Messages in this thread | | | From | Tom Cook <> | Date | Wed, 6 Jan 2021 10:07:08 +0000 | Subject | Re: cBPF socket filters failing - inexplicably? |
| |
Just to note I have also reproduced this on a 5.10.0 kernel.
On Tue, Jan 5, 2021 at 1:42 PM Tom Cook <tom.k.cook@gmail.com> wrote: > > In the course of tracking down a defect in some existing software, > I've found the failure demonstrated by the short program below. > Essentially, a cBPF program that just rejects every frame (ie always > returns zero) and is attached to a socket using setsockopt(SOL_SOCKET, > SO_ATTACH_FILTER, ...) still occasionally lets frames through to > userspace. > > The code is based on the first example in > Documentation/networking/filter.txt, except that I've changed the > content of the filter program and added a timeout on the socket. > > To reproduce the problem: > > # gcc test.c -o test > # sudo ./test > ... and in another console start a large network operation. > > In my case, I copied a ~300MB core file I had lying around to another > host on the LAN. The test code should print the string "Failed to > read from socket" 100 times. In practice, it produces about 10% > "Received packet with ethertype..." messages. > > I've observed the same result on Ubuntu amd64 glibc system running a > 5.9.0 kernel and also on Alpine arm64v8 muslc system running a 4.9.1 > kernel. I've written test code in both C and Python. I'm fairly sure > this is not something I'm doing wrong - but very keen to have things > thrown at me if it is. > > Regards, > Tom Cook > > > #include <stdio.h> > #include <sys/socket.h> > #include <sys/types.h> > #include <arpa/inet.h> > #include <linux/if_ether.h> > #include <linux/filter.h> > #include <stdint.h> > #include <unistd.h> > > struct sock_filter code[] = { > { 0x06, 0, 0, 0x00 } /* BPF_RET | BPF_K 0 0 0 */ > }; > > struct sock_fprog bpf = { > .len = 1, > .filter = code, > }; > > void test() { > uint8_t buf[2048]; > > int sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); > if (sock < 0) { > printf("Failed to open socket\n"); > return; > } > int ret = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf)); > if (ret < 0) { > printf("Failed to set socket filter\n"); > return; > } > struct timeval tv = { > .tv_sec = 1 > }; > > ret = setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)); > if (ret < 0) { > printf("Failed to set socket timeout\n"); > return; > } > > ssize_t count = recv(sock, buf, 2048, 0); > if (count <= 0) { > printf("Failed to read from socket\n"); > return; > } > > close(sock); > > uint16_t *ethertype = (short*)(buf + 12); > uint8_t *proto = (unsigned char *)(buf + 23); > uint16_t *dport = (uint16_t *)(buf + 14 + 20); > > printf("Received packet with ethertype 0x%04hu, protocol 0x%02hhu > and dport 0x%04hu\n", *ethertype, *proto, *dport); > } > > int main() { > for (size_t ii = 0; ii < 100; ++ii) { > test(); > } > }
| |