netdev - Re: [PATCH net-next] net: add network device notifier trace points

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 19 Dec 2018 07:43:25 -0800
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     Jesper Dangaard Brouer <brouer@...hat.com>
Cc:     netdev@...r.kernel.org, Stephen Hemminger <sthemmin@...rosoft.com>,
        Daniel Borkmann <borkmann@...earbox.net>,
        Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Arnaldo Carvalho de Melo <acme@...hat.com>,
        Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [PATCH net-next] net: add network device notifier trace points

On Wed, 19 Dec 2018 08:36:43 +0100
Jesper Dangaard Brouer <brouer@...hat.com> wrote:

> On Tue, 18 Dec 2018 18:27:06 -0800
> Stephen Hemminger <stephen@...workplumber.org> wrote:
> 
> > This is the result of a conversation about monitoring of link
> > state changes with BPF.  
> 
> If you want to use this from BPF then you are in for a surprise.  As
> tracepoints BPF cannot read these "__string" constructs, here the netdev
> name.  I tried a lot of different tricks that didn't work, see [1],
> until Alexei explained that it simply isn't supported.
> 
> I instead recommend adding the ifindex to the tracepoint.  The__string
> and __assign_str is also a performance concern as it does strcpy behind
> your back.

Can we record the ifindex in the event record and do the decode in
the printk?

This is not a critical path so don't really care that much.
 
> I have an year old TODO list item about improving this:
>  ** TODO Make perf-script plugin for ifindex to name translation
>     SCHEDULED: <2017-11-20 Mon>
> 
> Today, the existing network tracepoints using dev->name is not that
> usable by BPF, as BPF cannot identify the interface.  Thus IMHO it would
> make sense to convert the existing network tracepoints dev->name into
> dev->ifindex, and then let perf-script convert this to the interface
> name.  Either in userspace via if_indextoname(3), or (as ACME pointed
> out at the time) we might want to have a lookup table stored together
> with perf.data for later inspection (in-case ifindexes changed).
> 
> 
> [1] https://github.com/netoptimizer/prototype-kernel/blob/master/kernel/samples/bpf/napi_monitor_kern.c#L34-L130

What about the event enum, can BPF take that?

Also want to add net namespace create/destroy events.