lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 17 Aug 2022 13:20:19 -0400 From: "Michael S. Tsirkin" <mst@...hat.com> To: Bobby Eshleman <bobbyeshleman@...il.com> Cc: Jakub Kicinski <kuba@...nel.org>, Bobby Eshleman <bobby.eshleman@...il.com>, Bobby Eshleman <bobby.eshleman@...edance.com>, Cong Wang <cong.wang@...edance.com>, Jiang Wang <jiang.wang@...edance.com>, Stefan Hajnoczi <stefanha@...hat.com>, Stefano Garzarella <sgarzare@...hat.com>, Jason Wang <jasowang@...hat.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, Toke Høiland-Jørgensen <toke@...e.dk> Subject: Re: [PATCH 3/6] vsock: add netdev to vhost/virtio vsock On Tue, Aug 16, 2022 at 10:50:55AM +0000, Bobby Eshleman wrote: > > > > Eh, I was hoping it was a side channel of an existing virtio_net > > > > which is not the case. Given the zero-config requirement IDK if > > > > we'll be able to fit this into netdev semantics :( > > > > > > It's certainly possible that it may not fit :/ I feel that it partially > > > depends on what we mean by zero-config. Is it "no config required to > > > have a working socket" or is it "no config required, but also no > > > tuning/policy/etc... supported"? > > > > The value of tuning vs confusion of a strange netdev floating around > > in the system is hard to estimate upfront. > > I think "a strange netdev floating around" is a total > mischaracterization... vsock is a networking device and it supports > vsock networks. Sure, it is a virtual device and the routing is done in > host software, but the same is true for virtio-net and VM-to-VM vlan. > > This patch actually uses netdev for its intended purpose: to support and > manage the transmission of packets via a network device to a network. > > Furthermore, it actually prepares vsock to eliminate a "strange" use of > a netdev. The netdev in vsockmon isn't even used to transmit > packets, it's "floating around" for no other reason than it is needed to > support packet capture, which vsock couldn't support because it didn't > have a netdev. > > Something smells when we are required to build workaround kernel modules > that use netdev for ciphoning packets off to userspace, when we could > instead be using netdev for its intended purpose and get the same and > more benefit. So what happens when userspace inevitably attempts to bind a raw packet socket to this device? Assign it an IP? Set up some firewall rules? These things all need to be addressed before merging since they affect UAPI. > > > > The nice thing about using a built-in fq with no user visible knobs is > > that there's no extra uAPI. We can always rip it out and replace later. > > And it shouldn't be controversial, making the path to upstream smoother. > > The issue is that after pulling in fq for one kind of flow management, > then as users observe other flow issues, we will need to re-implement > pfifo, and then TBF, and then we need to build an interface to let users > select one, and to choose queue sizes... and then after awhile we've > needlessly re-implemented huge chunks of the tc system. > > I don't see any good reason to restrict vsock users to using suboptimal > and rigid queuing. > > Thanks.
Powered by blists - more mailing lists