Re: [netsniff-ng] bpfc cpp defines passing

[vkochan]

On Mon, Nov 16, 2015 at 02:13:04PM +0100, Daniel Borkmann wrote:
> On 11/16/2015 02:00 PM, vkochan wrote:
> >Hi,
> >
> >Before start coding I'd like to know what do you think about such bpfc
> >feature like - passing =...= to bpfc which will
> >be converted to cpp as -Dvar1=value1..-DvarN=valueN, and in bpf filter
> >it allows to do #ifdef for specific define and generate bpf opcodes
> >considering this defined value (e.g. - port/protocol number).
> >
> >What do you think ?
> 
> Sounds good to me, I think such a feature might even be more interesting
> for trafgen, there was once a request on this in the past:
> 
>   https://www.mail-archive.com/netsniff-ng%40googlegroups.com/msg00789.html
> 
> I think we could use cpp to do textual replacement to pass in shell vars.
> Part of that should already be possible due to your cmdline feature, but
> for complex patterns that would be too long (thus cfg file preferred), it
> might be interesting as well.
> 
> Thanks!

Of course it will be tricky to specify IPv6 address for example, so it
will be needed to split it to at least 4 32bit variables... but for
single 8/16/32bit variables it should be useful.

I think it will be needed new command line option for trafgen & bpfc
(and better with the same name) which will enable invoke_cpp.

Regards,

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[netsniff-ng] Re: [PATCH 2/2] flowtop: Add runtime commands to show TCP/UDP/DCCP/ICMP/SCTP

[Tobias Klauser]

On 2015-11-12 at 07:54:19 +0100, Vadim Kochan  wrote:
> Now it is possible toggle display TCP/UDP/DCCP/ICMP/SCTP protos
> by the same char keys as short command line options - T/U/D/I/S.
> 
> Signed-off-by: Vadim Kochan 
> ---
>  flowtop.c | 69 
> +++
>  1 file changed, 65 insertions(+), 4 deletions(-)
> 
> diff --git a/flowtop.c b/flowtop.c
> index 4c6f383..b6d3a08 100644
> --- a/flowtop.c
> +++ b/flowtop.c
> @@ -104,6 +104,14 @@ enum flow_direction {
>  #define INCLUDE_ICMP (1 << 5)
>  #define INCLUDE_SCTP (1 << 6)
>  
> +#define TOGGLE_FLAG(what, flag) \
> +do { \
> + if (what & flag)\
> + what &= ~flag;  \
> + else\
> + what |= flag;   \
> +} while (0)
> +
>  struct sysctl_params_ctx {
>   int nfct_acct;
>   int nfct_tstamp;
> @@ -114,6 +122,7 @@ enum rate_units {
>   RATE_BYTES
>  };
>  
> +static volatile bool do_reload_flows;
>  static volatile bool is_flow_collecting;
>  static volatile sig_atomic_t sigint = 0;
>  static int what = INCLUDE_IPV4 | INCLUDE_IPV6 | INCLUDE_TCP;
> @@ -462,7 +471,6 @@ static void flow_list_destroy(struct flow_list *fl)
>   }
>  
>   synchronize_rcu();
> - spinlock_destroy(>lock);
>  }
>  
>  static int walk_process(unsigned int pid, struct flow_entry *n)
> @@ -1186,8 +1194,14 @@ static void draw_help(WINDOW *screen)
>   mvaddnstr(row + 9, col + 2, "Display Settings", -1);
>   attroff(A_BOLD | A_UNDERLINE);
>  
> - mvaddnstr(row + 11, col + 3, "b Toggle rate units 
> (bits/bytes)", -1);
> - mvaddnstr(row + 12, col + 3, "a Toggle display of active 
> flows (rate > 0) only", -1);
> + mvaddnstr(row + 11, col + 3, "b Toggle rate units (bits/bytes)", 
> -1);
> + mvaddnstr(row + 12, col + 3, "a Toggle display of active flows 
> (rate > 0) only", -1);
> +
> + mvaddnstr(row + 14, col + 3, "T Toggle display TCP flows", -1);
> + mvaddnstr(row + 15, col + 3, "U Toggle display UDP flows", -1);
> + mvaddnstr(row + 16, col + 3, "D Toggle display DCCP flows", -1);
> + mvaddnstr(row + 17, col + 3, "I Toggle display ICMP flows", -1);
> + mvaddnstr(row + 18, col + 3, "S Toggle display SCTP flows", -1);
>  }
>  
>  static void draw_header(WINDOW *screen)
> @@ -1217,6 +1231,27 @@ static void draw_footer(WINDOW *screen)
>   attroff(A_STANDOUT);
>  }
>  
> +static void show_option_toggle(int opt)
> +{
> + switch (opt) {
> + case 'T':
> + TOGGLE_FLAG(what, INCLUDE_TCP);
> + break;
> + case 'U':
> + TOGGLE_FLAG(what, INCLUDE_UDP);
> + break;
> + case 'D':
> + TOGGLE_FLAG(what, INCLUDE_DCCP);
> + break;
> + case 'I':
> + TOGGLE_FLAG(what, INCLUDE_ICMP);
> + break;
> + case 'S':
> + TOGGLE_FLAG(what, INCLUDE_SCTP);
> + break;
> + }
> +}
> +
>  static void presenter(void)
>  {
>   int time_sleep_us = 20;
> @@ -1238,11 +1273,13 @@ static void presenter(void)
>   rcu_register_thread();
>   while (!sigint) {
>   bool redraw_flows = true;
> + int ch;
>  
>   curs_set(0);
>   getmaxyx(screen, rows, cols);
>  
> - switch (getch()) {
> + ch = getch();
> + switch (ch) {
>   case 'q':
>   sigint = 1;
>   break;
> @@ -1274,6 +1311,18 @@ static void presenter(void)
>   wclear(screen);
>   clear();
>   break;
> + case 'T':
> + case 'U':
> + case 'D':
> + case 'I':
> + case 'S':
> + if (is_flow_collecting)
> + break;

In this case we will silently discard the user input, which is not very
nice. Do you see any reasonable way to avoid that?

> +
> + show_option_toggle(ch);
> +
> + do_reload_flows = true;
> + break;
>   default:
>   fflush(stdin);
>   redraw_flows = false;
> @@ -1606,11 +1655,21 @@ static void *collector(void *null __maybe_unused)
>  
>   rcu_register_thread();
>  
> +reload:
> + if (do_reload_flows)
> + collector_create_filter(ct_event);
> +
> + do_reload_flows = false;
>   collector_dump_flows();
>  
>   while (!sigint) {
>   int status;
>  
> + if (do_reload_flows) {
> + flow_list_destroy(_list);
> + goto reload;

Ugh, I don't like jumping out of the loop here, even if it saves some
code duplication. But in that case I'd rather opt for duplicating the 4
LoC above.

Otherwise looks good to me.

> + }
> +
>   

[netsniff-ng] Re: [PATCH] bpfc: Do not panic if bpf file is not valid

[Tobias Klauser]

On 2015-11-15 at 22:16:37 +0100, Vadim Kochan  wrote:
> If bpf file is not valid then cpp generated file is not
> deleted because panic() func is invoked.
> 
> Signed-off-by: Vadim Kochan 

Applied, thanks.

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[netsniff-ng] Re: About next release date

[vkochan]

On Fri, Oct 30, 2015 at 11:17:21AM +0100, Tobias Klauser wrote:
> Hi Vadim
> 
> On 2015-10-30 at 09:59:46 +0100, Vadim Kochan  wrote:
> > I'd like to know when you plan to do the next release, actually
> > I have some plans regarding flowtop which I think might be good to have in
> > the next release like sorting by rate & probably by received/sent traffic, 
> > and
> > probably some simple filtering at least by process.
> 
> Ah nice!
> 
> > Let me know if you have some ideas.
> > 
> > Anyway it would be good to have some notification before release is 
> > happened:)
> 
> Sure, will do. Actually, I'm planing to do a release since some time
> already, but unfortunately other work has gotten in the way :(
> 
> I want to get back to a more regular release schedule and want to drop
> the -rc releases. Instead, we'll release a new version every 2-3 months
> (depending on the work that went in, of course).
> 
> If nothing gets in the way, I'd like to get out a 0.5.10 (or should we
> make it 0.6.9? ;) release with the current feature set some time next
> week.
> 
> The features you suggest for flowtop would then probably be material for
> the release after this one (depending on the patch size and when you
> plan to submit them).
> 
> Thanks
> Tobias

Hi,

I'd like to ask if you plan to do some code freeze via email notification 
before new release schedule ?
So it might indicate that now it is better to focus on testing & bug fixing.

Regards,
Vadim Kochan

-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.