netdev - Re: [PATCH] tc, bpf: add option to dump bpf verifier as C program fragment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <30ac6974-a434-926b-5749-25c594e5841c@gmail.com>
Date:   Mon, 18 Jun 2018 15:44:08 -0600
From:   David Ahern <dsahern@...il.com>
To:     Jakub Kicinski <jakub.kicinski@...ronome.com>,
        Ophir Munk <ophirmu@...lanox.com>
Cc:     netdev@...r.kernel.org,
        Stephen Hemminger <stephen@...workplumber.org>,
        Thomas Monjalon <thomas@...jalon.net>,
        Olga Shern <olgas@...lanox.com>
Subject: Re: [PATCH] tc, bpf: add option to dump bpf verifier as C program
 fragment

On 6/18/18 2:18 PM, Jakub Kicinski wrote:
> On Sun, 17 Jun 2018 08:48:41 +0000, Ophir Munk wrote:
>> Similar to cbpf used within tcpdump utility with a "-d" option to dump
>> the compiled packet-matching code in a human readable form - tc has the
>> "verbose" option to dump ebpf verifier output.
>> Another useful option of cbpf using tcpdump "-dd" option is to dump
>> packet-matching code a C program fragment. Similar to this - this commit
>> adds a new tc ebpf option named "code" to dump ebpf verifier as C program
>> fragment.
>>
>> Existing "verbose" option sample output:
>>
>> Verifier analysis:
>> 0: (61) r2 = *(u32 *)(r1 +52)
>> 1: (18) r3 = 0xdeadbeef
>> 3: (63) *(u32 *)(r10 -4) = r3
>> .
>> .
>> 11: (63) *(u32 *)(r1 +52) = r2
>> 12: (18) r0 = 0xffffffff
>> 14: (95) exit
>>
>> New "code" option sample output:
>>
>> /* struct bpf_insn cls_q_code[] = { */
>> {0x61,    2,    1,       52, 0x00000000},
>> {0x18,    3,    0,        0, 0xdeadbeef},
>> {0x00,    0,    0,        0, 0x00000000},
>> .
>> .
>> {0x63,    1,    2,       52, 0x00000000},
>> {0x18,    0,    0,        0, 0xffffffff},
>> {0x00,    0,    0,        0, 0x00000000},
>> {0x95,    0,    0,        0, 0x00000000},
>>
>> Signed-off-by: Ophir Munk <ophirmu@...lanox.com>
> 
> Hmm... printing C arrays looks like hacky integration with some C
> code...  Would you not be better served by simply using libbpf in
> whatever is consuming this output?
> 

I was thinking the same. bpftool would provide options too -- print the
above, print in macro encodings and verifier. I gave an example of this
side by side dump at netconf 2.1. Does not look like the slides made it
online; see attached.

Download attachment "netconf-2.1-bpf.pdf" of type "application/pdf" (38266 bytes)