Feature to quickly discern heavily retransmitting flows and
therefore spotting culprit network paths.
Signed-off-by: Matthias Tafelmeier <matthias.tafelmeier@gmx.net>

add padding to the end of structure

execsnoop: fix the prototype for kprobe__sys_execve

provide padded structure for table_{key|leaf}_desc API

Commit 538a84e1 ("provide padded structure for
table_{key|leaf}_desc API") added explicit padding, if needed,
before every structure member.

This is not enough as if an array of elements are returned
from C++ to python side, the size of structure must be correct.

This patch also adds padding after the last structure field
to make structure size in python side consistent with C++
side. With this patch, I experimented with the pull request
for tcpretrans.py by Matthias Tafelmeier, the type
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u64 lport;
      u64 dport;
  }
can be replaced with
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u16 lport;
      u16 dport;
  }
where the original type of lport/dport is u16.
Some other ipv6 related data structures can also be simplified.
Signed-off-by: Yonghong Song <yhs@fb.com>

For sys_execve() the type of filename parameter should be
"const char __user *" instead of "struct filename *".

The fix doesn't imply any functional change.

Do not print to stderr if user specified log buffer

This patch intends to fix issue #606.

Currently, the key/value type information is passed from
C++ to Python through a JSON interface. The JSON is
constructed by traversing the struct/field's through clang
AST interface. Once Python gets the JSON, it will
reconstruct the C structure through ctype module.

There are two known issues where Python reconstructed
C structure may not be the same as the original C structure:
  . if user explicitly use "__attribute__ ((align))" to alter
    field alignment and such information is not passed to
    Python.
  . the "__int128" type is a u64[2] array in python.
    So in C, __int128 needs to align on 16 bytes boundary, and
    in Python, it aligns with 8 bytes boundary.

To solve this issue, this patch provided the structure
with added padding fields to Python. For example,
  struct {
    char a;
    __int128 b;
  };
Python will receive
  struct {
    char a;
    char __pad_1[15];
    __int128 b;
  };
Signed-off-by: Yonghong Song <yhs@fb.com>

sync compat headers with latest net-next

The same header is in torvalds/linux 4.15 rc2.
Signed-off-by: Yonghong Song <yhs@fb.com>

Update INSTALL instructions for binary packages

The old link to netperf is dead, but a copy exists in the iovisor repo
(for the buildbots to use).
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

* Update the instructions to reflect recent package availability
  * Nightly/stable packages for Ubuntu Xenial+Artful
  * Nightly/stable packages for Fedora 26+27
  * Remove references to Trusty as those are no longer being built
  * Remove references to Fedora 24 as those are no longer being built
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Use ctypes.byref() instead of ctypes.pointer() in cases where we do not
need the actual pointer object itself as it is much lighter.

python: make _decode_table_types aware of __int128

Do not keep Loader instances around

Fix 'test_libbcc' from failing in certain scenarios

man/bps: Add a man page for introspection/bps.c

There are no ctypes types ready for int128. However, recognizing this
type and representing it as an array is better than simply erroring out.

* Add mapping between (unsigned) __128 C types declaration and ctypes
  parsing
* Add simple test case in test_clang to recognisze and use such types
* Fixes deprecation warnings about self.assertEquals in 2 other test
  cases.

This patch adds a man page for bps.c and also introduces
bps in README.md
Signed-off-by: Martin KaFai Lau <kafai@fb.com>

libbpf: Enable the creation of unbound raw socket

force linking the whole api-static library into shared library

When a static library is linked to produce a shared library,
only referenced symbols in the static library eventually
gets linked.

api-static library has entry points for C++ API.
Many symbols in this library do not have references
outside of this library and will get dropped during
linking process.

This patch forces the linking of the whole api-static
library in order to procude bcc shared library.
Reported-by: Mauricio Vasquez <mauricio.vasquez@polito.it>
Signed-off-by: Yonghong Song <yhs@fb.com>

funcslower: add a note about nested calls

Passing a NULL (or empty) char string to bpf_open_raw_sock() will skip
the bind call on the newly created raw socket. This can create sniffers
for all interfaces using a single socket filter.

The dns_matching example has been updated to default to 'any' interface
if noone is specified in the arguments.

funcslower: fix missing tgid when filtering by pid

* The name encoding function was not checking the constraints on domain
  names properly (<= 253 chars as one byte is needed for the name of the
  label and one for the terminating 0-len label; <= 63 chars per label).
* The name encoding function was erroring when assigning a struct value
  in the byte array (Python 3.6.3). Refactored to join successive
  subarrays, and moved the null padding to make it explicit that it is
  needed by the bpf map key (and not the dns encoding).
* Used builtin from argparse to have a list of domains in the command
  line arguments.
* Reset the non-block flag through fcntl directly instead of
  reconstructing a socket object.
* Exit gracefully when triggering SIGINT as hinted.

Update info about installing stable packages
for Ubuntu Xenial in INSTALL.md

Fixes:#1440

Update perf event type and config checks

solisten.py maintenance

This fixes 'test_usdt_probes', called from 'test_libbcc', from
failing if the static markers are in libruby rather than a ruby
executable. So, when the path of the binary having the markers
is tested, we must check if either "/ruby" or "/libruby" is a
substring rather than only checking for the former.

Also, rather than relying on hardcoded values for the number of
locations and arguments for a given probe, we capture this info
using the readelf tool and then compare these with the values
reported by bcc. This is because these numbers may vary across
different versions of ruby and will cause the tests to fail.
For example, 'test_libbcc' fails on Fedora 26 with ruby-2.4 as
the number of locations where it expects 'array__create' is 7
even when it is actually 2 as reported by bcc and verified with
readelf output.
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>

This fixes 'test_c_api', called from 'test_libbcc', from failing
if the name of the first symbol with the address of "strtok" in
libc as returned by bcc_symcache_resolve() is not "strtok" but
some other alias pointing to the same address. For glibc-2.25 on
powerpc, a mismatch occurs as the name of the first symbol with
the same address as that of "strtok" is "__GI_strtok". This can
be verified from the output of the nm tool on Fedora 26 ppc64le
as shown below.

  00000000000b59c0 t __GI_strtok
  00000000000b59c0 T strtok
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>

This introduces a separate source file for adding common
utilities which can be used by any of the cc tests. For
now, we add a function to read values from the output of
a command with a format string like scanf().
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>