From: "Toke Høiland-Jørgensen" <toke@redhat.com>
To: David Ahern <dsahern@gmail.com>, David Ahern <dsahern@kernel.org>,
netdev@vger.kernel.org
Cc: davem@davemloft.net, kuba@kernel.org,
prashantbhole.linux@gmail.com, jasowang@redhat.com,
brouer@redhat.com, toshiaki.makita1@gmail.com,
daniel@iogearbox.net, john.fastabend@gmail.com, ast@kernel.org,
kafai@fb.com, songliubraving@fb.com, yhs@fb.com, andriin@fb.com,
David Ahern <dahern@digitalocean.com>
Subject: Re: [PATCH bpf-next 04/16] net: Add BPF_XDP_EGRESS as a bpf_attach_type
Date: Wed, 22 Apr 2020 13:21:09 +0200 [thread overview]
Message-ID: <87k1277om2.fsf@toke.dk> (raw)
In-Reply-To: <073ed1a6-ff5e-28ef-d41d-c33d87135faa@gmail.com>
David Ahern <dsahern@gmail.com> writes:
> On 4/21/20 7:25 AM, Toke Høiland-Jørgensen wrote:
>> David Ahern <dsahern@gmail.com> writes:
>>
>>> On 4/21/20 4:14 AM, Toke Høiland-Jørgensen wrote:
>>>> As I pointed out on the RFC patch, I'm concerned whether this will work
>>>> right with freplace programs attaching to XDP programs. It may just be
>>>> that I'm missing something, but in that case please explain why it
>>>> works? :)
>>>
>>> expected_attach_type is not unique to XDP. freplace is not unique to
>>> XDP. IF there is a problem, it is not unique to XDP, and any
>>> enhancements needed to freplace functionality will not be unique to XDP.
>>
>> Still needs to be fixed, though :)
>
> one problem at a time. I have a long list of items that are directly
> relevant to what I want to do.
Not saying a fix to freplace *has* to be part of this series; just
saying that I would be more comfortable if that was fixed before we
merge this.
>> Also, at least looking through all the is_valid_access functions in
>> filter.c, they all seem to "fail safe". I.e., specific
>> expected_attach_type values can permit the program access to additional
>> ranges. In which case an freplace program that doesn't have the right
>> attach type will just be rejected if it tries to access such a field.
>> Whereas here you're *disallowing* something based on a particular
>> expected_attach_type, so you can end up with an egress program that
>> should have been rejected by the verifier but isn't because it's missing
>> the attach_type.
>
> There are 6 existing valid access checks on expected_attach_type doing
> the exact same thing - validating access based on attach type.
See my point about default black/white listing, though. You are adding a
new restriction to an existing program type based on this, so surely we
should make sure this restriction actually sticks, no?
-Toke
next prev parent reply other threads:[~2020-04-22 11:21 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-20 20:00 [PATCH bpf-next 00/16] net: Add support for XDP in egress path David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 01/16] net: Refactor convert_to_xdp_frame David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 02/16] net: Move handling of IFLA_XDP attribute out of do_setlink David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 03/16] net: Add XDP setup and query commands for Tx programs David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 04/16] net: Add BPF_XDP_EGRESS as a bpf_attach_type David Ahern
2020-04-21 10:14 ` Toke Høiland-Jørgensen
2020-04-21 12:50 ` David Ahern
2020-04-21 13:25 ` Toke Høiland-Jørgensen
2020-04-21 13:49 ` David Ahern
2020-04-22 11:21 ` Toke Høiland-Jørgensen [this message]
2020-04-22 14:51 ` David Ahern
2020-04-22 15:27 ` Toke Høiland-Jørgensen
2020-04-22 15:33 ` David Ahern
2020-04-22 15:51 ` Toke Høiland-Jørgensen
2020-04-22 15:56 ` David Ahern
2020-04-23 15:23 ` Toke Høiland-Jørgensen
2020-04-23 0:39 ` Alexei Starovoitov
2020-04-23 16:40 ` Toke Høiland-Jørgensen
2020-04-23 16:52 ` Alexei Starovoitov
2020-04-23 17:05 ` Toke Høiland-Jørgensen
2020-04-23 22:44 ` Alexei Starovoitov
2020-04-23 23:49 ` Toke Høiland-Jørgensen
2020-04-24 0:53 ` Alexei Starovoitov
2020-04-24 0:58 ` David Ahern
2020-04-24 8:55 ` Toke Høiland-Jørgensen
2020-04-20 20:00 ` [PATCH bpf-next 05/16] xdp: Add xdp_txq_info to xdp_buff David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 06/16] net: Add IFLA_XDP_EGRESS for XDP programs in the egress path David Ahern
2020-04-21 10:17 ` Toke Høiland-Jørgensen
2020-04-21 12:59 ` David Ahern
2020-04-21 13:27 ` Toke Høiland-Jørgensen
2020-04-20 20:00 ` [PATCH bpf-next 07/16] net: Rename do_xdp_generic to do_xdp_generic_rx David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 08/16] net: rename netif_receive_generic_xdp to do_generic_xdp_core David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 09/16] net: set XDP egress program on netdevice David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 10/16] net: Support xdp in the Tx path for packets as an skb David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 11/16] net: Support xdp in the Tx path for xdp_frames David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 12/16] libbpf: Add egress XDP support David Ahern
2020-04-21 10:20 ` Toke Høiland-Jørgensen
2020-04-21 13:03 ` David Ahern
2020-04-21 13:28 ` Toke Høiland-Jørgensen
2020-04-23 1:19 ` Andrii Nakryiko
2020-04-23 1:33 ` David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 13/16] bpftool: Add support for XDP egress David Ahern
2020-04-23 10:43 ` Quentin Monnet
2020-04-23 18:50 ` David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 14/16] selftest: Add test for xdp_egress David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 15/16] selftest: Add xdp_egress attach tests David Ahern
2020-04-20 20:00 ` [PATCH bpf-next 16/16] samples/bpf: add XDP egress support to xdp1 David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87k1277om2.fsf@toke.dk \
--to=toke@redhat.com \
--cc=andriin@fb.com \
--cc=ast@kernel.org \
--cc=brouer@redhat.com \
--cc=dahern@digitalocean.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dsahern@gmail.com \
--cc=dsahern@kernel.org \
--cc=jasowang@redhat.com \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=prashantbhole.linux@gmail.com \
--cc=songliubraving@fb.com \
--cc=toshiaki.makita1@gmail.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.