On Wed, Mar 02, 2022 at 02:42:37AM -0500, Michael S. Tsirkin wrote: > On Tue, Mar 01, 2022 at 07:37:06PM +0100, Jason A. Donenfeld wrote: > > Hi Michael, > > > > On Tue, Mar 1, 2022 at 6:17 PM Michael S. Tsirkin <mst@xxxxxxxxxx> wrote: > > > Hmm okay, so it's a performance optimization... some batching then? Do > > > you really need to worry about every packet? Every 64 packets not > > > enough? Packets are after all queued at NICs etc, and VM fork can > > > happen after they leave wireguard ... > > > > Unfortunately, yes, this is an "every packet" sort of thing -- if the > > race is to be avoided in a meaningful way. It's really extra bad: > > ChaCha20 and AES-CTR work by xoring a secret stream of bytes with > > plaintext to produce a ciphertext. If you use that same secret stream > > and xor it with a second plaintext and transmit that too, an attacker > > can combine the two different ciphertexts to learn things about the > > original plaintext. > > So what about the point about packets queued then? You don't fish > packets out of qdisc queues, do you? Oh pls ignore it, I think I got it. Resending same packet is not a problem, producing a new one is. > > But, anyway, it seems like the race is here to stay given what we have > > _currently_ available with the virtual hardware. That's why I'm > > focused on trying to get something going that's the least bad with > > what we've currently got, which is racy by design. How vitally > > important is it to have something that doesn't race in the far future? > > I don't know, really. It seems plausible that that ACPI notifier > > triggers so early that nothing else really even has a chance, so the > > race concern is purely theoretical. But I haven't tried to measure > > that so I'm not sure. > > > > Jason So how about measuring the performance impact of reading the 16 byte vmgenid then? This could be a performance option, too - some people might want extra security, some might not care. And I feel if linux DTRT and reads the 16 bytes then hypervisor vendors will be motivated to improve and add a 4 byte unique one. As long as linux is interrupt driven there's no motivation for change. -- MST
