Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 1 | #!/usr/bin/python |
| 2 | # @lint-avoid-python-3-compatibility-imports |
| 3 | # |
| 4 | # tcpdrop Trace TCP kernel-dropped packets/segments. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
| 6 | # |
| 7 | # This provides information such as packet details, socket state, and kernel |
| 8 | # stack trace for packets/segments that were dropped via tcp_drop(). |
| 9 | # |
| 10 | # USAGE: tcpdrop [-c] [-h] [-l] |
| 11 | # |
| 12 | # This uses dynamic tracing of kernel functions, and will need to be updated |
| 13 | # to match kernel changes. |
| 14 | # |
| 15 | # Copyright 2018 Netflix, Inc. |
| 16 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 17 | # |
| 18 | # 30-May-2018 Brendan Gregg Created this. |
| 19 | |
| 20 | from __future__ import print_function |
| 21 | from bcc import BPF |
| 22 | import argparse |
| 23 | from time import strftime |
| 24 | from socket import inet_ntop, AF_INET, AF_INET6 |
| 25 | from struct import pack |
| 26 | import ctypes as ct |
| 27 | from time import sleep |
| 28 | from bcc import tcp |
| 29 | |
| 30 | # arguments |
| 31 | examples = """examples: |
| 32 | ./tcpdrop # trace kernel TCP drops |
| 33 | """ |
| 34 | parser = argparse.ArgumentParser( |
| 35 | description="Trace TCP drops by the kernel", |
| 36 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 37 | epilog=examples) |
| 38 | parser.add_argument("--ebpf", action="store_true", |
| 39 | help=argparse.SUPPRESS) |
| 40 | args = parser.parse_args() |
| 41 | debug = 0 |
| 42 | |
| 43 | # define BPF program |
| 44 | bpf_text = """ |
| 45 | #include <uapi/linux/ptrace.h> |
| 46 | #include <uapi/linux/tcp.h> |
| 47 | #include <uapi/linux/ip.h> |
| 48 | #include <net/sock.h> |
| 49 | #include <bcc/proto.h> |
| 50 | |
| 51 | BPF_STACK_TRACE(stack_traces, 1024); |
| 52 | |
| 53 | // separate data structs for ipv4 and ipv6 |
| 54 | struct ipv4_data_t { |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 55 | u32 pid; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 56 | u64 ip; |
| 57 | u64 saddr; |
| 58 | u64 daddr; |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 59 | u16 sport; |
| 60 | u16 dport; |
| 61 | u8 state; |
| 62 | u8 tcpflags; |
| 63 | u32 stack_id; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 64 | }; |
| 65 | BPF_PERF_OUTPUT(ipv4_events); |
| 66 | |
| 67 | struct ipv6_data_t { |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 68 | u32 pid; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 69 | u64 ip; |
| 70 | unsigned __int128 saddr; |
| 71 | unsigned __int128 daddr; |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 72 | u16 sport; |
| 73 | u16 dport; |
| 74 | u8 state; |
| 75 | u8 tcpflags; |
| 76 | u32 stack_id; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 77 | }; |
| 78 | BPF_PERF_OUTPUT(ipv6_events); |
| 79 | |
| 80 | static struct tcphdr *skb_to_tcphdr(const struct sk_buff *skb) |
| 81 | { |
| 82 | // unstable API. verify logic in tcp_hdr() -> skb_transport_header(). |
| 83 | return (struct tcphdr *)(skb->head + skb->transport_header); |
| 84 | } |
| 85 | |
| 86 | static inline struct iphdr *skb_to_iphdr(const struct sk_buff *skb) |
| 87 | { |
| 88 | // unstable API. verify logic in ip_hdr() -> skb_network_header(). |
| 89 | return (struct iphdr *)(skb->head + skb->network_header); |
| 90 | } |
| 91 | |
| 92 | // from include/net/tcp.h: |
| 93 | #ifndef tcp_flag_byte |
| 94 | #define tcp_flag_byte(th) (((u_int8_t *)th)[13]) |
| 95 | #endif |
| 96 | |
| 97 | int trace_tcp_drop(struct pt_regs *ctx, struct sock *sk, struct sk_buff *skb) |
| 98 | { |
| 99 | if (sk == NULL) |
| 100 | return 0; |
| 101 | u32 pid = bpf_get_current_pid_tgid(); |
| 102 | |
| 103 | // pull in details from the packet headers and the sock struct |
| 104 | u16 family = sk->__sk_common.skc_family; |
| 105 | char state = sk->__sk_common.skc_state; |
| 106 | u16 sport = 0, dport = 0; |
| 107 | u8 tcpflags = 0; |
| 108 | struct tcphdr *tcp = skb_to_tcphdr(skb); |
| 109 | struct iphdr *ip = skb_to_iphdr(skb); |
| 110 | bpf_probe_read(&sport, sizeof(sport), &tcp->source); |
| 111 | bpf_probe_read(&dport, sizeof(dport), &tcp->dest); |
| 112 | bpf_probe_read(&tcpflags, sizeof(tcpflags), &tcp_flag_byte(tcp)); |
| 113 | sport = ntohs(sport); |
| 114 | dport = ntohs(dport); |
| 115 | |
| 116 | if (family == AF_INET) { |
| 117 | struct ipv4_data_t data4 = {.pid = pid, .ip = 4}; |
| 118 | bpf_probe_read(&data4.saddr, sizeof(u32), &ip->saddr); |
| 119 | bpf_probe_read(&data4.daddr, sizeof(u32), &ip->daddr); |
| 120 | data4.dport = dport; |
| 121 | data4.sport = sport; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 122 | data4.state = state; |
Brendan Gregg | b2b9871 | 2018-06-01 01:28:08 -0400 | [diff] [blame] | 123 | data4.tcpflags = tcpflags; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 124 | data4.stack_id = stack_traces.get_stackid(ctx, 0); |
| 125 | ipv4_events.perf_submit(ctx, &data4, sizeof(data4)); |
| 126 | |
| 127 | } else if (family == AF_INET6) { |
| 128 | struct ipv6_data_t data6 = {.pid = pid, .ip = 6}; |
| 129 | bpf_probe_read(&data6.saddr, sizeof(data6.saddr), |
| 130 | sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
| 131 | bpf_probe_read(&data6.daddr, sizeof(data6.daddr), |
| 132 | sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
| 133 | data6.dport = dport; |
| 134 | data6.sport = sport; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 135 | data6.state = state; |
Brendan Gregg | b2b9871 | 2018-06-01 01:28:08 -0400 | [diff] [blame] | 136 | data6.tcpflags = tcpflags; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 137 | data6.stack_id = stack_traces.get_stackid(ctx, 0); |
| 138 | ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); |
| 139 | } |
| 140 | // else drop |
| 141 | |
| 142 | return 0; |
| 143 | } |
| 144 | """ |
| 145 | |
| 146 | if debug or args.ebpf: |
| 147 | print(bpf_text) |
| 148 | if args.ebpf: |
| 149 | exit() |
| 150 | |
| 151 | # event data |
| 152 | class Data_ipv4(ct.Structure): |
| 153 | _fields_ = [ |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 154 | ("pid", ct.c_ulong), |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 155 | ("ip", ct.c_ulonglong), |
| 156 | ("saddr", ct.c_ulonglong), |
| 157 | ("daddr", ct.c_ulonglong), |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 158 | ("sport", ct.c_ushort), |
| 159 | ("dport", ct.c_ushort), |
| 160 | ("state", ct.c_ubyte), |
| 161 | ("tcpflags", ct.c_ubyte), |
| 162 | ("stack_id", ct.c_ulong) |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 163 | ] |
| 164 | |
| 165 | class Data_ipv6(ct.Structure): |
| 166 | _fields_ = [ |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 167 | ("pid", ct.c_ulong), |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 168 | ("ip", ct.c_ulonglong), |
| 169 | ("saddr", (ct.c_ulonglong * 2)), |
| 170 | ("daddr", (ct.c_ulonglong * 2)), |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 171 | ("sport", ct.c_ushort), |
| 172 | ("dport", ct.c_ushort), |
| 173 | ("state", ct.c_ubyte), |
| 174 | ("tcpflags", ct.c_ubyte), |
| 175 | ("stack_id", ct.c_ulong) |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 176 | ] |
| 177 | |
| 178 | # process event |
| 179 | def print_ipv4_event(cpu, data, size): |
| 180 | event = ct.cast(data, ct.POINTER(Data_ipv4)).contents |
| 181 | print("%-8s %-6d %-2d %-20s > %-20s %s (%s)" % ( |
| 182 | strftime("%H:%M:%S"), event.pid, event.ip, |
| 183 | "%s:%d" % (inet_ntop(AF_INET, pack('I', event.saddr)), event.sport), |
| 184 | "%s:%s" % (inet_ntop(AF_INET, pack('I', event.daddr)), event.dport), |
| 185 | tcp.tcpstate[event.state], tcp.flags2str(event.tcpflags))) |
| 186 | for addr in stack_traces.walk(event.stack_id): |
| 187 | sym = b.ksym(addr, show_offset=True) |
| 188 | print("\t%s" % sym) |
| 189 | print("") |
| 190 | |
| 191 | def print_ipv6_event(cpu, data, size): |
| 192 | event = ct.cast(data, ct.POINTER(Data_ipv6)).contents |
| 193 | print("%-8s %-6d %-2d %-20s > %-20s %s (%s)" % ( |
| 194 | strftime("%H:%M:%S"), event.pid, event.ip, |
| 195 | "%s:%d" % (inet_ntop(AF_INET6, event.saddr), event.sport), |
| 196 | "%s:%d" % (inet_ntop(AF_INET6, event.daddr), event.dport), |
| 197 | tcp.tcpstate[event.state], tcp.flags2str(event.tcpflags))) |
| 198 | for addr in stack_traces.walk(event.stack_id): |
| 199 | sym = b.ksym(addr, show_offset=True) |
| 200 | print("\t%s" % sym) |
| 201 | print("") |
| 202 | |
| 203 | # initialize BPF |
| 204 | b = BPF(text=bpf_text) |
| 205 | if b.get_kprobe_functions("tcp_drop"): |
| 206 | b.attach_kprobe(event="tcp_drop", fn_name="trace_tcp_drop") |
| 207 | else: |
| 208 | print("ERROR: tcp_drop() kernel function not found or traceable. " |
| 209 | "Older kernel versions not supported.") |
| 210 | exit() |
| 211 | stack_traces = b.get_table("stack_traces") |
| 212 | |
| 213 | # header |
| 214 | print("%-8s %-6s %-2s %-20s > %-20s %s (%s)" % ("TIME", "PID", "IP", |
| 215 | "SADDR:SPORT", "DADDR:DPORT", "STATE", "FLAGS")) |
| 216 | |
| 217 | # read events |
| 218 | b["ipv4_events"].open_perf_buffer(print_ipv4_event) |
| 219 | b["ipv6_events"].open_perf_buffer(print_ipv6_event) |
| 220 | while 1: |
| 221 | b.perf_buffer_poll() |