linux-kernel - Re: [PATCH net-next] udp: Add tracepoints to monitor skbs going in and out of a UDP socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 Oct 2018 10:19:27 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     David Howells <dhowells@...hat.com>
Cc:     David Ahern <dsahern@...il.com>, netdev@...r.kernel.org,
        linux-afs@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next] udp: Add tracepoints to monitor skbs going in
 and out of a UDP socket

On Thu, Oct 04, 2018 at 05:54:33PM +0100, David Howells wrote:
> David Ahern <dsahern@...il.com> wrote:
> 
> > These do not add any real value. You are only dumping the skb address,
> 
> Not in and of themselves, no - but in combination with tracepoints elsewhere,
> where you can use the skb address as a key to follow the lifetime of a
> particular skb.
> 
> > and you can get the same effect with a probe on the function and dumping
> > the value of the register with the skb argument.
> 
> Installing a probe requires various preconditions, including your kernel not
> being locked down and having the source around AIUI.
> 
> Anyway, I've no especially strong feelings about this patch - it's been useful
> for me and it might be useful to others.

I don't quite see what value this tracepoint adds.
Just use kprobe in the same spot? Or tcpdump?
How was it useful for you? and why it couldn't have been achieved by other means?