Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Darren Reed
On 11/06/2015 1:08 AM, Paul LeoNerd Evans wrote: On Wed, 10 Jun 2015 23:17:20 +1000 Darren Reed darr...@netbsd.org wrote: BPF IPv6 -- The problem with IPv6 and BPF is that the transport header (TCP, UDP, etc) can have a number of extension headers between it and the network header

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Darren Reed
On 11/06/2015 9:31 AM, Mindaugas Rasiukevicius wrote: Darren Reed darr...@netbsd.org wrote: Extending BPF = Introduction BPF was originally designed to provide very fast packet matching capabilities for IPv4 but as a result of its generic nature, is capable of being

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Paul LeoNerd Evans
On Wed, 10 Jun 2015 19:25:58 -0700 Guy Harris g...@alum.mit.edu wrote: ...with some way of preventing infinite loops in the kernel, even if it's as crude as there's a pointer into the packet and if you do a backwards jump without moving that pointer forwards and checking to make sure you

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Paul LeoNerd Evans
On Thu, 11 Jun 2015 21:05:20 +1000 Darren Reed darr...@netbsd.org wrote: I would rather have instructions with larger operands that are easier for the parser to generate and let the interpreter (or JIT) worry about how to execute them. +1 BPF is supposed to be a high-level interface to

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Michael Richardson
Paul \LeoNerd\ Evans leon...@leonerd.org.uk wrote: 2) A few more AD constants added to the Linux auxdata area, giving information about the transport layer. Can you please expand on this? See the SKF_NET_OFF and SKF_LL_OFF constants. I wanted to simply add

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-11 Thread Paul LeoNerd Evans
On Thu, 11 Jun 2015 20:12:00 +1000 Darren Reed darr...@netbsd.org wrote: 2) A few more AD constants added to the Linux auxdata area, giving information about the transport layer. Can you please expand on this? See the SKF_NET_OFF and SKF_LL_OFF constants. I wanted to simply add another,

[tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-10 Thread Darren Reed
Extending BPF = Introduction BPF was originally designed to provide very fast packet matching capabilities for IPv4 but as a result of its generic nature, is capable of being used for just about any protocol. With IPv6 the limitations of BPF became apparent. BPF IPv6

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-10 Thread Mindaugas Rasiukevicius
Darren Reed darr...@netbsd.org wrote: Extending BPF = Introduction BPF was originally designed to provide very fast packet matching capabilities for IPv4 but as a result of its generic nature, is capable of being used for just about any protocol. With IPv6 the

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-10 Thread Guy Harris
On Jun 10, 2015, at 4:31 PM, Mindaugas Rasiukevicius rm...@noxt.eu wrote: Darren Reed darr...@netbsd.org wrote: Extending BPF = Introduction BPF was originally designed to provide very fast packet matching capabilities for IPv4 but as a result of its generic

Re: [tcpdump-workers] BPF Extended: addressing BPF's shortcomings

2015-06-10 Thread Paul LeoNerd Evans
On Wed, 10 Jun 2015 23:17:20 +1000 Darren Reed darr...@netbsd.org wrote: BPF IPv6 -- The problem with IPv6 and BPF is that the transport header (TCP, UDP, etc) can have a number of extension headers between it and the network header that is present for IPv6. There's no hints in the