netdev - [RFC ipsec-next 0/3] xfrm: policy: replace session decode with flow dissector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230908120628.26164-1-fw@strlen.de>
Date: Fri,  8 Sep 2023 14:06:17 +0200
From: Florian Westphal <fw@...len.de>
To: <netdev@...r.kernel.org>
Cc: steffen.klassert@...unet.com,
	herbert@...dor.apana.org.au,
	Florian Westphal <fw@...len.de>
Subject: [RFC ipsec-next 0/3] xfrm: policy: replace session decode with flow dissector

RFC, its only lightly tested, if at all.

This replaces the ipv4+ipv6 session decode functions in xfrm
with a flow dissector description and then uses that to populate
the flowi.

Main drawback is that if we don't want to break MOBIKE the
flow dissector needs more bloat to get to the mh_type from
the ipv6 mobility extension header.

Comments welcome, mainly sent for the sake of next weeks
IPSec workshop.

Florian Westphal (3):
  xfrm: move mark and oif flowi decode into common code
  flow_dissector: add ipv6 mobility header support
  xfrm: policy: replace session decode with flow dissector

 include/net/flow_dissector.h |   5 +
 net/core/flow_dissector.c    |  27 ++++
 net/xfrm/xfrm_policy.c       | 290 +++++++++++++++--------------------
 3 files changed, 152 insertions(+), 170 deletions(-)

-- 
2.41.0