| #!/usr/bin/python |
| # @lint-avoid-python-3-compatibility-imports |
| # |
| # tcpaccept Trace TCP accept()s. |
| # For Linux, uses BCC, eBPF. Embedded C. |
| # |
| # USAGE: tcpaccept [-h] [-t] [-p PID] |
| # |
| # This uses dynamic tracing of the kernel inet_csk_accept() socket function |
| # (from tcp_prot.accept), and will need to be modified to match kernel changes. |
| # |
| # Copyright (c) 2015 Brendan Gregg. |
| # Licensed under the Apache License, Version 2.0 (the "License") |
| # |
| # 13-Oct-2015 Brendan Gregg Created this. |
| # 14-Feb-2016 " " Switch to bpf_perf_output. |
| |
| from __future__ import print_function |
| from bcc import BPF |
| from socket import inet_ntop, AF_INET, AF_INET6 |
| from struct import pack |
| import argparse |
| import ctypes as ct |
| |
| # arguments |
| examples = """examples: |
| ./tcpaccept # trace all TCP accept()s |
| ./tcpaccept -t # include timestamps |
| ./tcpaccept -p 181 # only trace PID 181 |
| """ |
| parser = argparse.ArgumentParser( |
| description="Trace TCP accepts", |
| formatter_class=argparse.RawDescriptionHelpFormatter, |
| epilog=examples) |
| parser.add_argument("-t", "--timestamp", action="store_true", |
| help="include timestamp on output") |
| parser.add_argument("-p", "--pid", |
| help="trace this PID only") |
| parser.add_argument("--ebpf", action="store_true", |
| help=argparse.SUPPRESS) |
| args = parser.parse_args() |
| debug = 0 |
| |
| # define BPF program |
| bpf_text = """ |
| #include <uapi/linux/ptrace.h> |
| #include <net/sock.h> |
| #include <bcc/proto.h> |
| |
| // separate data structs for ipv4 and ipv6 |
| struct ipv4_data_t { |
| // XXX: switch some to u32's when supported |
| u64 ts_us; |
| u64 pid; |
| u64 saddr; |
| u64 daddr; |
| u64 ip; |
| u64 lport; |
| char task[TASK_COMM_LEN]; |
| }; |
| BPF_PERF_OUTPUT(ipv4_events); |
| |
| struct ipv6_data_t { |
| u64 ts_us; |
| u64 pid; |
| unsigned __int128 saddr; |
| unsigned __int128 daddr; |
| u64 ip; |
| u64 lport; |
| char task[TASK_COMM_LEN]; |
| }; |
| BPF_PERF_OUTPUT(ipv6_events); |
| |
| int kretprobe__inet_csk_accept(struct pt_regs *ctx) |
| { |
| struct sock *newsk = (struct sock *)PT_REGS_RC(ctx); |
| u32 pid = bpf_get_current_pid_tgid(); |
| |
| if (newsk == NULL) |
| return 0; |
| |
| // check this is TCP |
| u8 protocol = 0; |
| // workaround for reading the sk_protocol bitfield: |
| |
| // Following comments add by Joe Yin: |
| // Unfortunately,it can not work since Linux 4.10, |
| // because the sk_wmem_queued is not following the bitfield of sk_protocol. |
| // And the following member is sk_gso_max_segs. |
| // So, we can use this: |
| // bpf_probe_read(&protocol, 1, (void *)((u64)&newsk->sk_gso_max_segs) - 3); |
| // In order to diff the pre-4.10 and 4.10+ ,introduce the variables gso_max_segs_offset,sk_lingertime, |
| // sk_lingertime is closed to the gso_max_segs_offset,and |
| // the offset between the two members is 4 |
| |
| int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs); |
| int sk_lingertime_offset = offsetof(struct sock, sk_lingertime); |
| |
| if (sk_lingertime_offset - gso_max_segs_offset == 4) |
| // 4.10+ with little endian |
| #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ |
| bpf_probe_read(&protocol, 1, (void *)((u64)&newsk->sk_gso_max_segs) - 3); |
| else |
| // pre-4.10 with little endian |
| bpf_probe_read(&protocol, 1, (void *)((u64)&newsk->sk_wmem_queued) - 3); |
| #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ |
| // 4.10+ with big endian |
| bpf_probe_read(&protocol, 1, (void *)((u64)&newsk->sk_gso_max_segs) - 1); |
| else |
| // pre-4.10 with big endian |
| bpf_probe_read(&protocol, 1, (void *)((u64)&newsk->sk_wmem_queued) - 1); |
| #else |
| # error "Fix your compiler's __BYTE_ORDER__?!" |
| #endif |
| |
| if (protocol != IPPROTO_TCP) |
| return 0; |
| |
| // pull in details |
| u16 family = 0, lport = 0; |
| family = newsk->__sk_common.skc_family; |
| lport = newsk->__sk_common.skc_num; |
| |
| if (family == AF_INET) { |
| struct ipv4_data_t data4 = {.pid = pid, .ip = 4}; |
| data4.ts_us = bpf_ktime_get_ns() / 1000; |
| data4.saddr = newsk->__sk_common.skc_rcv_saddr; |
| data4.daddr = newsk->__sk_common.skc_daddr; |
| data4.lport = lport; |
| bpf_get_current_comm(&data4.task, sizeof(data4.task)); |
| ipv4_events.perf_submit(ctx, &data4, sizeof(data4)); |
| |
| } else if (family == AF_INET6) { |
| struct ipv6_data_t data6 = {.pid = pid, .ip = 6}; |
| data6.ts_us = bpf_ktime_get_ns() / 1000; |
| bpf_probe_read(&data6.saddr, sizeof(data6.saddr), |
| &newsk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
| bpf_probe_read(&data6.daddr, sizeof(data6.daddr), |
| &newsk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
| data6.lport = lport; |
| bpf_get_current_comm(&data6.task, sizeof(data6.task)); |
| ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); |
| } |
| // else drop |
| |
| return 0; |
| } |
| """ |
| |
| # code substitutions |
| if args.pid: |
| bpf_text = bpf_text.replace('FILTER', |
| 'if (pid != %s) { return 0; }' % args.pid) |
| else: |
| bpf_text = bpf_text.replace('FILTER', '') |
| if debug or args.ebpf: |
| print(bpf_text) |
| if args.ebpf: |
| exit() |
| |
| # event data |
| TASK_COMM_LEN = 16 # linux/sched.h |
| |
| class Data_ipv4(ct.Structure): |
| _fields_ = [ |
| ("ts_us", ct.c_ulonglong), |
| ("pid", ct.c_ulonglong), |
| ("saddr", ct.c_ulonglong), |
| ("daddr", ct.c_ulonglong), |
| ("ip", ct.c_ulonglong), |
| ("lport", ct.c_ulonglong), |
| ("task", ct.c_char * TASK_COMM_LEN) |
| ] |
| |
| class Data_ipv6(ct.Structure): |
| _fields_ = [ |
| ("ts_us", ct.c_ulonglong), |
| ("pid", ct.c_ulonglong), |
| ("saddr", (ct.c_ulonglong * 2)), |
| ("daddr", (ct.c_ulonglong * 2)), |
| ("ip", ct.c_ulonglong), |
| ("lport", ct.c_ulonglong), |
| ("task", ct.c_char * TASK_COMM_LEN) |
| ] |
| |
| # process event |
| def print_ipv4_event(cpu, data, size): |
| event = ct.cast(data, ct.POINTER(Data_ipv4)).contents |
| global start_ts |
| if args.timestamp: |
| if start_ts == 0: |
| start_ts = event.ts_us |
| print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="") |
| print("%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid, |
| event.task.decode(), event.ip, |
| inet_ntop(AF_INET, pack("I", event.daddr)), |
| inet_ntop(AF_INET, pack("I", event.saddr)), event.lport)) |
| |
| def print_ipv6_event(cpu, data, size): |
| event = ct.cast(data, ct.POINTER(Data_ipv6)).contents |
| global start_ts |
| if args.timestamp: |
| if start_ts == 0: |
| start_ts = event.ts_us |
| print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="") |
| print("%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid, |
| event.task.decode(), event.ip, inet_ntop(AF_INET6, event.daddr), |
| inet_ntop(AF_INET6, event.saddr), event.lport)) |
| |
| # initialize BPF |
| b = BPF(text=bpf_text) |
| |
| # header |
| if args.timestamp: |
| print("%-9s" % ("TIME(s)"), end="") |
| print("%-6s %-12s %-2s %-16s %-16s %-4s" % ("PID", "COMM", "IP", "RADDR", |
| "LADDR", "LPORT")) |
| |
| start_ts = 0 |
| |
| # read events |
| b["ipv4_events"].open_perf_buffer(print_ipv4_event) |
| b["ipv6_events"].open_perf_buffer(print_ipv6_event) |
| while 1: |
| b.perf_buffer_poll() |