Switch IPv4 saddr/daddr to u32's within tools/tcpstates.py (#1862)

make types appropriate for ipaddr/protocol etc.

tools/tcpaccept.py

@@ -51,22 +51,22 @@ bpf_text = """
 struct ipv4_data_t {
     // XXX: switch some to u32's when supported
     u64 ts_us;
-    u64 pid;
+    u32 pid;
     u32 saddr;
     u32 daddr;
     u64 ip;
-    u64 lport;
+    u16 lport;
     char task[TASK_COMM_LEN];
 };
 BPF_PERF_OUTPUT(ipv4_events);
 
 struct ipv6_data_t {
     u64 ts_us;
-    u64 pid;
+    u32 pid;
     unsigned __int128 saddr;
     unsigned __int128 daddr;
     u64 ip;
-    u64 lport;
+    u16 lport;
     char task[TASK_COMM_LEN];
 };
 BPF_PERF_OUTPUT(ipv6_events);
@@ -212,22 +212,22 @@ TASK_COMM_LEN = 16      # linux/sched.h
 class Data_ipv4(ct.Structure):
     _fields_ = [
         ("ts_us", ct.c_ulonglong),
-        ("pid", ct.c_ulonglong),
+        ("pid", ct.c_uint),
         ("saddr", ct.c_uint),
         ("daddr", ct.c_uint),
         ("ip", ct.c_ulonglong),
-        ("lport", ct.c_ulonglong),
+        ("lport", ct.c_ushort),
         ("task", ct.c_char * TASK_COMM_LEN)
     ]
 
 class Data_ipv6(ct.Structure):
     _fields_ = [
         ("ts_us", ct.c_ulonglong),
-        ("pid", ct.c_ulonglong),
+        ("pid", ct.c_uint),
         ("saddr", (ct.c_ulonglong * 2)),
         ("daddr", (ct.c_ulonglong * 2)),
         ("ip", ct.c_ulonglong),
-        ("lport", ct.c_ulonglong),
+        ("lport", ct.c_ushort),
         ("task", ct.c_char * TASK_COMM_LEN)
     ]
 

tools/tcpconnect.py

@@ -59,22 +59,22 @@ BPF_HASH(currsock, u32, struct sock *);
 struct ipv4_data_t {
     // XXX: switch some to u32's when supported
     u64 ts_us;
-    u64 pid;
-    u64 saddr;
-    u64 daddr;
+    u32 pid;
+    u32 saddr;
+    u32 daddr;
     u64 ip;
-    u64 dport;
+    u16 dport;
     char task[TASK_COMM_LEN];
 };
 BPF_PERF_OUTPUT(ipv4_events);
 
 struct ipv6_data_t {
     u64 ts_us;
-    u64 pid;
+    u32 pid;
     unsigned __int128 saddr;
     unsigned __int128 daddr;
     u64 ip;
-    u64 dport;
+    u16 dport;
     char task[TASK_COMM_LEN];
 };
 BPF_PERF_OUTPUT(ipv6_events);
@@ -175,22 +175,22 @@ TASK_COMM_LEN = 16      # linux/sched.h
 class Data_ipv4(ct.Structure):
     _fields_ = [
         ("ts_us", ct.c_ulonglong),
-        ("pid", ct.c_ulonglong),
-        ("saddr", ct.c_ulonglong),
-        ("daddr", ct.c_ulonglong),
+        ("pid", ct.c_uint),
+        ("saddr", ct.c_uint),
+        ("daddr", ct.c_uint),
         ("ip", ct.c_ulonglong),
-        ("dport", ct.c_ulonglong),
+        ("dport", ct.c_ushort),
         ("task", ct.c_char * TASK_COMM_LEN)
     ]
 
 class Data_ipv6(ct.Structure):
     _fields_ = [
         ("ts_us", ct.c_ulonglong),
-        ("pid", ct.c_ulonglong),
+        ("pid", ct.c_uint),
         ("saddr", (ct.c_ulonglong * 2)),
         ("daddr", (ct.c_ulonglong * 2)),
         ("ip", ct.c_ulonglong),
-        ("dport", ct.c_ulonglong),
+        ("dport", ct.c_ushort),
         ("task", ct.c_char * TASK_COMM_LEN)
     ]
 

tools/tcpdrop.py

@@ -54,8 +54,8 @@ BPF_STACK_TRACE(stack_traces, 1024);
 struct ipv4_data_t {
     u32 pid;
     u64 ip;
-    u64 saddr;
-    u64 daddr;
+    u32 saddr;
+    u32 daddr;
     u16 sport;
     u16 dport;
     u8 state;
@@ -113,7 +113,9 @@ int trace_tcp_drop(struct pt_regs *ctx, struct sock *sk, struct sk_buff *skb)
     dport = ntohs(dport);
 
     if (family == AF_INET) {
-        struct ipv4_data_t data4 = {.pid = pid, .ip = 4};
+        struct ipv4_data_t data4 = {};
+        data4.pid = pid;
+        data4.ip = 4;
         data4.saddr = ip->saddr;
         data4.daddr = ip->daddr;
         data4.dport = dport;
@@ -150,10 +152,10 @@ if debug or args.ebpf:
 # event data
 class Data_ipv4(ct.Structure):
     _fields_ = [
-        ("pid", ct.c_ulong),
+        ("pid", ct.c_uint),
         ("ip", ct.c_ulonglong),
-        ("saddr", ct.c_ulonglong),
-        ("daddr", ct.c_ulonglong),
+        ("saddr", ct.c_uint),
+        ("daddr", ct.c_uint),
         ("sport", ct.c_ushort),
         ("dport", ct.c_ushort),
         ("state", ct.c_ubyte),
@@ -163,7 +165,7 @@ class Data_ipv4(ct.Structure):
 
 class Data_ipv6(ct.Structure):
     _fields_ = [
-        ("pid", ct.c_ulong),
+        ("pid", ct.c_uint),
         ("ip", ct.c_ulonglong),
         ("saddr", (ct.c_ulonglong * 2)),
         ("daddr", (ct.c_ulonglong * 2)),

tools/tcplife.py

@@ -78,9 +78,9 @@ BPF_HASH(birth, struct sock *, u64);
 struct ipv4_data_t {
     // XXX: switch some to u32's when supported
     u64 ts_us;
-    u64 pid;
-    u64 saddr;
-    u64 daddr;
+    u32 pid;
+    u32 saddr;
+    u32 daddr;
     u64 ports;
     u64 rx_b;
     u64 tx_b;
@@ -91,7 +91,7 @@ BPF_PERF_OUTPUT(ipv4_events);
 
 struct ipv6_data_t {
     u64 ts_us;
-    u64 pid;
+    u32 pid;
     unsigned __int128 saddr;
     unsigned __int128 daddr;
     u64 ports;
@@ -195,8 +195,10 @@ int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)
     u16 family = sk->__sk_common.skc_family;
 
     if (family == AF_INET) {
-        struct ipv4_data_t data4 = {.span_us = delta_us,
-            .rx_b = rx_b, .tx_b = tx_b};
+        struct ipv4_data_t data4 = {};
+        data4.span_us = delta_us;
+        data4.rx_b = rx_b;
+        data4.tx_b = tx_b;
         data4.ts_us = bpf_ktime_get_ns() / 1000;
         data4.saddr = sk->__sk_common.skc_rcv_saddr;
         data4.daddr = sk->__sk_common.skc_daddr;
@@ -316,11 +318,13 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state)
     tx_b = tp->bytes_acked;
 
     if (args->family == AF_INET) {
-        struct ipv4_data_t data4 = {.span_us = delta_us,
-            .rx_b = rx_b, .tx_b = tx_b};
+        struct ipv4_data_t data4 = {};
+        data4.span_us = delta_us;
+        data4.rx_b = rx_b;
+        data4.tx_b = tx_b;
         data4.ts_us = bpf_ktime_get_ns() / 1000;
-        bpf_probe_read(&data4.saddr, sizeof(u32), args->saddr);
-        bpf_probe_read(&data4.daddr, sizeof(u32), args->daddr);
+        __builtin_memcpy(&data4.saddr, args->saddr, sizeof(data4.saddr));
+        __builtin_memcpy(&data4.daddr, args->daddr, sizeof(data4.daddr));
         // a workaround until data4 compiles with separate lport/dport
         data4.ports = dport + ((0ULL + lport) << 32);
         data4.pid = pid;
@@ -336,8 +340,8 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state)
         struct ipv6_data_t data6 = {.span_us = delta_us,
             .rx_b = rx_b, .tx_b = tx_b};
         data6.ts_us = bpf_ktime_get_ns() / 1000;
-        bpf_probe_read(&data6.saddr, sizeof(data6.saddr), args->saddr_v6);
-        bpf_probe_read(&data6.daddr, sizeof(data6.daddr), args->saddr_v6);
+        __builtin_memcpy(&data6.saddr, args->saddr_v6, sizeof(data6.saddr));
+        __builtin_memcpy(&data6.daddr, args->daddr_v6, sizeof(data6.daddr));
         // a workaround until data6 compiles with separate lport/dport
         data6.ports = dport + ((0ULL + lport) << 32);
         data6.pid = pid;
@@ -390,9 +394,9 @@ TASK_COMM_LEN = 16      # linux/sched.h
 class Data_ipv4(ct.Structure):
     _fields_ = [
         ("ts_us", ct.c_ulonglong),
-        ("pid", ct.c_ulonglong),
-        ("saddr", ct.c_ulonglong),
-        ("daddr", ct.c_ulonglong),
+        ("pid", ct.c_uint),
+        ("saddr", ct.c_uint),
+        ("daddr", ct.c_uint),
         ("ports", ct.c_ulonglong),
         ("rx_b", ct.c_ulonglong),
         ("tx_b", ct.c_ulonglong),
@@ -403,7 +407,7 @@ class Data_ipv4(ct.Structure):
 class Data_ipv6(ct.Structure):
     _fields_ = [
         ("ts_us", ct.c_ulonglong),
-        ("pid", ct.c_ulonglong),
+        ("pid", ct.c_uint),
         ("saddr", (ct.c_ulonglong * 2)),
         ("daddr", (ct.c_ulonglong * 2)),
         ("ports", ct.c_ulonglong),

tools/tcpretrans.py

@@ -54,24 +54,24 @@ bpf_text = """
 // separate data structs for ipv4 and ipv6
 struct ipv4_data_t {
     // XXX: switch some to u32's when supported
-    u64 pid;
+    u32 pid;
     u64 ip;
-    u64 saddr;
-    u64 daddr;
-    u64 lport;
-    u64 dport;
+    u32 saddr;
+    u32 daddr;
+    u16 lport;
+    u16 dport;
     u64 state;
     u64 type;
 };
 BPF_PERF_OUTPUT(ipv4_events);
 
 struct ipv6_data_t {
-    u64 pid;
+    u32 pid;
     u64 ip;
     unsigned __int128 saddr;
     unsigned __int128 daddr;
-    u64 lport;
-    u64 dport;
+    u16 lport;
+    u16 dport;
     u64 state;
     u64 type;
 };
@@ -142,7 +142,10 @@ struct_init = { 'ipv4':
                flow_key.dport = ntohs(dport);""",
                'trace' :
                """
-               struct ipv4_data_t data4 = {.pid = pid, .ip = 4, .type = type};
+               struct ipv4_data_t data4 = {};
+               data4.pid = pid;
+               data4.ip = 4;
+               data4.type = type;
                data4.saddr = skp->__sk_common.skc_rcv_saddr;
                data4.daddr = skp->__sk_common.skc_daddr;
                // lport is host order
@@ -197,24 +200,24 @@ if debug or args.ebpf:
 # event data
 class Data_ipv4(ct.Structure):
     _fields_ = [
-        ("pid", ct.c_ulonglong),
+        ("pid", ct.c_uint),
         ("ip", ct.c_ulonglong),
-        ("saddr", ct.c_ulonglong),
-        ("daddr", ct.c_ulonglong),
-        ("lport", ct.c_ulonglong),
-        ("dport", ct.c_ulonglong),
+        ("saddr", ct.c_uint),
+        ("daddr", ct.c_uint),
+        ("lport", ct.c_ushort),
+        ("dport", ct.c_ushort),
         ("state", ct.c_ulonglong),
         ("type", ct.c_ulonglong)
     ]
 
 class Data_ipv6(ct.Structure):
     _fields_ = [
-        ("pid", ct.c_ulonglong),
+        ("pid", ct.c_uint),
         ("ip", ct.c_ulonglong),
         ("saddr", (ct.c_ulonglong * 2)),
         ("daddr", (ct.c_ulonglong * 2)),
-        ("lport", ct.c_ulonglong),
-        ("dport", ct.c_ulonglong),
+        ("lport", ct.c_ushort),
+        ("dport", ct.c_ushort),
         ("state", ct.c_ulonglong),
         ("type", ct.c_ulonglong)
     ]

tools/tcpstates.py

@@ -68,8 +68,8 @@ BPF_HASH(last, struct sock *, u64);
 struct ipv4_data_t {
     u64 ts_us;
     u64 skaddr;
-    u64 saddr;
-    u64 daddr;
+    u32 saddr;
+    u32 daddr;
     u64 span_us;
     u32 pid;
     u32 ports;
@@ -129,8 +129,8 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state)
             .oldstate = args->oldstate, .newstate = args->newstate};
         data4.skaddr = (u64)args->skaddr;
         data4.ts_us = bpf_ktime_get_ns() / 1000;
-        bpf_probe_read(&data4.saddr, sizeof(u32), args->saddr);
-        bpf_probe_read(&data4.daddr, sizeof(u32), args->daddr);
+        __builtin_memcpy(&data4.saddr, args->saddr, sizeof(data4.saddr));
+        __builtin_memcpy(&data4.daddr, args->daddr, sizeof(data4.daddr));
         // a workaround until data4 compiles with separate lport/dport
         data4.ports = dport + ((0ULL + lport) << 32);
         data4.pid = pid;
@@ -144,8 +144,8 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state)
             .oldstate = args->oldstate, .newstate = args->newstate};
         data6.skaddr = (u64)args->skaddr;
         data6.ts_us = bpf_ktime_get_ns() / 1000;
-        bpf_probe_read(&data6.saddr, sizeof(data6.saddr), args->saddr_v6);
-        bpf_probe_read(&data6.daddr, sizeof(data6.daddr), args->saddr_v6);
+        __builtin_memcpy(&data6.saddr, args->saddr_v6, sizeof(data6.saddr));
+        __builtin_memcpy(&data6.daddr, args->daddr_v6, sizeof(data6.daddr));
         // a workaround until data6 compiles with separate lport/dport
         data6.ports = dport + ((0ULL + lport) << 32);
         data6.pid = pid;
@@ -191,8 +191,8 @@ class Data_ipv4(ct.Structure):
     _fields_ = [
         ("ts_us", ct.c_ulonglong),
         ("skaddr", ct.c_ulonglong),
-        ("saddr", ct.c_ulonglong),
-        ("daddr", ct.c_ulonglong),
+        ("saddr", ct.c_uint),
+        ("daddr", ct.c_uint),
         ("span_us", ct.c_ulonglong),
         ("pid", ct.c_uint),
         ("ports", ct.c_uint),