search

Igalia / pflua

Packet filtering in Lua
Other
313 stars 39 forks source link

Libpcap fails faster for some expressions that reject all packets #130

Closed kbara closed 9 years ago

kbara commented 9 years ago

$ tcpdump -i wlan0 "portrange 1-2 and arp" tcpdump: expression rejects all packets $ tcpdump -d "portrange 1-2 and arp" tcpdump: expression rejects all packets

Both exit nearly instantly, unlike the purely-lua pipeline, which inspects the packets: % ./pflua-match ~/igalia/pflua-bench/savefiles/wingolog.org.pcap "portrange 1-2 and arp" Matched 0/19589 packets in 4872 iterations: /home/me/igalia/pflua-bench/savefiles/wingolog.org.pcap (95.421673 MPPS).

kbara commented 9 years ago

Branch pflangprop, commit 8d5f6c % ../tools/pflua-quickcheck --seed=316580654 --iterations=42 properties/pflua_pipelines_match data/wingolog.pcap pcap_compile failed!: expression rejects all packets Crashed generating properties on run 41. Attempting to print extra information; it may be wrong. The pflang expression was portrange 43759-58172 and arp and the packet number 2645 Traceback (this is reliable): ../src/pf/libpcap.lua:55: pcap_compile failed stack traceback: [C]: in function 'error' ../src/pf/libpcap.lua:55: in function 'compile' ../src/pf.lua:27: in function 'compile_filter' ./properties/pflua_pipelines_match.lua:20: in function <./properties/pflua_pipelines_match.lua:13> [C]: in function 'xpcall' ../src/pf/quickcheck.lua:71: in function 'run' ../tools/pflua-quickcheck:10: in function 'main' ../tools/pflua-quickcheck:13: in main chunk [C]: at 0x00404bc0 Rerun as: pflua-quickcheck --seed=316580654 --iterations=42 properties/pflua_pipelines_match data/wingolog.pcap

kbara commented 9 years ago

This could reasonably be a WONTFIX, but I think it's worth having documented by a bug report. Thoughts?

wingo commented 9 years ago

Yeah it seems to me libpcap is at fault here -- its behavior differs whether you have licpcap optimization on or not :-P

Can we detect the "pcap_compile failed" thing in the case where it would reject all packets? If so we could make our libpcap wrapper return function(p,len) return false done instead.

kbara commented 9 years ago

Hacked around in https://github.com/Igalia/pflua/pull/203 , with precisely that approach.

kbara commented 9 years ago

Technically, pflua is still behaving differently from libpcap, but libpcap's pipeline within pflua is now matching pflua's norms.