netdev - Re: [RPC PATCH bpf-next] bpf: implement new BPF_CGROUP_INET_SOCK_POST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <500e4d8b-6ed0-92a5-a5ef-9477766be3e4@fb.com>
Date:   Thu, 14 Jan 2021 20:27:36 -0800
From:   Yonghong Song <yhs@...com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Stanislav Fomichev <sdf@...gle.com>
CC:     Andrii Nakryiko <andrii.nakryiko@...il.com>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>
Subject: Re: [RPC PATCH bpf-next] bpf: implement new
 BPF_CGROUP_INET_SOCK_POST_CONNECT



On 1/14/21 7:59 PM, Alexei Starovoitov wrote:
> On Thu, Jan 14, 2021 at 7:51 PM Stanislav Fomichev <sdf@...gle.com> wrote:
>>>>
>>>>          lock_sock(sock->sk);
>>>>          err = __inet_stream_connect(sock, uaddr, addr_len, flags, 0);
>>>
>>> Similarly here, attaching fexit to __inet_stream_connect would execute
>>> your BPF program at exactly the same time (and then you can check for
>>> err value).
>>>
>>> Or the point here is to have a more "stable" BPF program type?
>> Good suggestion, I can try to play with it, I think it should give me
>> all the info I need (I only need sock).
>> But yeah, I'd rather prefer a stable interface against stable
>> __sk_buff, but maybe fexit will also work.
> 
> Maybe we can add an extension to fentry/fexit that are cgroup scoped?
> I think this will solve many such cases.

Currently, google is pushing LTO build of the kernel. If this happens,
it is possible one global function in one file (say a.c) might be
inlined into another file (say b.c). So in this particular case,
if the global function is inlined, fentry/fexit approach might be
missing some cases? We could mark certain *special purpose* function
as non-inline, but not sure whether this is scalable or not.