netdev - Re: RFC: New BGF 'LOOP' instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100803141110.GT11110@cel.leo>
Date:	Tue, 3 Aug 2010 15:11:10 +0100
From:	Paul LeoNerd Evans <leonerd@...nerd.org.uk>
To:	Andi Kleen <andi@...stfloor.org>, netdev@...r.kernel.org
Cc:	David Miller <davem@...emloft.net>
Subject: Re: RFC: New BGF 'LOOP' instruction

On Tue, Aug 03, 2010 at 04:05:39PM +0200, Andi Kleen wrote:
> Well you could generalize it, like "SKIP headers where length 
> is at offset X and type at offset Y" 

Except that doesn't work for IPv6.

Some IPv6 headers are implied-length; their length never appears in the
packet. You have to "just know".

Some IPv6 headers store their length somewhere in the header body.
Different headers use different offsets within the body.

Some IPv6 headers do not make their length known on the wire -at all-,
such as IPsec's AH. Only the IPsec endpoints know how long this header
is.

This is what makes IPv6 -really- difficult to actually parse like this.

Ignoring even for a moment the impossible ones (IPsec's AH and ESP), the
rest of the headers end up becoming a giant lookup table, analogous to:

  switch(hdrtype)
  {
     case 1:
       length = someconst; break;
     case 2:
       length = someotherconst; break;
     case 3:
       length = b[someoffset]; break;
     ...
  }

This is why I wanted a LOOP instruction, the above switch code could
then be written -once- in BPF and LOOP'ed over to find the required
header. Instead, that loop must be statically unrolled some number of
times into an n-times-longer program script of less-than-equivalent
power. E.g. tcpdump/libpcap unrolls it a statically-configured 6 times,
meaning if the packet is particularly large, and the header comes 7th,
you'll never see it. My LOOP idea would mean the code is run once for
every header in the packet, regardless how many there were.

-- 
Paul "LeoNerd" Evans

leonerd@...nerd.org.uk
ICQ# 4135350       |  Registered Linux# 179460
http://www.leonerd.org.uk/

Download attachment "signature.asc" of type "application/pgp-signature" (191 bytes)