%PDF-
%PDF-
Mini Shell
Mini Shell
| Direktori : /sbin/ |
|
|
|
| Current File : //sbin/bindsnoop-bpfcc |
#! /usr/bin/python3
#
# bindsnoop Trace IPv4 and IPv6 binds()s.
# For Linux, uses BCC, eBPF. Embedded C.
#
# based on tcpconnect utility from Brendan Gregg's suite.
#
# USAGE: bindsnoop [-h] [-t] [-E] [-p PID] [-P PORT[,PORT ...]] [-w]
# [--count] [--cgroupmap mappath] [--mntnsmap mappath]
#
# bindsnoop reports socket options set before the bind call
# that would impact this system call behavior:
# SOL_IP IP_FREEBIND F....
# SOL_IP IP_TRANSPARENT .T...
# SOL_IP IP_BIND_ADDRESS_NO_PORT ..N..
# SOL_SOCKET SO_REUSEADDR ...R.
# SOL_SOCKET SO_REUSEPORT ....r
#
# SO_BINDTODEVICE interface is reported as "BOUND_IF" index
#
# This uses dynamic tracing of kernel functions, and will need to be updated
# to match kernel changes.
#
# Copyright (c) 2020-present Facebook.
# Licensed under the Apache License, Version 2.0 (the "License")
#
# 14-Feb-2020 Pavel Dubovitsky Created this.
from __future__ import print_function, absolute_import, unicode_literals
from bcc import BPF
from bcc.containers import filter_by_containers
from bcc.utils import printb
import argparse
import re
from os import strerror
from socket import (
inet_ntop, AF_INET, AF_INET6, __all__ as socket_all, __dict__ as socket_dct
)
from struct import pack
from time import sleep
# arguments
examples = """examples:
./bindsnoop # trace all TCP bind()s
./bindsnoop -t # include timestamps
./bindsnoop -w # wider columns (fit IPv6)
./bindsnoop -p 181 # only trace PID 181
./bindsnoop -P 80 # only trace port 80
./bindsnoop -P 80,81 # only trace port 80 and 81
./bindsnoop -U # include UID
./bindsnoop -u 1000 # only trace UID 1000
./bindsnoop -E # report bind errors
./bindsnoop --count # count bind per src ip
./bindsnoop --cgroupmap mappath # only trace cgroups in this BPF map
./bindsnoop --mntnsmap mappath # only trace mount namespaces in the map
it is reporting socket options set before the bins call
impacting system call behavior:
SOL_IP IP_FREEBIND F....
SOL_IP IP_TRANSPARENT .T...
SOL_IP IP_BIND_ADDRESS_NO_PORT ..N..
SOL_SOCKET SO_REUSEADDR ...R.
SOL_SOCKET SO_REUSEPORT ....r
SO_BINDTODEVICE interface is reported as "IF" index
"""
parser = argparse.ArgumentParser(
description="Trace TCP binds",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog=examples)
parser.add_argument("-t", "--timestamp", action="store_true",
help="include timestamp on output")
parser.add_argument("-w", "--wide", action="store_true",
help="wide column output (fits IPv6 addresses)")
parser.add_argument("-p", "--pid",
help="trace this PID only")
parser.add_argument("-P", "--port",
help="comma-separated list of ports to trace.")
parser.add_argument("-E", "--errors", action="store_true",
help="include errors in the output.")
parser.add_argument("-U", "--print-uid", action="store_true",
help="include UID on output")
parser.add_argument("-u", "--uid",
help="trace this UID only")
parser.add_argument("--count", action="store_true",
help="count binds per src ip and port")
parser.add_argument("--cgroupmap",
help="trace cgroups in this BPF map only")
parser.add_argument("--mntnsmap",
help="trace mount namespaces in this BPF map only")
parser.add_argument("--ebpf", action="store_true",
help=argparse.SUPPRESS)
parser.add_argument("--debug-source", action="store_true",
help=argparse.SUPPRESS)
args = parser.parse_args()
# define BPF program
bpf_text = """
#include <uapi/linux/ptrace.h>
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wtautological-compare"
#include <net/sock.h>
#pragma clang diagnostic pop
#include <net/inet_sock.h>
#include <net/net_namespace.h>
#include <bcc/proto.h>
BPF_HASH(currsock, u32, struct socket *);
// separate data structs for ipv4 and ipv6
struct ipv4_bind_data_t {
u64 ts_us;
u32 pid;
u32 uid;
u64 ip;
u32 saddr;
u32 bound_dev_if;
int return_code;
u16 sport;
u8 socket_options;
u8 protocol;
char task[TASK_COMM_LEN];
};
BPF_PERF_OUTPUT(ipv4_bind_events);
struct ipv6_bind_data_t {
// int128 would be aligned on 16 bytes boundary, better to go first
unsigned __int128 saddr;
u64 ts_us;
u32 pid;
u32 uid;
u64 ip;
u32 bound_dev_if;
int return_code;
u16 sport;
u8 socket_options;
u8 protocol;
char task[TASK_COMM_LEN];
};
BPF_PERF_OUTPUT(ipv6_bind_events);
// separate flow keys per address family
struct ipv4_flow_key_t {
u32 saddr;
u16 sport;
};
BPF_HASH(ipv4_count, struct ipv4_flow_key_t);
struct ipv6_flow_key_t {
unsigned __int128 saddr;
u16 sport;
};
BPF_HASH(ipv6_count, struct ipv6_flow_key_t);
// bind options for event reporting
union bind_options {
u8 data;
struct {
u8 freebind:1;
u8 transparent:1;
u8 bind_address_no_port:1;
u8 reuseaddress:1;
u8 reuseport:1;
} fields;
};
// TODO: add reporting for the original bind arguments
int bindsnoop_entry(struct pt_regs *ctx, struct socket *socket)
{
u64 pid_tgid = bpf_get_current_pid_tgid();
u32 pid = pid_tgid >> 32;
u32 tid = pid_tgid;
FILTER_PID
u32 uid = bpf_get_current_uid_gid();
FILTER_UID
if (container_should_be_filtered()) {
return 0;
}
// stash the sock ptr for lookup on return
currsock.update(&tid, &socket);
return 0;
};
static int bindsnoop_return(struct pt_regs *ctx, short ipver)
{
int ret = PT_REGS_RC(ctx);
u64 pid_tgid = bpf_get_current_pid_tgid();
u32 pid = pid_tgid >> 32;
u32 tid = pid_tgid;
struct socket **skpp;
skpp = currsock.lookup(&tid);
if (skpp == 0) {
return 0; // missed entry
}
int ignore_errors = 1;
FILTER_ERRORS
if (ret != 0 && ignore_errors) {
// failed to bind
currsock.delete(&tid);
return 0;
}
// pull in details
struct socket *skp_ = *skpp;
struct sock *skp = skp_->sk;
struct inet_sock *sockp = (struct inet_sock *)skp;
u16 sport = 0;
bpf_probe_read_kernel(&sport, sizeof(sport), &sockp->inet_sport);
sport = ntohs(sport);
FILTER_PORT
union bind_options opts = {0};
u8 bitfield;
// fetching freebind, transparent, and bind_address_no_port bitfields
// via the next struct member, rcv_tos
bitfield = (u8) *(&sockp->rcv_tos - 2) & 0xFF;
// IP_FREEBIND (sockp->freebind)
opts.fields.freebind = bitfield >> 2 & 0x01;
// IP_TRANSPARENT (sockp->transparent)
opts.fields.transparent = bitfield >> 5 & 0x01;
// IP_BIND_ADDRESS_NO_PORT (sockp->bind_address_no_port)
opts.fields.bind_address_no_port = *(&sockp->rcv_tos - 1) & 0x01;
// SO_REUSEADDR and SO_REUSEPORT are bitfields that
// cannot be accessed directly, fetched via the next struct member,
// __sk_common.skc_bound_dev_if
bitfield = *((u8*)&skp->__sk_common.skc_bound_dev_if - 1);
// SO_REUSEADDR (skp->reuse)
// it is 4 bit, but we are interested in the lowest one
opts.fields.reuseaddress = bitfield & 0x0F;
// SO_REUSEPORT (skp->reuseport)
opts.fields.reuseport = bitfield >> 4 & 0x01;
// workaround for reading the sk_protocol bitfield (from tcpaccept.py):
u16 protocol;
int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs);
int sk_lingertime_offset = offsetof(struct sock, sk_lingertime);
// Since kernel v5.6 sk_protocol has its own u16 field
if (sk_lingertime_offset - gso_max_segs_offset == 2)
protocol = skp->sk_protocol;
else if (sk_lingertime_offset - gso_max_segs_offset == 4)
// 4.10+ with little endian
#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
protocol = *(u8 *)((u64)&skp->sk_gso_max_segs - 3);
else
// pre-4.10 with little endian
protocol = *(u8 *)((u64)&skp->sk_wmem_queued - 3);
#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
// 4.10+ with big endian
protocol = *(u8 *)((u64)&skp->sk_gso_max_segs - 1);
else
// pre-4.10 with big endian
protocol = *(u8 *)((u64)&skp->sk_wmem_queued - 1);
#else
# error "Fix your compiler's __BYTE_ORDER__?!"
#endif
if (ipver == 4) {
IPV4_CODE
} else /* 6 */ {
IPV6_CODE
}
currsock.delete(&tid);
return 0;
}
int bindsnoop_v4_return(struct pt_regs *ctx)
{
return bindsnoop_return(ctx, 4);
}
int bindsnoop_v6_return(struct pt_regs *ctx)
{
return bindsnoop_return(ctx, 6);
}
"""
struct_init = {
'ipv4': {
'count': """
struct ipv4_flow_key_t flow_key = {};
flow_key.saddr = skp->__sk_common.skc_rcv_saddr;
flow_key.sport = sport;
ipv4_count.increment(flow_key);""",
'trace': """
struct ipv4_bind_data_t data4 = {.pid = pid, .ip = ipver};
data4.uid = bpf_get_current_uid_gid();
data4.ts_us = bpf_ktime_get_ns() / 1000;
bpf_probe_read_kernel(
&data4.saddr, sizeof(data4.saddr), &sockp->inet_saddr);
data4.return_code = ret;
data4.sport = sport;
data4.bound_dev_if = skp->__sk_common.skc_bound_dev_if;
data4.socket_options = opts.data;
data4.protocol = protocol;
bpf_get_current_comm(&data4.task, sizeof(data4.task));
ipv4_bind_events.perf_submit(ctx, &data4, sizeof(data4));"""
},
'ipv6': {
'count': """
struct ipv6_flow_key_t flow_key = {};
bpf_probe_read_kernel(&flow_key.saddr, sizeof(flow_key.saddr),
skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
flow_key.sport = sport;
ipv6_count.increment(flow_key);""",
'trace': """
struct ipv6_bind_data_t data6 = {.pid = pid, .ip = ipver};
data6.uid = bpf_get_current_uid_gid();
data6.ts_us = bpf_ktime_get_ns() / 1000;
bpf_probe_read_kernel(&data6.saddr, sizeof(data6.saddr),
skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
data6.return_code = ret;
data6.sport = sport;
data6.bound_dev_if = skp->__sk_common.skc_bound_dev_if;
data6.socket_options = opts.data;
data6.protocol = protocol;
bpf_get_current_comm(&data6.task, sizeof(data6.task));
ipv6_bind_events.perf_submit(ctx, &data6, sizeof(data6));"""
},
}
# code substitutions
if args.count:
bpf_text = bpf_text.replace("IPV4_CODE", struct_init['ipv4']['count'])
bpf_text = bpf_text.replace("IPV6_CODE", struct_init['ipv6']['count'])
else:
bpf_text = bpf_text.replace("IPV4_CODE", struct_init['ipv4']['trace'])
bpf_text = bpf_text.replace("IPV6_CODE", struct_init['ipv6']['trace'])
if args.pid:
bpf_text = bpf_text.replace('FILTER_PID',
'if (pid != %s) { return 0; }' % args.pid)
if args.port:
sports = [int(sport) for sport in args.port.split(',')]
sports_if = ' && '.join(['sport != %d' % sport for sport in sports])
bpf_text = bpf_text.replace('FILTER_PORT',
'if (%s) { currsock.delete(&tid); return 0; }' % sports_if)
if args.uid:
bpf_text = bpf_text.replace('FILTER_UID',
'if (uid != %s) { return 0; }' % args.uid)
if args.errors:
bpf_text = bpf_text.replace('FILTER_ERRORS', 'ignore_errors = 0;')
bpf_text = filter_by_containers(args) + bpf_text
bpf_text = bpf_text.replace('FILTER_PID', '')
bpf_text = bpf_text.replace('FILTER_PORT', '')
bpf_text = bpf_text.replace('FILTER_UID', '')
bpf_text = bpf_text.replace('FILTER_ERRORS', '')
# selecting output format - 80 characters or wide, fitting IPv6 addresses
header_fmt = "%8s %-12.12s %-4s %-15s %-5s %5s %2s"
output_fmt = b"%8d %-12.12s %-4.4s %-15.15s %5d %-5s %2d"
error_header_fmt = "%3s "
error_output_fmt = b"%3s "
error_value_fmt = str
if args.wide:
header_fmt = "%10s %-12.12s %-4s %-39s %-5s %5s %2s"
output_fmt = b"%10d %-12.12s %-4s %-39s %5d %-5s %2d"
error_header_fmt = "%-25s "
error_output_fmt = b"%-25s "
error_value_fmt = strerror
if args.ebpf:
print(bpf_text)
exit()
# L4 protocol resolver
class L4Proto:
def __init__(self):
self.num2str = {}
proto_re = re.compile("IPPROTO_(.*)")
for attr in socket_all:
proto_match = proto_re.match(attr)
if proto_match:
self.num2str[socket_dct[attr]] = proto_match.group(1)
def proto2str(self, proto):
return self.num2str.get(proto, "UNKNOWN")
l4 = L4Proto()
# bind options:
# SOL_IP IP_FREEBIND F....
# SOL_IP IP_TRANSPARENT .T...
# SOL_IP IP_BIND_ADDRESS_NO_PORT ..N..
# SOL_SOCKET SO_REUSEADDR ...R.
# SOL_SOCKET SO_REUSEPORT ....r
def opts2str(bitfield):
str_options = ""
bit = 1
for opt in "FTNRr":
str_options += opt if bitfield & bit else "."
bit *= 2
return str_options.encode()
# process events
def print_ipv4_bind_event(cpu, data, size):
event = b["ipv4_bind_events"].event(data)
global start_ts
if args.timestamp:
if start_ts == 0:
start_ts = event.ts_us
printb(b"%-9.6f " % ((float(event.ts_us) - start_ts) / 1000000), nl="")
if args.print_uid:
printb(b"%6d " % event.uid, nl="")
if args.errors:
printb(
error_output_fmt % error_value_fmt(event.return_code).encode(),
nl="",
)
printb(output_fmt % (event.pid, event.task,
l4.proto2str(event.protocol).encode(),
inet_ntop(AF_INET, pack("I", event.saddr)).encode(),
event.sport, opts2str(event.socket_options), event.bound_dev_if))
def print_ipv6_bind_event(cpu, data, size):
event = b["ipv6_bind_events"].event(data)
global start_ts
if args.timestamp:
if start_ts == 0:
start_ts = event.ts_us
printb(b"%-9.6f " % ((float(event.ts_us) - start_ts) / 1000000), nl="")
if args.print_uid:
printb(b"%6d " % event.uid, nl="")
if args.errors:
printb(
error_output_fmt % error_value_fmt(event.return_code).encode(),
nl="",
)
printb(output_fmt % (event.pid, event.task,
l4.proto2str(event.protocol).encode(),
inet_ntop(AF_INET6, event.saddr).encode(),
event.sport, opts2str(event.socket_options), event.bound_dev_if))
def depict_cnt(counts_tab, l3prot='ipv4'):
for k, v in sorted(
counts_tab.items(), key=lambda counts: counts[1].value, reverse=True
):
depict_key = ""
if l3prot == 'ipv4':
depict_key = "%-32s %20s" % (
(inet_ntop(AF_INET, pack('I', k.saddr))), k.sport
)
else:
depict_key = "%-32s %20s" % (
(inet_ntop(AF_INET6, k.saddr)), k.sport
)
print("%s %-10d" % (depict_key, v.value))
# initialize BPF
b = BPF(text=bpf_text)
b.attach_kprobe(event="inet_bind", fn_name="bindsnoop_entry")
b.attach_kprobe(event="inet6_bind", fn_name="bindsnoop_entry")
b.attach_kretprobe(event="inet_bind", fn_name="bindsnoop_v4_return")
b.attach_kretprobe(event="inet6_bind", fn_name="bindsnoop_v6_return")
print("Tracing binds ... Hit Ctrl-C to end")
if args.count:
try:
while 1:
sleep(99999999)
except KeyboardInterrupt:
pass
# header
print("\n%-32s %20s %-10s" % (
"LADDR", "LPORT", "BINDS"))
depict_cnt(b["ipv4_count"])
depict_cnt(b["ipv6_count"], l3prot='ipv6')
# read events
else:
# header
if args.timestamp:
print("%-9s " % ("TIME(s)"), end="")
if args.print_uid:
print("%6s " % ("UID"), end="")
if args.errors:
print(error_header_fmt % ("RC"), end="")
print(header_fmt % ("PID", "COMM", "PROT", "ADDR", "PORT", "OPTS", "IF"))
start_ts = 0
# read events
b["ipv4_bind_events"].open_perf_buffer(print_ipv4_bind_event)
b["ipv6_bind_events"].open_perf_buffer(print_ipv6_bind_event)
while 1:
try:
b.perf_buffer_poll()
except KeyboardInterrupt:
exit()
Zerion Mini Shell 1.0