netdev - RE: [PATCH bpf-next] bpf: Generate cookie for new non-initial net NS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <AM6PR08MB3589E63AE14327C2544D6C2598790@AM6PR08MB3589.eurprd08.prod.outlook.com>
Date:   Wed, 22 Jul 2020 06:30:32 +0000
From:   Jianlin Lv <Jianlin.Lv@....com>
To:     Daniel Borkmann <daniel@...earbox.net>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>
CC:     "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "ast@...nel.org" <ast@...nel.org>, "yhs@...com" <yhs@...com>,
        Song Zhu <Song.Zhu@....com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH bpf-next] bpf: Generate cookie for new non-initial net NS



> -----Original Message-----
> From: bpf-owner@...r.kernel.org <bpf-owner@...r.kernel.org> On Behalf
> Of Daniel Borkmann
> Sent: Wednesday, July 22, 2020 4:18 AM
> To: Jianlin Lv <Jianlin.Lv@....com>; bpf@...r.kernel.org
> Cc: davem@...emloft.net; kuba@...nel.org; ast@...nel.org; yhs@...com;
> Song Zhu <Song.Zhu@....com>; linux-kernel@...r.kernel.org;
> netdev@...r.kernel.org
> Subject: Re: [PATCH bpf-next] bpf: Generate cookie for new non-initial net NS
>
> On 7/20/20 4:09 PM, Jianlin Lv wrote:
> > For non-initial network NS, the net cookie is generated when
> > bpf_get_netns_cookie_sock is called for the first time, but it is more
> > reasonable to complete the cookie generation work when creating a new
> > network NS, just like init_net.
> > net_gen_cookie() be moved into setup_net() that it can serve the
> > initial and non-initial network namespace.
> >
> > Signed-off-by: Jianlin Lv <Jianlin.Lv@....com>
>
> What use-case are you trying to solve? Why should it be different than, say,
> socket cookie generation? I'm currently not seeing much of a point in moving
> this. When it's not used in the system, it would actually create more work.

This patch does not come from use-case, but based on the following points were considered:
1. setup_net() runs the initializers for the network namespace object, net_cookie is a member of struct net, and its initialization is more reasonable in setup_net();
2. For initial network namespaces, this patch does not introduce additional burden;
3. For systems that have not created non-initial network namespaces, this will not introduce additional work;
4. For newly created non-initial network namespaces, the added effort of net_gen_cookie() is weak for the entire network namespaces creation process, and net_cookie is only written once during the entire life cycle of network namespaces.

>
> > ---
> >   net/core/net_namespace.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index
> > dcd61aca343e..5937bd0df56d 100644
> > --- a/net/core/net_namespace.c
> > +++ b/net/core/net_namespace.c
> > @@ -336,6 +336,7 @@ static __net_init int setup_net(struct net *net,
> struct user_namespace *user_ns)
> >   idr_init(&net->netns_ids);
> >   spin_lock_init(&net->nsid_lock);
> >   mutex_init(&net->ipv4.ra_mutex);
> > +net_gen_cookie(net);
> >
> >   list_for_each_entry(ops, &pernet_list, list) {
> >   error = ops_init(ops, net);
> > @@ -1101,7 +1102,6 @@ static int __init net_ns_init(void)
> >   panic("Could not allocate generic netns");
> >
> >   rcu_assign_pointer(init_net.gen, ng);
> > -net_gen_cookie(&init_net);
> >
> >   down_write(&pernet_ops_rwsem);
> >   if (setup_net(&init_net, &init_user_ns))
> >

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.