netdev - Re: [PATCH] net: tracepoint: exposing sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 29 Jan 2021 11:53:45 +1100
From:   Brendan Gregg <bgregg@...flix.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Hariharan Ananthakrishnan <hari@...flix.com>,
        Eric Dumazet <edumazet@...gle.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Network Development <netdev@...r.kernel.org>,
        Song Liu <songliubraving@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>
Subject: Re: [PATCH] net: tracepoint: exposing sk_family in all tcp:tracepoints

On Fri, Jan 29, 2021 at 11:16 AM Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
>
> On Thu, Jan 28, 2021 at 4:12 PM Hariharan Ananthakrishnan
> <hari@...flix.com> wrote:
> >
> > Similar to sock:inet_sock_set_state tracepoint, expose sk_family to
> > distinguish AF_INET and AF_INET6 families.
> >
> > The following tcp tracepoints are updated:
> > tcp:tcp_destroy_sock
> > tcp:tcp_rcv_space_adjust
> > tcp:tcp_retransmit_skb
> > tcp:tcp_send_reset
> > tcp:tcp_receive_reset
> > tcp:tcp_retransmit_synack
> > tcp:tcp_probe
> >
> > Signed-off-by: Hariharan Ananthakrishnan <hari@...flix.com>
> > Signed-off-by: Brendan Gregg <bgregg@...flix.com>
> > ---
> >  include/trace/events/tcp.h | 20 ++++++++++++++++----
> >  1 file changed, 16 insertions(+), 4 deletions(-)
> >
> > diff --git a/include/trace/events/tcp.h b/include/trace/events/tcp.h
> > index cf97f6339acb..a319d2f86cd9 100644
> > --- a/include/trace/events/tcp.h
> > +++ b/include/trace/events/tcp.h
> > @@ -59,6 +59,7 @@ DECLARE_EVENT_CLASS(tcp_event_sk_skb,
> >                 __field(int, state)
> >                 __field(__u16, sport)
> >                 __field(__u16, dport)
> > +               __field(__u16, family)
> >                 __array(__u8, saddr, 4)
> >                 __array(__u8, daddr, 4)
> >                 __array(__u8, saddr_v6, 16)
>
> raw tracepoint can access all sk and skb fields already.
> Why do you need this?


We (Netflix) can dig it out using raw tracepoints and BTF (once it's
rolled out) but this was about fixing the existing tracepoints so they
were more useful.

I think tracepoints and their arguments suit a class of
non-kernel-hacker users: SREs, operators, sysadmins, etc. People who
run and tweak bpftrace one-liners.

Brendan

-- 
Brendan Gregg, Senior Performance Architect, Netflix