Manjusaka 的碎碎念（以及摇曳露营 S4 制作确定！）

Forwarded from Welcome to the Black Parade

开始吹 bpfsnoop (https://github.com/bpfsnoop/bpfsnoop)，我至少会在三个场景使用它

1. disas kernel

之前我都是用 gdb -ex 'x/100i 0x'$(ksym skb_gso_validate_network_len) -ex q vmlinux /proc/kcore 这种蹩脚的方式去看汇编；若是 bpf prog 会用 bpftool p d 。但前者要手算 call 的目标函数，后者又长期有 bug (https://github.com/libbpf/bpftool/issues/109)。

但是以后我会用

bpfsnoop -d -k ip_rcv

和

bpfsnoop -d -p n:cil_to_overlay

来代替 gdb。输出非常好（图一），有颜色，有行号，有正确的 call 指令解析。

2. 用 --output-arg --filter-arg --filter-pkt 做 skb 观测

之前讨论过一个 nf postrouting 不会两次处理同一个 skb 的问题，本质是要观测 skb->_nfct 在生命期内的变化，用 bpfsnoop 可以一步到位：

bpfsnoop --filter-pkt 'icmp and dst host 10.244.2.2'  -t '*:(struct sk_buff *)skb' --output-pkt --output-arg 'skb->_nfct'

虽然目前还不支持更复杂的操作，比如想观测 skb_sec_path(skb) 则需要写成 --output-arg 'skb->extensions->offset[1] << 3' 然而并不支持，但大部分简单的场景够用了。

3. 用 --output-lbr 观测 bpf prog

bpf prog 自身的观测性一直比较恶心，用 lbr 和 kprobe on bpf helpers 是目前为止我所知的唯二办法，而 bpfsnoop 是唯一实现了前者工程化的工具。（其实两者结合才是最吼的）

比如排查 https://github.com/cilium/cilium/issues/35023 的时候需要找到 bpf 运行的提前返回点，可以先无脑观测 bpf prog 退出时的 lbr

bpfsnoop -p i:7963 --output-lbr --filter-pkt 'dst host 1.1.1.1 and tcp[tcpflags]=tcp-syn' -m exit

然后再根据结果往上以 bpf helper 为节点回溯

bpfsnoop -k bpf_skb_event_output --output-lbr --filter-pkt 'dst host 1.1.1.1 and tcp[tcpflags]=tcp-syn' -m entry

最终定位代码执行流

www.tg-me.com/us/telegram/com.ManjusakaH/452

422 viewsApr 10 at 09:42

tg-me.com/ManjusakaH/452

Create: 2025-04-10
Last Update: 2025-05-02 05:47:23

bpfsnoop -d -k ip_rcv

和

bpfsnoop -d -p n:cil_to_overlay

bpfsnoop --filter-pkt 'icmp and dst host 10.244.2.2'  -t '*:(struct sk_buff *)skb' --output-pkt --output-arg 'skb->_nfct'

bpfsnoop -p i:7963 --output-lbr --filter-pkt 'dst host 1.1.1.1 and tcp[tcpflags]=tcp-syn' -m exit

然后再根据结果往上以 bpf helper 为节点回溯

bpfsnoop -k bpf_skb_event_output --output-lbr --filter-pkt 'dst host 1.1.1.1 and tcp[tcpflags]=tcp-syn' -m entry

最终定位代码执行流

BY Manjusaka 的碎碎念（以及摇曳露营 S4 制作确定！）

Share with your friend now:
tg-me.com/ManjusakaH/452

telegram Telegram | DID YOU KNOW?

Date: 2025-05-02| telegram

The STAR Market, as is implied by the name, is heavily geared toward smaller innovative tech companies, in particular those engaged in strategically important fields, such as biopharmaceuticals, 5G technology, semiconductors, and new energy. The STAR Market currently has 340 listed securities. The STAR Market is seen as important for China’s high-tech and emerging industries, providing a space for smaller companies to raise capital in China. This is especially significant for technology companies that may be viewed with suspicion on overseas stock exchanges.

Telegram auto-delete message, expiring invites, and more

elegram is updating its messaging app with options for auto-deleting messages, expiring invite links, and new unlimited groups, the company shared in a blog post. Much like Signal, Telegram received a burst of new users in the confusion over WhatsApp’s privacy policy and now the company is adopting features that were already part of its competitors’ apps, features which offer more security and privacy. Auto-deleting messages were already possible in Telegram’s encrypted Secret Chats, but this new update for iOS and Android adds the option to make messages disappear in any kind of chat. Auto-delete can be enabled inside of chats, and set to delete either 24 hours or seven days after messages are sent. Auto-delete won’t remove every message though; if a message was sent before the feature was turned on, it’ll stick around. Telegram’s competitors have had similar features: WhatsApp introduced a feature in 2020 and Signal has had disappearing messages since at least 2016.