linux-kernel - Re: Re: [PATCH] net/ipv4: add tracepoint for icmp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240302110211.6967-1-peilinhe2020@163.com>
Date: Sat,  2 Mar 2024 06:02:11 -0500
From: He Peilin <peilinhe2020@....com>
To: edumazet@...gle.com
Cc: davem@...emloft.net,
	dsahern@...nel.org,
	he.peilin@....com.cn,
	jiang.xuexin@....com.cn,
	kuba@...nel.org,
	linux-kernel@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org,
	liu.chun2@....com.cn,
	mhiramat@...nel.org,
	netdev@...r.kernel.org,
	rostedt@...dmis.org,
	xu.xin16@....com.cn,
	yang.yang29@....com.cn,
	zhang.yunkai@....com.cn
Subject: Re: Re: [PATCH] net/ipv4: add tracepoint for icmp_send

> >  include/trace/events/icmp.h | 57 +++++++++++++++++++++++++++++++++++++++++++++
> >  net/ipv4/icmp.c             |  4 ++++
> >  2 files changed, 61 insertions(+)
> >  create mode 100644 include/trace/events/icmp.h
> >
> > diff --git a/include/trace/events/icmp.h b/include/trace/events/icmp.h
> > new file mode 100644
> > index 000000000000..3d9af5769bc3
> > --- /dev/null
> > +++ b/include/trace/events/icmp.h
> > @@ -0,0 +1,57 @@
> > +/* SPDX-License-Identifier: GPL-2.0 */
> > +#undef TRACE_SYSTEM
> > +#define TRACE_SYSTEM icmp
> > +
> > +#if !defined(_TRACE_ICMP_H) || defined(TRACE_HEADER_MULTI_READ)
> > +#define _TRACE_ICMP_H
> > +
> > +#include <linux/icmp.h>
> > +#include <linux/tracepoint.h>
> > +
> > +TRACE_EVENT(icmp_send,
> > +
> > +               TP_PROTO(const struct sk_buff *skb, int type, int code),
> > +
> > +               TP_ARGS(skb, type, code),
> > +
> > +               TP_STRUCT__entry(
> > +                               __field(__u16, sport)
> > +                               __field(__u16, dport)
> > +                               __field(unsigned short, ulen)
> > +                               __field(const void *, skbaddr)
> > +                               __field(int, type)
> > +                               __field(int, code)
> > +                               __array(__u8, saddr, 4)
> > +                               __array(__u8, daddr, 4)
> > +               ),
> > +
> > +               TP_fast_assign(
> > +                               // Get UDP header
> > +                               struct udphdr *uh = udp_hdr(skb);
> > +                               struct iphdr *iph = ip_hdr(skb);
> > +                               __be32 *p32;
> > +
> > +                               __entry->sport = ntohs(uh->source);
> > +                               __entry->dport = ntohs(uh->dest);
> > +                               __entry->ulen = ntohs(uh->len);
> > +                               __entry->skbaddr = skb;
> > +                               __entry->type = type;
> > +                               __entry->code = code;
> > +
> > +                               p32 = (__be32 *) __entry->saddr;
> > +                               *p32 = iph->saddr;
> > +
> > +                               p32 = (__be32 *) __entry->daddr;
> > +                               *p32 =  iph->daddr;
> > +               ),
> > +
> 
> FYI, ICMP can be generated for many other protocols than UDP.

We have noted this issue. Therefore, a UDP judgment confition has been added in TP_fast_assign.This condition will only track abnormal messages when icmp_send is called with the UDP protocol. Otherwise, it will simply print the abnormal type and code.

As follows:
if(proto_4 == IPPROTO_UDP) {
	struct udphdr *uh = udp_hdr(skb);
	__entry->sport = nthos(uh->source);
	__entry_dport = nthos(uh->dest);
	__entry->ulen = nthos(uh->len);
} else {
	__entry->sport = 0;
	__entry_dport = 0;
	__entry->ulen = 0;
}

> 
> > +               TP_printk("icmp_send: type=%d, code=%d. From %pI4:%u to %pI4:%u ulen=%d skbaddr=%p",
> > +                       __entry->type, __entry->code,
> > +                       __entry->saddr, __entry->sport, __entry->daddr,
> > +                       __entry->dport, __entry->ulen, __entry->skbaddr)
> > +);
> > +
> > +#endif /* _TRACE_ICMP_H */
> > +
> > +/* This part must be outside protection */
> > +#include <trace/define_trace.h>
> > diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
> > index e63a3bf99617..437bdb7e2650 100644
> > --- a/net/ipv4/icmp.c
> > +++ b/net/ipv4/icmp.c
> > @@ -92,6 +92,8 @@
> >  #include <net/inet_common.h>
> >  #include <net/ip_fib.h>
> >  #include <net/l3mdev.h>
> > +#define CREATE_TRACE_POINTS
> > +#include <trace/events/icmp.h>
> >
> >  /*
> >   *     Build xmit assembly blocks
> > @@ -599,6 +601,8 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
> >         struct net *net;
> >         struct sock *sk;
> >
> > +       trace_icmp_send(skb_in, type, code);
> 
> I think you missed many sanity checks between lines 622 and 676
Thank you for the reminder. The next step is to move the trace point to line 676.

> Honestly, a kprobe BPF based solution would be less risky, and less
> maintenance for us.
emm, yeah, but tracepoints has advantages on its convienice, especially for those Embedded Linux which doesn't support EBPF.