netdev - Re: [PATCH RFC 0/4] net: add bpfilter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180221120123.7ze57exniznjjavs@salvia>
Date:   Wed, 21 Feb 2018 13:01:23 +0100
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     David Miller <davem@...emloft.net>, phil@....cc,
        laforge@...monks.org, fw@...len.de, daniel@...earbox.net,
        netdev@...r.kernel.org, netfilter-devel@...r.kernel.org
Subject: Re: [PATCH RFC 0/4] net: add bpfilter

On Tue, Feb 20, 2018 at 05:52:54PM -0800, Alexei Starovoitov wrote:
> On Tue, Feb 20, 2018 at 11:44:31AM +0100, Pablo Neira Ayuso wrote:
> > 
> >   Don't get me wrong, no software is safe from security issues, but if you
> >   don't abstract your resources in the right way, you have more chance to
> >   have experimence more problems.
> 
> interesting point.
> The key part of iptables and nft design is heavy use of indirect calls.
> The execution of single iptable rule is ~3 indirect calls.
> Quite a lot worse in nft where every expression is an indirect call.

That's right. Netfilter is probably too modular, probably we can
revisit this to find a better balance, actually Felix Fietkau was
recently rising concerns on this, specifically in environments with
limited space to store the kernel image. We'll have a look, thanks for
remind us about this.

[...]
> CPUs will eventually be fixed and IBRS_ALL will become reality.
> Until then the kernel has to deal with the performance issues.

Hopefully, so we can all skip these problems.

Thanks.