[tcpconnect] filter traced connection based on destination ports

Test:
While running:
while [ 1 ]; do nc -w 1 100.127.0.1 80; nc -w 1 100.127.0.1 81; done

root@vagrant:/mnt/bcc# ./tools/tcpconnect.py
PID    COMM         IP SADDR            DADDR            DPORT
19978  nc           4  10.0.2.15        100.127.0.1      80
19979  nc           4  10.0.2.15        100.127.0.1      81
19980  nc           4  10.0.2.15        100.127.0.1      80
19981  nc           4  10.0.2.15        100.127.0.1      81
root@vagrant:/mnt/bcc# ./tools/tcpconnect.py  -P 80
PID    COMM         IP SADDR            DADDR            DPORT
19987  nc           4  10.0.2.15        100.127.0.1      80
19989  nc           4  10.0.2.15        100.127.0.1      80
19991  nc           4  10.0.2.15        100.127.0.1      80
19993  nc           4  10.0.2.15        100.127.0.1      80
19995  nc           4  10.0.2.15        100.127.0.1      80
root@vagrant:/mnt/bcc# ./tools/tcpconnect.py  -P 80,81
PID    COMM         IP SADDR            DADDR            DPORT
8725   nc           4  10.0.2.15        100.127.0.1      80
8726   nc           4  10.0.2.15        100.127.0.1      81
8727   nc           4  10.0.2.15        100.127.0.1      80
8728   nc           4  10.0.2.15        100.127.0.1      81
8729   nc           4  10.0.2.15        100.127.0.1      80

Fixes #681

* add new tool: capable

* refactor a little, remove extra bpf_get_current_pid_tgid()

Use tempfile module to create a temp file

Fix some review input

Fix style check

Style

Style check

Remove builtin module from python test to run fedora ctest

Let the program calling bpf_prog_load to handle the log buffer

Check max instruction before the syscall. Fix other review comment

minor cleanup + process partial name matching

Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

... since they are unused.
Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

Prepare debian changelog for v0.2.0 tag

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

examples: fix indentation in tracing/tcpv4connect

Python doesn't like mixing spaces and tabs.

fileslower: use de->d_name.name, add filtering

fix biosnoop after kernel change

offcputime improvements: use less RAM, add PID/TID support

Add perf_submit_skb

For BPF_PROG_TYPE_SCHED_CLS/ACT, the upstream kernel has recently added a
feature to efficiently output skb + meta data:
commit 555c8a8623a3 ("bpf: avoid stack copy and use skb ctx for event output")

This patch adds perf_submit_skb to BPF_PERF_OUTPUT macro.  It takes
an extra u32 argument.  perf_submit_skb will then be expanded to
bpf_perf_event_output properly to consider the newly added
u32 argument as the skb's len.

Other than the above described changes, perf_submit_skb is almost
a carbon copy of the perf_submit except the removal of the 'string name'
variable since I cannot find a specific use of it.

Note that the 3rd param type of bpf_perf_event_output has also been
changed from u32 to u64.

Added a sample program tc_perf_event.py.  Here is how the output
looks like:
[root@arch-fb-vm1 networking]# ./tc_perf_event.py
Try: "ping -6 ff02::1%me"

CPU SRC IP                           DST IP       Magic
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c

Minor adjustments to the documentation

Fix a few typos
Add missing link
Reword update() description sentence

fix build with 4.0 llvm trunk

Signed-off-by: Alexei Starovoitov <ast@fb.com>

As reported in #664:
In cases where the AST contains a MemberExpr with an invalid opLoc,
rewrite will fail but prior to this change would segfault. Fail a little
more gracefully, even though the program will still be rejected.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Tool to sniff data contents before encrypted with OpenSSL

Now it also captures gnutls_record_send and gnutls_record_recv calls.
Added options to filter by pid or command name, or just one lib.

Add tool as talked in iovisor-dev 'BCC: bpf_probe_read read function arguments'

This reverts commit c6688dda4e856be43b8651afe92d7e32e63faea9.

killsnoop: use current time replace timestamp and default output

* debian packaging: Add missing Build-dependencies

* Add clang-format-3.7 to build-depends
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* debian packaging: Build with -DBCC_KERNEL_HAS_SOURCE_DIR=1

This is required to use the distro-provided includes on Debian/Ubuntu

dcsnoop: use PERF_EVENT_OUTPUT

Add some explanation for functions in BPF program in Tutorial