<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Victor,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">Security work is never completed. There is always a long list of inventive new vulnerabilities and a laundry list of hardening work to be completed. The vulnerability work, considering the severity, is generally urgent. Hardening
work is not urgent but important. In this case, we are dealing with a hardening initiative that focuses on a small area of the code.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The challenge is that these small change proposed have larger implications. As was pointed out on the gerrit reviews, performance and / or functional testing is required. My concern is that we affect the timing / behaviour of stx-ha
and stx-metal such that they do not work together in some scenarios. This will need to be tested and is certainly larger than a sanity.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Also, I am wondering if there is a way to phase the effort. For example, is there a way to break up the flag changes such that the warnings are separated from the flags which change the compiled code? That way, we are not trying to
jam everything through at once.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hope this helps. Happy to discuss when you return from Holliday.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Regards,<o:p></o:p></p>
<p class="MsoPlainText">Ken Y<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Victor Rodriguez <vm.rod25@gmail.com><br>
<b>Date: </b>Friday, December 28, 2018 at 7:34 PM<br>
<b>To: </b>Curtis <serverascode@gmail.com><br>
<b>Cc: </b>"starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io><br>
<b>Subject: </b>Re: [Starlingx-discuss] Recommended C/C++ compiler flag for security<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Dec 21, 2018, 07:08 Curtis <<a href="mailto:serverascode@gmail.com">serverascode@gmail.com</a> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Dec 20, 2018 at 3:47 PM Victor Rodriguez <<a href="mailto:vm.rod25@gmail.com" target="_blank">vm.rod25@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal">Hi StarlingX community<br>
<br>
We can all agree that security is an important feature to be taken<br>
into consideration in any SW project. In the aim of improving the<br>
security of the StarlingX project, we have been taking the task to<br>
propose the use of some compiler flags that prevent and detect some<br>
security holes, especially by buffer overflow that could lead into ROP<br>
attacks.<br>
<br>
The list of flags that we are proposing are :<br>
<br>
Stack-based Buffer Overrun Detection: CFLAGS=”-fstack-protector-strong”<br>
<br>
Fortify source: CFLAGS="-O2 -D_FORTIFY_SOURCE=2"<br>
Format string vulnerabilities: CFLAGS="-Wformat -Wformat-security"<br>
Stack execution protection: LDFLAGS="-z noexecstack"<br>
Data relocation and protection (RELRO): LDLFAGS="-z relro -z now"<br>
<br>
<br>
These are being analyzed in the following Gerrit reviews (thanks a lot<br>
for all the good feedback)<br>
<br>
<a href="https://review.openstack.org/#/c/623608/" target="_blank">https://review.openstack.org/#/c/623608/</a><br>
<a href="https://review.openstack.org/#/c/623603/" target="_blank">https://review.openstack.org/#/c/623603/</a><br>
<a href="https://review.openstack.org/#/c/623601/" target="_blank">https://review.openstack.org/#/c/623601/</a><br>
<a href="https://review.openstack.org/#/c/623599/" target="_blank">https://review.openstack.org/#/c/623599/</a><br>
<br>
As requested in the Gerrit reviews, there is a proper need to first<br>
understand what these compiler flags do and what is the impact they<br>
have at the functional and performance area of the project. This is a<br>
preliminary report, we will be following up with a test plan for<br>
functional & performance test plans for the services as a next step.<br>
This report includes:<br>
<br>
* Detailed description of what the compiler flag does<br>
* Code example that shows how does it work to prevent attacks<br>
* If there is a change in the binary, we create a microbenchmark that<br>
shows us how the flag impact the performance<br>
<br>
<a href="https://github.com/VictorRodriguez/hobbies/tree/master/c_programing_exercises/cflags_security" target="_blank">https://github.com/VictorRodriguez/hobbies/tree/master/c_programing_exercises/cflags_security</a><br>
<br>
As a result of the microbenchmark, the performance impact is not<br>
relevant ( less than 1% ) using an Ubuntu x86 system ( GCC 5 ) (more<br>
details on the HW and SW specification upon requests)<br>
<br>
The areas of the code we are suggesting on the patches are:<br>
<br>
* stx-ha<br>
* stx-metal<br>
* stx-nfv<br>
* stx-fault<br>
<br>
We do take care that these flags are not breaking the following areas<br>
after being applied.<br>
<br>
* Build process of the image<br>
* Sanity test cases after the image is created<br>
(Ada can give more details on the sanity report of the image generated<br>
with these flags)<br>
<br>
If running the sanity tests are not enough to prove that a change in<br>
compiler flags do not affect functionality, please gave us the right<br>
path to follow.<br>
<br>
As mentioned before, this is a preliminary report, and that we will be<br>
following up with a test plan for functional & performance test plans<br>
for the services as a next step.<br>
<br>
Hope this email helps to clarify some questions related to the flags<br>
and start the follow-up discussion.<o:p></o:p></p>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for the context Victor, it's very helpful to me.<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hi Curtis, glad it helps, it was fun to do the research <o:p></o:p></p>
</div>
<div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">One thing I want to mention is something the Kata Containers team was talking about at the Berlin OpenStack summit, which is when many small performance hits start to add up. They have to be careful to ensure they don't have a bunch of
smallish looking changes that add up to a large performance hit over a longer period of time.<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You are right, it's a valid point that we need to take care too <o:p></o:p></p>
</div>
<div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Overall I'm sure the StarlingX project would like to have some performance testing, if we don't already, though that can be challenging for an open source project. I had mentioned OPNFV's Functest and related projects on the TSC call, but
now seeing which components are affected I'm not sure that would be directly helpful. I look forward to further discussions around this area.<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for let me know that, I will take a look at <span style="font-family:"Arial",sans-serif">OPNFV's functest and other projects before the next TSC of 2019 </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">I will do my best to came up with a proposal for a better performance testing. </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Thanks </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Victor Rodriguez </span><o:p></o:p></p>
</div>
<div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Curtis<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal"><br>
Regards<br>
<br>
Victor Rodriguez<br>
<br>
_______________________________________________<br>
Starlingx-discuss mailing list<br>
<a href="mailto:Starlingx-discuss@lists.starlingx.io" target="_blank">Starlingx-discuss@lists.starlingx.io</a><br>
<a href="http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss" target="_blank">http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<br>
-- <o:p></o:p></p>
<div>
<p class="MsoNormal">Blog: <a href="http://serverascode.com" target="_blank">serverascode.com</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>