Re: using verifier to ensure a BPF program uses certain metadata?

Hi Alexei,

quoted

https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next
.git/log/?h=bpf

bpf bits looks pretty straightforward.

Thanks for looking at this!

attach looks fine too. I'm assuming there is some rtnl or other lock,
so multiple assigns cannot race?

Yes.

It's missing query interface though.
Please add support to return prog_id.

Good point, this is about half a year old, so ... :)

[...]

quoted

Now, I realize that people could trivially just work around this in
their program if they wanted, but I think most will take the
reminder
and just implement

    if (ctx->is_data_ethernet)
        return DROP_FRAME;

instead, since mostly data frames will not be very relevant to
them.

What do you think?

sounds fine and considering new verifier ops after Jakub refactoring
a check that is_data_ethernet was accessed would fit nicely.
Without void** hack.

Ok, thanks! I'll have to check what Jakub is doing there, do you have a
pointer to that refactoring?

johannes