netdev - Re: [PATCH iproute2 5/5] bpf: implement btf handling and map annotation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180718111337.165cfd5f@cakuba.lan>
Date:   Wed, 18 Jul 2018 11:13:37 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     dsahern@...il.com, alexei.starovoitov@...il.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH iproute2 5/5] bpf: implement btf handling and map
 annotation

On Wed, 18 Jul 2018 11:33:22 +0200, Daniel Borkmann wrote:
> On 07/18/2018 10:42 AM, Daniel Borkmann wrote:
> > On 07/18/2018 02:27 AM, Jakub Kicinski wrote:  
> >> On Wed, 18 Jul 2018 01:31:22 +0200, Daniel Borkmann wrote:  
> >>>   # bpftool map dump id 386
> >>>    [{
> >>>         "key": 0,
> >>>         "value": {
> >>>             "": {
> >>>                 "value": 0,
> >>>                 "ifindex": 0,
> >>>                 "mac": []
> >>>             }
> >>>         }
> >>>     },{
> >>>         "key": 1,
> >>>         "value": {
> >>>             "": {
> >>>                 "value": 0,
> >>>                 "ifindex": 0,
> >>>                 "mac": []
> >>>             }
> >>>         }
> >>>     },{
> >>>   [...]  
> >>
> >> Ugh, the empty keys ("") look worrying, we should probably improve
> >> handling of anonymous structs in bpftool :S  
> > 
> > Yeah agree, I think it would be nice to see a more pahole style dump
> > where we have types and member names along with the value as otherwise
> > it might be a bit confusing.  
> 
> Another feature that would be super useful imho would be in the /single/
> map view e.g. 'bpftool map show id 123' to have a detailed BTF key+value
> type dump, so in addition to the basic map info we show pahole like info
> of the structs with length/offsets.

That sounds good!  We could also consider adding a btf object and
commands to interrogate BTF types in the kernel in general..  Perhaps
then we could add something like bpftool btf describe map id 123.

Having the single map view show more information seems interesting, but
I wonder if it could be surprising.  Is there precedent for such
behaviour?