netdev - [net PATCH 0/5] sockmap fixes for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <150833522977.3588.14633565129152334098.stgit@john-XPS-13-9360>
Date:   Wed, 18 Oct 2017 07:09:48 -0700
From:   John Fastabend <john.r.fastabend@...il.com>
To:     alexei.starovoitov@...il.com, davem@...emloft.net
Cc:     netdev@...r.kernel.org, borkmann@...earbox.net
Subject: [net PATCH 0/5] sockmap fixes for net

The following implements a set of fixes for sockmap and changes the
API slightly in a few places to reduce preempt_disable/enable scope.
We do this here in net because it requires an API change and this
avoids getting stuck with legacy API going forward.

The short description:

Access to skb mark is removed, it is problematic when we add
features in the future because mark is a union and used by the
TCP/socket code internally. We don't want to expose this to the
BPF programs or let programs change the values.

The other change is caching metadata in the skb itself between
when the BPF program returns a redirect code and the core code
implements the redirect. This avoids having per cpu metadata.

Finally, tighten restriction on using sockmap to CAP_NET_ADMIN and
only SOCK_STREAM sockets.

Thanks,
John

---

John Fastabend (5):
      bpf: enforce TCP only support for sockmap
      bpf: avoid preempt enable/disable in sockmap using tcp_skb_cb region
      bpf: remove mark access for SK_SKB program types
      bpf: require CAP_NET_ADMIN when using sockmap maps
      bpf: require CAP_NET_ADMIN when using devmap

 include/linux/filter.h                             |    2 +
 include/net/tcp.h                                  |    5 +++
 kernel/bpf/devmap.c                                |    3 ++
 kernel/bpf/sockmap.c                               |   28 ++++++++++++------
 net/core/filter.c                                  |   31 ++++++++++----------
 samples/sockmap/sockmap_kern.c                     |    2 +
 tools/include/uapi/linux/bpf.h                     |    3 +-
 tools/testing/selftests/bpf/bpf_helpers.h          |    2 +
 tools/testing/selftests/bpf/sockmap_verdict_prog.c |    4 +--
 tools/testing/selftests/bpf/test_maps.c            |   12 +++++++-
 tools/testing/selftests/bpf/test_verifier.c        |   16 +++++++++-
 11 files changed, 74 insertions(+), 34 deletions(-)

--
Signature