Blacklist regex is too general

Blacklist regex is too general

[Alexander Lochmann]

[-- Attachment #1.1: Type: text/plain, Size: 740 bytes --]

Hi folks!

I've wanted to measure the impact of packet duplication due to a raw socket.
To do so, I have to probe the kernel function 'raw_v4_input' in
net/ipv4/raw.c.
Unfortunately, the function name matches the regex defined at
dwflpp:4324, which is: blfn += "|raw_.*";.
On my opinion, the regex is too general, and there is no reason why it
shouldn't be allowed to probe 'raw_v4_input'.
It therefore might be necessary to rephrase the mentioned regex. :)

Cheers,
Alex

-- 
Technische Universität Dortmund
Alexander Lochmann                PGP key: 0xBC3EF6FD
Otto-Hahn-Str. 16                 phone:  +49.231.7556141
D-44227 Dortmund                  fax:    +49.231.7556116
http://ess.cs.tu-dortmund.de/Staff/al


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Blacklist regex is too general

[David Smith]

On 04/12/2016 04:12 AM, Alexander Lochmann wrote:
> Hi folks!
> 
> I've wanted to measure the impact of packet duplication due to a raw socket.
> To do so, I have to probe the kernel function 'raw_v4_input' in
> net/ipv4/raw.c.
> Unfortunately, the function name matches the regex defined at
> dwflpp:4324, which is: blfn += "|raw_.*";.
> On my opinion, the regex is too general, and there is no reason why it
> shouldn't be allowed to probe 'raw_v4_input'.
> It therefore might be necessary to rephrase the mentioned regex. :)

While we think about the best way to proceed here, you should be able to
use '-g' (guru mode) to ignore the blacklist.

-- 
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)

Re: Blacklist regex is too general

[Alexander Lochmann]

[-- Attachment #1.1: Type: text/plain, Size: 1086 bytes --]

On 04/12/2016 05:41 PM, David Smith wrote:
> On 04/12/2016 04:12 AM, Alexander Lochmann wrote:
>> Hi folks!
>>
>> I've wanted to measure the impact of packet duplication due to a raw socket.
>> To do so, I have to probe the kernel function 'raw_v4_input' in
>> net/ipv4/raw.c.
>> Unfortunately, the function name matches the regex defined at
>> dwflpp:4324, which is: blfn += "|raw_.*";.
>> On my opinion, the regex is too general, and there is no reason why it
>> shouldn't be allowed to probe 'raw_v4_input'.
>> It therefore might be necessary to rephrase the mentioned regex. :)
> 
> While we think about the best way to proceed here, you should be able to
> use '-g' (guru mode) to ignore the blacklist.
> 
Ah. Thx. Good to know. :)
Since I compile my own version, I simply commented that line out.

- Alex

-- 
Technische Universität Dortmund
Alexander Lochmann                PGP key: 0xBC3EF6FD
Otto-Hahn-Str. 16                 phone:  +49.231.7556141
D-44227 Dortmund                  fax:    +49.231.7556116
http://ess.cs.tu-dortmund.de/Staff/al


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Blacklist regex is too general

[David Smith]

On 04/12/2016 10:46 AM, Alexander Lochmann wrote:
> On 04/12/2016 05:41 PM, David Smith wrote:
>> On 04/12/2016 04:12 AM, Alexander Lochmann wrote:
>>> Hi folks!
>>>
>>> I've wanted to measure the impact of packet duplication due to a raw socket.
>>> To do so, I have to probe the kernel function 'raw_v4_input' in
>>> net/ipv4/raw.c.
>>> Unfortunately, the function name matches the regex defined at
>>> dwflpp:4324, which is: blfn += "|raw_.*";.
>>> On my opinion, the regex is too general, and there is no reason why it
>>> shouldn't be allowed to probe 'raw_v4_input'.
>>> It therefore might be necessary to rephrase the mentioned regex. :)
>>
>> While we think about the best way to proceed here, you should be able to
>> use '-g' (guru mode) to ignore the blacklist.
>>
> Ah. Thx. Good to know. :)
> Since I compile my own version, I simply commented that line out.

I went through several kernels trying to figure out what that blacklist
regular expression was supposed to protect us against, and couldn't find
anything. So, commit 0748ca7 removes that regexp.

<https://sourceware.org/git/gitweb.cgi?p=systemtap.git;a=commit;h=0748ca7c7d3fbfec536cc1c38fe3deab70007fef>

Thanks for the report.

-- 
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)