1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (c) 2020 Anton Protopopov
3 //
4 // Based on tcpconnect(8) from BCC by Brendan Gregg
5 #include <sys/resource.h>
6 #include <arpa/inet.h>
7 #include <argp.h>
8 #include <signal.h>
9 #include <limits.h>
10 #include <unistd.h>
11 #include <time.h>
12 #include <bpf/bpf.h>
13 #include "tcpconnect.h"
14 #include "tcpconnect.skel.h"
15 #include "btf_helpers.h"
16 #include "trace_helpers.h"
17 #include "map_helpers.h"
18
19 #define warn(...) fprintf(stderr, __VA_ARGS__)
20
21 static volatile sig_atomic_t exiting = 0;
22
23 const char *argp_program_version = "tcpconnect 0.1";
24 const char *argp_program_bug_address =
25 "https://github.com/iovisor/bcc/tree/master/libbpf-tools";
26 static const char argp_program_doc[] =
27 "\ntcpconnect: Count/Trace active tcp connections\n"
28 "\n"
29 "EXAMPLES:\n"
30 " tcpconnect # trace all TCP connect()s\n"
31 " tcpconnect -t # include timestamps\n"
32 " tcpconnect -p 181 # only trace PID 181\n"
33 " tcpconnect -P 80 # only trace port 80\n"
34 " tcpconnect -P 80,81 # only trace port 80 and 81\n"
35 " tcpconnect -U # include UID\n"
36 " tcpconnect -u 1000 # only trace UID 1000\n"
37 " tcpconnect -c # count connects per src, dest, port\n"
38 " tcpconnect --C mappath # only trace cgroups in the map\n"
39 " tcpconnect --M mappath # only trace mount namespaces in the map\n"
40 ;
41
get_int(const char * arg,int * ret,int min,int max)42 static int get_int(const char *arg, int *ret, int min, int max)
43 {
44 char *end;
45 long val;
46
47 errno = 0;
48 val = strtol(arg, &end, 10);
49 if (errno) {
50 warn("strtol: %s: %s\n", arg, strerror(errno));
51 return -1;
52 } else if (end == arg || val < min || val > max) {
53 return -1;
54 }
55 if (ret)
56 *ret = val;
57 return 0;
58 }
59
get_ints(const char * arg,int * size,int * ret,int min,int max)60 static int get_ints(const char *arg, int *size, int *ret, int min, int max)
61 {
62 const char *argp = arg;
63 int max_size = *size;
64 int sz = 0;
65 char *end;
66 long val;
67
68 while (sz < max_size) {
69 errno = 0;
70 val = strtol(argp, &end, 10);
71 if (errno) {
72 warn("strtol: %s: %s\n", arg, strerror(errno));
73 return -1;
74 } else if (end == arg || val < min || val > max) {
75 return -1;
76 }
77 ret[sz++] = val;
78 if (*end == 0)
79 break;
80 argp = end + 1;
81 }
82
83 *size = sz;
84 return 0;
85 }
86
get_uint(const char * arg,unsigned int * ret,unsigned int min,unsigned int max)87 static int get_uint(const char *arg, unsigned int *ret,
88 unsigned int min, unsigned int max)
89 {
90 char *end;
91 long val;
92
93 errno = 0;
94 val = strtoul(arg, &end, 10);
95 if (errno) {
96 warn("strtoul: %s: %s\n", arg, strerror(errno));
97 return -1;
98 } else if (end == arg || val < min || val > max) {
99 return -1;
100 }
101 if (ret)
102 *ret = val;
103 return 0;
104 }
105
106 static const struct argp_option opts[] = {
107 { "verbose", 'v', NULL, 0, "Verbose debug output" },
108 { "timestamp", 't', NULL, 0, "Include timestamp on output" },
109 { "count", 'c', NULL, 0, "Count connects per src ip and dst ip/port" },
110 { "print-uid", 'U', NULL, 0, "Include UID on output" },
111 { "pid", 'p', "PID", 0, "Process PID to trace" },
112 { "uid", 'u', "UID", 0, "Process UID to trace" },
113 { "source-port", 's', NULL, 0, "Consider source port when counting" },
114 { "port", 'P', "PORTS", 0,
115 "Comma-separated list of destination ports to trace" },
116 { "cgroupmap", 'C', "PATH", 0, "trace cgroups in this map" },
117 { "mntnsmap", 'M', "PATH", 0, "trace mount namespaces in this map" },
118 { NULL, 'h', NULL, OPTION_HIDDEN, "Show the full help" },
119 {},
120 };
121
122 static struct env {
123 bool verbose;
124 bool count;
125 bool print_timestamp;
126 bool print_uid;
127 pid_t pid;
128 uid_t uid;
129 int nports;
130 int ports[MAX_PORTS];
131 bool source_port;
132 } env = {
133 .uid = (uid_t) -1,
134 };
135
parse_arg(int key,char * arg,struct argp_state * state)136 static error_t parse_arg(int key, char *arg, struct argp_state *state)
137 {
138 int err;
139 int nports;
140
141 switch (key) {
142 case 'h':
143 argp_state_help(state, stderr, ARGP_HELP_STD_HELP);
144 break;
145 case 'v':
146 env.verbose = true;
147 break;
148 case 'c':
149 env.count = true;
150 break;
151 case 's':
152 env.source_port = true;
153 break;
154 case 't':
155 env.print_timestamp = true;
156 break;
157 case 'U':
158 env.print_uid = true;
159 break;
160 case 'p':
161 err = get_int(arg, &env.pid, 1, INT_MAX);
162 if (err) {
163 warn("invalid PID: %s\n", arg);
164 argp_usage(state);
165 }
166 break;
167 case 'u':
168 err = get_uint(arg, &env.uid, 0, (uid_t) -2);
169 if (err) {
170 warn("invalid UID: %s\n", arg);
171 argp_usage(state);
172 }
173 break;
174 case 'P':
175 nports = MAX_PORTS;
176 err = get_ints(arg, &nports, env.ports, 1, 65535);
177 if (err) {
178 warn("invalid PORT_LIST: %s\n", arg);
179 argp_usage(state);
180 }
181 env.nports = nports;
182 break;
183 case 'C':
184 warn("not implemented: --cgroupmap");
185 break;
186 case 'M':
187 warn("not implemented: --mntnsmap");
188 break;
189 default:
190 return ARGP_ERR_UNKNOWN;
191 }
192 return 0;
193 }
194
libbpf_print_fn(enum libbpf_print_level level,const char * format,va_list args)195 static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
196 {
197 if (level == LIBBPF_DEBUG && !env.verbose)
198 return 0;
199 return vfprintf(stderr, format, args);
200 }
201
sig_int(int signo)202 static void sig_int(int signo)
203 {
204 exiting = 1;
205 }
206
print_count_ipv4(int map_fd)207 static void print_count_ipv4(int map_fd)
208 {
209 static struct ipv4_flow_key keys[MAX_ENTRIES];
210 __u32 value_size = sizeof(__u64);
211 __u32 key_size = sizeof(keys[0]);
212 static struct ipv4_flow_key zero;
213 static __u64 counts[MAX_ENTRIES];
214 char s[INET_ADDRSTRLEN];
215 char d[INET_ADDRSTRLEN];
216 __u32 i, n = MAX_ENTRIES;
217 struct in_addr src;
218 struct in_addr dst;
219
220 if (dump_hash(map_fd, keys, key_size, counts, value_size, &n, &zero)) {
221 warn("dump_hash: %s", strerror(errno));
222 return;
223 }
224
225 for (i = 0; i < n; i++) {
226 src.s_addr = keys[i].saddr;
227 dst.s_addr = keys[i].daddr;
228
229 printf("%-25s %-25s",
230 inet_ntop(AF_INET, &src, s, sizeof(s)),
231 inet_ntop(AF_INET, &dst, d, sizeof(d)));
232 if (env.source_port)
233 printf(" %-20d", keys[i].sport);
234 printf(" %-20d", ntohs(keys[i].dport));
235 printf(" %-10llu", counts[i]);
236 printf("\n");
237 }
238 }
239
print_count_ipv6(int map_fd)240 static void print_count_ipv6(int map_fd)
241 {
242 static struct ipv6_flow_key keys[MAX_ENTRIES];
243 __u32 value_size = sizeof(__u64);
244 __u32 key_size = sizeof(keys[0]);
245 static struct ipv6_flow_key zero;
246 static __u64 counts[MAX_ENTRIES];
247 char s[INET6_ADDRSTRLEN];
248 char d[INET6_ADDRSTRLEN];
249 __u32 i, n = MAX_ENTRIES;
250 struct in6_addr src;
251 struct in6_addr dst;
252
253 if (dump_hash(map_fd, keys, key_size, counts, value_size, &n, &zero)) {
254 warn("dump_hash: %s", strerror(errno));
255 return;
256 }
257
258 for (i = 0; i < n; i++) {
259 memcpy(src.s6_addr, keys[i].saddr, sizeof(src.s6_addr));
260 memcpy(dst.s6_addr, keys[i].daddr, sizeof(src.s6_addr));
261
262 printf("%-25s %-25s",
263 inet_ntop(AF_INET6, &src, s, sizeof(s)),
264 inet_ntop(AF_INET6, &dst, d, sizeof(d)));
265 if (env.source_port)
266 printf(" %-20d", keys[i].sport);
267 printf(" %-20d", ntohs(keys[i].dport));
268 printf(" %-10llu", counts[i]);
269 printf("\n");
270 }
271 }
272
print_count_header()273 static void print_count_header()
274 {
275 printf("\n%-25s %-25s", "LADDR", "RADDR");
276 if (env.source_port)
277 printf(" %-20s", "LPORT");
278 printf(" %-20s", "RPORT");
279 printf(" %-10s", "CONNECTS");
280 printf("\n");
281 }
282
print_count(int map_fd_ipv4,int map_fd_ipv6)283 static void print_count(int map_fd_ipv4, int map_fd_ipv6)
284 {
285 while (!exiting)
286 pause();
287
288 print_count_header();
289 print_count_ipv4(map_fd_ipv4);
290 print_count_ipv6(map_fd_ipv6);
291 }
292
print_events_header()293 static void print_events_header()
294 {
295 if (env.print_timestamp)
296 printf("%-9s", "TIME(s)");
297 if (env.print_uid)
298 printf("%-6s", "UID");
299 printf("%-6s %-12s %-2s %-16s %-16s",
300 "PID", "COMM", "IP", "SADDR", "DADDR");
301 if (env.source_port)
302 printf(" %-5s", "SPORT");
303 printf(" %-5s\n", "DPORT");
304 }
305
handle_event(void * ctx,int cpu,void * data,__u32 data_sz)306 static void handle_event(void *ctx, int cpu, void *data, __u32 data_sz)
307 {
308 const struct event *event = data;
309 char src[INET6_ADDRSTRLEN];
310 char dst[INET6_ADDRSTRLEN];
311 union {
312 struct in_addr x4;
313 struct in6_addr x6;
314 } s, d;
315 static __u64 start_ts;
316
317 if (event->af == AF_INET) {
318 s.x4.s_addr = event->saddr_v4;
319 d.x4.s_addr = event->daddr_v4;
320 } else if (event->af == AF_INET6) {
321 memcpy(&s.x6.s6_addr, event->saddr_v6, sizeof(s.x6.s6_addr));
322 memcpy(&d.x6.s6_addr, event->daddr_v6, sizeof(d.x6.s6_addr));
323 } else {
324 warn("broken event: event->af=%d", event->af);
325 return;
326 }
327
328 if (env.print_timestamp) {
329 if (start_ts == 0)
330 start_ts = event->ts_us;
331 printf("%-9.3f", (event->ts_us - start_ts) / 1000000.0);
332 }
333
334 if (env.print_uid)
335 printf("%-6d", event->uid);
336
337 printf("%-6d %-12.12s %-2d %-16s %-16s",
338 event->pid, event->task,
339 event->af == AF_INET ? 4 : 6,
340 inet_ntop(event->af, &s, src, sizeof(src)),
341 inet_ntop(event->af, &d, dst, sizeof(dst)));
342
343 if (env.source_port)
344 printf(" %-5d", event->sport);
345
346 printf(" %-5d", ntohs(event->dport));
347
348 printf("\n");
349 }
350
handle_lost_events(void * ctx,int cpu,__u64 lost_cnt)351 static void handle_lost_events(void *ctx, int cpu, __u64 lost_cnt)
352 {
353 warn("Lost %llu events on CPU #%d!\n", lost_cnt, cpu);
354 }
355
print_events(int perf_map_fd)356 static void print_events(int perf_map_fd)
357 {
358 struct perf_buffer *pb;
359 int err;
360
361 pb = perf_buffer__new(perf_map_fd, 128,
362 handle_event, handle_lost_events, NULL, NULL);
363 if (!pb) {
364 err = -errno;
365 warn("failed to open perf buffer: %d\n", err);
366 goto cleanup;
367 }
368
369 print_events_header();
370 while (!exiting) {
371 err = perf_buffer__poll(pb, 100);
372 if (err < 0 && err != -EINTR) {
373 warn("error polling perf buffer: %s\n", strerror(-err));
374 goto cleanup;
375 }
376 /* reset err to return 0 if exiting */
377 err = 0;
378 }
379
380 cleanup:
381 perf_buffer__free(pb);
382 }
383
main(int argc,char ** argv)384 int main(int argc, char **argv)
385 {
386 LIBBPF_OPTS(bpf_object_open_opts, open_opts);
387 static const struct argp argp = {
388 .options = opts,
389 .parser = parse_arg,
390 .doc = argp_program_doc,
391 .args_doc = NULL,
392 };
393 struct tcpconnect_bpf *obj;
394 int i, err;
395
396 err = argp_parse(&argp, argc, argv, 0, NULL, NULL);
397 if (err)
398 return err;
399
400 libbpf_set_print(libbpf_print_fn);
401
402 err = ensure_core_btf(&open_opts);
403 if (err) {
404 fprintf(stderr, "failed to fetch necessary BTF for CO-RE: %s\n", strerror(-err));
405 return 1;
406 }
407
408 obj = tcpconnect_bpf__open_opts(&open_opts);
409 if (!obj) {
410 warn("failed to open BPF object\n");
411 return 1;
412 }
413
414 if (env.count)
415 obj->rodata->do_count = true;
416 if (env.pid)
417 obj->rodata->filter_pid = env.pid;
418 if (env.uid != (uid_t) -1)
419 obj->rodata->filter_uid = env.uid;
420 if (env.nports > 0) {
421 obj->rodata->filter_ports_len = env.nports;
422 for (i = 0; i < env.nports; i++) {
423 obj->rodata->filter_ports[i] = htons(env.ports[i]);
424 }
425 }
426 if (env.source_port)
427 obj->rodata->source_port = true;
428
429 err = tcpconnect_bpf__load(obj);
430 if (err) {
431 warn("failed to load BPF object: %d\n", err);
432 goto cleanup;
433 }
434
435 err = tcpconnect_bpf__attach(obj);
436 if (err) {
437 warn("failed to attach BPF programs: %s\n", strerror(-err));
438 goto cleanup;
439 }
440
441 if (signal(SIGINT, sig_int) == SIG_ERR) {
442 warn("can't set signal handler: %s\n", strerror(errno));
443 err = 1;
444 goto cleanup;
445 }
446
447 if (env.count) {
448 print_count(bpf_map__fd(obj->maps.ipv4_count),
449 bpf_map__fd(obj->maps.ipv6_count));
450 } else {
451 print_events(bpf_map__fd(obj->maps.events));
452 }
453
454 cleanup:
455 tcpconnect_bpf__destroy(obj);
456 cleanup_core_btf(&open_opts);
457
458 return err != 0;
459 }
460