mode as the target of multiple routes each specifying a different if_id. > > With the appropriate changes to iproute2, considering an xfrm device > ipsec1 in collect_md mode one can for example add a route specifying > an if_id like so: > > ip route add <SUBNET> dev ipsec1 encap xfrm if_id 1 > > In which case traffic routed to the device via this route would use > if_id in the xfrm interface policy lookup. > > Or in the context of vrf, one can also specify the "link" property: > > ip route add <SUBNET> dev ipsec1 encap xfrm if_id 1 link_dev eth15 > > Note: LWT_XFRM_LINK uses NLA_U32 similar to IFLA_XFRM_LINK even though > internally "link" is signed. This is consistent with other _LINK > attributes in other devices as well as in bpf and should not have an > effect as device indexes can't be negative. > > Signed-off-by: Eyal Birger <eyal.birger@...il.com> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>
Powered by blists - more mailing lists