netdev - Re: [PATCH net v5] bpf: add helper to compare network namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <16fcf613-fc8d-e2a1-5f49-40ddbade65b5@cumulusnetworks.com>
Date:   Thu, 16 Feb 2017 21:01:54 -0700
From:   David Ahern <dsa@...ulusnetworks.com>
To:     Daniel Borkmann <daniel@...earbox.net>, netdev@...r.kernel.org,
        davem@...emloft.net
Cc:     ast@...nel.org, tj@...nel.org, luto@...capital.net,
        ebiederm@...ssion.com
Subject: Re: [PATCH net v5] bpf: add helper to compare network namespaces

On 2/16/17 3:08 AM, Daniel Borkmann wrote:
> Is there anything that speaks against doing the comparison itself
> outside of the helper? Meaning, the helper would get a buffer
> passed from stack f.e. struct foo { u64 ns_dev; u64 ns_ino; }
> and fills both out with the netns info belonging to the sk/skb.

How do you handle CONFIG_NET_NS not set?

You call something like bpf_get_netns_id(sk, &foo), it has to exist
regardless of the config. What should it return if netns is disabled?