|
|
@@ -1376,488 +1376,488 @@ static __inline void process_syscall_data_vecs(struct pt_regs* ctx, __u64 id,
|
|
|
/***********************************************************
|
|
|
* BPF syscall probe/tracepoint function entry-points
|
|
|
***********************************************************/
|
|
|
-TPPROG(sys_enter_write) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int fd = (int)ctx->fd;
|
|
|
- char *buf = (char *)ctx->buf;
|
|
|
-
|
|
|
- struct data_args_t write_args = {};
|
|
|
- write_args.source_fn = SYSCALL_FUNC_WRITE;
|
|
|
- write_args.fd = fd;
|
|
|
- write_args.buf = buf;
|
|
|
- write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- active_write_args_map__update(&id, &write_args);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_write/format
|
|
|
-TPPROG(sys_exit_write) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
- // Don't process FD 0-2 to avoid STDIN, STDOUT, STDERR.
|
|
|
- if (write_args != NULL && write_args->fd > 2) {
|
|
|
- write_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
- }
|
|
|
-
|
|
|
- active_write_args_map__delete(&id);
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// ssize_t read(int fd, void *buf, size_t count);
|
|
|
-TPPROG(sys_enter_read) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int fd = (int)ctx->fd;
|
|
|
- char *buf = (char *)ctx->buf;
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t read_args = {};
|
|
|
- read_args.source_fn = SYSCALL_FUNC_READ;
|
|
|
- read_args.fd = fd;
|
|
|
- read_args.buf = buf;
|
|
|
- read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- read_args.tcp_seq = get_tcp_read_seq_from_fd(fd);
|
|
|
- active_read_args_map__update(&id, &read_args);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_read/format
|
|
|
-TPPROG(sys_exit_read) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
- // Don't process FD 0-2 to avoid STDIN, STDOUT, STDERR.
|
|
|
- if (read_args != NULL && read_args->fd > 2) {
|
|
|
- read_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
- }
|
|
|
-
|
|
|
- active_read_args_map__delete(&id);
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
|
|
|
-// const struct sockaddr *dest_addr, socklen_t addrlen);
|
|
|
-TPPROG(sys_enter_sendto) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int sockfd = (int)ctx->fd;
|
|
|
- char *buf = (char *)ctx->buf;
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t write_args = {};
|
|
|
- write_args.source_fn = SYSCALL_FUNC_SENDTO;
|
|
|
- write_args.fd = sockfd;
|
|
|
- write_args.buf = buf;
|
|
|
- write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- active_write_args_map__update(&id, &write_args);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendto/format
|
|
|
-TPPROG(sys_exit_sendto) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
-
|
|
|
- // 潜在的问题:如果sentto() addr是由TCP连接提供的,系统调用可能会忽略它,但我们仍然会跟踪它。在实践中,TCP连接不应该使用带addr参数的sendto()。
|
|
|
- // 在手册页中:
|
|
|
- // 如果sendto()用于连接模式(SOCK_STREAM, SOCK_SEQPACKET)套接字,参数
|
|
|
- // dest_addr和addrlen会被忽略(如果不是,可能会返回EISCONN错误空和0)
|
|
|
- //
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
- if (write_args != NULL) {
|
|
|
- write_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data((struct pt_regs*)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
- active_write_args_map__delete(&id);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// ssize_t recvfrom(int sockfd, void *buf, size_t len, int flags,
|
|
|
-// struct sockaddr *src_addr, socklen_t *addrlen);
|
|
|
-TPPROG(sys_enter_recvfrom) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
- // If flags contains MSG_PEEK, it is returned directly.
|
|
|
- // ref : https://linux.die.net/man/2/recvfrom
|
|
|
- if (ctx->flags & MSG_PEEK)
|
|
|
- return 0;
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int sockfd = (int)ctx->fd;
|
|
|
- char *buf = (char *)ctx->buf;
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t read_args = {};
|
|
|
- read_args.source_fn = SYSCALL_FUNC_RECVFROM;
|
|
|
- read_args.fd = sockfd;
|
|
|
- read_args.buf = buf;
|
|
|
- read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- read_args.tcp_seq = get_tcp_read_seq_from_fd(sockfd);
|
|
|
- active_read_args_map__update(&id, &read_args);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvfrom/format
|
|
|
-TPPROG(sys_exit_recvfrom) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
-
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
- if (read_args != NULL) {
|
|
|
- read_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
- active_read_args_map__delete(&id);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags);
|
|
|
-KPROG(__sys_sendmsg) (struct pt_regs* ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int sockfd = (int)PT_REGS_PARM1(ctx);
|
|
|
- struct user_msghdr *msghdr_ptr = (struct user_msghdr *)PT_REGS_PARM2(ctx);
|
|
|
-
|
|
|
- if (msghdr_ptr != NULL) {
|
|
|
- // Stash arguments.
|
|
|
- struct user_msghdr *msghdr, __msghdr;
|
|
|
- bpf_probe_read(&__msghdr, sizeof(__msghdr), msghdr_ptr);
|
|
|
- msghdr = &__msghdr;
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t write_args = {};
|
|
|
- write_args.source_fn = SYSCALL_FUNC_SENDMSG;
|
|
|
- write_args.fd = sockfd;
|
|
|
- write_args.iov = msghdr->msg_iov;
|
|
|
- write_args.iovlen = msghdr->msg_iovlen;
|
|
|
- write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- active_write_args_map__update(&id, &write_args);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendmsg/format
|
|
|
-TPPROG(sys_exit_sendmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
- if (write_args != NULL) {
|
|
|
- write_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data_vecs((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
- active_write_args_map__delete(&id);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// int sendmmsg(int sockfd, struct mmsghdr *msgvec, unsigned int vlen,
|
|
|
-// int flags);
|
|
|
-KPROG(__sys_sendmmsg)(struct pt_regs* ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int sockfd = (int)PT_REGS_PARM1(ctx);
|
|
|
- struct mmsghdr *msgvec_ptr = (struct mmsghdr *)PT_REGS_PARM2(ctx);
|
|
|
- unsigned int vlen = (unsigned int)PT_REGS_PARM3(ctx);
|
|
|
-
|
|
|
- if (msgvec_ptr != NULL && vlen >= 1) {
|
|
|
- struct mmsghdr *msgvec, __msgvec;
|
|
|
- bpf_probe_read(&__msgvec, sizeof(__msgvec), msgvec_ptr);
|
|
|
- msgvec = &__msgvec;
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t write_args = {};
|
|
|
- write_args.source_fn = SYSCALL_FUNC_SENDMMSG;
|
|
|
- write_args.fd = sockfd;
|
|
|
- write_args.iov = msgvec[0].msg_hdr.msg_iov;
|
|
|
- write_args.iovlen = msgvec[0].msg_hdr.msg_iovlen;
|
|
|
- write_args.msg_len = (void *)msgvec_ptr + offsetof(typeof(struct mmsghdr), msg_len); //&msgvec[0].msg_len;
|
|
|
- write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- active_write_args_map__update(&id, &write_args);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendmmsg/format
|
|
|
-TPPROG(sys_exit_sendmmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
-
|
|
|
- int num_msgs = ctx->ret;
|
|
|
-
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
- if (write_args != NULL && num_msgs > 0) {
|
|
|
- ssize_t bytes_count;
|
|
|
- bpf_probe_read(&bytes_count, sizeof(write_args->msg_len), write_args->msg_len);
|
|
|
- process_syscall_data_vecs((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
- }
|
|
|
- active_write_args_map__delete(&id);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// BSD recvmsg interface
|
|
|
-// long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
|
|
|
-// bool forbid_cmsg_compat)
|
|
|
-// ssize_t recvmsg(int sockfd, struct msghdr *msg, int flags);
|
|
|
-KPROG(__sys_recvmsg) (struct pt_regs* ctx) {
|
|
|
- int flags = (int) PT_REGS_PARM3(ctx);
|
|
|
- if (flags & MSG_PEEK)
|
|
|
- return 0;
|
|
|
-
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- struct user_msghdr __msg, *msghdr = (struct user_msghdr *)PT_REGS_PARM2(ctx);
|
|
|
- int sockfd = (int) PT_REGS_PARM1(ctx);
|
|
|
-
|
|
|
- if (msghdr != NULL) {
|
|
|
- bpf_probe_read(&__msg, sizeof(__msg), (void *)msghdr);
|
|
|
- msghdr = &__msg;
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t read_args = {};
|
|
|
- read_args.source_fn = SYSCALL_FUNC_RECVMSG;
|
|
|
- read_args.fd = sockfd;
|
|
|
- read_args.iov = msghdr->msg_iov;
|
|
|
- read_args.iovlen = msghdr->msg_iovlen;
|
|
|
- read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- read_args.tcp_seq = get_tcp_read_seq_from_fd(sockfd);
|
|
|
- active_read_args_map__update(&id, &read_args);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvmsg/format
|
|
|
-TPPROG(sys_exit_recvmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
- if (read_args != NULL) {
|
|
|
- read_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data_vecs((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
- active_read_args_map__delete(&id);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
|
|
|
-// unsigned int flags, struct timespec *timeout)
|
|
|
-KPROG(__sys_recvmmsg) (struct pt_regs* ctx) {
|
|
|
- int flags = (int) PT_REGS_PARM4(ctx);
|
|
|
- if (flags & MSG_PEEK)
|
|
|
- return 0;
|
|
|
-
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int sockfd = (int)PT_REGS_PARM1(ctx);
|
|
|
- struct mmsghdr *msgvec = (struct mmsghdr *)PT_REGS_PARM2(ctx);
|
|
|
- unsigned int vlen = (unsigned int)PT_REGS_PARM3(ctx);
|
|
|
-
|
|
|
- if (msgvec != NULL && vlen >= 1) {
|
|
|
- int offset;
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t read_args = {};
|
|
|
- read_args.source_fn = SYSCALL_FUNC_RECVMMSG;
|
|
|
- read_args.fd = sockfd;
|
|
|
- read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
-
|
|
|
- offset = offsetof(typeof(struct mmsghdr), msg_hdr) +
|
|
|
- offsetof(typeof(struct user_msghdr), msg_iov);
|
|
|
-
|
|
|
- bpf_probe_read(&read_args.iov, sizeof(read_args.iov), (void *)msgvec + offset);
|
|
|
-
|
|
|
- offset = offsetof(typeof(struct mmsghdr), msg_hdr) +
|
|
|
- offsetof(typeof(struct user_msghdr), msg_iovlen);
|
|
|
-
|
|
|
- bpf_probe_read(&read_args.iovlen, sizeof(read_args.iovlen), (void *)msgvec + offset);
|
|
|
-
|
|
|
- read_args.msg_len = (void *)msgvec + offsetof(typeof(struct mmsghdr), msg_len);
|
|
|
- read_args.tcp_seq = get_tcp_read_seq_from_fd(sockfd);
|
|
|
- active_read_args_map__update(&id, &read_args);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvmmsg/format
|
|
|
-TPPROG(sys_exit_recvmmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int num_msgs = ctx->ret;
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
- if (read_args != NULL && num_msgs > 0) {
|
|
|
- ssize_t bytes_count;
|
|
|
- bpf_probe_read(&bytes_count, sizeof(read_args->msg_len), read_args->msg_len);
|
|
|
- process_syscall_data_vecs((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
- }
|
|
|
- active_read_args_map__delete(&id);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-//static ssize_t do_writev(unsigned long fd, const struct iovec __user *vec,
|
|
|
-// unsigned long vlen, rwf_t flags)
|
|
|
-// ssize_t writev(int fd, const struct iovec *iov, int iovcnt);
|
|
|
-KPROG(do_writev) (struct pt_regs* ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int fd = (int)PT_REGS_PARM1(ctx);
|
|
|
- struct iovec *iov = (struct iovec *)PT_REGS_PARM2(ctx);
|
|
|
- int iovlen = (int)PT_REGS_PARM3(ctx);
|
|
|
-
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t write_args = {};
|
|
|
- write_args.source_fn = SYSCALL_FUNC_WRITEV;
|
|
|
- write_args.fd = fd;
|
|
|
- write_args.iov = iov;
|
|
|
- write_args.iovlen = iovlen;
|
|
|
- write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- active_write_args_map__update(&id, &write_args);
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_writev/format
|
|
|
-TPPROG(sys_exit_writev) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
-
|
|
|
- // Unstash arguments, and process syscall.
|
|
|
- struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
- if (write_args != NULL) {
|
|
|
- write_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data_vecs((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
- }
|
|
|
-
|
|
|
- active_write_args_map__delete(&id);
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// ssize_t readv(int fd, const struct iovec *iov, int iovcnt);
|
|
|
-KPROG(do_readv) (struct pt_regs* ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- int fd = (int)PT_REGS_PARM1(ctx);
|
|
|
- struct iovec *iov = (struct iovec *)PT_REGS_PARM2(ctx);
|
|
|
- int iovlen = (int)PT_REGS_PARM3(ctx);
|
|
|
-
|
|
|
- // Stash arguments.
|
|
|
- struct data_args_t read_args = {};
|
|
|
- read_args.source_fn = SYSCALL_FUNC_READV;
|
|
|
- read_args.fd = fd;
|
|
|
- read_args.iov = iov;
|
|
|
- read_args.iovlen = iovlen;
|
|
|
- read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
- read_args.tcp_seq = get_tcp_read_seq_from_fd(fd);
|
|
|
- active_read_args_map__update(&id, &read_args);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_readv/format
|
|
|
-TPPROG(sys_exit_readv) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- ssize_t bytes_count = ctx->ret;
|
|
|
- struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
- if (read_args != NULL) {
|
|
|
- read_args->bytes_count = bytes_count;
|
|
|
- process_syscall_data_vecs((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
- }
|
|
|
-
|
|
|
- active_read_args_map__delete(&id);
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_enter_close/format
|
|
|
-// 为什么不用tcp_fin? 主要原因要考虑UDP场景。
|
|
|
-TPPROG(sys_enter_close) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
- int fd = ctx->fd;
|
|
|
- //Ignore stdin, stdout and stderr
|
|
|
- if (fd <= 2)
|
|
|
- return 0;
|
|
|
-
|
|
|
- __u32 k0 = 0;
|
|
|
- struct member_fields_offset *offset = members_offset__lookup(&k0);
|
|
|
- if (!offset)
|
|
|
- return 0;
|
|
|
-
|
|
|
- CHECK_OFFSET_READY(fd);
|
|
|
-
|
|
|
- __u64 sock_addr = (__u64)get_socket_from_fd(fd, offset);
|
|
|
- if (sock_addr) {
|
|
|
- __u64 conn_key = gen_conn_key_id(bpf_get_current_pid_tgid() >> 32, (__u64)fd);
|
|
|
- struct socket_info_t *socket_info_ptr = socket_info_map__lookup(&conn_key);
|
|
|
- if (socket_info_ptr != NULL)
|
|
|
- delete_socket_info(conn_key, socket_info_ptr);
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_enter_getppid
|
|
|
-// 此处tracepoint用于周期性的将驻留在缓存中还未发送的数据发给用户态接收程序处理。
|
|
|
-TPPROG(sys_enter_getppid) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
- int k0 = 0;
|
|
|
- struct __socket_data_buffer *v_buff = bpf_map_lookup_elem(&NAME(data_buf), &k0);
|
|
|
- if (v_buff) {
|
|
|
- if (v_buff->events_num > 0) {
|
|
|
- struct __socket_data *v = (struct __socket_data *)&v_buff->data[0];
|
|
|
- if ((bpf_ktime_get_ns() - v->timestamp * NS_PER_US) > NS_PER_SEC) {
|
|
|
- __u32 buf_size = (v_buff->len +
|
|
|
- offsetof(typeof(struct __socket_data_buffer), data))
|
|
|
- & (sizeof(*v_buff) - 1);
|
|
|
- if (buf_size >= sizeof(*v_buff))
|
|
|
- bpf_perf_event_output(ctx, &NAME(socket_data),
|
|
|
- BPF_F_CURRENT_CPU, v_buff,
|
|
|
- sizeof(*v_buff));
|
|
|
- else
|
|
|
- /* 使用'buf_size + 1'代替'buf_size',来规避(Linux 4.14.x)长度检查 */
|
|
|
- bpf_perf_event_output(ctx, &NAME(socket_data),
|
|
|
- BPF_F_CURRENT_CPU, v_buff,
|
|
|
- buf_size + 1);
|
|
|
-
|
|
|
- v_buff->events_num = 0;
|
|
|
- v_buff->len = 0;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-// /sys/kernel/debug/tracing/events/syscalls/sys_exit_socket/format
|
|
|
-TPPROG(sys_exit_socket) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
- __u64 fd = (__u64)ctx->ret;
|
|
|
- char comm[TASK_COMM_LEN];
|
|
|
- bpf_get_current_comm(comm, sizeof(comm));
|
|
|
-
|
|
|
- // 试用于nginx负载均衡场景
|
|
|
- if (!(comm[0] == 'n' && comm[1] == 'g' && comm[2] == 'i' &&
|
|
|
- comm[3] == 'n' && comm[4] == 'x' && comm[5] == '\0'))
|
|
|
- return 0;
|
|
|
-
|
|
|
- // nginx is not a go process, disable go tracking
|
|
|
- struct trace_key_t key = get_trace_key(0, true);
|
|
|
- struct trace_info_t *trace = trace_map__lookup(&key);
|
|
|
- if (trace && trace->peer_fd != 0 && trace->peer_fd != (__u32)fd) {
|
|
|
- struct socket_info_t sk_info = { 0 };
|
|
|
- sk_info.peer_fd = trace->peer_fd;
|
|
|
- sk_info.trace_id = trace->thread_trace_id;
|
|
|
- __u64 conn_key = gen_conn_key_id(id >> 32, fd);
|
|
|
- int ret = socket_info_map__update(&conn_key, &sk_info);
|
|
|
- __u32 k0 = 0;
|
|
|
- struct trace_stats *trace_stats = trace_stats_map__lookup(&k0);
|
|
|
- if (trace_stats == NULL)
|
|
|
- return 0;
|
|
|
- if (ret == 0) {
|
|
|
- __sync_fetch_and_add(&trace_stats->
|
|
|
- socket_map_count, 1);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
+//TPPROG(sys_enter_write) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int fd = (int)ctx->fd;
|
|
|
+// char *buf = (char *)ctx->buf;
|
|
|
+//
|
|
|
+// struct data_args_t write_args = {};
|
|
|
+// write_args.source_fn = SYSCALL_FUNC_WRITE;
|
|
|
+// write_args.fd = fd;
|
|
|
+// write_args.buf = buf;
|
|
|
+// write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// active_write_args_map__update(&id, &write_args);
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_write/format
|
|
|
+//TPPROG(sys_exit_write) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
+// // Don't process FD 0-2 to avoid STDIN, STDOUT, STDERR.
|
|
|
+// if (write_args != NULL && write_args->fd > 2) {
|
|
|
+// write_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
+// }
|
|
|
+//
|
|
|
+// active_write_args_map__delete(&id);
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// ssize_t read(int fd, void *buf, size_t count);
|
|
|
+//TPPROG(sys_enter_read) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int fd = (int)ctx->fd;
|
|
|
+// char *buf = (char *)ctx->buf;
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t read_args = {};
|
|
|
+// read_args.source_fn = SYSCALL_FUNC_READ;
|
|
|
+// read_args.fd = fd;
|
|
|
+// read_args.buf = buf;
|
|
|
+// read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// read_args.tcp_seq = get_tcp_read_seq_from_fd(fd);
|
|
|
+// active_read_args_map__update(&id, &read_args);
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_read/format
|
|
|
+//TPPROG(sys_exit_read) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
+// // Don't process FD 0-2 to avoid STDIN, STDOUT, STDERR.
|
|
|
+// if (read_args != NULL && read_args->fd > 2) {
|
|
|
+// read_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
+// }
|
|
|
+//
|
|
|
+// active_read_args_map__delete(&id);
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
|
|
|
+//// const struct sockaddr *dest_addr, socklen_t addrlen);
|
|
|
+//TPPROG(sys_enter_sendto) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int sockfd = (int)ctx->fd;
|
|
|
+// char *buf = (char *)ctx->buf;
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t write_args = {};
|
|
|
+// write_args.source_fn = SYSCALL_FUNC_SENDTO;
|
|
|
+// write_args.fd = sockfd;
|
|
|
+// write_args.buf = buf;
|
|
|
+// write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// active_write_args_map__update(&id, &write_args);
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendto/format
|
|
|
+//TPPROG(sys_exit_sendto) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+//
|
|
|
+// // 潜在的问题:如果sentto() addr是由TCP连接提供的,系统调用可能会忽略它,但我们仍然会跟踪它。在实践中,TCP连接不应该使用带addr参数的sendto()。
|
|
|
+// // 在手册页中:
|
|
|
+// // 如果sendto()用于连接模式(SOCK_STREAM, SOCK_SEQPACKET)套接字,参数
|
|
|
+// // dest_addr和addrlen会被忽略(如果不是,可能会返回EISCONN错误空和0)
|
|
|
+// //
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
+// if (write_args != NULL) {
|
|
|
+// write_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data((struct pt_regs*)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
+// active_write_args_map__delete(&id);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// ssize_t recvfrom(int sockfd, void *buf, size_t len, int flags,
|
|
|
+//// struct sockaddr *src_addr, socklen_t *addrlen);
|
|
|
+//TPPROG(sys_enter_recvfrom) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
+// // If flags contains MSG_PEEK, it is returned directly.
|
|
|
+// // ref : https://linux.die.net/man/2/recvfrom
|
|
|
+// if (ctx->flags & MSG_PEEK)
|
|
|
+// return 0;
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int sockfd = (int)ctx->fd;
|
|
|
+// char *buf = (char *)ctx->buf;
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t read_args = {};
|
|
|
+// read_args.source_fn = SYSCALL_FUNC_RECVFROM;
|
|
|
+// read_args.fd = sockfd;
|
|
|
+// read_args.buf = buf;
|
|
|
+// read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// read_args.tcp_seq = get_tcp_read_seq_from_fd(sockfd);
|
|
|
+// active_read_args_map__update(&id, &read_args);
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvfrom/format
|
|
|
+//TPPROG(sys_exit_recvfrom) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+//
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
+// if (read_args != NULL) {
|
|
|
+// read_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
+// active_read_args_map__delete(&id);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags);
|
|
|
+//KPROG(__sys_sendmsg) (struct pt_regs* ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int sockfd = (int)PT_REGS_PARM1(ctx);
|
|
|
+// struct user_msghdr *msghdr_ptr = (struct user_msghdr *)PT_REGS_PARM2(ctx);
|
|
|
+//
|
|
|
+// if (msghdr_ptr != NULL) {
|
|
|
+// // Stash arguments.
|
|
|
+// struct user_msghdr *msghdr, __msghdr;
|
|
|
+// bpf_probe_read(&__msghdr, sizeof(__msghdr), msghdr_ptr);
|
|
|
+// msghdr = &__msghdr;
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t write_args = {};
|
|
|
+// write_args.source_fn = SYSCALL_FUNC_SENDMSG;
|
|
|
+// write_args.fd = sockfd;
|
|
|
+// write_args.iov = msghdr->msg_iov;
|
|
|
+// write_args.iovlen = msghdr->msg_iovlen;
|
|
|
+// write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// active_write_args_map__update(&id, &write_args);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendmsg/format
|
|
|
+//TPPROG(sys_exit_sendmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
+// if (write_args != NULL) {
|
|
|
+// write_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data_vecs((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
+// active_write_args_map__delete(&id);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// int sendmmsg(int sockfd, struct mmsghdr *msgvec, unsigned int vlen,
|
|
|
+//// int flags);
|
|
|
+//KPROG(__sys_sendmmsg)(struct pt_regs* ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int sockfd = (int)PT_REGS_PARM1(ctx);
|
|
|
+// struct mmsghdr *msgvec_ptr = (struct mmsghdr *)PT_REGS_PARM2(ctx);
|
|
|
+// unsigned int vlen = (unsigned int)PT_REGS_PARM3(ctx);
|
|
|
+//
|
|
|
+// if (msgvec_ptr != NULL && vlen >= 1) {
|
|
|
+// struct mmsghdr *msgvec, __msgvec;
|
|
|
+// bpf_probe_read(&__msgvec, sizeof(__msgvec), msgvec_ptr);
|
|
|
+// msgvec = &__msgvec;
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t write_args = {};
|
|
|
+// write_args.source_fn = SYSCALL_FUNC_SENDMMSG;
|
|
|
+// write_args.fd = sockfd;
|
|
|
+// write_args.iov = msgvec[0].msg_hdr.msg_iov;
|
|
|
+// write_args.iovlen = msgvec[0].msg_hdr.msg_iovlen;
|
|
|
+// write_args.msg_len = (void *)msgvec_ptr + offsetof(typeof(struct mmsghdr), msg_len); //&msgvec[0].msg_len;
|
|
|
+// write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// active_write_args_map__update(&id, &write_args);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendmmsg/format
|
|
|
+//TPPROG(sys_exit_sendmmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+//
|
|
|
+// int num_msgs = ctx->ret;
|
|
|
+//
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
+// if (write_args != NULL && num_msgs > 0) {
|
|
|
+// ssize_t bytes_count;
|
|
|
+// bpf_probe_read(&bytes_count, sizeof(write_args->msg_len), write_args->msg_len);
|
|
|
+// process_syscall_data_vecs((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
+// }
|
|
|
+// active_write_args_map__delete(&id);
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// BSD recvmsg interface
|
|
|
+//// long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
|
|
|
+//// bool forbid_cmsg_compat)
|
|
|
+//// ssize_t recvmsg(int sockfd, struct msghdr *msg, int flags);
|
|
|
+//KPROG(__sys_recvmsg) (struct pt_regs* ctx) {
|
|
|
+// int flags = (int) PT_REGS_PARM3(ctx);
|
|
|
+// if (flags & MSG_PEEK)
|
|
|
+// return 0;
|
|
|
+//
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// struct user_msghdr __msg, *msghdr = (struct user_msghdr *)PT_REGS_PARM2(ctx);
|
|
|
+// int sockfd = (int) PT_REGS_PARM1(ctx);
|
|
|
+//
|
|
|
+// if (msghdr != NULL) {
|
|
|
+// bpf_probe_read(&__msg, sizeof(__msg), (void *)msghdr);
|
|
|
+// msghdr = &__msg;
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t read_args = {};
|
|
|
+// read_args.source_fn = SYSCALL_FUNC_RECVMSG;
|
|
|
+// read_args.fd = sockfd;
|
|
|
+// read_args.iov = msghdr->msg_iov;
|
|
|
+// read_args.iovlen = msghdr->msg_iovlen;
|
|
|
+// read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// read_args.tcp_seq = get_tcp_read_seq_from_fd(sockfd);
|
|
|
+// active_read_args_map__update(&id, &read_args);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvmsg/format
|
|
|
+//TPPROG(sys_exit_recvmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
+// if (read_args != NULL) {
|
|
|
+// read_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data_vecs((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
+// active_read_args_map__delete(&id);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
|
|
|
+//// unsigned int flags, struct timespec *timeout)
|
|
|
+//KPROG(__sys_recvmmsg) (struct pt_regs* ctx) {
|
|
|
+// int flags = (int) PT_REGS_PARM4(ctx);
|
|
|
+// if (flags & MSG_PEEK)
|
|
|
+// return 0;
|
|
|
+//
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int sockfd = (int)PT_REGS_PARM1(ctx);
|
|
|
+// struct mmsghdr *msgvec = (struct mmsghdr *)PT_REGS_PARM2(ctx);
|
|
|
+// unsigned int vlen = (unsigned int)PT_REGS_PARM3(ctx);
|
|
|
+//
|
|
|
+// if (msgvec != NULL && vlen >= 1) {
|
|
|
+// int offset;
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t read_args = {};
|
|
|
+// read_args.source_fn = SYSCALL_FUNC_RECVMMSG;
|
|
|
+// read_args.fd = sockfd;
|
|
|
+// read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+//
|
|
|
+// offset = offsetof(typeof(struct mmsghdr), msg_hdr) +
|
|
|
+// offsetof(typeof(struct user_msghdr), msg_iov);
|
|
|
+//
|
|
|
+// bpf_probe_read(&read_args.iov, sizeof(read_args.iov), (void *)msgvec + offset);
|
|
|
+//
|
|
|
+// offset = offsetof(typeof(struct mmsghdr), msg_hdr) +
|
|
|
+// offsetof(typeof(struct user_msghdr), msg_iovlen);
|
|
|
+//
|
|
|
+// bpf_probe_read(&read_args.iovlen, sizeof(read_args.iovlen), (void *)msgvec + offset);
|
|
|
+//
|
|
|
+// read_args.msg_len = (void *)msgvec + offsetof(typeof(struct mmsghdr), msg_len);
|
|
|
+// read_args.tcp_seq = get_tcp_read_seq_from_fd(sockfd);
|
|
|
+// active_read_args_map__update(&id, &read_args);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvmmsg/format
|
|
|
+//TPPROG(sys_exit_recvmmsg) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int num_msgs = ctx->ret;
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
+// if (read_args != NULL && num_msgs > 0) {
|
|
|
+// ssize_t bytes_count;
|
|
|
+// bpf_probe_read(&bytes_count, sizeof(read_args->msg_len), read_args->msg_len);
|
|
|
+// process_syscall_data_vecs((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
+// }
|
|
|
+// active_read_args_map__delete(&id);
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+////static ssize_t do_writev(unsigned long fd, const struct iovec __user *vec,
|
|
|
+//// unsigned long vlen, rwf_t flags)
|
|
|
+//// ssize_t writev(int fd, const struct iovec *iov, int iovcnt);
|
|
|
+//KPROG(do_writev) (struct pt_regs* ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int fd = (int)PT_REGS_PARM1(ctx);
|
|
|
+// struct iovec *iov = (struct iovec *)PT_REGS_PARM2(ctx);
|
|
|
+// int iovlen = (int)PT_REGS_PARM3(ctx);
|
|
|
+//
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t write_args = {};
|
|
|
+// write_args.source_fn = SYSCALL_FUNC_WRITEV;
|
|
|
+// write_args.fd = fd;
|
|
|
+// write_args.iov = iov;
|
|
|
+// write_args.iovlen = iovlen;
|
|
|
+// write_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// active_write_args_map__update(&id, &write_args);
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_writev/format
|
|
|
+//TPPROG(sys_exit_writev) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+//
|
|
|
+// // Unstash arguments, and process syscall.
|
|
|
+// struct data_args_t* write_args = active_write_args_map__lookup(&id);
|
|
|
+// if (write_args != NULL) {
|
|
|
+// write_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data_vecs((struct pt_regs *)ctx, id, T_EGRESS, write_args, bytes_count);
|
|
|
+// }
|
|
|
+//
|
|
|
+// active_write_args_map__delete(&id);
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// ssize_t readv(int fd, const struct iovec *iov, int iovcnt);
|
|
|
+//KPROG(do_readv) (struct pt_regs* ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// int fd = (int)PT_REGS_PARM1(ctx);
|
|
|
+// struct iovec *iov = (struct iovec *)PT_REGS_PARM2(ctx);
|
|
|
+// int iovlen = (int)PT_REGS_PARM3(ctx);
|
|
|
+//
|
|
|
+// // Stash arguments.
|
|
|
+// struct data_args_t read_args = {};
|
|
|
+// read_args.source_fn = SYSCALL_FUNC_READV;
|
|
|
+// read_args.fd = fd;
|
|
|
+// read_args.iov = iov;
|
|
|
+// read_args.iovlen = iovlen;
|
|
|
+// read_args.enter_ts = bpf_ktime_get_ns();
|
|
|
+// read_args.tcp_seq = get_tcp_read_seq_from_fd(fd);
|
|
|
+// active_read_args_map__update(&id, &read_args);
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_readv/format
|
|
|
+//TPPROG(sys_exit_readv) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// ssize_t bytes_count = ctx->ret;
|
|
|
+// struct data_args_t* read_args = active_read_args_map__lookup(&id);
|
|
|
+// if (read_args != NULL) {
|
|
|
+// read_args->bytes_count = bytes_count;
|
|
|
+// process_syscall_data_vecs((struct pt_regs *)ctx, id, T_INGRESS, read_args, bytes_count);
|
|
|
+// }
|
|
|
+//
|
|
|
+// active_read_args_map__delete(&id);
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_enter_close/format
|
|
|
+//// 为什么不用tcp_fin? 主要原因要考虑UDP场景。
|
|
|
+//TPPROG(sys_enter_close) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
+// int fd = ctx->fd;
|
|
|
+// //Ignore stdin, stdout and stderr
|
|
|
+// if (fd <= 2)
|
|
|
+// return 0;
|
|
|
+//
|
|
|
+// __u32 k0 = 0;
|
|
|
+// struct member_fields_offset *offset = members_offset__lookup(&k0);
|
|
|
+// if (!offset)
|
|
|
+// return 0;
|
|
|
+//
|
|
|
+// CHECK_OFFSET_READY(fd);
|
|
|
+//
|
|
|
+// __u64 sock_addr = (__u64)get_socket_from_fd(fd, offset);
|
|
|
+// if (sock_addr) {
|
|
|
+// __u64 conn_key = gen_conn_key_id(bpf_get_current_pid_tgid() >> 32, (__u64)fd);
|
|
|
+// struct socket_info_t *socket_info_ptr = socket_info_map__lookup(&conn_key);
|
|
|
+// if (socket_info_ptr != NULL)
|
|
|
+// delete_socket_info(conn_key, socket_info_ptr);
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_enter_getppid
|
|
|
+//// 此处tracepoint用于周期性的将驻留在缓存中还未发送的数据发给用户态接收程序处理。
|
|
|
+//TPPROG(sys_enter_getppid) (struct syscall_comm_enter_ctx *ctx) {
|
|
|
+// int k0 = 0;
|
|
|
+// struct __socket_data_buffer *v_buff = bpf_map_lookup_elem(&NAME(data_buf), &k0);
|
|
|
+// if (v_buff) {
|
|
|
+// if (v_buff->events_num > 0) {
|
|
|
+// struct __socket_data *v = (struct __socket_data *)&v_buff->data[0];
|
|
|
+// if ((bpf_ktime_get_ns() - v->timestamp * NS_PER_US) > NS_PER_SEC) {
|
|
|
+// __u32 buf_size = (v_buff->len +
|
|
|
+// offsetof(typeof(struct __socket_data_buffer), data))
|
|
|
+// & (sizeof(*v_buff) - 1);
|
|
|
+// if (buf_size >= sizeof(*v_buff))
|
|
|
+// bpf_perf_event_output(ctx, &NAME(socket_data),
|
|
|
+// BPF_F_CURRENT_CPU, v_buff,
|
|
|
+// sizeof(*v_buff));
|
|
|
+// else
|
|
|
+// /* 使用'buf_size + 1'代替'buf_size',来规避(Linux 4.14.x)长度检查 */
|
|
|
+// bpf_perf_event_output(ctx, &NAME(socket_data),
|
|
|
+// BPF_F_CURRENT_CPU, v_buff,
|
|
|
+// buf_size + 1);
|
|
|
+//
|
|
|
+// v_buff->events_num = 0;
|
|
|
+// v_buff->len = 0;
|
|
|
+// }
|
|
|
+// }
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
+//
|
|
|
+//// /sys/kernel/debug/tracing/events/syscalls/sys_exit_socket/format
|
|
|
+//TPPROG(sys_exit_socket) (struct syscall_comm_exit_ctx *ctx) {
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+// __u64 fd = (__u64)ctx->ret;
|
|
|
+// char comm[TASK_COMM_LEN];
|
|
|
+// bpf_get_current_comm(comm, sizeof(comm));
|
|
|
+//
|
|
|
+// // 试用于nginx负载均衡场景
|
|
|
+// if (!(comm[0] == 'n' && comm[1] == 'g' && comm[2] == 'i' &&
|
|
|
+// comm[3] == 'n' && comm[4] == 'x' && comm[5] == '\0'))
|
|
|
+// return 0;
|
|
|
+//
|
|
|
+// // nginx is not a go process, disable go tracking
|
|
|
+// struct trace_key_t key = get_trace_key(0, true);
|
|
|
+// struct trace_info_t *trace = trace_map__lookup(&key);
|
|
|
+// if (trace && trace->peer_fd != 0 && trace->peer_fd != (__u32)fd) {
|
|
|
+// struct socket_info_t sk_info = { 0 };
|
|
|
+// sk_info.peer_fd = trace->peer_fd;
|
|
|
+// sk_info.trace_id = trace->thread_trace_id;
|
|
|
+// __u64 conn_key = gen_conn_key_id(id >> 32, fd);
|
|
|
+// int ret = socket_info_map__update(&conn_key, &sk_info);
|
|
|
+// __u32 k0 = 0;
|
|
|
+// struct trace_stats *trace_stats = trace_stats_map__lookup(&k0);
|
|
|
+// if (trace_stats == NULL)
|
|
|
+// return 0;
|
|
|
+// if (ret == 0) {
|
|
|
+// __sync_fetch_and_add(&trace_stats->
|
|
|
+// socket_map_count, 1);
|
|
|
+// }
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
|
|
|
// Store IO event information
|
|
|
MAP_PERARRAY(io_event_buffer, __u32, struct __io_event_buffer, 1)
|
|
|
@@ -1967,14 +1967,14 @@ static __inline int output_data_common(void *ctx) {
|
|
|
debug("DataSeq: %llu", v->data_seq);
|
|
|
debug("DataType: %u", v->data_type);
|
|
|
debug("DataLen: %u", v->data_len);
|
|
|
- debug("data: %s", v->data);
|
|
|
+// debug("data: %s", v->data);
|
|
|
// for (size_t i = 0; i < v->data_len; ++i) {
|
|
|
// debug("%02x ", (unsigned char)v->data[i]);
|
|
|
// if ((i + 1) % 16 == 0) {
|
|
|
// debug("\n");
|
|
|
// }
|
|
|
// }
|
|
|
- debug("=======================end");
|
|
|
+ debug("=======================end\n");
|
|
|
|
|
|
v_buff->len += offsetof(typeof(struct __socket_data), data) + v->data_len;
|
|
|
v_buff->events_num++;
|
|
|
@@ -2201,29 +2201,29 @@ static __inline void trace_io_event_common(void *ctx,
|
|
|
PROG_OUTPUT_DATA_TP_IDX);
|
|
|
return;
|
|
|
}
|
|
|
-
|
|
|
-PROGTP(io_event)(void *ctx)
|
|
|
-{
|
|
|
- __u64 id = bpf_get_current_pid_tgid();
|
|
|
-
|
|
|
- struct data_args_t *data_args = NULL;
|
|
|
-
|
|
|
- data_args = active_read_args_map__lookup(&id);
|
|
|
- if (data_args) {
|
|
|
- trace_io_event_common(ctx, data_args, T_INGRESS, id);
|
|
|
- active_read_args_map__delete(&id);
|
|
|
- return 0;
|
|
|
- }
|
|
|
-
|
|
|
- data_args = active_write_args_map__lookup(&id);
|
|
|
- if (data_args) {
|
|
|
- trace_io_event_common(ctx, data_args, T_EGRESS, id);
|
|
|
- active_write_args_map__delete(&id);
|
|
|
- return 0;
|
|
|
- }
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
+//
|
|
|
+//PROGTP(io_event)(void *ctx)
|
|
|
+//{
|
|
|
+// __u64 id = bpf_get_current_pid_tgid();
|
|
|
+//
|
|
|
+// struct data_args_t *data_args = NULL;
|
|
|
+//
|
|
|
+// data_args = active_read_args_map__lookup(&id);
|
|
|
+// if (data_args) {
|
|
|
+// trace_io_event_common(ctx, data_args, T_INGRESS, id);
|
|
|
+// active_read_args_map__delete(&id);
|
|
|
+// return 0;
|
|
|
+// }
|
|
|
+//
|
|
|
+// data_args = active_write_args_map__lookup(&id);
|
|
|
+// if (data_args) {
|
|
|
+// trace_io_event_common(ctx, data_args, T_EGRESS, id);
|
|
|
+// active_write_args_map__delete(&id);
|
|
|
+// return 0;
|
|
|
+// }
|
|
|
+//
|
|
|
+// return 0;
|
|
|
+//}
|
|
|
|
|
|
//Refer to the eBPF programs here
|
|
|
//#include "go_tls_bpf.c"
|