slides - PDOS - MIT
slides - PDOS - MIT
slides - PDOS - MIT
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Solution: Berkeley Packet Filter (BPF)Are embedded interpreters really secure?ip*src*net*not*(18.26.5.0/24*or*18.0.0.0/24)kernelUntrustedinputInputs tobytecodeHostsystemtcpdump********ldh****[12]********!@#S****[238472398]********jeq****#ETHERTYPE_IP,*L1,*L4*********$&$s****#934deadL1:*****ld*****[26]L1:*****@#&#$(&@#$*#@$********and****#0xffffff00********kill****[xxx]********jeq****#0x121a0500,*L4,*L2********#@!&#*@#**!*&#$*$*#L2:*****jeq****#0x12010200,*L4,*L3L2:*****...L3:*****ret****#TRUE********ret*****#deadbeafL4:*****ret****#0*********#(@&*&*$#!@&(&UntrustedbytecodeBytecodeprogram*****packets*****BPF interpreterFilteredpackets