From: "Toke Høiland-Jørgensen" <toke@redhat•com>
To: David Ahern <dsahern@gmail•com>, David Ahern <dsahern@kernel•org>,
netdev@vger•kernel.org
Cc: davem@davemloft•net, kuba@kernel•org,
prashantbhole.linux@gmail•com, jasowang@redhat•com,
brouer@redhat•com, toshiaki.makita1@gmail•com,
daniel@iogearbox•net, john.fastabend@gmail•com, ast@kernel•org,
kafai@fb•com, songliubraving@fb•com, yhs@fb•com, andriin@fb•com,
David Ahern <dahern@digitalocean•com>
Subject: Re: [PATCH bpf-next 04/16] net: Add BPF_XDP_EGRESS as a bpf_attach_type
Date: Wed, 22 Apr 2020 13:21:09 +0200 [thread overview]
Message-ID: <87k1277om2.fsf@toke.dk> (raw)
In-Reply-To: <073ed1a6-ff5e-28ef-d41d-c33d87135faa@gmail.com>
David Ahern <dsahern@gmail•com> writes:
> On 4/21/20 7:25 AM, Toke Høiland-Jørgensen wrote:
>> David Ahern <dsahern@gmail•com> writes:
>>
>>> On 4/21/20 4:14 AM, Toke Høiland-Jørgensen wrote:
>>>> As I pointed out on the RFC patch, I'm concerned whether this will work
>>>> right with freplace programs attaching to XDP programs. It may just be
>>>> that I'm missing something, but in that case please explain why it
>>>> works? :)
>>>
>>> expected_attach_type is not unique to XDP. freplace is not unique to
>>> XDP. IF there is a problem, it is not unique to XDP, and any
>>> enhancements needed to freplace functionality will not be unique to XDP.
>>
>> Still needs to be fixed, though :)
>
> one problem at a time. I have a long list of items that are directly
> relevant to what I want to do.
Not saying a fix to freplace *has* to be part of this series; just
saying that I would be more comfortable if that was fixed before we
merge this.
>> Also, at least looking through all the is_valid_access functions in
>> filter.c, they all seem to "fail safe". I.e., specific
>> expected_attach_type values can permit the program access to additional
>> ranges. In which case an freplace program that doesn't have the right
>> attach type will just be rejected if it tries to access such a field.
>> Whereas here you're *disallowing* something based on a particular
>> expected_attach_type, so you can end up with an egress program that
>> should have been rejected by the verifier but isn't because it's missing
>> the attach_type.
>
> There are 6 existing valid access checks on expected_attach_type doing
> the exact same thing - validating access based on attach type.
See my point about default black/white listing, though. You are adding a
new restriction to an existing program type based on this, so surely we
should make sure this restriction actually sticks, no?
-Toke
next prev parent reply other threads:[~2020-04-22 11:21 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-20 20:00 [PATCH bpf-next 00/16] net: Add support for XDP in egress path David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 01/16] net: Refactor convert_to_xdp_frame David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 02/16] net: Move handling of IFLA_XDP attribute out of do_setlink David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 03/16] net: Add XDP setup and query commands for Tx programs David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 04/16] net: Add BPF_XDP_EGRESS as a bpf_attach_type David Ahern
2020-04-21 10:14 ` Toke Høiland-Jørgensen
2020-04-21 12:50 ` David Ahern
2020-04-21 13:25 ` Toke Høiland-Jørgensen
2020-04-21 13:49 ` David Ahern
2020-04-22 11:21 ` Toke Høiland-Jørgensen [this message]
2020-04-22 14:51 ` David Ahern
2020-04-22 15:27 ` Toke Høiland-Jørgensen
2020-04-22 15:33 ` David Ahern
2020-04-22 15:51 ` Toke Høiland-Jørgensen
2020-04-22 15:56 ` David Ahern
2020-04-23 15:23 ` Toke Høiland-Jørgensen
2020-04-23 0:39 ` Alexei Starovoitov
2020-04-23 16:40 ` Toke Høiland-Jørgensen
2020-04-23 16:52 ` Alexei Starovoitov
2020-04-23 17:05 ` Toke Høiland-Jørgensen
2020-04-23 22:44 ` Alexei Starovoitov
2020-04-23 23:49 ` Toke Høiland-Jørgensen
2020-04-24 0:53 ` Alexei Starovoitov
2020-04-24 0:58 ` David Ahern
2020-04-24 8:55 ` Toke Høiland-Jørgensen
2020-04-20 20:00 ` [PATCH bpf-next 05/16] xdp: Add xdp_txq_info to xdp_buff David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 06/16] net: Add IFLA_XDP_EGRESS for XDP programs in the egress path David Ahern
2020-04-21 10:17 ` Toke Høiland-Jørgensen
2020-04-21 12:59 ` David Ahern
2020-04-21 13:27 ` Toke Høiland-Jørgensen
2020-04-20 20:00 ` [PATCH bpf-next 07/16] net: Rename do_xdp_generic to do_xdp_generic_rx David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 08/16] net: rename netif_receive_generic_xdp to do_generic_xdp_core David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 09/16] net: set XDP egress program on netdevice David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 10/16] net: Support xdp in the Tx path for packets as an skb David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 11/16] net: Support xdp in the Tx path for xdp_frames David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 12/16] libbpf: Add egress XDP support David Ahern
2020-04-21 10:20 ` Toke Høiland-Jørgensen
2020-04-21 13:03 ` David Ahern
2020-04-21 13:28 ` Toke Høiland-Jørgensen
2020-04-23 1:19 ` Andrii Nakryiko
2020-04-23 1:33 ` David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 13/16] bpftool: Add support for XDP egress David Ahern
2020-04-23 10:43 ` Quentin Monnet
2020-04-23 18:50 ` David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 14/16] selftest: Add test for xdp_egress David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 15/16] selftest: Add xdp_egress attach tests David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 16/16] samples/bpf: add XDP egress support to xdp1 David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87k1277om2.fsf@toke.dk \
--to=toke@redhat$(echo .)com \
--cc=andriin@fb$(echo .)com \
--cc=ast@kernel$(echo .)org \
--cc=brouer@redhat$(echo .)com \
--cc=dahern@digitalocean$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@gmail$(echo .)com \
--cc=dsahern@kernel$(echo .)org \
--cc=jasowang@redhat$(echo .)com \
--cc=john.fastabend@gmail$(echo .)com \
--cc=kafai@fb$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=prashantbhole.linux@gmail$(echo .)com \
--cc=songliubraving@fb$(echo .)com \
--cc=toshiaki.makita1@gmail$(echo .)com \
--cc=yhs@fb$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox