Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 2 | # |
| 3 | # tcpv4tracer Trace TCP connections. |
| 4 | # For Linux, uses BCC, eBPF. Embedded C. |
| 5 | # |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 6 | # USAGE: tcpv4tracer [-h] [-v] [-p PID] [-N NETNS] [-4 | -6] |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 7 | # |
| 8 | # You should generally try to avoid writing long scripts that measure multiple |
| 9 | # functions and walk multiple kernel structures, as they will be a burden to |
| 10 | # maintain as the kernel changes. |
| 11 | # The following code should be replaced, and simplified, when static TCP probes |
| 12 | # exist. |
| 13 | # |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 14 | # Copyright 2017-2020 Kinvolk GmbH |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 15 | # |
| 16 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 17 | from __future__ import print_function |
| 18 | from bcc import BPF |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 19 | from bcc.containers import filter_by_containers |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 20 | |
| 21 | import argparse as ap |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 22 | from socket import inet_ntop, AF_INET, AF_INET6 |
| 23 | from struct import pack |
| 24 | |
| 25 | parser = ap.ArgumentParser(description="Trace TCP connections", |
| 26 | formatter_class=ap.RawDescriptionHelpFormatter) |
Iago López Galeiras | 6426cd4 | 2017-08-04 16:57:20 +0200 | [diff] [blame] | 27 | parser.add_argument("-t", "--timestamp", action="store_true", |
| 28 | help="include timestamp on output") |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 29 | parser.add_argument("-p", "--pid", default=0, type=int, |
| 30 | help="trace this PID only") |
| 31 | parser.add_argument("-N", "--netns", default=0, type=int, |
| 32 | help="trace this Network Namespace only") |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 33 | parser.add_argument("--cgroupmap", |
| 34 | help="trace cgroups in this BPF map only") |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 35 | parser.add_argument("--mntnsmap", |
| 36 | help="trace mount namespaces in this BPF map only") |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 37 | group = parser.add_mutually_exclusive_group() |
| 38 | group.add_argument("-4", "--ipv4", action="store_true", |
| 39 | help="trace IPv4 family only") |
| 40 | group.add_argument("-6", "--ipv6", action="store_true", |
| 41 | help="trace IPv6 family only") |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 42 | parser.add_argument("-v", "--verbose", action="store_true", |
| 43 | help="include Network Namespace in the output") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 44 | parser.add_argument("--ebpf", action="store_true", |
Gal Pressman | 1980d63 | 2018-02-05 14:55:53 +0200 | [diff] [blame] | 45 | help=ap.SUPPRESS) |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 46 | args = parser.parse_args() |
| 47 | |
| 48 | bpf_text = """ |
| 49 | #include <uapi/linux/ptrace.h> |
| 50 | #pragma clang diagnostic push |
| 51 | #pragma clang diagnostic ignored "-Wtautological-compare" |
| 52 | #include <net/sock.h> |
| 53 | #pragma clang diagnostic pop |
| 54 | #include <net/inet_sock.h> |
| 55 | #include <net/net_namespace.h> |
| 56 | #include <bcc/proto.h> |
| 57 | |
| 58 | #define TCP_EVENT_TYPE_CONNECT 1 |
| 59 | #define TCP_EVENT_TYPE_ACCEPT 2 |
| 60 | #define TCP_EVENT_TYPE_CLOSE 3 |
| 61 | |
| 62 | struct tcp_ipv4_event_t { |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 63 | u64 ts_ns; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 64 | u32 type; |
| 65 | u32 pid; |
| 66 | char comm[TASK_COMM_LEN]; |
| 67 | u8 ip; |
| 68 | u32 saddr; |
| 69 | u32 daddr; |
| 70 | u16 sport; |
| 71 | u16 dport; |
| 72 | u32 netns; |
| 73 | }; |
| 74 | BPF_PERF_OUTPUT(tcp_ipv4_event); |
| 75 | |
| 76 | struct tcp_ipv6_event_t { |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 77 | u64 ts_ns; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 78 | u32 type; |
| 79 | u32 pid; |
| 80 | char comm[TASK_COMM_LEN]; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 81 | unsigned __int128 saddr; |
| 82 | unsigned __int128 daddr; |
| 83 | u16 sport; |
| 84 | u16 dport; |
| 85 | u32 netns; |
Jerome Marchand | 21b810a | 2020-09-17 10:37:02 +0200 | [diff] [blame] | 86 | u8 ip; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 87 | }; |
| 88 | BPF_PERF_OUTPUT(tcp_ipv6_event); |
| 89 | |
| 90 | // tcp_set_state doesn't run in the context of the process that initiated the |
| 91 | // connection so we need to store a map TUPLE -> PID to send the right PID on |
| 92 | // the event |
| 93 | struct ipv4_tuple_t { |
| 94 | u32 saddr; |
| 95 | u32 daddr; |
| 96 | u16 sport; |
| 97 | u16 dport; |
| 98 | u32 netns; |
| 99 | }; |
| 100 | |
| 101 | struct ipv6_tuple_t { |
| 102 | unsigned __int128 saddr; |
| 103 | unsigned __int128 daddr; |
| 104 | u16 sport; |
| 105 | u16 dport; |
| 106 | u32 netns; |
| 107 | }; |
| 108 | |
| 109 | struct pid_comm_t { |
| 110 | u64 pid; |
| 111 | char comm[TASK_COMM_LEN]; |
| 112 | }; |
| 113 | |
| 114 | BPF_HASH(tuplepid_ipv4, struct ipv4_tuple_t, struct pid_comm_t); |
| 115 | BPF_HASH(tuplepid_ipv6, struct ipv6_tuple_t, struct pid_comm_t); |
| 116 | |
| 117 | BPF_HASH(connectsock, u64, struct sock *); |
| 118 | |
| 119 | static int read_ipv4_tuple(struct ipv4_tuple_t *tuple, struct sock *skp) |
| 120 | { |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 121 | u32 net_ns_inum = 0; |
| 122 | u32 saddr = skp->__sk_common.skc_rcv_saddr; |
| 123 | u32 daddr = skp->__sk_common.skc_daddr; |
| 124 | struct inet_sock *sockp = (struct inet_sock *)skp; |
| 125 | u16 sport = sockp->inet_sport; |
| 126 | u16 dport = skp->__sk_common.skc_dport; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 127 | #ifdef CONFIG_NET_NS |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 128 | net_ns_inum = skp->__sk_common.skc_net.net->ns.inum; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 129 | #endif |
| 130 | |
| 131 | ##FILTER_NETNS## |
| 132 | |
| 133 | tuple->saddr = saddr; |
| 134 | tuple->daddr = daddr; |
| 135 | tuple->sport = sport; |
| 136 | tuple->dport = dport; |
| 137 | tuple->netns = net_ns_inum; |
| 138 | |
| 139 | // if addresses or ports are 0, ignore |
| 140 | if (saddr == 0 || daddr == 0 || sport == 0 || dport == 0) { |
| 141 | return 0; |
| 142 | } |
| 143 | |
| 144 | return 1; |
| 145 | } |
| 146 | |
| 147 | static int read_ipv6_tuple(struct ipv6_tuple_t *tuple, struct sock *skp) |
| 148 | { |
| 149 | u32 net_ns_inum = 0; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 150 | unsigned __int128 saddr = 0, daddr = 0; |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 151 | struct inet_sock *sockp = (struct inet_sock *)skp; |
| 152 | u16 sport = sockp->inet_sport; |
| 153 | u16 dport = skp->__sk_common.skc_dport; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 154 | #ifdef CONFIG_NET_NS |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 155 | net_ns_inum = skp->__sk_common.skc_net.net->ns.inum; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 156 | #endif |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 157 | bpf_probe_read_kernel(&saddr, sizeof(saddr), |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 158 | skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 159 | bpf_probe_read_kernel(&daddr, sizeof(daddr), |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 160 | skp->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 161 | |
| 162 | ##FILTER_NETNS## |
| 163 | |
| 164 | tuple->saddr = saddr; |
| 165 | tuple->daddr = daddr; |
| 166 | tuple->sport = sport; |
| 167 | tuple->dport = dport; |
| 168 | tuple->netns = net_ns_inum; |
| 169 | |
| 170 | // if addresses or ports are 0, ignore |
| 171 | if (saddr == 0 || daddr == 0 || sport == 0 || dport == 0) { |
| 172 | return 0; |
| 173 | } |
| 174 | |
| 175 | return 1; |
| 176 | } |
| 177 | |
| 178 | static bool check_family(struct sock *sk, u16 expected_family) { |
| 179 | u64 zero = 0; |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 180 | u16 family = sk->__sk_common.skc_family; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 181 | return family == expected_family; |
| 182 | } |
| 183 | |
| 184 | int trace_connect_v4_entry(struct pt_regs *ctx, struct sock *sk) |
| 185 | { |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 186 | if (container_should_be_filtered()) { |
| 187 | return 0; |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 188 | } |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 189 | |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 190 | u64 pid = bpf_get_current_pid_tgid(); |
| 191 | |
| 192 | ##FILTER_PID## |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 193 | |
| 194 | u16 family = sk->__sk_common.skc_family; |
| 195 | ##FILTER_FAMILY## |
| 196 | |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 197 | |
| 198 | // stash the sock ptr for lookup on return |
| 199 | connectsock.update(&pid, &sk); |
| 200 | |
| 201 | return 0; |
| 202 | } |
| 203 | |
| 204 | int trace_connect_v4_return(struct pt_regs *ctx) |
| 205 | { |
| 206 | int ret = PT_REGS_RC(ctx); |
| 207 | u64 pid = bpf_get_current_pid_tgid(); |
| 208 | |
| 209 | struct sock **skpp; |
| 210 | skpp = connectsock.lookup(&pid); |
| 211 | if (skpp == 0) { |
| 212 | return 0; // missed entry |
| 213 | } |
| 214 | |
| 215 | connectsock.delete(&pid); |
| 216 | |
| 217 | if (ret != 0) { |
| 218 | // failed to send SYNC packet, may not have populated |
| 219 | // socket __sk_common.{skc_rcv_saddr, ...} |
| 220 | return 0; |
| 221 | } |
| 222 | |
| 223 | // pull in details |
| 224 | struct sock *skp = *skpp; |
| 225 | struct ipv4_tuple_t t = { }; |
| 226 | if (!read_ipv4_tuple(&t, skp)) { |
| 227 | return 0; |
| 228 | } |
| 229 | |
| 230 | struct pid_comm_t p = { }; |
| 231 | p.pid = pid; |
| 232 | bpf_get_current_comm(&p.comm, sizeof(p.comm)); |
| 233 | |
| 234 | tuplepid_ipv4.update(&t, &p); |
| 235 | |
| 236 | return 0; |
| 237 | } |
| 238 | |
| 239 | int trace_connect_v6_entry(struct pt_regs *ctx, struct sock *sk) |
| 240 | { |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 241 | if (container_should_be_filtered()) { |
| 242 | return 0; |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 243 | } |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 244 | u64 pid = bpf_get_current_pid_tgid(); |
| 245 | |
| 246 | ##FILTER_PID## |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 247 | u16 family = sk->__sk_common.skc_family; |
| 248 | ##FILTER_FAMILY## |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 249 | |
| 250 | // stash the sock ptr for lookup on return |
| 251 | connectsock.update(&pid, &sk); |
| 252 | |
| 253 | return 0; |
| 254 | } |
| 255 | |
| 256 | int trace_connect_v6_return(struct pt_regs *ctx) |
| 257 | { |
| 258 | int ret = PT_REGS_RC(ctx); |
| 259 | u64 pid = bpf_get_current_pid_tgid(); |
| 260 | |
| 261 | struct sock **skpp; |
| 262 | skpp = connectsock.lookup(&pid); |
| 263 | if (skpp == 0) { |
| 264 | return 0; // missed entry |
| 265 | } |
| 266 | |
| 267 | connectsock.delete(&pid); |
| 268 | |
| 269 | if (ret != 0) { |
| 270 | // failed to send SYNC packet, may not have populated |
| 271 | // socket __sk_common.{skc_rcv_saddr, ...} |
| 272 | return 0; |
| 273 | } |
| 274 | |
| 275 | // pull in details |
| 276 | struct sock *skp = *skpp; |
| 277 | struct ipv6_tuple_t t = { }; |
| 278 | if (!read_ipv6_tuple(&t, skp)) { |
| 279 | return 0; |
| 280 | } |
| 281 | |
| 282 | struct pid_comm_t p = { }; |
| 283 | p.pid = pid; |
| 284 | bpf_get_current_comm(&p.comm, sizeof(p.comm)); |
| 285 | |
| 286 | tuplepid_ipv6.update(&t, &p); |
| 287 | |
| 288 | return 0; |
| 289 | } |
| 290 | |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 291 | int trace_tcp_set_state_entry(struct pt_regs *ctx, struct sock *skp, int state) |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 292 | { |
| 293 | if (state != TCP_ESTABLISHED && state != TCP_CLOSE) { |
| 294 | return 0; |
| 295 | } |
| 296 | |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 297 | u16 family = skp->__sk_common.skc_family; |
| 298 | ##FILTER_FAMILY## |
| 299 | |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 300 | u8 ipver = 0; |
| 301 | if (check_family(skp, AF_INET)) { |
| 302 | ipver = 4; |
| 303 | struct ipv4_tuple_t t = { }; |
| 304 | if (!read_ipv4_tuple(&t, skp)) { |
| 305 | return 0; |
| 306 | } |
| 307 | |
| 308 | if (state == TCP_CLOSE) { |
| 309 | tuplepid_ipv4.delete(&t); |
| 310 | return 0; |
| 311 | } |
| 312 | |
| 313 | struct pid_comm_t *p; |
| 314 | p = tuplepid_ipv4.lookup(&t); |
| 315 | if (p == 0) { |
| 316 | return 0; // missed entry |
| 317 | } |
| 318 | |
| 319 | struct tcp_ipv4_event_t evt4 = { }; |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 320 | evt4.ts_ns = bpf_ktime_get_ns(); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 321 | evt4.type = TCP_EVENT_TYPE_CONNECT; |
| 322 | evt4.pid = p->pid >> 32; |
| 323 | evt4.ip = ipver; |
| 324 | evt4.saddr = t.saddr; |
| 325 | evt4.daddr = t.daddr; |
| 326 | evt4.sport = ntohs(t.sport); |
| 327 | evt4.dport = ntohs(t.dport); |
| 328 | evt4.netns = t.netns; |
| 329 | |
| 330 | int i; |
| 331 | for (i = 0; i < TASK_COMM_LEN; i++) { |
| 332 | evt4.comm[i] = p->comm[i]; |
| 333 | } |
| 334 | |
| 335 | tcp_ipv4_event.perf_submit(ctx, &evt4, sizeof(evt4)); |
| 336 | tuplepid_ipv4.delete(&t); |
| 337 | } else if (check_family(skp, AF_INET6)) { |
| 338 | ipver = 6; |
| 339 | struct ipv6_tuple_t t = { }; |
| 340 | if (!read_ipv6_tuple(&t, skp)) { |
| 341 | return 0; |
| 342 | } |
| 343 | |
| 344 | if (state == TCP_CLOSE) { |
| 345 | tuplepid_ipv6.delete(&t); |
| 346 | return 0; |
| 347 | } |
| 348 | |
| 349 | struct pid_comm_t *p; |
| 350 | p = tuplepid_ipv6.lookup(&t); |
| 351 | if (p == 0) { |
| 352 | return 0; // missed entry |
| 353 | } |
| 354 | |
| 355 | struct tcp_ipv6_event_t evt6 = { }; |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 356 | evt6.ts_ns = bpf_ktime_get_ns(); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 357 | evt6.type = TCP_EVENT_TYPE_CONNECT; |
| 358 | evt6.pid = p->pid >> 32; |
| 359 | evt6.ip = ipver; |
| 360 | evt6.saddr = t.saddr; |
| 361 | evt6.daddr = t.daddr; |
| 362 | evt6.sport = ntohs(t.sport); |
| 363 | evt6.dport = ntohs(t.dport); |
| 364 | evt6.netns = t.netns; |
| 365 | |
| 366 | int i; |
| 367 | for (i = 0; i < TASK_COMM_LEN; i++) { |
| 368 | evt6.comm[i] = p->comm[i]; |
| 369 | } |
| 370 | |
| 371 | tcp_ipv6_event.perf_submit(ctx, &evt6, sizeof(evt6)); |
| 372 | tuplepid_ipv6.delete(&t); |
| 373 | } |
| 374 | // else drop |
| 375 | |
| 376 | return 0; |
| 377 | } |
| 378 | |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 379 | int trace_close_entry(struct pt_regs *ctx, struct sock *skp) |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 380 | { |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 381 | if (container_should_be_filtered()) { |
| 382 | return 0; |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 383 | } |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 384 | |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 385 | u64 pid = bpf_get_current_pid_tgid(); |
| 386 | |
| 387 | ##FILTER_PID## |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 388 | |
| 389 | u16 family = skp->__sk_common.skc_family; |
| 390 | ##FILTER_FAMILY## |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 391 | |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 392 | u8 oldstate = skp->sk_state; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 393 | // Don't generate close events for connections that were never |
| 394 | // established in the first place. |
| 395 | if (oldstate == TCP_SYN_SENT || |
| 396 | oldstate == TCP_SYN_RECV || |
| 397 | oldstate == TCP_NEW_SYN_RECV) |
| 398 | return 0; |
| 399 | |
| 400 | u8 ipver = 0; |
| 401 | if (check_family(skp, AF_INET)) { |
| 402 | ipver = 4; |
| 403 | struct ipv4_tuple_t t = { }; |
| 404 | if (!read_ipv4_tuple(&t, skp)) { |
| 405 | return 0; |
| 406 | } |
| 407 | |
| 408 | struct tcp_ipv4_event_t evt4 = { }; |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 409 | evt4.ts_ns = bpf_ktime_get_ns(); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 410 | evt4.type = TCP_EVENT_TYPE_CLOSE; |
| 411 | evt4.pid = pid >> 32; |
| 412 | evt4.ip = ipver; |
| 413 | evt4.saddr = t.saddr; |
| 414 | evt4.daddr = t.daddr; |
| 415 | evt4.sport = ntohs(t.sport); |
| 416 | evt4.dport = ntohs(t.dport); |
| 417 | evt4.netns = t.netns; |
| 418 | bpf_get_current_comm(&evt4.comm, sizeof(evt4.comm)); |
| 419 | |
| 420 | tcp_ipv4_event.perf_submit(ctx, &evt4, sizeof(evt4)); |
| 421 | } else if (check_family(skp, AF_INET6)) { |
| 422 | ipver = 6; |
| 423 | struct ipv6_tuple_t t = { }; |
| 424 | if (!read_ipv6_tuple(&t, skp)) { |
| 425 | return 0; |
| 426 | } |
| 427 | |
| 428 | struct tcp_ipv6_event_t evt6 = { }; |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 429 | evt6.ts_ns = bpf_ktime_get_ns(); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 430 | evt6.type = TCP_EVENT_TYPE_CLOSE; |
| 431 | evt6.pid = pid >> 32; |
| 432 | evt6.ip = ipver; |
| 433 | evt6.saddr = t.saddr; |
| 434 | evt6.daddr = t.daddr; |
| 435 | evt6.sport = ntohs(t.sport); |
| 436 | evt6.dport = ntohs(t.dport); |
| 437 | evt6.netns = t.netns; |
| 438 | bpf_get_current_comm(&evt6.comm, sizeof(evt6.comm)); |
| 439 | |
| 440 | tcp_ipv6_event.perf_submit(ctx, &evt6, sizeof(evt6)); |
| 441 | } |
| 442 | // else drop |
| 443 | |
| 444 | return 0; |
| 445 | }; |
| 446 | |
| 447 | int trace_accept_return(struct pt_regs *ctx) |
| 448 | { |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 449 | if (container_should_be_filtered()) { |
| 450 | return 0; |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 451 | } |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 452 | |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 453 | struct sock *newsk = (struct sock *)PT_REGS_RC(ctx); |
| 454 | u64 pid = bpf_get_current_pid_tgid(); |
| 455 | |
| 456 | ##FILTER_PID## |
| 457 | |
| 458 | if (newsk == NULL) { |
| 459 | return 0; |
| 460 | } |
| 461 | |
| 462 | // pull in details |
| 463 | u16 lport = 0, dport = 0; |
| 464 | u32 net_ns_inum = 0; |
| 465 | u8 ipver = 0; |
| 466 | |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 467 | dport = newsk->__sk_common.skc_dport; |
| 468 | lport = newsk->__sk_common.skc_num; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 469 | |
| 470 | // Get network namespace id, if kernel supports it |
| 471 | #ifdef CONFIG_NET_NS |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 472 | net_ns_inum = newsk->__sk_common.skc_net.net->ns.inum; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 473 | #endif |
| 474 | |
| 475 | ##FILTER_NETNS## |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 476 | |
| 477 | u16 family = newsk->__sk_common.skc_family; |
| 478 | ##FILTER_FAMILY## |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 479 | |
| 480 | if (check_family(newsk, AF_INET)) { |
| 481 | ipver = 4; |
| 482 | |
| 483 | struct tcp_ipv4_event_t evt4 = { 0 }; |
| 484 | |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 485 | evt4.ts_ns = bpf_ktime_get_ns(); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 486 | evt4.type = TCP_EVENT_TYPE_ACCEPT; |
| 487 | evt4.netns = net_ns_inum; |
| 488 | evt4.pid = pid >> 32; |
| 489 | evt4.ip = ipver; |
| 490 | |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 491 | evt4.saddr = newsk->__sk_common.skc_rcv_saddr; |
| 492 | evt4.daddr = newsk->__sk_common.skc_daddr; |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 493 | |
| 494 | evt4.sport = lport; |
| 495 | evt4.dport = ntohs(dport); |
| 496 | bpf_get_current_comm(&evt4.comm, sizeof(evt4.comm)); |
| 497 | |
| 498 | // do not send event if IP address is 0.0.0.0 or port is 0 |
| 499 | if (evt4.saddr != 0 && evt4.daddr != 0 && |
| 500 | evt4.sport != 0 && evt4.dport != 0) { |
| 501 | tcp_ipv4_event.perf_submit(ctx, &evt4, sizeof(evt4)); |
| 502 | } |
| 503 | } else if (check_family(newsk, AF_INET6)) { |
| 504 | ipver = 6; |
| 505 | |
| 506 | struct tcp_ipv6_event_t evt6 = { 0 }; |
| 507 | |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 508 | evt6.ts_ns = bpf_ktime_get_ns(); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 509 | evt6.type = TCP_EVENT_TYPE_ACCEPT; |
| 510 | evt6.netns = net_ns_inum; |
| 511 | evt6.pid = pid >> 32; |
| 512 | evt6.ip = ipver; |
| 513 | |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 514 | bpf_probe_read_kernel(&evt6.saddr, sizeof(evt6.saddr), |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 515 | newsk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 516 | bpf_probe_read_kernel(&evt6.daddr, sizeof(evt6.daddr), |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 517 | newsk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 518 | |
| 519 | evt6.sport = lport; |
| 520 | evt6.dport = ntohs(dport); |
| 521 | bpf_get_current_comm(&evt6.comm, sizeof(evt6.comm)); |
| 522 | |
| 523 | // do not send event if IP address is 0.0.0.0 or port is 0 |
| 524 | if (evt6.saddr != 0 && evt6.daddr != 0 && |
| 525 | evt6.sport != 0 && evt6.dport != 0) { |
| 526 | tcp_ipv6_event.perf_submit(ctx, &evt6, sizeof(evt6)); |
| 527 | } |
| 528 | } |
| 529 | // else drop |
| 530 | |
| 531 | return 0; |
| 532 | } |
| 533 | """ |
| 534 | |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 535 | verbose_types = {"C": "connect", "A": "accept", |
| 536 | "X": "close", "U": "unknown"} |
| 537 | |
| 538 | |
| 539 | def print_ipv4_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 540 | event = b["tcp_ipv4_event"].event(data) |
Iago López Galeiras | 6426cd4 | 2017-08-04 16:57:20 +0200 | [diff] [blame] | 541 | global start_ts |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 542 | |
Iago López Galeiras | 6426cd4 | 2017-08-04 16:57:20 +0200 | [diff] [blame] | 543 | if args.timestamp: |
| 544 | if start_ts == 0: |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 545 | start_ts = event.ts_ns |
| 546 | if args.verbose: |
| 547 | print("%-14d" % (event.ts_ns - start_ts), end="") |
| 548 | else: |
Paul Chaignon | 7297af0 | 2017-10-07 11:06:58 +0200 | [diff] [blame] | 549 | print("%-9.3f" % ((event.ts_ns - start_ts) / 1000000000.0), end="") |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 550 | if event.type == 1: |
| 551 | type_str = "C" |
| 552 | elif event.type == 2: |
| 553 | type_str = "A" |
| 554 | elif event.type == 3: |
| 555 | type_str = "X" |
| 556 | else: |
| 557 | type_str = "U" |
| 558 | |
| 559 | if args.verbose: |
| 560 | print("%-12s " % (verbose_types[type_str]), end="") |
| 561 | else: |
| 562 | print("%-2s " % (type_str), end="") |
| 563 | |
| 564 | print("%-6d %-16s %-2d %-16s %-16s %-6d %-6d" % |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 565 | (event.pid, event.comm.decode('utf-8', 'replace'), |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 566 | event.ip, |
| 567 | inet_ntop(AF_INET, pack("I", event.saddr)), |
| 568 | inet_ntop(AF_INET, pack("I", event.daddr)), |
| 569 | event.sport, |
| 570 | event.dport), end="") |
| 571 | if args.verbose and not args.netns: |
| 572 | print(" %-8d" % event.netns) |
| 573 | else: |
| 574 | print() |
| 575 | |
| 576 | |
| 577 | def print_ipv6_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 578 | event = b["tcp_ipv6_event"].event(data) |
Iago López Galeiras | 6426cd4 | 2017-08-04 16:57:20 +0200 | [diff] [blame] | 579 | global start_ts |
| 580 | if args.timestamp: |
| 581 | if start_ts == 0: |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 582 | start_ts = event.ts_ns |
| 583 | if args.verbose: |
| 584 | print("%-14d" % (event.ts_ns - start_ts), end="") |
| 585 | else: |
Paul Chaignon | 7297af0 | 2017-10-07 11:06:58 +0200 | [diff] [blame] | 586 | print("%-9.3f" % ((event.ts_ns - start_ts) / 1000000000.0), end="") |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 587 | if event.type == 1: |
| 588 | type_str = "C" |
| 589 | elif event.type == 2: |
| 590 | type_str = "A" |
| 591 | elif event.type == 3: |
| 592 | type_str = "X" |
| 593 | else: |
| 594 | type_str = "U" |
| 595 | |
| 596 | if args.verbose: |
| 597 | print("%-12s " % (verbose_types[type_str]), end="") |
| 598 | else: |
| 599 | print("%-2s " % (type_str), end="") |
| 600 | |
| 601 | print("%-6d %-16s %-2d %-16s %-16s %-6d %-6d" % |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 602 | (event.pid, event.comm.decode('utf-8', 'replace'), |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 603 | event.ip, |
Paul Chaignon | 7297af0 | 2017-10-07 11:06:58 +0200 | [diff] [blame] | 604 | "[" + inet_ntop(AF_INET6, event.saddr) + "]", |
| 605 | "[" + inet_ntop(AF_INET6, event.daddr) + "]", |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 606 | event.sport, |
| 607 | event.dport), end="") |
| 608 | if args.verbose and not args.netns: |
| 609 | print(" %-8d" % event.netns) |
| 610 | else: |
| 611 | print() |
| 612 | |
| 613 | |
| 614 | pid_filter = "" |
| 615 | netns_filter = "" |
| 616 | |
| 617 | if args.pid: |
| 618 | pid_filter = 'if (pid >> 32 != %d) { return 0; }' % args.pid |
| 619 | if args.netns: |
| 620 | netns_filter = 'if (net_ns_inum != %d) { return 0; }' % args.netns |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 621 | if args.ipv4: |
| 622 | bpf_text = bpf_text.replace('##FILTER_FAMILY##', |
| 623 | 'if (family != AF_INET) { return 0; }') |
| 624 | elif args.ipv6: |
| 625 | bpf_text = bpf_text.replace('##FILTER_FAMILY##', |
| 626 | 'if (family != AF_INET6) { return 0; }') |
| 627 | bpf_text = bpf_text.replace('##FILTER_FAMILY##', '') |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 628 | bpf_text = bpf_text.replace('##FILTER_PID##', pid_filter) |
| 629 | bpf_text = bpf_text.replace('##FILTER_NETNS##', netns_filter) |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 630 | bpf_text = filter_by_containers(args) + bpf_text |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 631 | |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 632 | if args.ebpf: |
| 633 | print(bpf_text) |
| 634 | exit() |
| 635 | |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 636 | # initialize BPF |
| 637 | b = BPF(text=bpf_text) |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 638 | if args.ipv4: |
| 639 | b.attach_kprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_entry") |
| 640 | b.attach_kretprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_return") |
| 641 | elif args.ipv6: |
| 642 | b.attach_kprobe(event="tcp_v6_connect", fn_name="trace_connect_v6_entry") |
| 643 | b.attach_kretprobe(event="tcp_v6_connect", fn_name="trace_connect_v6_return") |
| 644 | else: |
| 645 | b.attach_kprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_entry") |
| 646 | b.attach_kretprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_return") |
| 647 | b.attach_kprobe(event="tcp_v6_connect", fn_name="trace_connect_v6_entry") |
| 648 | b.attach_kretprobe(event="tcp_v6_connect", fn_name="trace_connect_v6_return") |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 649 | b.attach_kprobe(event="tcp_set_state", fn_name="trace_tcp_set_state_entry") |
| 650 | b.attach_kprobe(event="tcp_close", fn_name="trace_close_entry") |
| 651 | b.attach_kretprobe(event="inet_csk_accept", fn_name="trace_accept_return") |
| 652 | |
| 653 | print("Tracing TCP established connections. Ctrl-C to end.") |
| 654 | |
| 655 | # header |
| 656 | if args.verbose: |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 657 | if args.timestamp: |
| 658 | print("%-14s" % ("TIME(ns)"), end="") |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 659 | print("%-12s %-6s %-16s %-2s %-16s %-16s %-6s %-7s" % ("TYPE", |
| 660 | "PID", "COMM", "IP", "SADDR", "DADDR", "SPORT", "DPORT"), end="") |
| 661 | if not args.netns: |
| 662 | print("%-8s" % "NETNS", end="") |
| 663 | print() |
| 664 | else: |
Iago López Galeiras | fff792d | 2017-08-04 18:13:05 +0200 | [diff] [blame] | 665 | if args.timestamp: |
| 666 | print("%-9s" % ("TIME(s)"), end="") |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 667 | print("%-2s %-6s %-16s %-2s %-16s %-16s %-6s %-6s" % |
| 668 | ("T", "PID", "COMM", "IP", "SADDR", "DADDR", "SPORT", "DPORT")) |
| 669 | |
Iago López Galeiras | 6426cd4 | 2017-08-04 16:57:20 +0200 | [diff] [blame] | 670 | start_ts = 0 |
Iago López Galeiras | f37434b | 2017-03-30 19:07:47 +0200 | [diff] [blame] | 671 | |
| 672 | def inet_ntoa(addr): |
| 673 | dq = '' |
| 674 | for i in range(0, 4): |
| 675 | dq = dq + str(addr & 0xff) |
| 676 | if (i != 3): |
| 677 | dq = dq + '.' |
| 678 | addr = addr >> 8 |
| 679 | return dq |
| 680 | |
| 681 | |
| 682 | b["tcp_ipv4_event"].open_perf_buffer(print_ipv4_event) |
| 683 | b["tcp_ipv6_event"].open_perf_buffer(print_ipv6_event) |
| 684 | while True: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 685 | try: |
| 686 | b.perf_buffer_poll() |
| 687 | except KeyboardInterrupt: |
| 688 | exit() |