Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Michael Richardson
"Paul \"LeoNerd\" Evans" wrote: >> > 2) A few more AD constants added to the Linux "auxdata" area, >> > giving information about the transport layer. >> >> Can you please expand on this? > See the SKF_NET_OFF and SKF_LL_OFF constants. > I wanted to simply add another, S

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Paul "LeoNerd" Evans
On Thu, 11 Jun 2015 21:05:20 +1000 Darren Reed wrote: > I would rather have instructions with larger operands that are easier > for the parser to generate and let the interpreter (or JIT) worry > about how to execute them. +1 BPF is supposed to be a high-level interface to describe some sort of

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Paul "LeoNerd" Evans
On Thu, 11 Jun 2015 20:12:00 +1000 Darren Reed wrote: > > 2) A few more AD constants added to the Linux "auxdata" area, > > giving information about the transport layer. > > Can you please expand on this? See the SKF_NET_OFF and SKF_LL_OFF constants. I wanted to simply add another, SKF_TRANS_

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Darren Reed
On 11/06/2015 9:31 AM, Mindaugas Rasiukevicius wrote: Darren Reed wrote: Extending BPF = Introduction BPF was originally designed to provide very fast packet matching capabilities for IPv4 but as a result of its generic nature, is capable of being used for just about a

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Darren Reed
On 11/06/2015 1:08 AM, Paul "LeoNerd" Evans wrote: On Wed, 10 Jun 2015 23:17:20 +1000 Darren Reed wrote: BPF & IPv6 -- The problem with IPv6 and BPF is that the transport header (TCP, UDP, etc) can have a number of extension headers between it and the network header that is present for

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Paul "LeoNerd" Evans
On Wed, 10 Jun 2015 19:25:58 -0700 Guy Harris wrote: > ...with some way of preventing infinite loops in the kernel, even if > it's as crude as "there's a pointer into the packet and if you do a > backwards jump without moving that pointer forwards and checking to > make sure you haven't gone bey