Re: [PATCH v2 ipsec-next] xfrm: Add possibility to set the default to block if we have no policy
From: Dmitry V. Levin <hidden>
Date: 2021-09-01 15:14:06
Hi, On Sun, Jul 18, 2021 at 09:11:06AM +0200, Antony Antony wrote:
From: Steffen Klassert <steffen.klassert@secunet.com> As the default we assume the traffic to pass, if we have no matching IPsec policy. With this patch, we have a possibility to change this default from allow to block. It can be configured via netlink. Each direction (input/output/forward) can be configured separately. With the default to block configuered, we need allow policies for all packet flows we accept. We do not use default policy lookup for the loopback device. v1->v2 - fix compiling when XFRM is disabled - Reported-by: kernel test robot [off-list ref] Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Co-developed-by: Christian Langrock <redacted> Signed-off-by: Christian Langrock <redacted> Co-developed-by: Antony Antony <redacted> Signed-off-by: Antony Antony <redacted>
[...] The following part of this patch is ABI break:
quoted hunk ↗ jump to hunk
diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h index ffc6a5391bb7..6e8095106192 100644 --- a/include/uapi/linux/xfrm.h +++ b/include/uapi/linux/xfrm.h@@ -213,6 +213,11 @@ enum { XFRM_MSG_GETSPDINFO, #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO + XFRM_MSG_SETDEFAULT, +#define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT + XFRM_MSG_GETDEFAULT, +#define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT + XFRM_MSG_MAPPING, #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING __XFRM_MSG_MAX
After this change, strace no longer builds with the following diagnostics: ../../../src/xlat/nl_xfrm_types.h:162:1: error: static assertion failed: "XFRM_MSG_MAPPING != 0x26" 162 | static_assert((XFRM_MSG_MAPPING) == (0x26), "XFRM_MSG_MAPPING != 0x26"); -- ldv