From e7f5f9092530521c007cb1170e951b43c28af9e0 Mon Sep 17 00:00:00 2001 From: hengyoush Date: Tue, 10 Sep 2024 21:35:14 +0800 Subject: [PATCH] [Fix] fix --- agent/agent_test.go | 2 ++ bpf/agent_x86_bpfel.go | 12 ++++++------ bpf/agentold_x86_bpfel.go | 12 ++++++------ bpf/pktlatency.bpf.c | 20 +++++++++++++------- bpf/prog.go | 4 ++-- 5 files changed, 29 insertions(+), 21 deletions(-) diff --git a/agent/agent_test.go b/agent/agent_test.go index 1b8f9378..dc67e444 100644 --- a/agent/agent_test.go +++ b/agent/agent_test.go @@ -397,6 +397,7 @@ func TestRecvmsg(t *testing.T) { connIdDirect: bpf.AgentTrafficDirectionTKIngress, pid: uint64(os.Getpid()), fd: uint32(conn.TgidFd), + ignoreFuncName: true, funcName: "syscall", dataLen: uint32(readBufSizeSlice[index]), seq: seq, @@ -644,6 +645,7 @@ func TestSendMsg(t *testing.T) { KernDataEventAssertConditions: KernDataEventAssertConditions{connIdDirect: bpf.AgentTrafficDirectionTKEgress, pid: uint64(os.Getpid()), fd: uint32(conn.TgidFd), + ignoreFuncName: true, funcName: "syscall", dataLen: uint32(len(sendMessages[index])), seq: seq, diff --git a/bpf/agent_x86_bpfel.go b/bpf/agent_x86_bpfel.go index 099e18a7..1a677662 100644 --- a/bpf/agent_x86_bpfel.go +++ b/bpf/agent_x86_bpfel.go @@ -201,8 +201,6 @@ type AgentSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type AgentProgramSpecs struct { - Accept4Entry *ebpf.ProgramSpec `ebpf:"accept4_entry"` - ConnectEntry *ebpf.ProgramSpec `ebpf:"connect_entry"` DevHardStartXmit *ebpf.ProgramSpec `ebpf:"dev_hard_start_xmit"` DevQueueXmit *ebpf.ProgramSpec `ebpf:"dev_queue_xmit"` IpQueueXmit *ebpf.ProgramSpec `ebpf:"ip_queue_xmit"` @@ -220,7 +218,9 @@ type AgentProgramSpecs struct { TcpV4DoRcv *ebpf.ProgramSpec `ebpf:"tcp_v4_do_rcv"` TcpV4Rcv *ebpf.ProgramSpec `ebpf:"tcp_v4_rcv"` TracepointNetifReceiveSkb *ebpf.ProgramSpec `ebpf:"tracepoint__netif_receive_skb"` + TracepointSyscallsSysEnterAccept4 *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_accept4"` TracepointSyscallsSysEnterClose *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_close"` + TracepointSyscallsSysEnterConnect *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_connect"` TracepointSyscallsSysEnterRead *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_read"` TracepointSyscallsSysEnterRecvmsg *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_recvmsg"` TracepointSyscallsSysEnterSendmsg *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_sendmsg"` @@ -327,8 +327,6 @@ func (m *AgentMaps) Close() error { // // It can be passed to LoadAgentObjects or ebpf.CollectionSpec.LoadAndAssign. type AgentPrograms struct { - Accept4Entry *ebpf.Program `ebpf:"accept4_entry"` - ConnectEntry *ebpf.Program `ebpf:"connect_entry"` DevHardStartXmit *ebpf.Program `ebpf:"dev_hard_start_xmit"` DevQueueXmit *ebpf.Program `ebpf:"dev_queue_xmit"` IpQueueXmit *ebpf.Program `ebpf:"ip_queue_xmit"` @@ -346,7 +344,9 @@ type AgentPrograms struct { TcpV4DoRcv *ebpf.Program `ebpf:"tcp_v4_do_rcv"` TcpV4Rcv *ebpf.Program `ebpf:"tcp_v4_rcv"` TracepointNetifReceiveSkb *ebpf.Program `ebpf:"tracepoint__netif_receive_skb"` + TracepointSyscallsSysEnterAccept4 *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_accept4"` TracepointSyscallsSysEnterClose *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_close"` + TracepointSyscallsSysEnterConnect *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_connect"` TracepointSyscallsSysEnterRead *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_read"` TracepointSyscallsSysEnterRecvmsg *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_recvmsg"` TracepointSyscallsSysEnterSendmsg *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_sendmsg"` @@ -368,8 +368,6 @@ type AgentPrograms struct { func (p *AgentPrograms) Close() error { return _AgentClose( - p.Accept4Entry, - p.ConnectEntry, p.DevHardStartXmit, p.DevQueueXmit, p.IpQueueXmit, @@ -387,7 +385,9 @@ func (p *AgentPrograms) Close() error { p.TcpV4DoRcv, p.TcpV4Rcv, p.TracepointNetifReceiveSkb, + p.TracepointSyscallsSysEnterAccept4, p.TracepointSyscallsSysEnterClose, + p.TracepointSyscallsSysEnterConnect, p.TracepointSyscallsSysEnterRead, p.TracepointSyscallsSysEnterRecvmsg, p.TracepointSyscallsSysEnterSendmsg, diff --git a/bpf/agentold_x86_bpfel.go b/bpf/agentold_x86_bpfel.go index f0543a8c..11ce1bf7 100644 --- a/bpf/agentold_x86_bpfel.go +++ b/bpf/agentold_x86_bpfel.go @@ -201,8 +201,6 @@ type AgentOldSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type AgentOldProgramSpecs struct { - Accept4Entry *ebpf.ProgramSpec `ebpf:"accept4_entry"` - ConnectEntry *ebpf.ProgramSpec `ebpf:"connect_entry"` DevHardStartXmit *ebpf.ProgramSpec `ebpf:"dev_hard_start_xmit"` DevQueueXmit *ebpf.ProgramSpec `ebpf:"dev_queue_xmit"` IpQueueXmit *ebpf.ProgramSpec `ebpf:"ip_queue_xmit"` @@ -219,7 +217,9 @@ type AgentOldProgramSpecs struct { TcpV4DoRcv *ebpf.ProgramSpec `ebpf:"tcp_v4_do_rcv"` TcpV4Rcv *ebpf.ProgramSpec `ebpf:"tcp_v4_rcv"` TracepointNetifReceiveSkb *ebpf.ProgramSpec `ebpf:"tracepoint__netif_receive_skb"` + TracepointSyscallsSysEnterAccept4 *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_accept4"` TracepointSyscallsSysEnterClose *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_close"` + TracepointSyscallsSysEnterConnect *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_connect"` TracepointSyscallsSysEnterRead *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_read"` TracepointSyscallsSysEnterRecvmsg *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_recvmsg"` TracepointSyscallsSysEnterSendmsg *ebpf.ProgramSpec `ebpf:"tracepoint__syscalls__sys_enter_sendmsg"` @@ -325,8 +325,6 @@ func (m *AgentOldMaps) Close() error { // // It can be passed to LoadAgentOldObjects or ebpf.CollectionSpec.LoadAndAssign. type AgentOldPrograms struct { - Accept4Entry *ebpf.Program `ebpf:"accept4_entry"` - ConnectEntry *ebpf.Program `ebpf:"connect_entry"` DevHardStartXmit *ebpf.Program `ebpf:"dev_hard_start_xmit"` DevQueueXmit *ebpf.Program `ebpf:"dev_queue_xmit"` IpQueueXmit *ebpf.Program `ebpf:"ip_queue_xmit"` @@ -343,7 +341,9 @@ type AgentOldPrograms struct { TcpV4DoRcv *ebpf.Program `ebpf:"tcp_v4_do_rcv"` TcpV4Rcv *ebpf.Program `ebpf:"tcp_v4_rcv"` TracepointNetifReceiveSkb *ebpf.Program `ebpf:"tracepoint__netif_receive_skb"` + TracepointSyscallsSysEnterAccept4 *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_accept4"` TracepointSyscallsSysEnterClose *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_close"` + TracepointSyscallsSysEnterConnect *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_connect"` TracepointSyscallsSysEnterRead *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_read"` TracepointSyscallsSysEnterRecvmsg *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_recvmsg"` TracepointSyscallsSysEnterSendmsg *ebpf.Program `ebpf:"tracepoint__syscalls__sys_enter_sendmsg"` @@ -364,8 +364,6 @@ type AgentOldPrograms struct { func (p *AgentOldPrograms) Close() error { return _AgentOldClose( - p.Accept4Entry, - p.ConnectEntry, p.DevHardStartXmit, p.DevQueueXmit, p.IpQueueXmit, @@ -382,7 +380,9 @@ func (p *AgentOldPrograms) Close() error { p.TcpV4DoRcv, p.TcpV4Rcv, p.TracepointNetifReceiveSkb, + p.TracepointSyscallsSysEnterAccept4, p.TracepointSyscallsSysEnterClose, + p.TracepointSyscallsSysEnterConnect, p.TracepointSyscallsSysEnterRead, p.TracepointSyscallsSysEnterRecvmsg, p.TracepointSyscallsSysEnterSendmsg, diff --git a/bpf/pktlatency.bpf.c b/bpf/pktlatency.bpf.c index 2b9c530f..8a599431 100644 --- a/bpf/pktlatency.bpf.c +++ b/bpf/pktlatency.bpf.c @@ -1529,17 +1529,20 @@ int tracepoint__syscalls__sys_exit_close(struct trace_event_raw_sys_exit *ctx) //int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen); -SEC("kprobe/__sys_connect") -int BPF_KPROBE(connect_entry, int sockfd, const struct sockaddr* addr) { +// SEC("kprobe/__sys_connect") +// int BPF_KPROBE(connect_entry, int sockfd, const struct sockaddr* addr) { +SEC("tracepoint/syscalls/sys_enter_connect") +int tracepoint__syscalls__sys_enter_connect(struct trace_event_raw_sys_enter *ctx) { uint64_t id = bpf_get_current_pid_tgid(); struct connect_args args = {0}; - args.fd = sockfd; - args.addr = addr; + TP_ARGS(&args.fd, 0, ctx) + TP_ARGS(&args.addr, 1, ctx) args.start_ts = bpf_ktime_get_ns(); bpf_map_update_elem(&connect_args_map, &id, &args, BPF_ANY); return 0; } + SEC("tracepoint/syscalls/sys_exit_connect") int tracepoint__syscalls__sys_exit_connect(struct trace_event_raw_sys_exit *ctx) { uint64_t id = bpf_get_current_pid_tgid(); @@ -1555,12 +1558,15 @@ int tracepoint__syscalls__sys_exit_connect(struct trace_event_raw_sys_exit *ctx) } -SEC("kprobe/accept4") -int BPF_KPROBE(accept4_entry, int sockfd, struct sockaddr* addr) { +// SEC("kprobe/accept4") +// int BPF_KPROBE(accept4_entry, int sockfd, struct sockaddr* addr) { + +SEC("tracepoint/syscalls/sys_enter_accept4") +int tracepoint__syscalls__sys_enter_accept4(struct trace_event_raw_sys_enter *ctx) { uint64_t id = bpf_get_current_pid_tgid(); struct accept_args args = {0}; - args.addr = addr; + TP_ARGS(&args.addr, 1, ctx) bpf_map_update_elem(&accept_args_map, &id, &args, BPF_ANY); return 0; } diff --git a/bpf/prog.go b/bpf/prog.go index 7c7f197f..bbf440dc 100644 --- a/bpf/prog.go +++ b/bpf/prog.go @@ -29,7 +29,7 @@ func GetProgram(programs any, fieldName string) *ebpf.Program { /* accept pair */ func AttachSyscallAcceptEntry(programs interface{}) link.Link { - return kprobe("__sys_accept4", GetProgram(programs, "Accept4Entry")) + return tracepoint("syscalls", "sys_enter_accept4", GetProgram(programs, "TracepointSyscallsSysEnterAccept4")) } func AttachSyscallAcceptExit(programs interface{}) link.Link { @@ -43,7 +43,7 @@ func AttachSyscallSockAllocExit(programs interface{}) link.Link { /* connect pair */ func AttachSyscallConnectEntry(programs interface{}) link.Link { - return kprobe("__sys_connect", GetProgram(programs, "ConnectEntry")) + return tracepoint("syscalls", "sys_enter_connect", GetProgram(programs, "TracepointSyscallsSysEnterConnect")) } func AttachSyscallConnectExit(programs interface{}) link.Link {