diff --git a/docs/bibliography/bibliography.bib b/docs/bibliography/bibliography.bib index 571e484..b2dc16e 100644 --- a/docs/bibliography/bibliography.bib +++ b/docs/bibliography/bibliography.bib @@ -91,6 +91,33 @@ pages={1} }, +@article{bpf_bsd_origin_bpf_page5, + title={The BSD Packet Filter: A New Architecture for User-level Packet Capture}, + author={Steven McCanne, Van Jacobson}, + institution={Lawrence Berkeley Laboratory}, + date={1992-12-19}, + url={https://www.tcpdump.org/papers/bpf-usenix93.pdf}, + pages={5} +}, + +@article{bpf_bsd_origin_bpf_page7, + title={The BSD Packet Filter: A New Architecture for User-level Packet Capture}, + author={Steven McCanne, Van Jacobson}, + institution={Lawrence Berkeley Laboratory}, + date={1992-12-19}, + url={https://www.tcpdump.org/papers/bpf-usenix93.pdf}, + pages={7} +}, + +@article{bpf_bsd_origin_bpf_page8, + title={The BSD Packet Filter: A New Architecture for User-level Packet Capture}, + author={Steven McCanne, Van Jacobson}, + institution={Lawrence Berkeley Laboratory}, + date={1992-12-19}, + url={https://www.tcpdump.org/papers/bpf-usenix93.pdf}, + pages={8} +}, + @online{ebpf_history_opensource, title={An intro to using eBPF to filter packets in the Linux kernel}, date={2017-08-11}, @@ -107,6 +134,12 @@ url={https://gunkies.org/wiki/Index_register} } +@online{bpf_organicprogrammer_analysis, + title={Write a Linux packet sniffer from scratch: part two- BPF}, + date={2022-03-28}, + url={https://organicprogrammer.com/2022/03/28/how-to-implement-libpcap-on-linux-with-raw-socket-part2/} +} + diff --git a/docs/document.aux b/docs/document.aux index dbe914d..e666ec8 100644 --- a/docs/document.aux +++ b/docs/document.aux @@ -62,7 +62,7 @@ \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} \@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {2.1}Introduction to eBPF}{5}{section.2.1}\protected@file@percent } -\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {2.1.1}eBPF history}{5}{subsection.2.1.1}\protected@file@percent } +\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {2.1.1}eBPF history - Classic BPF}{5}{subsection.2.1.1}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {2.1}{\ignorespaces Sketch of the functionality of classic BPF\relax }}{5}{figure.caption.7}\protected@file@percent } \providecommand*\caption@xref[2]{\@setref\relax\@undefined{#1}} \newlabel{fig:classif_bpf}{{2.1}{5}{Sketch of the functionality of classic BPF\relax }{figure.caption.7}{}} @@ -70,17 +70,35 @@ \abx@aux@segm{0}{0}{bpf_bsd_origin_bpf_page1} \abx@aux@cite{index_register} \abx@aux@segm{0}{0}{index_register} -\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {3}Methods??}{7}{chapter.3}\protected@file@percent } +\abx@aux@cite{bpf_bsd_origin_bpf_page5} +\abx@aux@segm{0}{0}{bpf_bsd_origin_bpf_page5} +\abx@aux@cite{bpf_organicprogrammer_analysis} +\abx@aux@segm{0}{0}{bpf_organicprogrammer_analysis} +\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {2.2}{\ignorespaces Execution of a BPF filter.\relax }}{7}{figure.caption.8}\protected@file@percent } +\newlabel{fig:cbpf_prog}{{2.2}{7}{Execution of a BPF filter.\relax }{figure.caption.8}{}} +\@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Table showing BPF instruction format. It is a fixed-length 64 bit instruction, the number of bits used by each field are indicated.\relax }}{7}{table.caption.9}\protected@file@percent } +\newlabel{table:bpf_inst_format}{{2.1}{7}{Table showing BPF instruction format. It is a fixed-length 64 bit instruction, the number of bits used by each field are indicated.\relax }{table.caption.9}{}} +\abx@aux@cite{bpf_bsd_origin_bpf_page7} +\abx@aux@segm{0}{0}{bpf_bsd_origin_bpf_page7} +\abx@aux@cite{bpf_bsd_origin_bpf_page8} +\abx@aux@segm{0}{0}{bpf_bsd_origin_bpf_page8} +\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Table of supported classic BPF instructions, as shown by McCanne and Jacobson\cite {bpf_bsd_origin_bpf_page7}\relax }}{8}{figure.caption.10}\protected@file@percent } +\newlabel{fig:bpf_instructions}{{2.3}{8}{Table of supported classic BPF instructions, as shown by McCanne and Jacobson\cite {bpf_bsd_origin_bpf_page7}\relax }{figure.caption.10}{}} +\abx@aux@cite{bpf_bsd_origin_bpf_page8} +\abx@aux@segm{0}{0}{bpf_bsd_origin_bpf_page8} +\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Table explaining the column address modes in Figure\ref {fig:bpf_instructions}, as shown by McCanne and Jacobson\cite {bpf_bsd_origin_bpf_page8}\relax }}{9}{figure.caption.11}\protected@file@percent } +\newlabel{fig:bpf_address_mode}{{2.4}{9}{Table explaining the column address modes in Figure\ref {fig:bpf_instructions}, as shown by McCanne and Jacobson\cite {bpf_bsd_origin_bpf_page8}\relax }{figure.caption.11}{}} +\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {3}Methods??}{10}{chapter.3}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} -\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {4}Results}{8}{chapter.4}\protected@file@percent } +\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {4}Results}{11}{chapter.4}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} -\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion and future work}{9}{chapter.5}\protected@file@percent } +\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion and future work}{12}{chapter.5}\protected@file@percent } \@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }} -\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{Bibliography}{10}{chapter.5}\protected@file@percent } -\abx@aux@read@bbl@mdfivesum{A38CCF92715F96EEC0C0F545CC410B50} +\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{Bibliography}{13}{chapter.5}\protected@file@percent } +\abx@aux@read@bbl@mdfivesum{87C7875B9C878945D5F672C63ACB5E95} \abx@aux@refcontextdefaultsdone \abx@aux@defaultrefcontext{0}{ransomware_pwc}{none/global//global/global} \abx@aux@defaultrefcontext{0}{rootkit_ptsecurity}{none/global//global/global} @@ -97,5 +115,9 @@ \abx@aux@defaultrefcontext{0}{ebpf_history_opensource}{none/global//global/global} \abx@aux@defaultrefcontext{0}{bpf_bsd_origin_bpf_page1}{none/global//global/global} \abx@aux@defaultrefcontext{0}{index_register}{none/global//global/global} +\abx@aux@defaultrefcontext{0}{bpf_bsd_origin_bpf_page5}{none/global//global/global} +\abx@aux@defaultrefcontext{0}{bpf_organicprogrammer_analysis}{none/global//global/global} +\abx@aux@defaultrefcontext{0}{bpf_bsd_origin_bpf_page7}{none/global//global/global} +\abx@aux@defaultrefcontext{0}{bpf_bsd_origin_bpf_page8}{none/global//global/global} \ttl@finishall -\gdef \@abspage@last{27} +\gdef \@abspage@last{30} diff --git a/docs/document.bbl b/docs/document.bbl index e6da86d..d6bd14d 100644 --- a/docs/document.bbl +++ b/docs/document.bbl @@ -23,8 +23,8 @@ \list{institution}{1}{% {PricewaterhouseCoopers}% } - \field{sortinit}{1} - \field{sortinithash}{50c6687d7fc80f50136d75228e3c59ba} + \field{sortinit}{2} + \field{sortinithash}{ed39bb39cf854d5250e95b1c1f94f4ed} \field{labeltitlesource}{title} \field{title}{Cyber Threats 2021: A year in Retrospect} \verb{urlraw} @@ -38,8 +38,8 @@ \list{institution}{1}{% {Positive Technologies}% } - \field{sortinit}{2} - \field{sortinithash}{ed39bb39cf854d5250e95b1c1f94f4ed} + \field{sortinit}{3} + \field{sortinithash}{a37a8ef248a93c322189792c34fc68c9} \field{labeltitlesource}{title} \field{day}{3} \field{month}{11} @@ -54,8 +54,8 @@ \endverb \endentry \entry{ebpf_linux318}{online}{} - \field{sortinit}{3} - \field{sortinithash}{a37a8ef248a93c322189792c34fc68c9} + \field{sortinit}{4} + \field{sortinithash}{e071e0bcb44634fab398d68ad04e69f4} \field{day}{7} \field{indextitle}{eBPF incorporation in the Linux Kernel 3.18} \field{month}{12} @@ -72,8 +72,8 @@ \list{institution}{1}{% {Pangu Lab}% } - \field{sortinit}{4} - \field{sortinithash}{e071e0bcb44634fab398d68ad04e69f4} + \field{sortinit}{5} + \field{sortinithash}{5dd416adbafacc8226114bc0202d5fdd} \field{labeltitlesource}{title} \field{day}{23} \field{month}{2} @@ -91,8 +91,8 @@ \list{institution}{1}{% {PricewaterhouseCoopers}% } - \field{sortinit}{5} - \field{sortinithash}{5dd416adbafacc8226114bc0202d5fdd} + \field{sortinit}{6} + \field{sortinithash}{7851c86048328b027313775d8fbd2131} \field{labeltitlesource}{title} \field{title}{Cyber Threats 2021: A year in Retrospect} \field{pages}{37} @@ -105,8 +105,8 @@ \endverb \endentry \entry{ebpf_windows}{online}{} - \field{sortinit}{6} - \field{sortinithash}{7851c86048328b027313775d8fbd2131} + \field{sortinit}{7} + \field{sortinithash}{f615fb9c6fba11c6f962fb3fd599810e} \field{labeltitlesource}{title} \field{day}{7} \field{month}{12} @@ -121,8 +121,8 @@ \endverb \endentry \entry{ebpf_android}{online}{} - \field{sortinit}{7} - \field{sortinithash}{f615fb9c6fba11c6f962fb3fd599810e} + \field{sortinit}{8} + \field{sortinithash}{1b24cab5087933ef0826a7cd3b99e994} \field{labeltitlesource}{title} \field{title}{eBPF for Windows} \verb{urlraw} @@ -152,8 +152,8 @@ \strng{authorbibnamehash}{5142e68c748eb70cb619b21160eb7f72} \strng{authornamehash}{5142e68c748eb70cb619b21160eb7f72} \strng{authorfullhash}{5142e68c748eb70cb619b21160eb7f72} - \field{sortinit}{8} - \field{sortinithash}{1b24cab5087933ef0826a7cd3b99e994} + \field{sortinit}{9} + \field{sortinithash}{54047ffb55bdefa0694bbd554c1b11a0} \field{labelnamesource}{author} \field{eventtitle}{Evil eBPF Practical Abuses of an In-Kernel Bytecode Runtime} \verb{urlraw} @@ -180,8 +180,8 @@ \strng{authorbibnamehash}{53d4d4da0d1a82f58d57d86ba9635f2c} \strng{authornamehash}{53d4d4da0d1a82f58d57d86ba9635f2c} \strng{authorfullhash}{53d4d4da0d1a82f58d57d86ba9635f2c} - \field{sortinit}{9} - \field{sortinithash}{54047ffb55bdefa0694bbd554c1b11a0} + \field{sortinit}{1} + \field{sortinithash}{50c6687d7fc80f50136d75228e3c59ba} \field{labelnamesource}{author} \field{eventtitle}{Bad BPF - Warping reality using eBPF} \verb{urlraw} @@ -332,6 +332,130 @@ \verb https://gunkies.org/wiki/Index_register \endverb \endentry + \entry{bpf_bsd_origin_bpf_page5}{article}{} + \name{author}{1}{}{% + {{hash=b74c2671072cf5a1a1400dc035240dfd}{% + family={Steven\bibnamedelima McCanne}, + familyi={S\bibinitperiod\bibinitdelim M\bibinitperiod}, + given={Van\bibnamedelima Jacobson}, + giveni={V\bibinitperiod\bibinitdelim J\bibinitperiod}}}% + } + \list{institution}{1}{% + {Lawrence Berkeley Laboratory}% + } + \strng{namehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{fullhash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{bibnamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authorbibnamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authornamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authorfullhash}{b74c2671072cf5a1a1400dc035240dfd} + \field{extraname}{3} + \field{sortinit}{1} + \field{sortinithash}{50c6687d7fc80f50136d75228e3c59ba} + \field{labelnamesource}{author} + \field{labeltitlesource}{title} + \field{day}{19} + \field{month}{12} + \field{title}{The BSD Packet Filter: A New Architecture for User-level Packet Capture} + \field{year}{1992} + \field{dateera}{ce} + \field{pages}{5} + \range{pages}{1} + \verb{urlraw} + \verb https://www.tcpdump.org/papers/bpf-usenix93.pdf + \endverb + \verb{url} + \verb https://www.tcpdump.org/papers/bpf-usenix93.pdf + \endverb + \endentry + \entry{bpf_organicprogrammer_analysis}{online}{} + \field{sortinit}{1} + \field{sortinithash}{50c6687d7fc80f50136d75228e3c59ba} + \field{labeltitlesource}{title} + \field{day}{28} + \field{month}{3} + \field{title}{Write a Linux packet sniffer from scratch: part two- BPF} + \field{year}{2022} + \field{dateera}{ce} + \verb{urlraw} + \verb https://organicprogrammer.com/2022/03/28/how-to-implement-libpcap-on-linux-with-raw-socket-part2/ + \endverb + \verb{url} + \verb https://organicprogrammer.com/2022/03/28/how-to-implement-libpcap-on-linux-with-raw-socket-part2/ + \endverb + \endentry + \entry{bpf_bsd_origin_bpf_page7}{article}{} + \name{author}{1}{}{% + {{hash=b74c2671072cf5a1a1400dc035240dfd}{% + family={Steven\bibnamedelima McCanne}, + familyi={S\bibinitperiod\bibinitdelim M\bibinitperiod}, + given={Van\bibnamedelima Jacobson}, + giveni={V\bibinitperiod\bibinitdelim J\bibinitperiod}}}% + } + \list{institution}{1}{% + {Lawrence Berkeley Laboratory}% + } + \strng{namehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{fullhash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{bibnamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authorbibnamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authornamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authorfullhash}{b74c2671072cf5a1a1400dc035240dfd} + \field{extraname}{4} + \field{sortinit}{1} + \field{sortinithash}{50c6687d7fc80f50136d75228e3c59ba} + \field{labelnamesource}{author} + \field{labeltitlesource}{title} + \field{day}{19} + \field{month}{12} + \field{title}{The BSD Packet Filter: A New Architecture for User-level Packet Capture} + \field{year}{1992} + \field{dateera}{ce} + \field{pages}{7} + \range{pages}{1} + \verb{urlraw} + \verb https://www.tcpdump.org/papers/bpf-usenix93.pdf + \endverb + \verb{url} + \verb https://www.tcpdump.org/papers/bpf-usenix93.pdf + \endverb + \endentry + \entry{bpf_bsd_origin_bpf_page8}{article}{} + \name{author}{1}{}{% + {{hash=b74c2671072cf5a1a1400dc035240dfd}{% + family={Steven\bibnamedelima McCanne}, + familyi={S\bibinitperiod\bibinitdelim M\bibinitperiod}, + given={Van\bibnamedelima Jacobson}, + giveni={V\bibinitperiod\bibinitdelim J\bibinitperiod}}}% + } + \list{institution}{1}{% + {Lawrence Berkeley Laboratory}% + } + \strng{namehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{fullhash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{bibnamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authorbibnamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authornamehash}{b74c2671072cf5a1a1400dc035240dfd} + \strng{authorfullhash}{b74c2671072cf5a1a1400dc035240dfd} + \field{extraname}{5} + \field{sortinit}{2} + \field{sortinithash}{ed39bb39cf854d5250e95b1c1f94f4ed} + \field{labelnamesource}{author} + \field{labeltitlesource}{title} + \field{day}{19} + \field{month}{12} + \field{title}{The BSD Packet Filter: A New Architecture for User-level Packet Capture} + \field{year}{1992} + \field{dateera}{ce} + \field{pages}{8} + \range{pages}{1} + \verb{urlraw} + \verb https://www.tcpdump.org/papers/bpf-usenix93.pdf + \endverb + \verb{url} + \verb https://www.tcpdump.org/papers/bpf-usenix93.pdf + \endverb + \endentry \enddatalist \endrefsection \endinput diff --git a/docs/document.bcf b/docs/document.bcf index ffc3f5f..d15f2dc 100644 --- a/docs/document.bcf +++ b/docs/document.bcf @@ -2348,21 +2348,26 @@ bibliography/bibliography.bib - ransomware_pwc - rootkit_ptsecurity - ebpf_linux318 - bvp47_report - bpfdoor_pwc - ebpf_windows - ebpf_android - evil_ebpf - bad_ebpf - ebpf_friends - ebpf_io - bpf_bsd_origin - ebpf_history_opensource - bpf_bsd_origin_bpf_page1 - index_register + ransomware_pwc + rootkit_ptsecurity + ebpf_linux318 + bvp47_report + bpfdoor_pwc + ebpf_windows + ebpf_android + evil_ebpf + bad_ebpf + ebpf_friends + ebpf_io + bpf_bsd_origin + ebpf_history_opensource + bpf_bsd_origin_bpf_page1 + index_register + bpf_bsd_origin_bpf_page5 + bpf_organicprogrammer_analysis + bpf_bsd_origin_bpf_page7 + bpf_bsd_origin_bpf_page8 + bpf_bsd_origin_bpf_page8 diff --git a/docs/document.blg b/docs/document.blg index 9daa27f..4da7df7 100644 --- a/docs/document.blg +++ b/docs/document.blg @@ -1,31 +1,34 @@ [0] Config.pm:311> INFO - This is Biber 2.16 -[1] Config.pm:314> INFO - Logfile is 'document.blg' -[161] biber:340> INFO - === Sun May 22, 2022, 19:16:55 -[193] Biber.pm:415> INFO - Reading 'document.bcf' -[366] Biber.pm:952> INFO - Found 15 citekeys in bib section 0 -[401] Biber.pm:4340> INFO - Processing section 0 -[425] Biber.pm:4531> INFO - Looking for bibtex format file 'bibliography/bibliography.bib' for section 0 -[428] bibtex.pm:1689> INFO - LaTeX decoding ... -[446] bibtex.pm:1494> INFO - Found BibTeX data source 'bibliography/bibliography.bib' -[567] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 9, warning: 1 characters of junk seen at toplevel -[567] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 15, warning: 1 characters of junk seen at toplevel -[567] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 22, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 28, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 35, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 42, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 50, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 58, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 65, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 70, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 77, warning: 1 characters of junk seen at toplevel -[568] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 85, warning: 1 characters of junk seen at toplevel -[569] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 94, warning: 1 characters of junk seen at toplevel -[569] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 100, warning: 1 characters of junk seen at toplevel -[569] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_3ewM/f4d088b3f9f145b5c3058da33afd57d4_107890.utf8, line 105, warning: 1 characters of junk seen at toplevel -[603] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'normalization = NFD' with 'normalization = prenormalized' -[604] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'variable = shifted' with 'variable = non-ignorable' -[604] Biber.pm:4168> INFO - Sorting list 'none/global//global/global' of type 'entry' with template 'none' and locale 'en-US' -[604] Biber.pm:4174> INFO - No sort tailoring available for locale 'en-US' -[629] bbl.pm:654> INFO - Writing 'document.bbl' with encoding 'UTF-8' -[639] bbl.pm:757> INFO - Output to document.bbl -[640] Biber.pm:128> INFO - WARNINGS: 15 +[0] Config.pm:314> INFO - Logfile is 'document.blg' +[57] biber:340> INFO - === Mon May 23, 2022, 05:19:28 +[69] Biber.pm:415> INFO - Reading 'document.bcf' +[138] Biber.pm:952> INFO - Found 19 citekeys in bib section 0 +[152] Biber.pm:4340> INFO - Processing section 0 +[161] Biber.pm:4531> INFO - Looking for bibtex format file 'bibliography/bibliography.bib' for section 0 +[162] bibtex.pm:1689> INFO - LaTeX decoding ... +[171] bibtex.pm:1494> INFO - Found BibTeX data source 'bibliography/bibliography.bib' +[237] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 9, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 15, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 22, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 28, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 35, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 42, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 50, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 58, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 65, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 70, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 77, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 85, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 94, warning: 1 characters of junk seen at toplevel +[238] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 103, warning: 1 characters of junk seen at toplevel +[239] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 112, warning: 1 characters of junk seen at toplevel +[239] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 121, warning: 1 characters of junk seen at toplevel +[239] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 127, warning: 1 characters of junk seen at toplevel +[239] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_HDya/f4d088b3f9f145b5c3058da33afd57d4_111283.utf8, line 132, warning: 1 characters of junk seen at toplevel +[255] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'variable = shifted' with 'variable = non-ignorable' +[255] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'normalization = NFD' with 'normalization = prenormalized' +[255] Biber.pm:4168> INFO - Sorting list 'none/global//global/global' of type 'entry' with template 'none' and locale 'en-US' +[255] Biber.pm:4174> INFO - No sort tailoring available for locale 'en-US' +[268] bbl.pm:654> INFO - Writing 'document.bbl' with encoding 'UTF-8' +[273] bbl.pm:757> INFO - Output to document.bbl +[273] Biber.pm:128> INFO - WARNINGS: 18 diff --git a/docs/document.lof b/docs/document.lof index 72cb9f0..d89092f 100644 --- a/docs/document.lof +++ b/docs/document.lof @@ -7,6 +7,12 @@ \defcounter {refsection}{0}\relax \contentsline {figure}{\numberline {2.1}{\ignorespaces Sketch of the functionality of classic BPF\relax }}{5}{figure.caption.7}% \defcounter {refsection}{0}\relax +\contentsline {figure}{\numberline {2.2}{\ignorespaces Execution of a BPF filter.\relax }}{7}{figure.caption.8}% +\defcounter {refsection}{0}\relax +\contentsline {figure}{\numberline {2.3}{\ignorespaces Table of supported classic BPF instructions, as shown by McCanne and Jacobson\cite {bpf_bsd_origin_bpf_page7}\relax }}{8}{figure.caption.10}% +\defcounter {refsection}{0}\relax +\contentsline {figure}{\numberline {2.4}{\ignorespaces Table explaining the column address modes in Figure\ref {fig:bpf_instructions}, as shown by McCanne and Jacobson\cite {bpf_bsd_origin_bpf_page8}\relax }}{9}{figure.caption.11}% +\defcounter {refsection}{0}\relax \addvspace {10\p@ } \defcounter {refsection}{0}\relax \addvspace {10\p@ } diff --git a/docs/document.log b/docs/document.log index c4bb400..146833a 100644 --- a/docs/document.log +++ b/docs/document.log @@ -1,4 +1,4 @@ -This is pdfTeX, Version 3.14159265-2.6-1.40.21 (TeX Live 2020/Debian) (preloaded format=pdflatex 2022.4.27) 22 MAY 2022 19:56 +This is pdfTeX, Version 3.14159265-2.6-1.40.21 (TeX Live 2020/Debian) (preloaded format=pdflatex 2022.4.27) 23 MAY 2022 06:08 entering extended mode restricted \write18 enabled. %&-line parsing enabled. @@ -1210,47 +1210,61 @@ Overfull \hbox (0.50073pt too wide) in paragraph at lines 355--356 [3] [4] Chapter 2. - + File: images//classic_bpf.jpg Graphic file (type jpg) -Package pdftex.def Info: images//classic_bpf.jpg used on input line 415. +Package pdftex.def Info: images//classic_bpf.jpg used on input line 416. (pdftex.def) Requested size: 341.43306pt x 251.12224pt. [5 - <./images//classic_bpf.jpg>] [6] + <./images//classic_bpf.jpg>] + +File: images//cbpf_prog.jpg Graphic file (type jpg) + +Package pdftex.def Info: images//cbpf_prog.jpg used on input line 439. +(pdftex.def) Requested size: 227.62204pt x 254.80415pt. + [6] [7 <./images/cBPF_prog.jpg>] + +File: images//bpf_instructions.png Graphic file (type png) + +Package pdftex.def Info: images//bpf_instructions.png used on input line 478. +(pdftex.def) Requested size: 227.62204pt x 283.99998pt. + [8 <./images//bpf_instructions.png>] + +File: images//bpf_address_mode.png Graphic file (type png) + +Package pdftex.def Info: images//bpf_address_mode.png used on input line 494. +(pdftex.def) Requested size: 227.62204pt x 171.19905pt. + [9 <./images//bpf_address_mode.png>] Chapter 3. -[7 +[10 ] Chapter 4. -[8 +[11 ] Chapter 5. -[9 +[12 ] -LaTeX Font Info: Trying to load font information for T1+txtt on input line 4 -75. +LaTeX Font Info: Trying to load font information for T1+txtt on input line 5 +41. (/usr/share/texlive/texmf-dist/tex/latex/txfonts/t1txtt.fd File: t1txtt.fd 2000/12/15 v3.1 ) -Overfull \hbox (5.34976pt too wide) in paragraph at lines 476--476 +Overfull \hbox (5.34976pt too wide) in paragraph at lines 542--542 \T1/txtt/m/n/12 threat -[] intelligence / cyber -[] year -[] in -[] retrospect / yir -[] cyber -[] threats -[] [] -[10 +[13 -] [11] [1 +] [14] [1 ] -Package caption Warning: Unused \captionsetup[table] on input line 112. -See the caption package documentation for explanation. - - Package caption Warning: Unused \captionsetup[lstlisting] on input line 164. See the caption package documentation for explanation. @@ -1258,21 +1272,21 @@ pdfTeX warning (ext4): destination with the same identifier (name{page.}) has b een already used, duplicate ignored \relax -l.492 \end{document} +l.558 \end{document} [2 ] (./document.aux) Package rerunfilecheck Info: File `document.out' has not changed. -(rerunfilecheck) Checksum: 71D9F5FA3399DF2DE8ECBC4935021C38;879. +(rerunfilecheck) Checksum: 79836A949AAA92D8359931E3F0756F41;902. Package logreq Info: Writing requests to 'document.run.xml'. \openout1 = `document.run.xml'. ) Here is how much of TeX's memory you used: - 27216 strings out of 481209 - 431808 string characters out of 5914747 - 1168551 words of memory out of 5000000 - 43682 multiletter control sequences out of 15000+600000 + 27260 strings out of 481209 + 433123 string characters out of 5914747 + 1169390 words of memory out of 5000000 + 43712 multiletter control sequences out of 15000+600000 450160 words of font info for 95 fonts, out of 8000000 for 9000 36 hyphenation exceptions out of 8191 88i,11n,90p,1029b,3095s stack positions out of 5000i,500n,10000p,200000b,80000s @@ -1285,9 +1299,9 @@ fb> -Output written on document.pdf (27 pages, 217947 bytes). +Output written on document.pdf (30 pages, 412900 bytes). PDF statistics: - 340 PDF objects out of 1000 (max. 8388607) - 61 named destinations out of 1000 (max. 500000) - 140 words of extra memory for PDF output out of 10000 (max. 10000000) + 395 PDF objects out of 1000 (max. 8388607) + 72 named destinations out of 1000 (max. 500000) + 155 words of extra memory for PDF output out of 10000 (max. 10000000) diff --git a/docs/document.lot b/docs/document.lot index 57549e3..9090e99 100644 --- a/docs/document.lot +++ b/docs/document.lot @@ -5,6 +5,8 @@ \defcounter {refsection}{0}\relax \addvspace {10\p@ } \defcounter {refsection}{0}\relax +\contentsline {table}{\numberline {2.1}{\ignorespaces Table showing BPF instruction format. It is a fixed-length 64 bit instruction, the number of bits used by each field are indicated.\relax }}{7}{table.caption.9}% +\defcounter {refsection}{0}\relax \addvspace {10\p@ } \defcounter {refsection}{0}\relax \addvspace {10\p@ } diff --git a/docs/document.out b/docs/document.out index 754dde7..8c3294d 100644 --- a/docs/document.out +++ b/docs/document.out @@ -7,7 +7,7 @@ \BOOKMARK [1][-]{section.1.4}{Structure\040of\040the\040document}{chapter.1}% 7 \BOOKMARK [0][-]{chapter.2}{State\040of\040the\040art}{}% 8 \BOOKMARK [1][-]{section.2.1}{Introduction\040to\040eBPF}{chapter.2}% 9 -\BOOKMARK [2][-]{subsection.2.1.1}{eBPF\040history}{section.2.1}% 10 +\BOOKMARK [2][-]{subsection.2.1.1}{eBPF\040history\040-\040Classic\040BPF}{section.2.1}% 10 \BOOKMARK [0][-]{chapter.3}{Methods??}{}% 11 \BOOKMARK [0][-]{chapter.4}{Results}{}% 12 \BOOKMARK [0][-]{chapter.5}{Conclusion\040and\040future\040work}{}% 13 diff --git a/docs/document.pdf b/docs/document.pdf index c839b61..cdbeef5 100644 Binary files a/docs/document.pdf and b/docs/document.pdf differ diff --git a/docs/document.synctex.gz b/docs/document.synctex.gz index 77cb3a5..3afe98d 100644 Binary files a/docs/document.synctex.gz and b/docs/document.synctex.gz differ diff --git a/docs/document.tex b/docs/document.tex index 81d2308..b25d4e4 100644 --- a/docs/document.tex +++ b/docs/document.tex @@ -103,7 +103,7 @@ hmargin=3cm \DeclareCaptionFormat{upper}{#1#2\uppercase{#3}\par} \captionsetup[table]{ - format=upper, + %format=upper, UPPER??? Set by the template, but it looks really weird, I got this off justification=centering, labelsep=period, width=.75\linewidth, @@ -404,13 +404,14 @@ This chapter is dedicated to an study of the eBPF technology. Firstly, we will a \section{Introduction to eBPF} % Is it ok to have sections / chapters without individual intros? -\subsection{eBPF history} + +\subsection{eBPF history - Classic BPF} Nowadays eBPF is not officially considered to be an acronym anymore\cite{ebpf_io}, but it remains largely known as "extended Berkeley Packet Filters", given its roots in the Berkeley Packet Filter (BPF) technology, now known as classic BPF. -BPF was introduced in 1992 in the paper "The BSD Packet Filter: A New Architecture for User-level Packet Capture"\cite{bpf_bsd_origin}, as a new filtering technology for network packets in the BSD platform. It was first integrated in the Linux kernel on version 2.1.75\cite{ebpf_history_opensource}. +BPF was introduced in 1992 by Steven McCanne and Van Jacobson in the paper "The BSD Packet Filter: A New Architecture for User-level Packet Capture"\cite{bpf_bsd_origin}, as a new filtering technology for network packets in the BSD platform. It was first integrated in the Linux kernel on version 2.1.75\cite{ebpf_history_opensource}. -\begin{figure}[h] +\begin{figure}[H] \centering \includegraphics[width=12cm, keepaspectratio=true]{classic_bpf.jpg} \caption{Sketch of the functionality of classic BPF} @@ -433,6 +434,71 @@ The components of the BPF VM are used to support running BPF filter programs. A \item If it returns \textit{false}, the packet is not accepted by the filter (and thus the network stack will be the next to operate it). \end{itemize} +\begin{figure}[H] + \centering + \includegraphics[width=8cm]{cbpf_prog.jpg} + \caption{Execution of a BPF filter.} + \label{fig:cbpf_prog} +\end{figure} + +Figure \ref{fig:cbpf_prog} shows an example of a BPF filter upon receiving a packet. In the figure, green lines indicate that the condition is true and red lines that it is evaluated as false. Therefore, the execution works as a control flow graph (CFG) which ends on a boolean value\cite{bpf_bsd_origin_bpf_page5}. The figure presents an example BPF program which accepts the following frames: +\begin{itemize} +\item Frames with an IP packet as a payload directed from IP address X. +\item Frames with an IP packet as a payload directed towards IP address Y. +\item Frames belonging to the ARP protocol and from IP address Y. +\item Frames not from the ARP protocol directed from IP address Y to IP address X. +\end{itemize} + + +In order to implement the CFG to be run at the BPF VM, BPF filter programs are made up of BPF bytecode, which is defined by a new BPF instruction set. Therefore, a BPF filter program is an array of BPF bytecode instructions\cite{bpf_organicprogrammer_analysis}. + + +\begin{table}[H] +\begin{tabular}{|c|c|c|c|c|} +\hline +& OPCODE & JT & JF & K\\ +\hline +BITS & 16 & 8 & 8 & 32\\ +\hline +\end{tabular} +\caption{Table showing BPF instruction format. It is a fixed-length 64 bit instruction, the number of bits used by each field are indicated.} +\label{table:bpf_inst_format} +\end{table} + +Table \ref{table:bpf_inst_format} shows the format of a BPF bytecode instruction. As it can be observed, it is a compound of: +\begin{itemize} +\item An \textbf{opcode}, similar to assembly opcode, it indicates the operation to be executed. +\item Field \textbf{jt} indicates the offset to the next instruction to jump in case a condition is evaluated as \textit{true}. +\item Field \textbf{jf} indicates the offset to the next instruction to jump in case a condition is evaluated as \textit{false}. +\item Field \textbf{k} is miscellaneous and its contents vary depending on the instruction opcode. +\end{itemize} + +\begin{figure}[H] + \centering + \includegraphics[width=8cm]{bpf_instructions.png} + \caption{Table of supported classic BPF instructions, as shown by McCanne and Jacobson\cite{bpf_bsd_origin_bpf_page7}} + \label{fig:bpf_instructions} +\end{figure} + +Figure \ref{fig:bpf_instructions} shows how BPF instructions are defined according to the BPF instruction set. As we mentioned, similarly to assembly, instructions include an opcode which indicates the operation to execute, and the multiple arguments defining the arguments of the operation. The table shows, in order by rows, the following instruction types\cite{bpf_bsd_origin_bpf_page8}: +\begin{itemize} +\item Rows 1-4 are \textbf{load instructions}, copying the addressed value into the index or accumulator register. +\item Rows 4-6 are \textbf{store instructions}, copying the accumulator or index register into the scratch memory store. +\item Rows 7-11 are \textbf{jump instructions}, changing the program counter register. These are usually present on each node of the CFG, and evaluate whether the condition to be evaluated is true or not. +\item Rows 12-19 and 21-22 are \textbf{arithmetic and miscellaneous instructions}, performing operations usually needed during the program execution. +\item Row 20 is a \textbf{return instruction}, it is positioned in the final end of the CFG, and indicate whether the filter accepts the packet (returning true) or otherwise rejects it (return false). +\end{itemize} + +\begin{figure}[H] + \centering + \includegraphics[width=8cm]{bpf_address_mode.png} + \caption{Table explaining the column address modes in Figure\ref{fig:bpf_instructions}, as shown by McCanne and Jacobson\cite{bpf_bsd_origin_bpf_page8}} + \label{fig:bpf_address_mode} +\end{figure} + +The column \textit{addr modes} in figure \ref{fig:bpf_instructions} describes how the parameters of a BPF instruction are referenced depending on the opcode. The address modes are detailed in figure \ref{fig:bpf_address_mode}. As it can be observed, paremeters may consist of immediate values, offsets to memory positions or on the packet, the index register or combinations of the previous. + + diff --git a/docs/document.toc b/docs/document.toc index e9dcd6f..bba4c41 100644 --- a/docs/document.toc +++ b/docs/document.toc @@ -19,13 +19,13 @@ \defcounter {refsection}{0}\relax \contentsline {section}{\numberline {2.1}Introduction to eBPF}{5}{section.2.1}% \defcounter {refsection}{0}\relax -\contentsline {subsection}{\numberline {2.1.1}eBPF history}{5}{subsection.2.1.1}% +\contentsline {subsection}{\numberline {2.1.1}eBPF history - Classic BPF}{5}{subsection.2.1.1}% \defcounter {refsection}{0}\relax -\contentsline {chapter}{\numberline {3}Methods??}{7}{chapter.3}% +\contentsline {chapter}{\numberline {3}Methods??}{10}{chapter.3}% \defcounter {refsection}{0}\relax -\contentsline {chapter}{\numberline {4}Results}{8}{chapter.4}% +\contentsline {chapter}{\numberline {4}Results}{11}{chapter.4}% \defcounter {refsection}{0}\relax -\contentsline {chapter}{\numberline {5}Conclusion and future work}{9}{chapter.5}% +\contentsline {chapter}{\numberline {5}Conclusion and future work}{12}{chapter.5}% \defcounter {refsection}{0}\relax -\contentsline {chapter}{Bibliography}{10}{chapter.5}% +\contentsline {chapter}{Bibliography}{13}{chapter.5}% \contentsfinish diff --git a/docs/images/bpf_address_mode.png b/docs/images/bpf_address_mode.png new file mode 100644 index 0000000..3cc011c Binary files /dev/null and b/docs/images/bpf_address_mode.png differ diff --git a/docs/images/bpf_instructions.png b/docs/images/bpf_instructions.png new file mode 100644 index 0000000..e08d8d3 Binary files /dev/null and b/docs/images/bpf_instructions.png differ diff --git a/docs/images/cBPF_prog.jpg b/docs/images/cBPF_prog.jpg new file mode 100644 index 0000000..acc2434 Binary files /dev/null and b/docs/images/cBPF_prog.jpg differ diff --git a/docs/images/classic_bpf.jpg b/docs/images/classic_bpf.jpg index 5fee0ba..31875be 100644 Binary files a/docs/images/classic_bpf.jpg and b/docs/images/classic_bpf.jpg differ diff --git a/docs/pdfa.xmpi b/docs/pdfa.xmpi index c574751..f1815b4 100644 --- a/docs/pdfa.xmpi +++ b/docs/pdfa.xmpi @@ -73,15 +73,15 @@ LaTeX with hyperref - 2022-05-22T19:56:50-04:00 - 2022-05-22T19:56:50-04:00 - 2022-05-22T19:56:50-04:00 + 2022-05-23T06:08:53-04:00 + 2022-05-23T06:08:53-04:00 + 2022-05-23T06:08:53-04:00 uuid:467B87E0-A1EA-A037-7CB7-0477245DEBC3 - uuid:C8D2E526-372E-864C-1A84-623F24CF0672 + uuid:12416B69-B953-27CD-2DFE-471B56C93388