Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

nginx/1.28.0

System:

Linux 6.8.0-90-generic

PHP Version:

8.4.15

User:

alqudsvolunteers

Directory:

/home/alqudsvolunteers/rootlink/proc/thread-self/root/proc/self/root/usr/share/doc/varnish/html/phk

Free Space:

79.41 GB

🔧 Quick Actions

✏️ Editing: cheri4.html

<!DOCTYPE html>

<title>How Varnish met CHERI 4/N &#8212; Varnish version 7.5.0 documentation</title>
 <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
 <link rel="stylesheet" type="text/css" href="../_static/classic.css?v=e2714048" />
 
 <script src="../_static/documentation_options.js?v=8214db13"></script>
 <script src="../_static/doctools.js?v=888ff710"></script>
 <script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
 
 <link rel="index" title="Index" href="../genindex.html" />
 <link rel="search" title="Search" href="../search.html" />
 <link rel="next" title="How Varnish met CHERI 3/N" href="cheri3.html" />
 <link rel="prev" title="How Varnish met CHERI 5/N" href="cheri5.html" /> 
 </head><body>
 <div class="related" role="navigation" aria-label="related navigation">
 <h3>Navigation</h3>
 <ul>
 <li class="right" style="margin-right: 10px">
 <a href="../genindex.html" title="General Index"
 accesskey="I">index</a></li>
 <li class="right" >
 <a href="cheri3.html" title="How Varnish met CHERI 3/N"
 accesskey="N">next</a> |</li>
 <li class="right" >
 <a href="cheri5.html" title="How Varnish met CHERI 5/N"
 accesskey="P">previous</a> |</li>
 <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
 <li class="nav-item nav-item-1"><a href="index.html" accesskey="U">Poul-Hennings random outbursts</a> &#187;</li>
 <li class="nav-item nav-item-this"><a href="">How Varnish met CHERI 4/N</a></li> 
 </ul>
 </div>

<div class="document">
 <div class="documentwrapper">
 <div class="bodywrapper">
 <div class="body" role="main">
 
 <section id="how-varnish-met-cheri-4-n">
<h1>How Varnish met CHERI 4/N<a class="headerlink" href="#how-varnish-met-cheri-4-n" title="Link to this heading">¶</a></h1>
<section id="so-what-can-cheri-do">
<h2>So what can CHERI do ?<a class="headerlink" href="#so-what-can-cheri-do" title="Link to this heading">¶</a></h2>
CHERI can restrict pointers, but it does not restrict the memory
they point to:
<div class="highlight-default notranslate"><div class="highlight"><pre>#include &lt;cheriintrin.h&gt;
#include &lt;stdio.h&gt;
#include &lt;string.h&gt;

int
main()
{
 char buf[20];
 char *ptr1 = cheri_perms_and(buf, CHERI_PERM_LOAD);
 char *ptr2 = buf;

strcpy(buf, &quot;Hello World\n&quot;);
 //ptr1[5] = &#39;_&#39;; // Will core dump
 ptr2[5] = &#39;_&#39;; // Works fine.
 puts(buf);
 printf(&quot;buf:\t%#p\n&quot;, buf);
 printf(&quot;ptr1:\t%#p\n&quot;, ptr1);
 printf(&quot;ptr2:\t%#p\n&quot;, ptr2);
 ptr3 = ptr2 + 1;
 printf(&quot;ptr3:\t%#p\n&quot;, ptr3);
 ptr4 = cheri_bounds_set(ptr3, 4);
 printf(&quot;ptr4:\t%#p\n&quot;, ptr4);
 return (0);
}
</pre></div>
</div>
And we get:
<div class="highlight-default notranslate"><div class="highlight"><pre>buf: 0xfffffff7ff68 [rwRW,0xfffffff7ff68-0xfffffff7ff7c]
ptr1: 0xfffffff7ff68 [r,0xfffffff7ff68-0xfffffff7ff7c]
ptr2: 0xfffffff7ff68 [rwRW,0xfffffff7ff68-0xfffffff7ff7c]
ptr3: 0xfffffff7ff69 [rwRW,0xfffffff7ff68-0xfffffff7ff7c]
ptr4: 0xfffffff7ff69 [rwRW,0xfffffff7ff69-0xfffffff7ff6d]
</pre></div>
</div>
(Ignore the upper-case ‘RW’ for now, I’ll get back to those later.)
Because of the odd things people do with pointers in C, <code class="docutils literal notranslate">ptr3</code>
keeps the same range as <code class="docutils literal notranslate">ptr2</code> and that’s a good excuse to
address the question I imagine my readers have at this point:
</section>
<section id="what-about-const">
<h2>What about <code class="docutils literal notranslate">const</code> ?<a class="headerlink" href="#what-about-const" title="Link to this heading">¶</a></h2>
The C language is a mess.
Bjarne Stroustrup introduced <code class="docutils literal notranslate">const</code> in “C-with-classes”,
which later became C++, and in C++ it does the right thing.
The morons on the ISO-C committee did a half-assed import
in C89, and therefore it does the wrong thing:
<div class="highlight-default notranslate"><div class="highlight"><pre>char *strchr(const char *s, int c);
</pre></div>
</div>
You pass a read-only pointer in, and you get a read-write
pointer into that string back ?!
There were at least three different ways they could have done right:
<ul>
<li>Add a <code class="docutils literal notranslate">cstrchr</code> function, having <code class="docutils literal notranslate">const</code> on both sides.</li>
<li>Enable prototypes to explain this, with some gruesome hack:
<div class="highlight-default notranslate"><div class="highlight"><pre>(const) char *strchr((const) char *s, int c);
</pre></div>
</div>
</li>
<li>Allow multiple prototypes for the same function, varying only in const-ness:
<div class="highlight-default notranslate"><div class="highlight"><pre>char *strchr(char *s, int c);
const char *strchr(const char *s, int c);
</pre></div>
</div>
</li>
</ul>
But instead they just ignored that issue, and several others like it.
The result is that we have developed the concept of “const-poisoning”,
to describe the fact that if you use “const” to any extent in your
C sources, you almost always end up needing a macro like:
<div class="highlight-default notranslate"><div class="highlight"><pre>#define TRUST_ME(ptr) ((void*)(uintptr_t)(ptr))
</pre></div>
</div>
To remove const-ness where it cannot go.
(If you think that is ISO-C’s opus magnum, ask yourself why we still
cannot specify struct packing and endianess explicitly ? It’s hardly
like anybody ever have to apart data-structures explicitly specified in
hardware or protocol documents, is it ?)
</section>
<section id="read-write-markup-with-cheri">
<h2>Read/Write markup with CHERI<a class="headerlink" href="#read-write-markup-with-cheri" title="Link to this heading">¶</a></h2>
Because <code class="docutils literal notranslate">const</code> is such a mess in C, the CHERI compiler does not
automatically remove the write-capability from <code class="docutils literal notranslate">const</code> arguments
to functions, something I suspect (but have not checked) that they
can do in C++.
Instead we will have to do it ourselves, so I have added two macros to
our <code class="docutils literal notranslate">&lt;vdef.h&gt;</code> file:
<div class="highlight-default notranslate"><div class="highlight"><pre>#define RO(x) cheri_perms_and((x), CHERI_PERM_LOAD)
#define ROP(x) cheri_perms_and((x), CHERI_PERM_LOAD|CHERI_PERM_LOAD_CAP)
</pre></div>
</div>
Passing a pointer through the <code class="docutils literal notranslate">RO()</code> macro makes it read-only, so we
can do stuff like:
<div class="highlight-default notranslate"><div class="highlight"><pre>@@ -285,7 +286,7 @@ VRT_GetHdr(VRT_CTX, VCL_HEADER hs)
 […]
- return (p);
+ return (RO(p));
 }
</pre></div>
</div>
To explicitly give <code class="docutils literal notranslate">const</code> some bite.
The difference between <code class="docutils literal notranslate">RO</code> and <code class="docutils literal notranslate">ROP</code> is where the upper- and
lower-case “rw” comes into the picture: Capabilities have two
levels of read/write protection:
<ul class="simple">
<li>Can you read or write normal data with this pointer (<code class="docutils literal notranslate">CHERI_PERM_LOAD</code>)</li>
<li>Can you read or write pointers with this pointer (<code class="docutils literal notranslate">CHERI_PERM_LOAD_CAP</code>)</li>
</ul>
Rule of thumb: Pure data: Use only the first, structs with pointers in them,
use both.
One can also make write-only pointers with CHERI, but there are
only few places where they can be gainfully employed, outside strict
security in handling of (cryptographic) secrets.
Right now I’m plunking <code class="docutils literal notranslate">RO()</code> and <code class="docutils literal notranslate">ROP()</code> into the varnish code,
and one by one relearning what atrocity the 37 uses of <code class="docutils literal notranslate">TRUST_ME()</code>
hide.
Still no bugs found.
/phk
</section>
</section>

<div class="clearer"></div>
 </div>
 </div>
 </div>
 <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
 <div class="sphinxsidebarwrapper">
 <div>
 <h3><a href="../index.html">Table of Contents</a></h3>
 <ul>
<li><a class="reference internal" href="#">How Varnish met CHERI 4/N</a><ul>
<li><a class="reference internal" href="#so-what-can-cheri-do">So what can CHERI do ?</a></li>
<li><a class="reference internal" href="#what-about-const">What about <code class="docutils literal notranslate">const</code> ?</a></li>
<li><a class="reference internal" href="#read-write-markup-with-cheri">Read/Write markup with CHERI</a></li>
</ul>
</li>
</ul>

</div>
 <div>
 <h4>Previous topic</h4>
 <a href="cheri5.html"
 title="previous chapter">How Varnish met CHERI 5/N</a>
 </div>
 <div>
 <h4>Next topic</h4>
 <a href="cheri3.html"
 title="next chapter">How Varnish met CHERI 3/N</a>
 </div>
 <div role="note" aria-label="source link">
 <h3>This Page</h3>
 <ul class="this-page-menu">
 <li><a href="../_sources/phk/cheri4.rst.txt"
 rel="nofollow">Show Source</a></li>
 </ul>
 </div>
<div id="searchbox" style="display: none" role="search">
 <h3 id="searchlabel">Quick search</h3>
 <div class="searchformwrapper">
 <form class="search" action="../search.html" method="get">
 <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
 <input type="submit" value="Go" />
 </form>
 </div>
</div>
<script>document.getElementById('searchbox').style.display = "block"</script>
 </div>
 </div>
 <div class="clearer"></div>
 </div>
 <div class="related" role="navigation" aria-label="related navigation">
 <h3>Navigation</h3>
 <ul>
 <li class="right" style="margin-right: 10px">
 <a href="../genindex.html" title="General Index"
 >index</a></li>
 <li class="right" >
 <a href="cheri3.html" title="How Varnish met CHERI 3/N"
 >next</a> |</li>
 <li class="right" >
 <a href="cheri5.html" title="How Varnish met CHERI 5/N"
 >previous</a> |</li>
 <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> &#187;</li>
 <li class="nav-item nav-item-1"><a href="index.html" >Poul-Hennings random outbursts</a> &#187;</li>
 <li class="nav-item nav-item-this"><a href="">How Varnish met CHERI 4/N</a></li> 
 </ul>
 </div>
 <div class="footer" role="contentinfo">
 &#169; Copyright 2010-2014, Varnish Software AS.
 Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.2.6.
 </div>
 </body>
</html>

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: cheri4.html

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation