| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 18 Jun 2015 06:16:09 +0000
From: Hiroshi Shimamoto <h-shimamoto@...jp.nec.com>
To: Alexander Duyck <alexander.duyck@...il.com>,
"Skidmore, Donald C" <donald.c.skidmore@...el.com>,
"Rose, Gregory V" <gregory.v.rose@...el.com>,
"Kirsher, Jeffrey T" <jeffrey.t.kirsher@...el.com>,
"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
CC: "nhorman@...hat.com" <nhorman@...hat.com>,
"jogreene@...hat.com" <jogreene@...hat.com>,
Linux Netdev List <netdev@...r.kernel.org>,
"Choi, Sy Jong" <sy.jong.choi@...el.com>,
Rony Efraim <ronye@...lanox.com>,
"David Miller" <davem@...emloft.net>,
Edward Cree <ecree@...arflare.com>,
Or Gerlitz <gerlitz.or@...il.com>,
"sassmann@...hat.com" <sassmann@...hat.com>
Subject: RE: [Intel-wired-lan] [PATCH v6 1/3] if_link: Add control trust VF
> Subject: Re: [Intel-wired-lan] [PATCH v6 1/3] if_link: Add control trust VF
>
> On 06/17/2015 04:41 AM, Hiroshi Shimamoto wrote:
> > From: Hiroshi Shimamoto <h-shimamoto@...jp.nec.com>
> >
> > Add netlink directives and ndo entry to trust VF user.
> >
> > This controls the special permission of VF user.
> > The administrator will dedicatedly trust VF user to use some features
> > which impacts security and/or performance.
> >
> > The administrator never turn it on unless VF user is fully trusted.
> >
> > Signed-off-by: Hiroshi Shimamoto <h-shimamoto@...jp.nec.com>
> > Reviewed-by: Hayato Momma <h-momma@...jp.nec.com>
> > CC: Choi, Sy Jong <sy.jong.choi@...el.com>
> > ---
> > include/linux/if_link.h | 1 +
> > include/linux/netdevice.h | 3 +++
> > include/uapi/linux/if_link.h | 6 ++++++
> > net/core/rtnetlink.c | 19 +++++++++++++++++--
> > 4 files changed, 27 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/linux/if_link.h b/include/linux/if_link.h
> > index ae5d0d2..f923d15 100644
> > --- a/include/linux/if_link.h
> > +++ b/include/linux/if_link.h
> > @@ -24,5 +24,6 @@ struct ifla_vf_info {
> > __u32 min_tx_rate;
> > __u32 max_tx_rate;
> > __u32 rss_query_en;
> > + __u32 trusted;
> > };
> > #endif /* _LINUX_IF_LINK_H */
> > diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> > index e20979d..a034fb8 100644
> > --- a/include/linux/netdevice.h
> > +++ b/include/linux/netdevice.h
> > @@ -873,6 +873,7 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
> > * int (*ndo_set_vf_rate)(struct net_device *dev, int vf, int min_tx_rate,
> > * int max_tx_rate);
> > * int (*ndo_set_vf_spoofchk)(struct net_device *dev, int vf, bool setting);
> > + * int (*ndo_set_vf_trust)(struct net_device *dev, int vf, bool setting);
> > * int (*ndo_get_vf_config)(struct net_device *dev,
> > * int vf, struct ifla_vf_info *ivf);
> > * int (*ndo_set_vf_link_state)(struct net_device *dev, int vf, int link_state);
> > @@ -1095,6 +1096,8 @@ struct net_device_ops {
> > int max_tx_rate);
> > int (*ndo_set_vf_spoofchk)(struct net_device *dev,
> > int vf, bool setting);
> > + int (*ndo_set_vf_trust)(struct net_device *dev,
> > + int vf, bool setting);
> > int (*ndo_get_vf_config)(struct net_device *dev,
> > int vf,
> > struct ifla_vf_info *ivf);
> > diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
> > index 2c7e8e3..891050c 100644
> > --- a/include/uapi/linux/if_link.h
> > +++ b/include/uapi/linux/if_link.h
> > @@ -485,6 +485,7 @@ enum {
> > * on/off switch
> > */
> > IFLA_VF_STATS, /* network device statistics */
> > + IFLA_VF_TRUST, /* Trust VF */
> > __IFLA_VF_MAX,
> > };
> >
> > @@ -546,6 +547,11 @@ enum {
> >
> > #define IFLA_VF_STATS_MAX (__IFLA_VF_STATS_MAX - 1)
> >
> > +struct ifla_vf_trust {
> > + __u32 vf;
> > + __u32 setting;
> > +};
> > +
> > /* VF ports management section
> > *
> > * Nested layout of set/get msg is:
> > diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> > index 2d102ce..abd1a75 100644
> > --- a/net/core/rtnetlink.c
> > +++ b/net/core/rtnetlink.c
> > @@ -831,7 +831,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
> > /* IFLA_VF_STATS_BROADCAST */
> > nla_total_size(sizeof(__u64)) +
> > /* IFLA_VF_STATS_MULTICAST */
> > - nla_total_size(sizeof(__u64)));
> > + nla_total_size(sizeof(__u64)) +
> > + nla_total_size(sizeof(struct ifla_vf_trust)));
> > return size;
> > } else
> > return 0;
> > @@ -1151,6 +1152,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
> > struct ifla_vf_link_state vf_linkstate;
> > struct ifla_vf_rss_query_en vf_rss_query_en;
> > struct ifla_vf_stats vf_stats;
> > + struct ifla_vf_trust vf_trust;
> >
> > /*
> > * Not all SR-IOV capable drivers support the
> > @@ -1160,6 +1162,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
> > */
> > ivi.spoofchk = -1;
> > ivi.rss_query_en = -1;
> > + ivi.trusted = -1;
> > memset(ivi.mac, 0, sizeof(ivi.mac));
> > /* The default value for VF link state is "auto"
> > * IFLA_VF_LINK_STATE_AUTO which equals zero
> > @@ -1173,7 +1176,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
> > vf_tx_rate.vf =
> > vf_spoofchk.vf =
> > vf_linkstate.vf =
> > - vf_rss_query_en.vf = ivi.vf;
> > + vf_rss_query_en.vf =
> > + vf_trust.vf = ivi.vf;
> >
> > memcpy(vf_mac.mac, ivi.mac, sizeof(ivi.mac));
> > vf_vlan.vlan = ivi.vlan;
> > @@ -1184,6 +1188,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
> > vf_spoofchk.setting = ivi.spoofchk;
> > vf_linkstate.link_state = ivi.linkstate;
> > vf_rss_query_en.setting = ivi.rss_query_en;
> > + vf_trust.setting = ivi.trusted;
> > vf = nla_nest_start(skb, IFLA_VF_INFO);
> > if (!vf) {
> > nla_nest_cancel(skb, vfinfo);
>
> Don't you also need to define a section in ifla_vf_policy for
> IFLA_VF_TRUST? Otherwise I thought the .len value gets configured as 0.
Yes, I will check and add codes.
thanks,
Hiroshi
>
> > @@ -1571,6 +1576,16 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
> > ivrssq_en->setting);
> > break;
> > }
> > + case IFLA_VF_TRUST: {
> > + struct ifla_vf_trust *ivt;
> > +
> > + ivt = nla_data(vf);
> > + err = -EOPNOTSUPP;
> > + if (ops->ndo_set_vf_trust)
> > + err = ops->ndo_set_vf_trust(dev, ivt->vf,
> > + ivt->setting);
> > + break;
> > + }
> > default:
> > err = -EINVAL;
> > break;
> >
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists