netdev - Re: [RFC bpf-next 0/5] Convert iproute2 to use libbpf (WIP)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 4 Feb 2020 15:12:29 -0700
From:   David Ahern <dsahern@...il.com>
To:     Toke Høiland-Jørgensen <toke@...hat.com>,
        Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        Stephen Hemminger <stephen@...workplumber.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        David Miller <davem@...emloft.net>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>
Subject: Re: [RFC bpf-next 0/5] Convert iproute2 to use libbpf (WIP)

On 2/4/20 2:56 PM, Toke Høiland-Jørgensen wrote:
>> I'm confused, honestly. libbpf is either a dependency and thus can be
>> relied upon to be present in the target system, or it's not and this
>> whole dance with detecting libbpf presence needs to be performed.
> 
> Yes, and iproute2 is likely to be built in both sorts of environments,
> so we will have to support both :)
> 
>> If libbpf is optional, then I don't see how iproute2 BPF-related code
>> and complexity can be reduced at all, given it should still support
>> loading BPF programs even without libbpf. Furthermore, given libbpf
>> supports more features already and will probably be outpacing
>> iproute2's own BPF support in the future, some users will start
>> relying on BPF features supported only by libbpf "backend", so
>> iproute2's own BPF backend will just fail to load such programs,
>> bringing unpleasant surprises, potentially. So I still fail to see how
>> libbpf can be optional and what benefit does that bring.
> 
> I wasn't saying that libbpf itself should be optional; if we're porting
> things, we should rip out as much of the old code as we can. I just
> meant that we should support both modes of building, so distros that
> *do* build libbpf as a library can link iproute2 against that with as
> little friction as possible.
> 
> I'm dead set on a specific auto-detection semantic either; I guess it'll
> be up to the iproute2 maintainers whether they prefer defaulting to one
> or the other.
> 

A few concerns from my perspective:

1. Right now ip comes in around 650k unstripped; libbpf.a for 0.0.7 is
around 1.2M with the size of libbpf.o > than ip. Most likely, making
iproute2 use libbpf statically is going to be challenging and I am not
sure it is the right thing to do (unless the user is building a static
version of iproute2 commands).

2. git submodules can be a PITA to deal with (e.g., jumping between
branches and versions), so there needs to be a good reason for it.

3. iproute2 code needs to build for a wide range of OSes and not lose
functionality compared to what it has today.