Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

implement port mirroring #11

Open
rjarry opened this issue Mar 21, 2024 · 3 comments
Open

implement port mirroring #11

rjarry opened this issue Mar 21, 2024 · 3 comments
Labels
feature New feature or request

Comments

@rjarry
Copy link
Collaborator

rjarry commented Mar 21, 2024

Allow mirroring traffic from a port to a linux tap interface so that we can run regular tcpdump on it.

Example:

[root@dio brouter]$ br-cli mirror add tap-port0 port 0
[root@dio brouter]$ tcpdump -nni tap-port0 -c 5
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tap-port0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
14:36:31.483702 IP 192.168.1.33.5353 > 224.0.0.251.5353: 0*- [0q] 1/0/0 (Cache flush) TXT "deviceid=DC:A6:32:CC:CD:37" "model=Xbmc,1" "srcvers=101.28" "features=0x20F7" (131)
14:36:31.758020 IP6 2a01:cb00:f8b:9700:ead2:ffff:fee4:99e0.53 > 2a01:cb00:f8b:9700:ffd8:872f:c4a:d9d4.35798: 27883 2/0/1 CNAME edge-web.dual-gslb.spotify.com., AAAA 2600:1901:1:c36:: (124)
14:36:31.759541 IP6 2a01:cb00:f8b:9700:ead2:ffff:fee4:99e0.53 > 2a01:cb00:f8b:9700:ffd8:872f:c4a:d9d4.49708: 30401 2/0/1 CNAME edge-web.dual-gslb.spotify.com., A 35.186.224.25 (112)
14:36:32.507441 ARP, Request who-has 192.168.1.1 (ff:ff:ff:ff:ff:ff) tell 192.168.1.16, length 46
14:36:33.324903 IP6 2001:41d0:a:69e1::1.1107 > 2a01:cb00:f8b:9700:ffd8:872f:c4a:d9d4.40526: Flags [P.], seq 4102294619:4102294705, ack 3835940537, win 501, options [nop,nop,TS val 1300040159 ecr 4009689886], length 86
5 packets captured
6 packets received by filter
0 packets dropped by kernel
[root@dio brouter]$ br-cli mirror del tap-port0
@rjarry rjarry added the feature New feature or request label Mar 21, 2024
@christophefontaine
Copy link
Contributor

Instead of a built-in tcpdump, what about adding a mirroring node instead ?
As we should be able to add dynamically a tap port, we can then run a standard tcpdump command.

@rjarry
Copy link
Collaborator Author

rjarry commented Mar 21, 2024

That sounds like a better idea :)

I'll adjust the title and description.

@rjarry rjarry changed the title implement "tcpdump" like command implement port mirroring Mar 21, 2024
@bmagistro
Copy link

Ack that port mirroring and tcpdump, depending on context, are different requirements, but this may be achievable already with the use of dpdk-dumpcap (secondary process)

rjarry added a commit to rjarry/grout that referenced this issue Dec 6, 2024
The docstring of event_base_foreach_event() states explicitly that
modifying events in the callback function is unsafe and will cause
crashes.

event_free_finalize tries to acquire a lock that is already held when
the callback is called. Leading to a deadlock:

 (gdb) bt
 ...
 DPDK#3  ___pthread_mutex_lock (mutex=0x504000001550) at pthread_mutex_lock.c:93
 DPDK#4  0x00007f3f211b8485 in event_finalize_impl_ (flags=65536, ev=0x50c000005200, cb=0x4031ba <finalize_fd>)
 DPDK#5  0x00000000004042ed in close_connections (ev=0x50c000005200) at main/api.c:174
 ...
 DPDK#10 0x00007f3f211b263a in event_base_foreach_event (base=0x517000006d00, fn=0x40429f <close_connections>, arg=0x0)
 DPDK#11 0x0000000000404a3a in api_socket_stop () at main/api.c:253
 DPDK#12 0x00000000004072aa in main (argc=4, argv=0x7ffcc575d898) at main/main.c:210

Only use event_base_foreach_event() for iterating over the events that
we actually want to free (namely, ones that have read_cb and write_cb as
callbacks).

Only *after* returning from event_base_foreach_event(), call
event_free_finalize on all these events.

Fixes: 8653320 ("main: close active connections on shutdown")
Signed-off-by: Robin Jarry <[email protected]>
rjarry added a commit to rjarry/grout that referenced this issue Dec 6, 2024
The docstring of event_base_foreach_event() states explicitly that
modifying events in the callback function is unsafe and will cause
crashes.

event_free_finalize tries to acquire a lock that is already held when
the callback is called. Leading to a deadlock:

 (gdb) bt
 ...
 DPDK#3  ___pthread_mutex_lock (mutex=0x504000001550) at pthread_mutex_lock.c:93
 DPDK#4  0x00007f3f211b8485 in event_finalize_impl_ (flags=65536, ev=0x50c000005200, cb=0x4031ba <finalize_fd>)
 DPDK#5  0x00000000004042ed in close_connections (ev=0x50c000005200) at main/api.c:174
 ...
 DPDK#10 0x00007f3f211b263a in event_base_foreach_event (base=0x517000006d00, fn=0x40429f <close_connections>, arg=0x0)
 DPDK#11 0x0000000000404a3a in api_socket_stop () at main/api.c:253
 DPDK#12 0x00000000004072aa in main (argc=4, argv=0x7ffcc575d898) at main/main.c:210

Only use event_base_foreach_event() for iterating over the events that
we actually want to free (namely, ones that have read_cb and write_cb as
callbacks).

Only *after* returning from event_base_foreach_event(), call
event_free_finalize on all these events.

Fixes: 8653320 ("main: close active connections on shutdown")
Signed-off-by: Robin Jarry <[email protected]>
rjarry added a commit that referenced this issue Dec 6, 2024
The docstring of event_base_foreach_event() states explicitly that
modifying events in the callback function is unsafe and will cause
crashes.

event_free_finalize tries to acquire a lock that is already held when
the callback is called. Leading to a deadlock:

 (gdb) bt
 ...
 #3  ___pthread_mutex_lock (mutex=0x504000001550) at pthread_mutex_lock.c:93
 #4  0x00007f3f211b8485 in event_finalize_impl_ (flags=65536, ev=0x50c000005200, cb=0x4031ba <finalize_fd>)
 #5  0x00000000004042ed in close_connections (ev=0x50c000005200) at main/api.c:174
 ...
 #10 0x00007f3f211b263a in event_base_foreach_event (base=0x517000006d00, fn=0x40429f <close_connections>, arg=0x0)
 #11 0x0000000000404a3a in api_socket_stop () at main/api.c:253
 #12 0x00000000004072aa in main (argc=4, argv=0x7ffcc575d898) at main/main.c:210

Only use event_base_foreach_event() for iterating over the events that
we actually want to free (namely, ones that have read_cb and write_cb as
callbacks).

Only *after* returning from event_base_foreach_event(), call
event_free_finalize on all these events.

Fixes: 8653320 ("main: close active connections on shutdown")
Signed-off-by: Robin Jarry <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants