iovisor / ubpf / 21424018225

80%

push

github

Add JIT constant blinding to mitigate spray attacks (#718)

* Add constant blinding API and infrastructure

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Implement x86-64 constant blinding for ALU operations

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Fix unused parameter warnings in blinded emit functions

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Add constant blinding test and fix random generation

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Address code review feedback - fix random generation error handling and type safety

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Address PR review feedback - fix thread safety, add functional test, document ARM64 limitation

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Expand constant blinding test coverage - add randomness verification and all ALU immediate ops

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Fix error handling in constant blinding tests - add null checks and proper cleanup

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Skip randomness verification test on non-x86_64 platforms

Constant blinding is only implemented for x86_64 JIT. On ARM64 and other
platforms, enabling constant blinding has no effect (as documented in API).
The randomness verification test expects different JIT code on each
compilation, which only works on x86_64.

Add platform detection and skip the randomness test on non-x86_64 platforms
with a clear message indicating why the test is skipped.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Add CI test pass with constant blinding enabled for comprehensive coverage

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Fix CI regex to actually run JIT tests with constant blind... (continued)

288 of 369 new or added lines in 6 files covered. (78.05%)

6213 of 7972 relevant lines covered (77.94%)

561036.73 hits per line