netdev - Re: [RFC PATCH] xfrm: reduce struct sec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aYX920Dxv4-b1QyK@secunet.com>
Date: Fri, 6 Feb 2026 15:42:35 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Paolo Abeni <pabeni@...hat.com>
CC: Florian Westphal <fw@...len.de>, <netdev@...r.kernel.org>, Herbert Xu
	<herbert@...dor.apana.org.au>, "David S. Miller" <davem@...emloft.net>, Eric
 Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Simon Horman
	<horms@...nel.org>
Subject: Re: [RFC PATCH] xfrm: reduce struct sec_path size

On Fri, Feb 06, 2026 at 03:36:53PM +0100, Paolo Abeni wrote:
> On 2/6/26 10:48 AM, Steffen Klassert wrote:
> > On Fri, Feb 06, 2026 at 10:37:51AM +0100, Paolo Abeni wrote:
> >> I'm trying to understand why XFRM_MAX_OFFLOAD_DEPTH is 6 exactly, but
> >> it's not obvious to me skimming over the code.
> > 
> > That is beause we allow 6 transformations per packet as a maximum.
> > But for offloading we currently support just one transformation,
> > and we probably won't support more in future. This transfomation
> > bundle stuff if from the old RFC 2401. This was obsoleted by RFC
> > 4301 which does not have the concept of transformation bundles.
> > 
> > I'm currently looking how to move our inplementation from RFC 2401
> > to RFC 4301. This should remove a lot of complexity that came with
> > the old RFC 2401.
> 
> Thanks for the insights! Looking forward to complexity reduction :)
> 
> BTW are you ok if I send a formal, non RFC patch directly targeting
> net-next? The goal would be to keep skb_extensions under control for
> 6.20, countering a very recent size increase for CAN's sake.

Sure, go ahead.

Steffen