uBPF bounds_check doesn't account for access to packet data about ubpf

[Alan-Jowett]

The model we are taking with Ebpf-on-Windows is to define all the inputs to types of eBPF programs and the signature of helper functions and have that provided to the verifier at verification time. See: eBpfExtensions

Unfortunately, the bounds_check code as it exists today is of limited usefulness.

[Alan-Jowett]

Note:
This also misses cases where we access memory retrieved from a map.

[jpsamaroo]

These are the sorts of things that we really need a verifier for (and I imagine that's what PREVAIL does for Windows eBPF). With that, we'd also need some way to tell the verifier about input structures; a BTF parser would probably make sense to accomplish that.

[rlane]

Yeah, the current bounds check is very simplistic. Does the PREVAIL verifier enforce that the code does its own bounds checking?

[Alan-Jowett]

Yep, Prevail tracks each BPF register and evaluates the control flow graph to determine safety. Not an expert on this myself, but based on my understanding a formal verification.

[Alan-Jowett]

This was fixed with the addition of the ubpf_register_data_bounds_check function.