netdev - Re: [PATCH bpf] libbpf: fix probe for BPF_PROG_TYPE_CGROUP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAM798qBDjKk2Na4qfe+OKNWX6z4Boo+eTzrsTisBzUXYKXQCwQ@mail.gmail.com>
Date:   Wed, 28 Jul 2021 12:59:09 +0200
From:   Robin Gögge <r.goegge@...glemail.com>
To:     Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Stanislav Fomichev <sdf@...gle.com>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
        Quentin Monnet <quentin@...valent.com>
Subject: Re: [PATCH bpf] libbpf: fix probe for BPF_PROG_TYPE_CGROUP_SOCKOPT

On Tue, Jul 27, 2021 at 11:17 PM Andrii Nakryiko
<andrii.nakryiko@...il.com> wrote:
>
> On Tue, Jul 27, 2021 at 7:41 AM Robin Gögge <r.goegge@...look.com> wrote:
> >
> > This patch fixes the probe for BPF_PROG_TYPE_CGROUP_SOCKOPT,
> > so the probe reports accurate results when used by e.g.
> > bpftool.
> >
> > Fixes: 4cdbfb59c44a ("libbpf: support sockopt hooks")
> >
> > Signed-off-by: Robin Gögge <r.goegge@...look.com>
> > Reviewed-by: Quentin Monnet <quentin@...valent.com>
> > ---
>
> Looks good, I'll apply to bpf tree once this patch makes it into patchworks.

I think I'll have to resend the patch from my gmail account, rookie mistake
on my part for using my outlook account in the first place I guess.
>
> Meanwhile, looking at probe_load() seems like a bunch of other program
> types are not handled properly as well. Would you mind checking that
> as well and following up with more fixes for this? See also [0] for
> this whole probing APIs situation.
>
>   [0] https://github.com/libbpf/libbpf/issues/312

Yes, some other program type probes are broken at the moment. But
as far as I can tell fixing them won't be as easy for me as this one. I'm
currently working on implementing a feature probe API in cilium/ebpf,
once I have working probes for the types there I can try and translate
them to follow up with fixes here.
>
> >  tools/lib/bpf/libbpf_probes.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
> > index ecaae2927ab8..cd8c703dde71 100644
> > --- a/tools/lib/bpf/libbpf_probes.c
> > +++ b/tools/lib/bpf/libbpf_probes.c
> > @@ -75,6 +75,9 @@ probe_load(enum bpf_prog_type prog_type, const struct bpf_insn *insns,
> >         case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
> >                 xattr.expected_attach_type = BPF_CGROUP_INET4_CONNECT;
> >                 break;
> > +       case BPF_PROG_TYPE_CGROUP_SOCKOPT:
> > +               xattr.expected_attach_type = BPF_CGROUP_GETSOCKOPT;
> > +               break;
> >         case BPF_PROG_TYPE_SK_LOOKUP:
> >                 xattr.expected_attach_type = BPF_SK_LOOKUP;
> >                 break;
> > @@ -104,7 +107,6 @@ probe_load(enum bpf_prog_type prog_type, const struct bpf_insn *insns,
> >         case BPF_PROG_TYPE_SK_REUSEPORT:
> >         case BPF_PROG_TYPE_FLOW_DISSECTOR:
> >         case BPF_PROG_TYPE_CGROUP_SYSCTL:
> > -       case BPF_PROG_TYPE_CGROUP_SOCKOPT:
> >         case BPF_PROG_TYPE_TRACING:
> >         case BPF_PROG_TYPE_STRUCT_OPS:
> >         case BPF_PROG_TYPE_EXT:
> > --
> > 2.25.1
> >

-- 
Robin Goegge
Tel. +491732422154