Slide 1
Slide 1 text
ٱถഅ(.01FQBCP
*OD
,JYTWPM-5NJO
F#1'ೖ
Slide 2
Slide 2 text
(.0ϖύϘΠϯϑϥΤϯδχΞ
ٱถഅ!UBLVNBLVNF
ϗεςΟϯάࣄۀ෦
IUUQTUBLVNBLVNFUFDI
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
Έͳ͞Μ#1'ͯ͠·͔͢ʁ
Slide 5
Slide 5 text
#1'JT
#FSLFMFZ1BDLFU'JMUFS
-JOVYLFSOFMʹ࣮͞Ε͍ͯΔ
ύέοτͷΩϟϓνϟϑΟϧλΛߦ͏ͨΊͷ
ΠϯλʔϑΣΠε
Slide 6
Slide 6 text
UDQEVNQ
Slide 7
Slide 7 text
UDQEVNQ
~$ sudo tcpdump port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:27:12.580101 IP 192.168.0.18.61285 > archlinux.vagrant.vm.http: Flags
[S], seq 1854919014, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS
val 844367687 ecr 0,sackOK,eol], length 0
:
:
ຖୟ͍͍ͯΔ͍ͭͷͭͰ͢Ͷ
Slide 8
Slide 8 text
UDQEVNQ
#1'
Slide 9
Slide 9 text
#1'
/*$
5$14UBDL
UDQEVNQ
VTFS
LFSOFM
LFSOFM
OFUXPSL
Slide 10
Slide 10 text
#1'
/*$
5$14UBDL
UDQEVNQ
tcpdump port 80
VTFS
LFSOFM
LFSOFM
OFUXPSL
Slide 11
Slide 11 text
#1'
/*$
5$14UBDL
UDQEVNQ
tcpdump port 80
VTFS
LFSOFM
LFSOFM
OFUXPSL
#1'
CZUFDPEF
UDQEVNQ
#1'༻ʹϓϩάϥϜΛ
ίϯύΠϧͯ͠LFSOFM
Ͱ࣮ߦ͢Δ
Slide 12
Slide 12 text
#1'
/*$
5$14UBDL
UDQEVNQ
tcpdump port 80
OHJOY
VTFS
LFSOFM
LFSOFM
OFUXPSL
#1'
130(
UDQEVNQ
#1'༻ʹϓϩάϥϜΛ
ίϯύΠϧͯ͠LFSOFM
Ͱ࣮ߦ͢Δ
$ sudo tcpdump -d 'port 80'
(000) ldh [12]
(001) jeq #0x86dd jt 2 jf 10
(002) ldb [20]
(003) jeq #0x84 jt 6 jf 4
(004) jeq #0x6 jt 6 jf 5
(005) jeq #0x11 jt 6 jf 23
(006) ldh [54]
:
BPF Assembler
Slide 13
Slide 13 text
#1'
/*$
5$14UBDL
UDQEVNQ
tcpdump port 80
OHJOY
VTFS
LFSOFM
LFSOFM
OFUXPSL
#1'
130(
UDQEVNQ
#1'༻ʹϓϩάϥϜΛ
ίϯύΠϧͯ͠LFSOFM
Ͱ࣮ߦ͢Δ
~$ sudo tcpdump -dd 'port 80'
{ 0x28, 0, 0, 0x0000000c },
{ 0x15, 0, 8, 0x000086dd },
{ 0x30, 0, 0, 0x00000014 },
{ 0x15, 2, 0, 0x00000084 },
{ 0x15, 1, 0, 0x00000006 },
{ 0x15, 0, 17, 0x00000011 },
{ 0x28, 0, 0, 0x00000036 },
{ 0x15, 14, 0, 0x00000050 },
:
BPF Bytecode
Slide 14
Slide 14 text
#1'
/*$
5$14UBDL
UDQEVNQ
tcpdump port 80
VTFS
LFSOFM
LFSOFM
OFUXPSL
5$1QPSU
#1'
CZUFDPEF
Slide 15
Slide 15 text
#1'
/*$
5$14UBDL
UDQEVNQ
tcpdump port 80
VTFS
LFSOFM
LFSOFM
OFUXPSL
UFSNJOBM
දࣔ
5$1QPSU
#1'
CZUFDPEF
Slide 16
Slide 16 text
#1'JT
#FSLFMFZ1BDLFU'JMUFS
-JOVYLFSOFMʹ࣮͞Ε͍ͯΔ
ύέοτͷΩϟϓνϟϑΟϧλΛߦ͏ͨΊͷ
ΠϯλʔϑΣΠε
6TFSMBOEͰ࡞ͨ͠#1'#ZUFDPEFΛ
,FSOFMMBOEͰ࣮ߦ͢Δ
ύέοτΩϟϓνϟҎ֎ͷ༻్ʹΘΕ͍ͯΔ
Slide 17
Slide 17 text
TFDDPNQ
Slide 18
Slide 18 text
TFDDPNQ
ࢦఆͨ͠TZTUFNDBMMΛ࣮ߦͰ͖ͳ͍Α͏ʹ͢Δ
-JOVYLFSOFMͷػೳ
͜͜Ͱ͍͏TFDDPNQ-JOVYLFSOFMҎ߱ͷ
TFDDPNQNPEFΛࢦ͢
TFDDPNQNPEFɺϑΟϧλϦϯάʹ#1'͕
ΘΕ͓ͯΒͣɺॊೈੑ͕ͳ͍ػೳͩͬͨ
Slide 19
Slide 19 text
#1'
ϓϩάϥϜ
VTFS
LFSOFM
LFSOFM
Slide 20
Slide 20 text
#1'
ϓϩάϥϜ
VTFS
LFSOFM
LFSOFM
࣮ߦ
Slide 21
Slide 21 text
#1'
ϓϩάϥϜ
VTFS
LFSOFM
TFDDPNQ
࣮ߦ
LFSOFM
࣮ߦ
ྫͱͯ͠XSJUF
Λ੍ݶ͢Δ
Slide 22
Slide 22 text
#1'
ϓϩάϥϜ
VTFS
LFSOFM
TFDDPNQ
࣮ߦ
LFSOFM
࣮ߦ
͜ͷϓϩηεͰXSJUF
͕࣮ߦͰ͖ͳ͘ͳΔ
#1'༻ʹϓϩάϥϜΛ
ίϯύΠϧͯ͠
LFSOFMͰ࣮ߦ͢Δ
#1'
CZUFDPEF
ྫͱͯ͠XSJUF
Λ੍ݶ͢Δ
Slide 23
Slide 23 text
#1'
ϓϩάϥϜ
VTFS
LFSOFM
TFDDPNQ
࣮ߦ
LFSOFM
࣮ߦ
PQFO
࣮ߦ
ڐՄ
#1'
CZUFDPEF
ྫͱͯ͠XSJUF
Λ੍ݶ͢Δ
Slide 24
Slide 24 text
#1'
ϓϩάϥϜ
VTFS
LFSOFM
TFDDPNQ
࣮ߦ
LFSOFM
࣮ߦ
PQFO
࣮ߦ
XSJUF
࣮ߦ
#1'
CZUFDPEF
ڋ൱
Slide 25
Slide 25 text
Έͳ͞Μ#1'ָ͍͠Ͱ͔͢ʁ
Slide 26
Slide 26 text
ָ͍͠Ͱ͢Ͷʁ
Slide 27
Slide 27 text
F#1'ೖ
Slide 28
Slide 28 text
F#1'
&YUFOEFE#1'
Slide 29
Slide 29 text
F#1'
-JOVYLFSOFMҎ߱Ͱ࣮͞Ε͍ͯΔ
#1'ͷ֦ு࣮
VQSPCFTVTFSMFWFMEZOBNJDUSBDJOH
LQSPCFTLFSOFMEZOBNJDUSBDJOH
9%1F9QSFTT%BUB1BUI
ύέοτΛ,FSOFMͷ/FUXPSL4UBDLʹ
͞ΕΔલͷυϥΠόϨϕϧͰ੍ޚͰ͖Δ
FUD
Slide 30
Slide 30 text
IUUQTHJUIVCDPNUPSWBMETMJOVYCMPCWJODMVEFUSBDFFWFOUTCQGI
Slide 31
Slide 31 text
IUUQTHJUIVCDPNUPSWBMETMJOVYCMPCWJODMVEFUSBDFFWFOUTCQGI
Slide 32
Slide 32 text
F#1'ͷͬ͘͟Γͱͨ͠Έ
Slide 33
Slide 33 text
LQSPCFTF#1'
,FSOFMEZOBNJDUSBDJOH
Slide 34
Slide 34 text
LQSPCFT
LFSOFM
໋ྩ
໋ྩ
໋ྩ
໋ྩ
ϒϨʔΫϙΠϯτ
LQSPCFT
NPEVMF
ೖ
TBWFDPOUFYU
SFTUPSFDPOUFYU
࣮ߦ͍ͨ͠ॲཧ
KNQ
LFSOFMʹϒϨʔΫϙΠϯτΛઃఆ͠ϓϩάϥϜΛ࣮ߦͰ͖Δػೳ
Slide 35
Slide 35 text
VTFS
LFSOFM
ϓϩάϥϜ
F#1'
LQSPCFT
LQSPCFTF#1'
Slide 36
Slide 36 text
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
ੜ
LQSPCFT
LQSPCFTF#1'
Slide 37
Slide 37 text
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
LQSPCFT
LQSPCFTF#1'
Slide 38
Slide 38 text
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
LQSPCFT
ϓϩάϥϜͷ҆શੑ
ΛνΣοΫ
LQSPCFTF#1'
Slide 39
Slide 39 text
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF
LQSPCFT
LQSPCFTF#1'
Slide 40
Slide 40 text
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
ੜ
6TFS,FSOFMؒͰσʔλͷΓऔΓΛ͢Δ
)BTI
"SSBZ
FUDʜ
LQSPCFT
LQSPCFTF#1'
Slide 41
Slide 41 text
LQSPCFTF#1'
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
USBDJOH
ॻ͖ࠐΈ
ࢀর
LQSPCFT
Slide 42
Slide 42 text
LQSPCFTF#1'
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
USBDJOH
ॻ͖ࠐΈ
ࢀর
LQSPCFT
F#1'WFSJpFSʹΑͬͯ
҆શʹίʔυΛ࣮ߦͰ͖Δʂ
Slide 43
Slide 43 text
LQSPCFTF#1'
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
USBDJOH
ॻ͖ࠐΈ
ࢀর
LQSPCFT
F#1'NBQʹΑͬͯ
6TFSTQBDFͱ,FSOFMͰಈత
ʹσʔλΛڞ༗Ͱ͖Δʂ
Slide 44
Slide 44 text
LQSPCFTF#1'
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
USBDJOH
ॻ͖ࠐΈ
ࢀর
LQSPCFT
Կͷཱͪ·͔͢ʁ
Slide 45
Slide 45 text
LQSPCFTF#1'
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
USBDJOH
ॻ͖ࠐΈ
ࢀর
LQSPCFT
.FNPSZBMMPDBUJPOΛτϨʔε
ͯ͠ɺ.FNPSZMFBLΛ୳͢
Slide 46
Slide 46 text
LQSPCFTF#1'
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
USBDJOH
ॻ͖ࠐΈ
ࢀর
LQSPCFT
'JMFTZTUFNΛτϨʔεͯ͠
ϑΝΠϧͷPQFO
SFBE
XSJUF
ͳͲʹ͔͔Δ࣌ؒΛܭଌͯ͠
ϘτϧωοΫΛ୳͢
Slide 47
Slide 47 text
LQSPCFTF#1'
VTFS
LFSOFM
ϓϩάϥϜ
#1'CZUFDPEF
F#1'
WFSJpFS
ੜ
MPBE
#1'CZUFDPEF NBQ
USBDJOH
ॻ͖ࠐΈ
ࢀর
LQSPCFT
00.LJMMFSΛτϨʔε͠
ͦͷॠؒͷͱ͋ΔϓϩάϥϜͷ
UBTL@TUSVDUߏମͷதΛ
μϯϓͯ͠ݪҼΛ୳͢
Slide 48
Slide 48 text
9%1
F9QSFTT%BUB1BUI
ύέοτΛ,FSOFMͷ/FUXPSL4UBDL
ʹ͞ΕΔલͷυϥΠόϨϕϧͰ੍ޚͰ͖Δ
Slide 49
Slide 49 text
JQUBCMFT
/*$
%SJWFS
"QQMJDBUJPO
OFUpMUFS
%301
"$$&15
VTFS
LFSOFM
JQUBCMFT
/FUXPSL4UBDL
Slide 50
Slide 50 text
JQUBCMFTXJUI#1'
/*$
%SJWFS
/FUXPSL4UBDL
"QQMJDBUJPO
"$$&15
VTFS
LFSOFM
JQUBCMFT
D#1'
%301 CZUFDPEF
Slide 51
Slide 51 text
9%1
/*$
%SJWFS
/FUXPSL4UBDL
"QQMJDBUJPO
"$$&15
VTFS
LFSOFM
9%11SPH
%301 F#1' CZUFDPEF
Slide 52
Slide 52 text
9%1
/*$
%SJWFS
/FUXPSL4UBDL
"QQMJDBUJPO
VTFS
LFSOFM
9%1
%301
"$$&15
ωοτϫʔΫυϥΠόϨϕϧͰ
ύέοτͷૢ࡞͕Ͱ͖Δʂ
ରԠ͍ͯ͠ΔωοτϫʔΫυϥΠόҎԼΛࢀর
IUUQTHJUIVCDPNJPWJTPSCDDCMPCNBTUFSEPDTLFSOFMWFSTJPOTNEYEQ
Slide 53
Slide 53 text
9%1
/*$
%SJWFS
/FUXPSL4UBDL
"QQMJDBUJPO
VTFS
LFSOFM
9%1
%301
"$$&15
Slide 54
Slide 54 text
9%1
/*$
%SJWFS
/FUXPSL4UBDL
"QQMJDBUJPO
VTFS
LFSOFM
9%1
%301
"$$&15
%%P4ରࡦ
ηΩϡϦςΟରࡦ
-# ຊͰࣄྫ͋Γ
Slide 55
Slide 55 text
ເ͕͕Γ·͢Ͷʁ
Slide 56
Slide 56 text
·ͱΊ
#1'6TFSTQBDFͰ࡞ͨ͠#ZUFDPEFΛ
,FSOFMͰ࣮ߦ͢Δࣄ͕Ͱ͖Δɻ
D#1'ύέοτγεςϜίʔϧΛϑΟϧλ
Ϧϯά͢Δ͜ͱ͕Ͱ͖Δɻ
F#1'LQSPCFVQSPCFΛར༻ͨ͠τϨʔε
9%1ͷΑ͏ͳ%SJWFSϨϕϧͷߴͳύέο
τૢ࡞͕Ͱ͖Δɻଞʹػೳ͕͋Δɻ
7FSJpFSʹΑΓ҆શʹίʔυΛ࣮ߦͰ͖Δɻ
.BQʹΑΓಈతʹσʔλͷΓऔΓ͕Ͱ͖Δɻ
Slide 57
Slide 57 text
དྷ͍͖ͬͯ·͠ΐ͏ʂ
Slide 58
Slide 58 text
͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ