From: Ulrich Weber <ulrich.weber@sophos.com>
To: David Miller <davem@davemloft.net>
Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: Re: [PATCH 1/3] xfrm: add incoming interface to selector
Date: Wed, 30 Nov 2011 18:33:54 +0100 [thread overview]
Message-ID: <4ED66902.7060507@sophos.com> (raw)
In-Reply-To: <20111129.190037.1527680744377783412.davem@davemloft.net>
On 30.11.2011 01:00, David Miller wrote:
>
> This isn't safe, because we have no idea if existing users are putting
> garbage there. So your change can break things.
>
> You'll have to add a netlink attribute or similar.
But a implementation matching xfrm against UID would break
existing programs too, where sel->user is set to garbage.
I checked all common programs, they set sel->user to zero:
iproute 3.1.0: sel->user is shown if set, but its not possible to set it
openswan 2.6.37: xfrm_selector memset to zero
strongswan 4.6.1: ifindex and user set to zero
ipsec-tools 0.8.0: PF_KEY only (memset to zero in net/key/af_key.c)
ike 2.1.7: PF_KEY only
isakmpd 20041012: PF_KEY only
Cheers
Ulrich
--
Ulrich Weber | ulrich.weber@sophos.com | Senior Software Engineer
Astaro - a Sophos company | Amalienbadstr 41 | 76227 Karlsruhe | Germany
Phone +49-721-25516-0 | Fax –200 | www.astaro.com
next prev parent reply other threads:[~2011-11-30 17:33 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-28 20:14 [PATCH 0/3] xfrm: add incoming interface to selector Ulrich Weber
2011-11-28 20:14 ` [PATCH 1/3] " Ulrich Weber
2011-11-30 0:00 ` David Miller
2011-11-30 17:33 ` Ulrich Weber [this message]
2011-11-30 17:47 ` David Miller
2011-11-28 20:14 ` [PATCH 2/3] route: set iif and oif information in flowi struct Ulrich Weber
2011-11-28 23:53 ` Julian Anastasov
2011-11-30 17:21 ` Ulrich Weber
2011-11-30 22:37 ` Julian Anastasov
2011-11-30 0:01 ` David Miller
2011-11-28 20:14 ` [PATCH 3/3] xfrm: allow to overwrite incoming dev after decryption Ulrich Weber
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4ED66902.7060507@sophos.com \
--to=ulrich.weber@sophos.com \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.