RE: [E1000-devel] [PATCH 1/2] if_link: Add VF multicast promiscuous mode control

From: Skidmore, Donald C 

quoted

quoted

From: Hiroshi Shimamoto

quoted

My concern is what is the real issue that VF multicast promiscuous mode

can cause.

quoted

quoted

I think there is the 4k entries to filter multicast address, and the
current ixgbe/ixgbevf can turn all bits on from VM. That is almost same as

enabling multicast promiscuous mode.

quoted

quoted

I mean that we can receive all multicast addresses by an onerous

operation in untrusted VM.

quoted

quoted

I think we should clarify what is real security issue in this context.

If you are worried about passing un-enabled multicasts to users then
what about doing a software hash of received multicasts and checking
against an actual list of multicasts enabled for that hash entry.
Under normal conditions there is likely to be only a single address to check.

It may (or may not) be best to use the same hash as any hashing
hardware filter uses.

thanks for the comment. But I don't think that is the point.

I guess, introducing VF multicast promiscuous mode seems to add new
privilege to peek every multicast packet in VM and that doesn't look good.
On the other hand, I think that there has been the same privilege in the
current ixgbe/ixgbevf implementation already. Or I'm reading the code
wrongly.
I'd like to clarify what is the issue of allowing to receive all multicast packets.

Allowing a VM to give itself the privilege of seeing every multicast packet
could be seen as a hole in VM isolation.
Now if the host system allows this policy I don't see this as an issue as
someone specifically allowed this to happen and then must not be concerned.
We could even log that it has occurred, which I believe your patch did do.
The issue is also further muddied, as you mentioned above, since some of
these multicast packets are leaking anyway (the HW currently uses a 12 bit mask).
It's just that this change would greatly enlarge that hole from a fraction to
all multicast packets.

Why does it have anything to do with VM isolation?
Isn't is just the same as if the VM were connected directly to the
ethernet cable?

	David