netdev - Re: [PATCH RFC 0/4] net: add bpfilter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Feb 2018 10:00:51 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     daniel@...earbox.net
Cc:     laforge@...monks.org, netdev@...r.kernel.org,
        netfilter-devel@...r.kernel.org, alexei.starovoitov@...il.com
Subject: Re: [PATCH RFC 0/4] net: add bpfilter

From: Daniel Borkmann <daniel@...earbox.net>
Date: Mon, 19 Feb 2018 13:03:17 +0100

> Thought was that it would be more suitable to push all the complexity of
> such translation into user space which brings couple of additional advantages
> as well: the translation can become very complex and thus it would contain
> all of it behind syscall boundary where natural path of loading programs
> would go via verifier. Given the tool would reside in user space, it would
> also allow to ease development and testing can happen w/o recompiling the
> kernel. It would allow for all the clang sanitizers to run there and for
> having a comprehensive test suite to verify and dry test translations against
> traffic test patterns (e.g. bpf infra would provide possibilities on this
> w/o complex setup). Given normal user mode helpers make this rather painful
> since they need to be shipped as extra package by the various distros, the
> idea was that the module loader back end could treat umh similarly as kernel
> modules and hook them in through request_module() approach while still
> operating out of user space. In any case, I could image this approach might
> be interesting and useful in general also for other subsystems requiring
> umh in one way or another.

Yes, this is a very powerful new facility.

It also means that the scope of developers who can contribute and work
on the translater is much larger.

When we showed this infrastructure to Linus he thought it was a very
sane idea.