netdev - Re: netfilter 07/41: arp_tables: unfold two critical loops in arp_packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <49C952FE.7070202@cosmosbay.com>
Date:	Tue, 24 Mar 2009 22:39:10 +0100
From:	Eric Dumazet <dada1@...mosbay.com>
To:	Jan Engelhardt <jengelh@...ozas.de>
CC:	David Miller <davem@...emloft.net>, kaber@...sh.net,
	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org
Subject: Re: netfilter 07/41: arp_tables: unfold two critical loops in arp_packet_match()

Jan Engelhardt a écrit :
> On Tuesday 2009-03-24 22:18, David Miller wrote:
>>>> Arches without efficient unaligned access can still perform a loop
>>>> assuming 16bit alignment in ifname_compare()
>>> Allow me some skepticism, but the code looks pretty much like a
>>> standard memcmp.
>> memcmp() can't make any assumptions about alignment.
>> Whereas we _know_ this thing is exactly 16-bit aligned.
>>
>> All of the optimized memcmp() implementations look for
>> 32-bit alignment and punt to byte at a time comparison
>> loops if things are not aligned enough.
> 
> Yes, I seem to remember glibc doing something like
> 
>  if ((addr & 0x03) != 0) {
>      // process single bytes (increment addr as you go)
>      // until addr & 0x03 == 0.
>  }
> 
>  /* optimized loop here. also increases addr */
> 
>  if ((addr & 0x03) != 0)
>      // still bytes left after loop - process on a per-byte basis
> 
> Is the cost of testing for non-4-divisibility expensive enough
> to warrant not usnig memcmp?
> 
> Irrespective of all that, I think putting the interface comparison
> code should be agglomerated in a function/header so that it is
> replicated across iptables, ip6tables, ebtables, arptables, etc.

memcmp() is fine, but how is it solving the masking problem we have ?

Also in the case of arp_tables, _a is long word aligned, while _b and _mask are not.

memcmp() in this case is slower, (and dont handle mask thing)

If you look various ifname_compare(), we have two different implementations.

So yes, a factorization is possible for three ip_tables.c, ip6_tables.c and xt_physdev.c




--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html