From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.groups.io with SMTP id smtpd.web09.3384.1659610480729164687 for ; Thu, 04 Aug 2022 03:54:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=TpVHvDOV; spf=pass (domain: redhat.com, ip: 170.10.129.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1659610479; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Lh8pD8pFTYCsdeD1fu2zW81ZMWH+f50lj+pVK8x6amI=; b=TpVHvDOVuycQeIfU73LFnbJ7gPQ3j3jUEf+HvVebV2CQMlW6eitnAhXZcWj5FmtvTwZopL 5/a62t4vc/v0XSOiKXWFxtki0AhJCDbwxEZhI2TRhUThSuqNKC8sHEquh9jVTaNswGkxeF hHeEuIwCWr7kZKxqXmJWAlzCSVJEJhU= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-651-jfhskuE5N--oxbiNFtj4mw-1; Thu, 04 Aug 2022 06:54:37 -0400 X-MC-Unique: jfhskuE5N--oxbiNFtj4mw-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 6B178811E76; Thu, 4 Aug 2022 10:54:36 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (unknown [10.39.192.36]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 4024218ECB; Thu, 4 Aug 2022 10:54:34 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH v1 0/2] Add support to disable VirtIo net at runtime To: Ard Biesheuvel , edk2-devel-groups-io Cc: Yuan Yu , Ard Biesheuvel , Jordan Justen , Anthony Perard , Julien Grall , Gerd Hoffmann , Pawel Polawski , Oliver Steffen , Jiewen Yao References: <20220804025239.918263-1-yuanyu@google.com> <087048c2-d9d7-c50b-8b62-8bfe1267e4a0@redhat.com> From: "Laszlo Ersek" Message-ID: Date: Thu, 4 Aug 2022 12:54:32 +0200 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 08/04/22 11:58, Ard Biesheuvel wrote: > On Thu, 4 Aug 2022 at 07:55, Laszlo Ersek wrote: >> >> On 08/04/22 04:52, Yuan Yu wrote: >>> Currently networking can only be enabled/disabled at compile time. This >>> patch series will add support to disable VirtIo net at runtime even if >>> the functionality is built into binary at compile time. >>> >>> This will enable VMM to reduce attack surface without recompilation. >>> >>> The changes can be seen at: >>> https://github.com/yyu/edk2/tree/network_cfg_lib_v1 >>> >>> Cc: Ard Biesheuvel >>> Cc: Jordan Justen >>> Cc: Laszlo Ersek >>> Cc: Anthony Perard >>> Cc: Julien Grall >>> >>> Yuan Yu (2): >>> OvmfPkg: Introduce NetworkCfgLib >>> OvmfPkg: Use PcdNetworkSupport to enable/disable VirtIo net >>> >>> OvmfPkg/OvmfPkg.dec | 3 ++ >>> OvmfPkg/OvmfPkgX64.dsc | 7 ++++- >>> OvmfPkg/Library/NetworkCfgLib/NetworkCfgLib.inf | 29 ++++++++++++++++++ >>> OvmfPkg/VirtioNetDxe/VirtioNet.inf | 3 ++ >>> OvmfPkg/Library/NetworkCfgLib/NetworkCfgLib.c | 32 ++++++++++++++++++++ >>> OvmfPkg/VirtioNetDxe/EntryPoint.c | 10 ++++++ >>> 6 files changed, 83 insertions(+), 1 deletion(-) >>> create mode 100644 OvmfPkg/Library/NetworkCfgLib/NetworkCfgLib.inf >>> create mode 100644 OvmfPkg/Library/NetworkCfgLib/NetworkCfgLib.c >>> >> >> Well I've not been reviewing upstream edk2 patches for a while, but the >> virtio-net driver is still very close to my heart, so this patch kind of >> hits a nerve. >> > > Welcome back old friend! > >> I think I disagree with the idea and the implementation both. >> >> Minimally, the idea needs a much better elaboration -- what is the >> threat model? Do you want to protect the host from the guest, or the >> guest from the host? Or something else? How does controlling a single >> SNP driver via fw_cfg (which is also dictated by the host) help? >> > > I have to confess that I was the one who suggested this approach to > Yuan internally, but mainly to get the discussion going, as I was > anticipating some pushback, just not from you :-) Heh, sorry about that :) > > 'Reducing the attack surface' is probably not the most accurate > characterization of the purpose. We are simply looking for a way to > disable network boot from the vmm/host side without affecting > how/which network interfaces the guest exposes to the OS. > >> Regarding the implementation: there is much more to networking in edk2 >> than VirtioNetDxe. UEFI driver binaries (SNP drivers) built from iPXE >> can be passed in via the NICs' option ROMs. SNP drivers can be loaded >> from the UEFI system partition (for example, Intel's binary-only driver >> for QEMU's e1000* cards). >> >> If you can control this fw_cfg switch from the VMM side, you can also >> control the VMM enough to simply *not give* a virtio-net device to the >> guest. Then the driver (it being a UEFI driver following the UEFI driver >> model) will simply not have anything to bind. >> > > Sure, but then the OS will lose networking as well. We just want to > remove the ability to network boot without impacting anything else > that relies on virtio-net > >> Sorry I find this approach very wrong. If you really need it for your >> particular VMM, I kind of suggest not upstreaming this patch. I see it >> as a step backwards for the upstream project. >> > > If there are better ways to achieve this, we're all ears, but I think > that having a PCD which could either be fixed at build and compiled > out completely, or be set via a NULL library resolution, or even be > wired to a menu option (using PcdsDynamicHii] is a rather low-impact > but flexible way to go about this. How about using PCDs, but at a higher level in the edk2 network stack (regardless of the SNP driver(s) used)? Not that I'm a huge fan of them, but we already have PcdIPv4PXESupport and PcdIPv6PXESupport, and they can be set for OVMF and ArmVirtQemu via fw_cfg. If both PCDs are "PXE_DISABLED" (0), then PxeBcDriverEntryPoint() [NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c] exits early. See: - https://bugzilla.tianocore.org/show_bug.cgi?id=1695 - https://bugzilla.tianocore.org/show_bug.cgi?id=2681 So that's at least "prior art". If similar PCDs could be introduced for other kinds of network boot (I think there's only HTTP(S)v[46] to speak of [*]), i.e. in "NetworkPkg.dec", then I guess setting those from fw_cfg in ArmVirtQemu and OVMF could be fine. I assume HttpBootDxe would be the driver to short-circuit. [*] Hmm, maybe not just that. Do we consider booting off an iSCSI device "network boot"? Perhaps where you want to "cut the stack" is Ip4Dxe/Ip6Dxe. Prior art with PXE does suggest PCDs for the higher-level network boot drivers. Laszlo