netdev - Re: [RFC PATCH] xfrm: reduce struct sec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYW5CHT70Q7LDoWa@secunet.com>
Date: Fri, 6 Feb 2026 10:48:56 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Paolo Abeni <pabeni@...hat.com>
CC: Florian Westphal <fw@...len.de>, <netdev@...r.kernel.org>, Herbert Xu
	<herbert@...dor.apana.org.au>, "David S. Miller" <davem@...emloft.net>, Eric
 Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Simon Horman
	<horms@...nel.org>
Subject: Re: [RFC PATCH] xfrm: reduce struct sec_path size

On Fri, Feb 06, 2026 at 10:37:51AM +0100, Paolo Abeni wrote:
> 
> I'm trying to understand why XFRM_MAX_OFFLOAD_DEPTH is 6 exactly, but
> it's not obvious to me skimming over the code.

That is beause we allow 6 transformations per packet as a maximum.
But for offloading we currently support just one transformation,
and we probably won't support more in future. This transfomation
bundle stuff if from the old RFC 2401. This was obsoleted by RFC
4301 which does not have the concept of transformation bundles.

I'm currently looking how to move our inplementation from RFC 2401
to RFC 4301. This should remove a lot of complexity that came with
the old RFC 2401.