Subject: Re: [PATCH 1/3] xfrm: add incoming interface to selector

From: Ulrich Weber <[email-masked]>
Date: Wed, 30 Nov 2011 18:33:54 +0100

On 30.11.2011 01:00, David Miller wrote:
>
> This isn't safe, because we have no idea if existing users are putting
> garbage there.  So your change can break things.
>
> You'll have to add a netlink attribute or similar.
But a implementation matching xfrm against UID would break
existing programs too, where sel->user is set to garbage.

I checked all common programs, they set sel->user to zero:

iproute 3.1.0: sel->user is shown if set, but its not possible to set it
openswan 2.6.37: xfrm_selector memset to zero
strongswan 4.6.1: ifindex and user set to zero
ipsec-tools 0.8.0: PF_KEY only (memset to zero in net/key/af_key.c)
ike 2.1.7: PF_KEY only
isakmpd 20041012: PF_KEY only

Cheers
Ulrich

-- 
Ulrich Weber | [email-masked] | Senior Software Engineer
Astaro - a Sophos company | Amalienbadstr 41 | 76227 Karlsruhe | Germany
Phone +49-721-25516-0 | Fax –200 | www.astaro.com