GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → YutaroHayakawa → ipftrace

YutaroHayakawa / ipftrace

Licence: Apache-2.0 license
[Deplicated] Now we have more sophisticated (and compact) implementation in ipftrace2 repository. Please check it as well.

Programming Languages

python
139335 projects - #7 most used programming language
c
50402 projects - #5 most used programming language
shell
77523 projects

Labels

networklinux-kerneltracingebpf

Projects that are alternatives of or similar to ipftrace

Ipftrace2
A packet oriented Linux kernel function call tracer
Stars: ✭ 193 (+221.67%)
Mutual labels:  linux-kernel, tracing, ebpf
Ebpf exporter
Prometheus exporter for custom eBPF metrics
Stars: ✭ 829 (+1281.67%)
Mutual labels:  linux-kernel, tracing, ebpf
Tracepkt
Trace a ping packet journey across network interfaces and namespace on recent Linux. Supports IPv4 and IPv6.
Stars: ✭ 176 (+193.33%)
Mutual labels:  tracing, ebpf
Ebpf
eBPF Utilities, Maps, and more
Stars: ✭ 238 (+296.67%)
Mutual labels:  tracing, ebpf
kernel new features
一个深挖 Linux 内核的新功能特性，以 io_uring, cgroup, ebpf, llvm 为代表，包含开源项目，代码案例，文章，视频，架构脑图等
Stars: ✭ 1,094 (+1723.33%)
Mutual labels:  linux-kernel, ebpf
Bpfd
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
Stars: ✭ 396 (+560%)
Mutual labels:  tracing, ebpf
Hubble
Hubble - Network, Service & Security Observability for Kubernetes using eBPF
Stars: ✭ 1,245 (+1975%)
Mutual labels:  tracing, ebpf
ebpfpub
ebpfpub is a generic function tracing library for Linux that supports tracepoints, kprobes and uprobes.
Stars: ✭ 86 (+43.33%)
Mutual labels:  tracing, ebpf
Polycube
eBPF/XDP-based software framework for fast network services running in the Linux kernel.
Stars: ✭ 217 (+261.67%)
Mutual labels:  linux-kernel, ebpf
bpfbox
🐝 BPFBox 📦 Exploring process confinement in eBPF
Stars: ✭ 93 (+55%)
Mutual labels:  linux-kernel, ebpf
rbbcc
BCC port for MRI - this is unofficial bonsai project.
Stars: ✭ 45 (-25%)
Mutual labels:  tracing, ebpf
Bpftrace
High-level tracing language for Linux eBPF
Stars: ✭ 4,526 (+7443.33%)
Mutual labels:  tracing, ebpf
pwru
Packet, where are you? -- Linux kernel networking debugger
Stars: ✭ 694 (+1056.67%)
Mutual labels:  tracing, ebpf
Weaver
Trace Go program execution with uprobes and eBPF
Stars: ✭ 174 (+190%)
Mutual labels:  tracing, ebpf
uprobe-http-tracer
uprobe-based HTTP tracer for Go binaries
Stars: ✭ 45 (-25%)
Mutual labels:  tracing, ebpf
ebpfkit-monitor
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
Stars: ✭ 80 (+33.33%)
Mutual labels:  linux-kernel, ebpf
Lttng Tools
The lttng-tools project provides a session daemon (lttng-sessiond) that acts as a tracing registry, the "lttng" command line for tracing control, a lttng-ctl library for tracing control and a lttng-relayd for network streaming.
Stars: ✭ 202 (+236.67%)
Mutual labels:  linux-kernel, tracing
ebpfkit
ebpfkit is a rootkit powered by eBPF
Stars: ✭ 472 (+686.67%)
Mutual labels:  linux-kernel, ebpf
portablebpf
You came here so you could have a base code to serve you as an example on how to develop a BPF application, compatible to BCC and/or LIBBPF, specially LIBBPF, having the userland part made in C or PYTHON.
Stars: ✭ 32 (-46.67%)
Mutual labels:  linux-kernel, ebpf
merbridge
Use eBPF to speed up your Service Mesh like crossing an Einstein-Rosen Bridge.
Stars: ✭ 469 (+681.67%)
Mutual labels:  ebpf
View All Similar Projects ➔

ipftrace

Now we have more sophisticated (and compact) implementation in ipftrace2 repository. Please check it as well.

TL;DR

ipftrace is a simple function tracer for Linux networking code with flow based filtering. It is similar to the ftrace in some sense but, you can trace which flow have gone through which functions inside the kernel which is usually more important information for the network people than which functions are called information provided by ftrace.

Usage

Usage: ipftrace [OPTIONS] MANIFEST

  Track the journey of the packets in Linux network stack

Options:
  -iv, --ipversion [4|6]  Specify IP version
  -s, --saddr TEXT        Specify IP source address
  -d, --daddr TEXT        Specify IP destination address
  -p, --proto TEXT        Specify protocol
  -sp, --sport TEXT       Specify source port number
  -dp, --dport TEXT       Specify destination port number
  -m, --module TEXT       Specify custom match module name
  -r, --regex TEXT        Filter the function names by regex
  -l, --length INTEGER    Specify the length of function trace
  -ls, --list-func        List available functions
  --help                  Show this message and exit.

Install

Dependencies

  • Python3.7 or above
  • BCC

Docker

$ git clone https://github.com/YutaroHayakawa/ipftrace
$ cd ipftrace
$ sudo ./scripts/ipftrace-docker -p ICMP examples/manifest/generic.yaml

ipftrace-docker is a wrapper script for docker run. Since the ipftrace container requires some boring things to make it work (like expose the Linux source to the container, make container privileged, uploading manifest file to the container and so on), this script does it for you.

On your system

$ git clone https://github.com/YutaroHayakawa/ipftrace
$ cd ipftrace
$ sudo pip3 install .
$ sudo ipftrace -p ICMP examples/manifest/generic.yaml

Examples

Trace the ping ICMP packets

# ipftrace -p ICMP examples/manifest/5.4.0-rc7-btf.yaml
<...>
ICMP	10.231.244.75	->	10.128.218.64
     Time Stamp  Function
495406078818070  nf_hook_slow
495406078929728  ip_output
495406078949359  nf_hook_slow
495406078970951  dev_queue_xmit
495406078986098  netdev_core_pick_tx
495406079008937  sch_direct_xmit
495406079024885  validate_xmit_skb_list
495406079036226  netif_skb_features
495406079057803  passthru_features_check
495406079071811  skb_network_protocol
495406079091507  dev_queue_xmit_nit
495406079106655  skb_clone
495406079132195  consume_skb
495406079143957  skb_release_head_state
495406079157152  skb_clone_tx_timestamp
495406079179885  skb_to_sgvec

ICMP	10.128.218.64	->	10.231.244.75
     Time Stamp  Function
495406112568847  inet_gro_receive
495406112662367  skb_defer_rx_timestamp
495406112712251  consume_skb
495406112732787  ip_rcv
495406112784692  nf_hook_slow
495406112811560  nf_ip_checksum
495406112837230  __skb_checksum_complete
495406112856814  __skb_checksum
495406112883108  ip_route_input_noref
495406112905093  ip_route_input_rcu
495406112928973  fib_validate_source
495406112952321  ip_local_deliver
495406112972174  nf_hook_slow
495406112999152  ip_protocol_deliver_rcu
495406113020418  raw_local_deliver
495406113047608  skb_clone
495406113074430  raw_rcv
495406113109356  ipv4_pktinfo_prepare
495406113132611  sock_queue_rcv_skb
495406113169237  sk_filter_trim_cap
495406113198364  security_sock_rcv_skb
495406113230150  __sock_queue_rcv_skb
495406113260665  icmp_rcv
495406113289802  ping_rcv
495406113368263  kfree_skb

Trace the GSO behavior with custom module

# ipftrace -p TCP -d 10.231.206.32 -dp 8000 -m examples/module/gso.py examples/5.4.0-rc7-btf.yaml
<...>
TCP    10.231.244.75:33696    ->    10.231.206.32:8000
     Time Stamp  Function                      Custom Data
490440712480226  nf_hook_slow                  (len: 2101 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712519497  ip_output                     (len: 2101 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712538213  nf_hook_slow                  (len: 2101 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712549567  skb_gso_validate_network_len  (len: 2101 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712566096  neigh_resolve_output          (len: 2101 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712578933  eth_header                    (len: 2101 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712594839  dev_queue_xmit                (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712604856  netdev_core_pick_tx           (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712614715  sch_direct_xmit               (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712623331  validate_xmit_skb_list        (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712631858  netif_skb_features            (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712641404  passthru_features_check       (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712653638  skb_network_protocol          (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712661015  __skb_gso_segment             (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712673966  skb_mac_gso_segment           (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712683431  skb_network_protocol          (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712688616  inet_gso_segment              (len: 2101 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712705180  tcp_gso_segment               (len: 2081 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712717131  skb_network_protocol          (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712750240  consume_skb                   (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712759857  skb_release_head_state        (len: 2115 gso_size: 1448 gso_segs: 2 gso_type: SKB_GSO_TCPV4)
490440712772181  dev_queue_xmit_nit            (len: 1514 gso_size: 0 gso_segs: 0 gso_type: )

Manifest file

ipftrace needs the YAML file called manifest file. Which seems like below.

functions:
  - name: ip_rcv
    skb_pos: 1

  - name: ip_local_out
    skb_pos: 3

  - name: ip_output
    skb_pos: 3

  - name: ip_local_deliver_finish
    skb_pos: 3
    egress: true

  - name: ip_forward
    skb_pos: 1

  - name: ip_route_input_noref
    skb_pos: 1

<...>

It contains following informtations.

  • name : The symbol name of the function to trace
  • skb_pos : The position of the struct sk_buff* in the function arguments
  • egress : (optional) Indicates the end of the function chain

As for the name, you can specify any kernel functions which takes struct sk_buff* as an argument (the symbol must be exported). In addition to the function name, we need skb_pos which indicates the position of the struct sk_buff* in the argument list of the function (the first argument is position 1).

egress indicates the end of the function tracing. The list of the functions for the flow will be terminated and displayed when the packet reaches to the function annotated with egress: true. You need to find appropriate egress function to get correct result from ipftrace. This is probably a most difficult part of the ipftrace.

As for today, you need to write the manifest file by your self. But the grows of the BTF (BPF Type Format) infrastructure will greatly reduce the time to write it (but you still need to find the egress function). Currently we have an example manifest in the examples. Feel free to use it.

We also have useful experimental script to generate the manifest from BTF information in vmlinux. Please checkout scripts/btf_to_manifest.py.

How it works?

It uses eBPF + kprobe for attaching the tracing programs to the kernel, parse the packet in the kprobe, filter out the unneccesary packets and output some log through perf. That's it.

Limitations and Tips

  • ipftrace cannot trace the function with skb_pos > 4 due to the limitation of the eBPF.
  • We recommend you to mark kfree_skb with egress: true this will catch the case which netfilter drops the packet.
  • ipftrace depends on the skb->network_header and skb->protocol to determine the IP address of the packet. So, if these informations are invalid, it cannot trace the function correctly. Due to this, ipftrace usually cannot trace the functions belongs to the "higher" layer than IP for TX path and "lower" layer than IP for RX path.
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].