Programming memory safe OVS in Rust

Speakers Yi-Hung Wei (VMware)
Slides: https://www.openvswitch.org/support/ovscon2019/day1/0910-tu-wei.pptx



Programming in unsafe languages like C is easily in jeopardy of memory issues such as buffer and stack overflows, dangling pointers, accesses of uninitialized or deallocated memory, and memory leakage. These memory safety issues can be exploited and leads to serve security vulnerability, and unpredictable behavior. For example, memory bugs in OVS’s packet processing, especially in parsing packet content and building the flow key, are prone to attacks, since it is always be executed for every packet. Thus, an attacker can craft packets to exploit the memory issue and launch a buffer overflow attack, such as [1]. Other than the security vulnerability, a small memory leakage in the packet processing path can quickly accumulated and leads to ovs-vswitchd crash when it runs out of memory, such as [2]. Bugs like these two are hard to detect and common in software written in C language.

Rust is a system programming language that provides memory safety without runtime overhead. Rust gives users fine control over the use of memory, but keeps track of the lifetime and ownership of each memory region. This model leads to less likely of memory leak, dangling pointers, or memory corruption issues. In this talk, we are working on replacing one of the memory safety critical parts in OVS from C code to Rust, starting by flow_extract(). We will share our experiences and lessons learned in this process.

[1] https://mail.openvswitch.org/pipermail/ovs-announce/2016-March/000082.html

[2] commit 1bddcb5dc598 (“ofproto-dpif-xlate: Fix bug that may leak ofproto_flow_mod”)