netdev - Re: using verifier to ensure a BPF program uses certain metadata?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20171018174253.sozuxdyfusixc5sx@ast-mbp>
Date:   Wed, 18 Oct 2017 10:42:55 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Johannes Berg <johannes@...solutions.net>
Cc:     netdev <netdev@...r.kernel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        linux-wireless <linux-wireless@...r.kernel.org>
Subject: Re: using verifier to ensure a BPF program uses certain metadata?

On Wed, Oct 18, 2017 at 08:56:31AM +0200, Johannes Berg wrote:
> > > Now, I realize that people could trivially just work around this in
> > > their program if they wanted, but I think most will take the
> > > reminder
> > > and just implement
> > > 
> > >     if (ctx->is_data_ethernet)
> > >         return DROP_FRAME;
> > > 
> > > instead, since mostly data frames will not be very relevant to
> > > them.
> > > 
> > > What do you think?
> > 
> > sounds fine and considering new verifier ops after Jakub refactoring
> > a check that is_data_ethernet was accessed would fit nicely.
> > Without void** hack.
> 
> Ok, thanks! I'll have to check what Jakub is doing there, do you have a
> pointer to that refactoring?

something similar to
commit 4f9218aaf8a4 ("bpf: move knowledge about post-translation offsets out of verifier")