[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1474393160.23058.39.camel@edumazet-glaptop3.roam.corp.google.com>
Date: Tue, 20 Sep 2016 10:39:20 -0700
From: Eric Dumazet <eric.dumazet@...il.com>
To: Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc: Jesper Dangaard Brouer <brouer@...hat.com>,
Tom Herbert <tom@...bertland.com>,
Tariq Toukan <ttoukan.linux@...il.com>,
Tariq Toukan <tariqt@...lanox.com>,
"David S. Miller" <davem@...emloft.net>,
Linux Kernel Network Developers <netdev@...r.kernel.org>,
Eran Ben Elisha <eranbe@...lanox.com>,
Saeed Mahameed <saeedm@...lanox.com>,
Rana Shahout <ranas@...lanox.com>
Subject: Re: [PATCH net-next 7/8] net/mlx5e: XDP TX forwarding support
On Tue, 2016-09-20 at 09:45 -0700, Alexei Starovoitov wrote:
> because 'div by zero' is an abnormal situation that shouldn't be exploited.
> Meaning if xdp program is doing DoS prevention and it has a bug that
> attacker can now exploit by sending a crafted packet that causes
> 'div by zero' and kernel will warn then attack got successful.
> Therefore it has to be silent drop.
A silent drop means a genuine error in a BPF program might be never
caught, since a tracepoint might never be enabled.
> tracpoint in such case is great, since the user can do debugging with it
> and even monitoring 24/7 and if suddenly the control plan sees a lot
> of such trace_xdp_abotred events, it can disable that tracepoint to avoid
> spam and adjust the program or act on attack some other way.
> Hardcoded warnings and counters are not generic enough for all
> the use cases people want to throw at XDP.
> The tracepoints idea is awesome, in a sense that it's optional.
Note that tracepoints are optional in a kernel.
Many existing supervision infrastructures collect device snmp counters,
and run as unprivileged programs.
tracepoints might not fit the need here, compared to a mere
tx_ring->tx_drops++
Powered by blists - more mailing lists