netdev - Re: [PATCH v3 bpf-next 1/3] bpf: switch BPF UAPI #define constants used from BPF program side to enums

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 4 Mar 2020 08:07:32 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     Toke Høiland-Jørgensen <toke@...hat.com>,
        Andrii Nakryiko <andrii.nakryiko@...il.com>,
        Andrii Nakryiko <andriin@...com>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Kernel Team <kernel-team@...com>, Yonghong Song <yhs@...com>
Subject: Re: [PATCH v3 bpf-next 1/3] bpf: switch BPF UAPI #define constants
 used from BPF program side to enums

On Wed, Mar 04, 2020 at 04:57:46PM +0100, Daniel Borkmann wrote:
> On 3/4/20 4:38 PM, Daniel Borkmann wrote:
> > On 3/4/20 10:37 AM, Toke Høiland-Jørgensen wrote:
> > > Andrii Nakryiko <andrii.nakryiko@...il.com> writes:
> > > > On Tue, Mar 3, 2020 at 3:01 PM Daniel Borkmann <daniel@...earbox.net> wrote:
> > > > > 
> > > > > On 3/3/20 1:32 AM, Andrii Nakryiko wrote:
> > > > > > Switch BPF UAPI constants, previously defined as #define macro, to anonymous
> > > > > > enum values. This preserves constants values and behavior in expressions, but
> > > > > > has added advantaged of being captured as part of DWARF and, subsequently, BTF
> > > > > > type info. Which, in turn, greatly improves usefulness of generated vmlinux.h
> > > > > > for BPF applications, as it will not require BPF users to copy/paste various
> > > > > > flags and constants, which are frequently used with BPF helpers. Only those
> > > > > > constants that are used/useful from BPF program side are converted.
> > > > > > 
> > > > > > Signed-off-by: Andrii Nakryiko <andriin@...com>
> > > > > 
> > > > > Just thinking out loud, is there some way this could be resolved generically
> > > > > either from compiler side or via additional tooling where this ends up as BTF
> > > > > data and thus inside vmlinux.h as anon enum eventually? bpf.h is one single
> > > > > header and worst case libbpf could also ship a copy of it (?), but what about
> > > > > all the other things one would need to redefine e.g. for tracing? Small example
> > > > > that comes to mind are all these TASK_* defines in sched.h etc, and there's
> > > > > probably dozens of other similar stuff needed too depending on the particular
> > > > > case; would be nice to have some generic catch-all, hmm.
> > > > 
> > > > Enum convertion seems to be the simplest and cleanest way,
> > > > unfortunately (as far as I know). DWARF has some extensions capturing
> > > > #defines, but values are strings (and need to be parsed, which is pain
> > > > already for "1 << 1ULL"), and it's some obscure extension, not a
> > > > standard thing. I agree would be nice not to have and change all UAPI
> > > > headers for this, but I'm not aware of the solution like that.
> > > 
> > > Since this is a UAPI header, are we sure that no userspace programs are
> > > using these defines in #ifdefs or something like that?
> > 
> > Hm, yes, anyone doing #ifdefs on them would get build issues. Simple example:
> > 
> > enum {
> >          FOO = 42,
> > //#define FOO   FOO
> > };
> > 
> > #ifndef FOO
> > # warning "bar"
> > #endif
> > 
> > int main(int argc, char **argv)
> > {
> >          return FOO;
> > }
> > 
> > $ gcc -Wall -O2 foo.c
> > foo.c:7:3: warning: #warning "bar" [-Wcpp]
> >      7 | # warning "bar"
> >        |   ^~~~~~~
> > 
> > Commenting #define FOO FOO back in fixes it as we discussed in v2:
> > 
> > $ gcc -Wall -O2 foo.c
> > $
> > 
> > There's also a flag_enum attribute, but with the experiments I tried yesterday
> > night I couldn't get a warning to trigger for anonymous enums at least, so that
> > part should be ok.
> > 
> > I was about to push the series out, but agree that there may be a risk for #ifndefs
> > in the BPF C code. If we want to be on safe side, #define FOO FOO would be needed.
> 
> I checked Cilium, LLVM, bcc, bpftrace code, and various others at least there it
> seems okay with the current approach, meaning no such if{,n}def seen that would
> cause a build warning. Also suricata seems to ship the BPF header itself. But
> iproute2 had the following in include/bpf_util.h:
> 
> #ifndef BPF_PSEUDO_MAP_FD
> # define BPF_PSEUDO_MAP_FD      1
> #endif

Consider that users can do all sorts of stupid things with uapi headers like:
#if BPF_OBJ_NAME_LEN == 16
int foo;
#else
int bar;
#endif

Does that mean that we cannnot change any #define ever?
Of course not.

Consider that #define A A
is also broken in such cases:

For example:
enum {
        A = 1
#define A A
};
#if A == 1
int foo;
#else
int bar;
#endif

Will give different 'int' variable vs:

#define A 1
#if A == 1
int foo;
#else
int bar;
#endif

So ? Let's paralyze the development because of crazy users? No.