Re: [PATCH net-next-2.6] pktgen: Optionally leak kernel memory

[Eric Dumazet <eric.dumazet@gmail.com>]

Le samedi 24 juillet 2010 à 06:18 -0700, Ben Greear a écrit :

> I think most users of pktgen wouldn't be too concerned about leaking
> memory content to the network.  It's a root-only test tool that can easily
> saturate most networks and do horrible things like overflow switch CAM tables
> by randomizing source/dest macs etc.  So, this warning might could be a bit
> more descriptive of how it is a security problem "arbitrary contents of memory can be
> sent across the network and may be sniffed by devices on the network, potentially
> revealing private information such as passwords and application data for applications
> running on the machine running pktgen" instead of telling folks not to use it unless it's
> really needed.

Most of the horrible things you mention are not related to the memset()
thing, arent they ?


Being root means : "I am a trusted user on this machine, and as such,
must know a bit what security means".

It doesnt mean : "I am allowed to steal passwords, credit card numbers,
from gentle users. I am allowed to blow up the LAN with billions of evil
frames". Still, pktgen is there and might be used by a fool.

The "UNSAFE" label should be more than enough to warn the fool admin ;)

Note this "UNSAFE" thing is really bad. Nowhere in the kernel we are
allowed to make this sort of thing : No special mmap() flag asking
kernel to give non cleared memory pages, even to root user.

I am not sure David will accept the patch !

Anyway, as I said, if you want to saturate a 10Gb+ network with pktgen,
you probably need clone_skb ?