netdev - can: hardware vs. software filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110512030245.GA253@e-circ.dyndns.org>
Date:	Wed, 11 May 2011 22:03:10 -0500
From:	Kurt Van Dijck <kurt.van.dijck@....be>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	Marc Kleine-Budde <mkl@...gutronix.de>,
	Arnd Bergmann <arnd@...db.de>,
	Subhasish Ghosh <subhasish@...tralsolutions.com>,
	Wolfgang Grandegger <wg@...ndegger.com>,
	linux-arm-kernel@...ts.infradead.org, sachi@...tralsolutions.com,
	davinci-linux-open-source@...ux.davincidsp.com,
	Netdev@...r.kernel.org, nsekhar@...com,
	open list <linux-kernel@...r.kernel.org>,
	CAN NETWORK DRIVERS <socketcan-core@...ts.berlios.de>,
	m-watkins@...com
Subject: can: hardware vs. software filter

On Wed, May 11, 2011 at 11:56:52PM +0100, Alan Cox wrote:
> > I'm not sure if reprogramming hardware filters on the fly works on evey
> > can core. The more conservative solution would be to configure the
> > filter list globally (+when the interface is down) via netlink.
> 
> For anything that isn't so braindead it ought to be done on the fly and
> behind the users back to avoid having to make app code specially aware.

> If the lists are fixed either in firmware or in software the stack needs
> to error attempts to use anything else

That is the best guarantee to let users never use this.
A tool like 'candump' should not know about any pre-configured
filter that is in place. It's the responsibility of the root user
to put proper preconfigured filters.

A lot of code would be spent to allow an application to request
software filters that fit in the preconfigured ones.
IMHO its the root users job to judge about a proper preconfigured
filter that suits the applications that run. The applications should
then be able to request any software filter they like, the root user
decided on limiting traffic.

This poses a problem in that an application may depend on these filters
for its proper operation. That exactly is the responsibility of the
root user who restricts the preconfigured filter.

Kurt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html