From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52516C432BE for ; Wed, 1 Sep 2021 15:14:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2520061056 for ; Wed, 1 Sep 2021 15:14:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245737AbhIAPPC (ORCPT ); Wed, 1 Sep 2021 11:15:02 -0400 Received: from vmicros1.altlinux.org ([194.107.17.57]:39614 "EHLO vmicros1.altlinux.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245569AbhIAPPB (ORCPT ); Wed, 1 Sep 2021 11:15:01 -0400 Received: from mua.local.altlinux.org (mua.local.altlinux.org [192.168.1.14]) by vmicros1.altlinux.org (Postfix) with ESMTP id 1641472C8F8; Wed, 1 Sep 2021 18:14:03 +0300 (MSK) Received: by mua.local.altlinux.org (Postfix, from userid 508) id 01A497CF769; Wed, 1 Sep 2021 18:14:02 +0300 (MSK) Date: Wed, 1 Sep 2021 18:14:02 +0300 From: "Dmitry V. Levin" To: Antony Antony Cc: Steffen Klassert , Herbert Xu , Christian Langrock , "David S. Miller" , Jakub Kicinski , netdev@vger.kernel.org Subject: Re: [PATCH v2 ipsec-next] xfrm: Add possibility to set the default to block if we have no policy Message-ID: <20210901151402.GA2557@altlinux.org> References: <20210331144843.GA25749@moon.secunet.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi, On Sun, Jul 18, 2021 at 09:11:06AM +0200, Antony Antony wrote: > From: Steffen Klassert > > As the default we assume the traffic to pass, if we have no > matching IPsec policy. With this patch, we have a possibility to > change this default from allow to block. It can be configured > via netlink. Each direction (input/output/forward) can be > configured separately. With the default to block configuered, > we need allow policies for all packet flows we accept. > We do not use default policy lookup for the loopback device. > > v1->v2 > - fix compiling when XFRM is disabled > - Reported-by: kernel test robot > > Signed-off-by: Steffen Klassert > Co-developed-by: Christian Langrock > Signed-off-by: Christian Langrock > Co-developed-by: Antony Antony > Signed-off-by: Antony Antony [...] The following part of this patch is ABI break: > diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h > index ffc6a5391bb7..6e8095106192 100644 > --- a/include/uapi/linux/xfrm.h > +++ b/include/uapi/linux/xfrm.h > @@ -213,6 +213,11 @@ enum { > XFRM_MSG_GETSPDINFO, > #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO > > + XFRM_MSG_SETDEFAULT, > +#define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT > + XFRM_MSG_GETDEFAULT, > +#define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT > + > XFRM_MSG_MAPPING, > #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING > __XFRM_MSG_MAX After this change, strace no longer builds with the following diagnostics: ../../../src/xlat/nl_xfrm_types.h:162:1: error: static assertion failed: "XFRM_MSG_MAPPING != 0x26" 162 | static_assert((XFRM_MSG_MAPPING) == (0x26), "XFRM_MSG_MAPPING != 0x26"); -- ldv