On Tue, 2016-09-20 at 09:45 -0700, Alexei Starovoitov wrote: > because 'div by zero' is an abnormal situation that shouldn't be exploited. > Meaning if xdp program is doing DoS prevention and it has a bug that > attacker can now exploit by sending a crafted packet that causes > 'div by zero' and kernel will warn then attack got successful. > Therefore it has to be silent drop.
A silent drop means a genuine error in a BPF program might be never caught, since a tracepoint might never be enabled. > tracpoint in such case is great, since the user can do debugging with it > and even monitoring 24/7 and if suddenly the control plan sees a lot > of such trace_xdp_abotred events, it can disable that tracepoint to avoid > spam and adjust the program or act on attack some other way. > Hardcoded warnings and counters are not generic enough for all > the use cases people want to throw at XDP. > The tracepoints idea is awesome, in a sense that it's optional. Note that tracepoints are optional in a kernel. Many existing supervision infrastructures collect device snmp counters, and run as unprivileged programs. tracepoints might not fit the need here, compared to a mere tx_ring->tx_drops++
