File docs/pre1.tex changed (mode: 100644) (index 19fc9fe..4532234) |
38 |
38 |
\item A log collection tool (future). |
\item A log collection tool (future). |
39 |
39 |
\item An alerting tool for certificate imminent expiration and security issues alerting. |
\item An alerting tool for certificate imminent expiration and security issues alerting. |
40 |
40 |
\item A tool for live patching of applications (log4j etc.) (future). |
\item A tool for live patching of applications (log4j etc.) (future). |
41 |
|
\item License is AGPL, the most developer and user friendly possible. |
|
|
41 |
|
\item It is free software (license is AGPL, the most developer and user friendly possible). |
42 |
42 |
\end{itemize} |
\end{itemize} |
43 |
43 |
\end{block} |
\end{block} |
44 |
44 |
\end{frame} |
\end{frame} |
|
72 |
72 |
\item It uses shared memory as a ring buffer to pass information to the tracer. |
\item It uses shared memory as a ring buffer to pass information to the tracer. |
73 |
73 |
\item The biggest cost is copying from memory to memory (negligible). |
\item The biggest cost is copying from memory to memory (negligible). |
74 |
74 |
\item It does not block if the ring is full. |
\item It does not block if the ring is full. |
75 |
|
\item It uses a small amount of memory compared with other products. |
|
|
75 |
|
\item It uses a small amount of memory compared with other solutions. |
76 |
76 |
\end{itemize} |
\end{itemize} |
77 |
77 |
\end{block} |
\end{block} |
78 |
78 |
\end{frame} |
\end{frame} |
|
95 |
95 |
|
|
96 |
96 |
\begin{frame}[fragile]{VMs/baremetal installation and usage} |
\begin{frame}[fragile]{VMs/baremetal installation and usage} |
97 |
97 |
\begin{block}{Fedora/RedHat/Alma/Rocky} |
\begin{block}{Fedora/RedHat/Alma/Rocky} |
98 |
|
\tiny |
|
|
98 |
|
\small |
99 |
99 |
\begin{verbatim} |
\begin{verbatim} |
100 |
|
# Installing RocketGit repository (so you will get updates automatically) |
|
101 |
|
dnf install https://rocketgit.com/op/pkgrepo/main/global/testing/fedora/37/x86_64/os/rocketgit-global-testing-1.1-1.noarch.rpm |
|
|
100 |
|
# Installing RocketGit repository (you will get updates) |
|
101 |
|
dnf install https://rocketgit.com/op/pkgrepo/main/global |
|
102 |
|
/testing/fedora/37/x86_64/os |
|
103 |
|
/rocketgit-global-testing-1.1-1.noarch.rpm |
102 |
104 |
# Installing package |
# Installing package |
103 |
105 |
dnf install catalinux+ninedogs |
dnf install catalinux+ninedogs |
104 |
106 |
\end{verbatim} |
\end{verbatim} |
|
... |
... |
TODO |
113 |
115 |
|
|
114 |
116 |
\begin{frame}[fragile]{Container installation and usage} |
\begin{frame}[fragile]{Container installation and usage} |
115 |
117 |
\begin{block}{Dockerfile} |
\begin{block}{Dockerfile} |
116 |
|
\tiny |
|
|
118 |
|
\small |
117 |
119 |
\begin{verbatim} |
\begin{verbatim} |
118 |
120 |
FROM fedora:37 |
FROM fedora:37 |
119 |
121 |
[...] |
[...] |
120 |
122 |
RUN dnf -y --setopt=tsflags=nodocs install \ |
RUN dnf -y --setopt=tsflags=nodocs install \ |
121 |
|
https://rocketgit.com/op/pkgrepo/main/global/testing/fedora/37/x86_64/os/rocketgit-global-testing-1.1-1.noarch.rpm \ |
|
|
123 |
|
https://rocketgit.com/op/pkgrepo/main/global/testing/fedora/37 |
|
124 |
|
/x86_64/os/rocketgit-global-testing-1.1-1.noarch.rpm \ |
122 |
125 |
&& dnf -y --setopt=tsflags=nodocs install catalinux+ninedogs \ |
&& dnf -y --setopt=tsflags=nodocs install catalinux+ninedogs \ |
123 |
126 |
&& dnf -y clean all |
&& dnf -y clean all |
124 |
127 |
\end{verbatim} |
\end{verbatim} |
|
... |
... |
connect(5, {sa_family=AF_INET, sin_port=htons(3306), sin_addr=inet_addr("x.x.x.x |
162 |
165 |
= -1 EINPROGRESS (Operation now in progress) |
= -1 EINPROGRESS (Operation now in progress) |
163 |
166 |
poll([{fd=5, events=POLLIN|POLLOUT|POLLERR|POLLHUP}], 1, 60000) = 1 ([{fd=5, revents=POLLOUT}]) |
poll([{fd=5, events=POLLIN|POLLOUT|POLLERR|POLLHUP}], 1, 60000) = 1 ([{fd=5, revents=POLLOUT}]) |
164 |
167 |
getsockopt(5, SOL_SOCKET, SO_ERROR, [0], [4]) = 0 |
getsockopt(5, SOL_SOCKET, SO_ERROR, [0], [4]) = 0 |
165 |
|
fcntl(5, F_SETFL, O_RDWR) = 0 |
|
166 |
|
setsockopt(5, SOL_TCP, TCP_NODELAY, [1], 4) = 0 |
|
|
168 |
|
fcntl(5, F_SETFL, O_RDWR) = 0 setsockopt(5, SOL_TCP, TCP_NODELAY, [1], 4) = 0 |
167 |
169 |
setsockopt(5, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0 |
setsockopt(5, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0 |
168 |
170 |
poll([{fd=5, events=POLLIN|POLLERR|POLLHUP}], 1, 86400000) = 1 ([{fd=5, revents=POLLIN}]) |
poll([{fd=5, events=POLLIN|POLLERR|POLLHUP}], 1, 86400000) = 1 ([{fd=5, revents=POLLIN}]) |
169 |
171 |
recvfrom(5, "Y\0\0\0\n5.5.5-10.5.16-MariaDB...", 32768, MSG_DONTWAIT, NULL, NULL) = 93 |
recvfrom(5, "Y\0\0\0\n5.5.5-10.5.16-MariaDB...", 32768, MSG_DONTWAIT, NULL, NULL) = 93 |
|
... |
... |
recvfrom(5, "\7\0\0\2\0\0\0\2\0\0\0", 32768, MSG_DONTWAIT, NULL, NULL) = 11 |
177 |
179 |
\begin{verbatim} |
\begin{verbatim} |
178 |
180 |
mysqli_real_connect(link=0x7ffba947f190, 'host=h1 user=ninedogs port=3306 db=ninedogs socket=', |
mysqli_real_connect(link=0x7ffba947f190, 'host=h1 user=ninedogs port=3306 db=ninedogs socket=', |
179 |
181 |
flags='0x20|COMPRESS') |
flags='0x20|COMPRESS') |
180 |
|
[strace like output (connect/poll/recvfrom/sendto etc.) omitted] |
|
181 |
182 |
mysqli_real_connect(link=0x7ffba947f190, 'host=h1 user=ninedogs port=3306 db=ninedogs socket=', |
mysqli_real_connect(link=0x7ffba947f190, 'host=h1 user=ninedogs port=3306 db=ninedogs socket=', |
182 |
183 |
flags='0x20|COMPRESS') = ok |
flags='0x20|COMPRESS') = ok |
183 |
184 |
\end{verbatim} |
\end{verbatim} |
|
... |
... |
mysqli_real_connect(link=0x7ffba947f190, 'host=h1 user=ninedogs port=3306 db=nin |
187 |
188 |
|
|
188 |
189 |
\begin{frame}[fragile]{PostgreSQL query} |
\begin{frame}[fragile]{PostgreSQL query} |
189 |
190 |
\begin{block}{PHP code} |
\begin{block}{PHP code} |
190 |
|
\tiny |
|
|
191 |
|
\small |
191 |
192 |
\begin{verbatim} |
\begin{verbatim} |
192 |
|
$sql = 'SELECT id FROM n1 WHERE id = $1 OR id = $2 OR d = $3 OR a1 = $4 OR a1 = $5'; |
|
|
193 |
|
$sql = 'SELECT id FROM n1 WHERE id = $1 OR id = $2 |
|
194 |
|
OR d = $3 OR a1 = $4 OR a1 = $5'; |
193 |
195 |
$params = array(3, '4', 1.2, NULL, FALSE); |
$params = array(3, '4', 1.2, NULL, FALSE); |
194 |
196 |
$res = pg_query_params($db, $sql, $params); |
$res = pg_query_params($db, $sql, $params); |
195 |
197 |
\end{verbatim} |
\end{verbatim} |
|
... |
... |
pg_query_params(h=0x7fb55be6a4d0, 'SELECT id FROM n1 WHERE id = $1 OR id = $2 OR |
216 |
218 |
|
|
217 |
219 |
\begin{frame}[fragile]{MySQL query} |
\begin{frame}[fragile]{MySQL query} |
218 |
220 |
\begin{block}{PHP code} |
\begin{block}{PHP code} |
219 |
|
\tiny |
|
|
221 |
|
\small |
220 |
222 |
\begin{verbatim} |
\begin{verbatim} |
221 |
223 |
$stmt = mysqli_stmt_init($db); |
$stmt = mysqli_stmt_init($db); |
222 |
|
$sql = 'SELECT id, a1 FROM n1 WHERE id = ? OR id = ? OR d = ? OR a1 = ? OR a1 = ?'; |
|
|
224 |
|
$sql = 'SELECT id, a1 FROM n1 WHERE id = ? OR id = ? OR d = ? |
|
225 |
|
OR a1 = ? OR a1 = ?'; |
223 |
226 |
mysqli_stmt_prepare($stmt, $sql); |
mysqli_stmt_prepare($stmt, $sql); |
224 |
227 |
mysqli_stmt_execute($stmt, array('1', '2', '3', '4', 5)); |
mysqli_stmt_execute($stmt, array('1', '2', '3', '4', 5)); |
225 |
228 |
\end{verbatim} |
\end{verbatim} |
|
... |
... |
close(20) |
306 |
309 |
\end{verbatim} |
\end{verbatim} |
307 |
310 |
\end{block} |
\end{block} |
308 |
311 |
\begin{block}{nd-trace} |
\begin{block}{nd-trace} |
309 |
|
\tiny |
|
|
312 |
|
\small |
310 |
313 |
\begin{verbatim} |
\begin{verbatim} |
311 |
314 |
gethostbyname_r('bla.com.com.com') |
gethostbyname_r('bla.com.com.com') |
312 |
|
gethostbyname_r('bla2.com.com.com') => name=[bla2.com.com.com] aliases={} addrs={45.33.20.235, 173.255.194.134} |
|
|
315 |
|
gethostbyname_r('bla2.com.com.com') => name=[bla2.com.com.com] |
|
316 |
|
aliases={} addrs={45.33.20.235, 173.255.194.134} |
313 |
317 |
\end{verbatim} |
\end{verbatim} |
314 |
318 |
\end{block} |
\end{block} |
315 |
319 |
\end{frame} |
\end{frame} |
|
... |
... |
Segmentation fault (core dumped) |
327 |
331 |
\end{verbatim} |
\end{verbatim} |
328 |
332 |
\end{block} |
\end{block} |
329 |
333 |
\begin{block}{nd-trace} |
\begin{block}{nd-trace} |
330 |
|
\tiny |
|
|
334 |
|
\small |
331 |
335 |
\begin{verbatim} |
\begin{verbatim} |
332 |
336 |
-segv: ../../agent/ninedogs.so(+0x11032) [0x7fc0f524a032] |
-segv: ../../agent/ninedogs.so(+0x11032) [0x7fc0f524a032] |
333 |
337 |
/lib64/libc.so.6(+0x3ea30) [0x7fc0f503ea30] |
/lib64/libc.so.6(+0x3ea30) [0x7fc0f503ea30] |
|
... |
... |
Segmentation fault (core dumped) |
340 |
344 |
\end{frame} |
\end{frame} |
341 |
345 |
|
|
342 |
346 |
|
|
|
347 |
|
\subsection{Demo} |
|
348 |
|
|
|
349 |
|
\begin{frame}[fragile]{Entering a container and do a trace} |
|
350 |
|
We assume that a container named c1 is already runing and it has |
|
351 |
|
the ninedogs tools installed and that a program is already running with |
|
352 |
|
\verb|LD_PRELOAD=ninedogs|. |
|
353 |
|
\small |
|
354 |
|
\begin{verbatim} |
|
355 |
|
$ docker exec -it c1 /bin/bash # enter container |
|
356 |
|
$ nd-trace -o my_trace_file.nd -p 1 |
|
357 |
|
Saving output to [my_trace_file.nd] |
|
358 |
|
1: shm_open returned 4 |
|
359 |
|
1: Attached |
|
360 |
|
16692xxxxx.054 1 getrandom(buf, 1, 0x1) |
|
361 |
|
16692xxxxx.054 1 getrandom('48', 1, 0x1) = 1 |
|
362 |
|
[...] |
|
363 |
|
16692xxxxx.792 1 pg_query(h=0x7f6d23803160, 'SELECT * FROM n1') |
|
364 |
|
= 0x7f6d23865158 [2 rows, 2 aff] |
|
365 |
|
[...] |
|
366 |
|
16692xxxxx.835 1 dlclose(0x55fbbadb82a0) = 0 |
|
367 |
|
16692xxxxx.526 1 -stop() = 0 |
|
368 |
|
\end{verbatim} |
|
369 |
|
\end{frame} |
|
370 |
|
|
|
371 |
|
|
343 |
372 |
\section{Misc} |
\section{Misc} |
344 |
373 |
|
|
345 |
374 |
\subsection{What is coming next?} |
\subsection{What is coming next?} |
|
... |
... |
Segmentation fault (core dumped) |
355 |
384 |
|
|
356 |
385 |
\begin{frame} |
\begin{frame} |
357 |
386 |
\center |
\center |
358 |
|
Thank you! |
|
|
387 |
|
\textbf{Thank you!} |
359 |
388 |
|
|
|
389 |
|
\vspace{2ex} |
360 |
390 |
Contact: ninedogs@embedromix.ro |
Contact: ninedogs@embedromix.ro |
361 |
391 |
|
|
|
392 |
|
\vspace{2ex} |
362 |
393 |
Download/history/artifacts: \href{https://rocketgit.com/user/catalinux/ninedogs}{https://rocketgit.com/user/catalinux/ninedogs} |
Download/history/artifacts: \href{https://rocketgit.com/user/catalinux/ninedogs}{https://rocketgit.com/user/catalinux/ninedogs} |
363 |
394 |
|
|
|
395 |
|
\vspace{2ex} |
364 |
396 |
We need sponsors, please contact us if you want to become one. |
We need sponsors, please contact us if you want to become one. |
365 |
397 |
\end{frame} |
\end{frame} |
366 |
398 |
|
|