netdev - Re: RFC: New BGF 'LOOP' instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 03 Aug 2010 11:10:28 +0200
From:	Hagen Paul Pfeifer <hagen@...u.net>
To:	David Miller <davem@...emloft.net>
Cc:	<leonerd@...nerd.org.uk>, <netdev@...r.kernel.org>
Subject: Re: RFC: New BGF 'LOOP' instruction


On Tue, 03 Aug 2010 00:19:04 -0700 (PDT), David Miller wrote:
> From: Paul LeoNerd Evans <leonerd@...nerd.org.uk>

>> Rightnow, BPF is all but useless for parsing, say, IPv6. I only pick
>> IPv6 as one example, I'm sure there must exist a great number more
>> packet-based protocols that use a "linked-list" style approach to
>> headers. None of those are currently filterable on the current set of
>> instructions. LOOP would allow these.
> 
> It's not meant for detailed packet protocol header analysis,
> it's for stateless straight line matching of masked values
> in packet headers.

David is right, BPF cannot - and will not - keep with any high level
connection tracking packet filter. There is an processing trade-off between
packet classification and packet storage with post processing analysis.

Hagen
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html