netdev - Re: [PATCH bpf-next 1/4] xdp: Support specifying expected existing program when attaching XDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200326194503.6wdx4gqq7u4quzrg@ast-mbp>
Date:   Thu, 26 Mar 2020 12:45:03 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Lorenz Bauer <lmb@...udflare.com>,
        Andrii Nakryiko <andrii.nakryiko@...il.com>,
        Toke Høiland-Jørgensen <toke@...hat.com>,
        John Fastabend <john.fastabend@...il.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        "David S. Miller" <davem@...emloft.net>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        Andrey Ignatov <rdna@...com>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>
Subject: Re: [PATCH bpf-next 1/4] xdp: Support specifying expected existing
 program when attaching XDP

On Thu, Mar 26, 2020 at 10:47:55AM -0700, Jakub Kicinski wrote:
> On Thu, 26 Mar 2020 10:04:53 +0000 Lorenz Bauer wrote:
> > On Thu, 26 Mar 2020 at 00:16, Andrii Nakryiko <andrii.nakryiko@...il.com> wrote:
> > > Those same folks have similar concern with XDP. In the world where
> > > container management installs "root" XDP program which other user
> > > applications can plug into (libxdp use case, right?), it's crucial to
> > > ensure that this root XDP program is not accidentally overwritten by
> > > some well-meaning, but not overly cautious developer experimenting in
> > > his own container with XDP programs. This is where bpf_link ownership
> > > plays a huge role. Tupperware agent (FB's container management agent)
> > > would install root XDP program and will hold onto this bpf_link
> > > without sharing it with other applications. That will guarantee that
> > > the system will be stable and can't be compromised.  
> > 
> > Thanks for the extensive explanation Andrii.
> > 
> > This is what I imagine you're referring to: Tupperware creates a new network
> > namespace ns1 and a veth0<>veth1 pair, moves one of the veth devices
> > (let's says veth1) into ns1 and runs an application in ns1. On which veth
> > would the XDP program go?
> > 
> > The way I understand it, veth1 would have XDP, and the application in ns1 would
> > be prevented from attaching a new program? Maybe you can elaborate on this
> > a little.
> 
> Nope, there is no veths involved. Tupperware mediates the requests 
> from containers to install programs on the physical interface for
> heavy-duty network processing like DDoS protection for the entire
> machine.

that's not what is happening.
Jakub, I strongly suggest to avoid talking about things you have no clue.