/usr/share/systemtap/tapset/linux
Edit: /usr/share/systemtap/tapset/linux/tcp.stp (22642B)
// TCP tapset
// Copyright (C) 2006 IBM Corp.
// Copyright (C) 2006 Intel Corporation.
// Copyright (C) 2007, 2010, 2012-2018 Red Hat, Inc.
//
// This file is part of systemtap, and is free software. You can
// redistribute it and/or modify it under the terms of the GNU General
// Public License (GPL); either version 2, or (at your option) any
// later version.
//
// This family of probe points is used to probe events that occur in the TCP layer,
//
// See the BZ1546179 block comment in tapset/linux/networking.stp for
// an explanation of the try/catch statements around sk_buff structure
// accesses.
%{
#include
#include
#include
#include
#include
%}
// Get retransmission timeout in usecs. RTO is initialized from default
// retransmission time, but can be adjusted (increased) each time we
// retransmit. It should always be less than the max value of TCP retransmission
// timeout (TCP_RTO_MAX)
function tcp_get_info_rto:long(sock:long)
%{ /* pure */
struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock;
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
struct tcp_opt *tp = tcp_sk(sk);
STAP_RETVALUE = (int64_t) jiffies_to_usecs(kread(&(tp->rto)));
#else
const struct inet_connection_sock *icsk = inet_csk(sk);
STAP_RETVALUE = (int64_t) jiffies_to_usecs(kread(&(icsk->icsk_rto)));
#endif
CATCH_DEREF_FAULT();
%}
//Get congestion window segment size. Initial value of congestion window size
//typically set to one segment (i.e., slow start algorithm, each segment can be 512 bytes).
//This congestion window size can be dynamically increased based on whether TCP
//is performing slow start or congestion avoidance.
function tcp_get_info_snd_cwnd:long(sock:long)
%{ /* pure */
struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock;
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
struct tcp_opt *tp = tcp_sk(sk);
#else
struct tcp_sock *tp = tcp_sk(sk);
#endif
STAP_RETVALUE = (int64_t) kread(&(tp->snd_cwnd));
CATCH_DEREF_FAULT();
%}
//
//Definitions of the TCP protocol sk_state field listed below.
//
// TCP_ESTABLISHED = 1, Normal data transfer
// TCP_SYN_SENT = 2, App. has started to open a connection
// TCP_SYN_RECV = 3, A connection request has arrived; wait for ACK
// TCP_FIN_WAIT1 = 4, App. has said it is finished
// TCP_FIN_WAIT2 = 5, The other side has agreed to close
// TCP_TIME_WAIT = 6, Wait for all packets to die off
// TCP_CLOSE = 7, No connection is active or pending
// TCP_CLOSE_WAIT = 8, The other side has initiated a release
// TCP_LAST_ACK = 9, Last ACK, wait for all packets to die off
// TCP_LISTEN = 10, Waiting for incoming call
// TCP_CLOSING = 11, Both sides have tried to close simultaneously
// TCP_MAX_STATES = 12 Max states number
//
function tcp_ts_get_info_state:long(sock:long)
%{ /* pure */
struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock;
STAP_RETVALUE = (int64_t) kread(&(sk->sk_state));
CATCH_DEREF_FAULT();
%}
/* return the TCP destination port for a given sock */
function __tcp_sock_dport:long (sock:long)
{
port = @choose_defined(@inet_sock_cast(sock)->sk->__sk_common->skc_dport, # kernel >= 3.8
@choose_defined(@inet_sock_cast(sock)->inet_dport, # kernel >= 2.6.33
@choose_defined(@inet_sock_cast(sock)->dport, # kernel >= 2.6.11
@inet_sock_cast(sock)->inet->dport)))
return ntohs(port)
}
/* returns the TCP header for recent (<2.6.21) kernel */
@__private30 function __get_skb_tcphdr_new:long(skb:long)
%{ /* pure */
struct sk_buff *skb;
skb = (struct sk_buff *)(uintptr_t)STAP_ARG_skb;
/* as done by skb_transport_header() */
#ifdef NET_SKBUFF_DATA_USES_OFFSET
STAP_RETVALUE = (long)(kread(&(skb->head)) + kread(&(skb->transport_header)));
#else
STAP_RETVALUE = (long)kread(&(skb->transport_header));
#endif
CATCH_DEREF_FAULT();
%}
/* returns the TCP header for a given sk_buff structure */
function __get_skb_tcphdr:long(skb:long)
{
%( kernel_v < "2.6.21" %?
tcphdr = @cast(skb, "sk_buff")->h->raw
return tcphdr
%:
return __get_skb_tcphdr_new(skb)
%)
}
/* returns TCP URG flag for a given sk_buff structure */
function __tcp_skb_urg:long (tcphdr:long)
{
return @cast(tcphdr, "tcphdr", "kernel")->urg
}
/* returns TCP ACK flag for a given sk_buff structure */
function __tcp_skb_ack:long (tcphdr:long)
{
return @cast(tcphdr, "tcphdr", "kernel")->ack
}
/* returns TCP PSH flag for a given sk_buff structure */
function __tcp_skb_psh:long (tcphdr:long)
{
return @cast(tcphdr, "tcphdr", "kernel")->psh
}
/* returns TCP RST flag for a given sk_buff structure */
function __tcp_skb_rst:long (tcphdr:long)
{
return @cast(tcphdr, "tcphdr", "kernel")->rst
}
/* returns TCP SYN flag for a given sk_buff structure */
function __tcp_skb_syn:long (tcphdr:long)
{
return @cast(tcphdr, "tcphdr", "kernel")->syn
}
/* returns TCP FIN flag for a given sk_buff structure */
function __tcp_skb_fin:long (tcphdr:long)
{
return @cast(tcphdr, "tcphdr", "kernel")->fin
}
/* returns TCP source port for a given sk_buff structure */
function __tcp_skb_sport:long (tcphdr:long)
{
return ntohs(@cast(tcphdr, "tcphdr", "kernel")->source)
}
/* returns TCP destination port for a given sk_buff structure */
function __tcp_skb_dport:long (tcphdr:long){
return ntohs(@cast(tcphdr, "tcphdr", "kernel")->dest)
}
/* return the TCP source port for a given sock */
function __tcp_sock_sport:long (sock:long)
{
port = @choose_defined(@inet_sock_cast(sock)->inet_sport, # kernel >= 2.6.33
@choose_defined(@inet_sock_cast(sock)->sport, # kernel >= 2.6.11
@inet_sock_cast(sock)->inet->sport))
return ntohs(port)
}
@__private30 global sockstate[12]
probe init {
sockstate[1] = "TCP_ESTABLISHED"
sockstate[2] = "TCP_SYN_SENT"
sockstate[3] = "TCP_SYN_RECV"
sockstate[4] = "TCP_FIN_WAIT1"
sockstate[5] = "TCP_FIN_WAIT2"
sockstate[6] = "TCP_TIME_WAIT"
sockstate[7] = "TCP_CLOSE"
sockstate[8] = "TCP_CLOSE_WAIT"
sockstate[9] = "TCP_LAST_ACK"
sockstate[10] = "TCP_LISTEN"
sockstate[11] = "TCP_CLOSING"
sockstate[12] = "TCP_MAX_STATES"
}
function tcp_sockstate_str:string (state:long) {
return (state in sockstate ? sockstate[state] : "UNDEF")
}
// Get slow start threshold size. If cwnd size is less than or equal to
// threshold size, then TCP is in slow start; otherwise TCP is in congestion
// avoidance.
function tcp_ts_get_info_snd_ssthresh:long(sock:long)
%{ /* pure */
struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock;
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
struct tcp_opt *tp = tcp_sk(sk);
#else
struct tcp_sock *tp = tcp_sk(sk);
#endif
STAP_RETVALUE = (int64_t) kread(&(tp->snd_ssthresh));
CATCH_DEREF_FAULT();
%}
// Get receiver's advertised segment size. TCP typically never sends more
// than what receiver can accept.
function tcp_ts_get_info_rcv_mss:long(sock:long)
%{ /* pure */
struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock;
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
struct tcp_opt *tp = tcp_sk(sk);
STAP_RETVALUE = (int64_t) kread(&(tp->ack.rcv_mss));
#else
const struct inet_connection_sock *icsk = inet_csk(sk);
STAP_RETVALUE = (int64_t) kread(&(icsk->icsk_ack.rcv_mss));
#endif
CATCH_DEREF_FAULT();
%}
%{
// Define newer IPv4 sockopt constants for older kernels.
#ifndef TCP_CONGESTION
#define TCP_CONGESTION 0
#endif
#ifndef TCP_MD5SIG
#define TCP_MD5SIG 0
#endif
#ifndef TCP_COOKIE_TRANSACTIONS
#define TCP_COOKIE_TRANSACTIONS 0
#endif
#ifndef TCP_THIN_LINEAR_TIMEOUTS
#define TCP_THIN_LINEAR_TIMEOUTS 0
#endif
#ifndef TCP_THIN_DUPACK
#define TCP_THIN_DUPACK 0
#endif
#ifndef TCP_USER_TIMEOUT
#define TCP_USER_TIMEOUT 0
#endif
%}
@__private30 global __sockopt[18]
probe init {
__sockopt[@const("TCP_NODELAY")] = "TCP_NODELAY"
__sockopt[@const("TCP_MAXSEG")] = "TCP_MAXSEG"
__sockopt[@const("TCP_CORK")] = "TCP_CORK"
__sockopt[@const("TCP_KEEPIDLE")] = "TCP_KEEPIDLE"
__sockopt[@const("TCP_KEEPINTVL")] = "TCP_KEEPINTVL"
__sockopt[@const("TCP_KEEPCNT")] = "TCP_KEEPCNT"
__sockopt[@const("TCP_SYNCNT")] = "TCP_SYNCNT"
__sockopt[@const("TCP_LINGER2")] = "TCP_LINGER2"
__sockopt[@const("TCP_DEFER_ACCEPT")] = "TCP_DEFER_ACCEPT"
__sockopt[@const("TCP_WINDOW_CLAMP")] = "TCP_WINDOW_CLAMP"
__sockopt[@const("TCP_INFO")] = "TCP_INFO"
__sockopt[@const("TCP_QUICKACK")] = "TCP_QUICKACK"
if (@const("TCP_CONGESTION") > 0)
__sockopt[@const("TCP_CONGESTION")]
= "TCP_CONGESTION"
if (@const("TCP_MD5SIG") > 0)
__sockopt[@const("TCP_MD5SIG")] = "TCP_MD5SIG"
if (@const("TCP_COOKIE_TRANSACTIONS") > 0)
__sockopt[@const("TCP_COOKIE_TRANSACTIONS")]
= "TCP_COOKIE_TRANSACTIONS"
if (@const("TCP_THIN_LINEAR_TIMEOUTS") > 0)
__sockopt[@const("TCP_THIN_LINEAR_TIMEOUTS")]
= "TCP_THIN_LINEAR_TIMEOUTS"
if (@const("TCP_THIN_DUPACK") > 0)
__sockopt[@const("TCP_THIN_DUPACK")]
= "TCP_THIN_DUPACK"
if (@const("TCP_USER_TIMEOUT") > 0)
__sockopt[@const("TCP_USER_TIMEOUT")]
= "TCP_USER_TIMEOUT"
}
function tcp_sockopt_str:string (optname:long)
{
return (optname in __sockopt ? __sockopt[optname]
: sprintf("UNDEF_SOCKOPT(%d)", optname))
}
%{
// Define newer IPv6 sockopt constants for older kernels.
#include
#ifndef IPV6_2292PKTINFO
#define IPV6_2292PKTINFO 0
#endif
#ifndef IPV6_2292HOPOPTS
#define IPV6_2292HOPOPTS 0
#endif
#ifndef IPV6_2292DSTOPTS
#define IPV6_2292DSTOPTS 0
#endif
#ifndef IPV6_2292RTHDR
#define IPV6_2292RTHDR 0
#endif
#ifndef IPV6_2292PKTOPTIONS
#define IPV6_2292PKTOPTIONS 0
#endif
#ifndef IPV6_2292HOPLIMIT
#define IPV6_2292HOPLIMIT 0
#endif
#ifndef IPV6_RECVPKTINFO
#define IPV6_RECVPKTINFO 0
#endif
#ifndef IPV6_RECVHOPLIMIT
#define IPV6_RECVHOPLIMIT 0
#endif
#ifndef IPV6_RECVHOPOPTS
#define IPV6_RECVHOPOPTS 0
#endif
#ifndef IPV6_RTHDRDSTOPTS
#define IPV6_RTHDRDSTOPTS 0
#endif
#ifndef IPV6_RECVRTHDR
#define IPV6_RECVRTHDR 0
#endif
#ifndef IPV6_RECVDSTOPTS
#define IPV6_RECVDSTOPTS 0
#endif
#ifndef IPV6_RECVPATHMTU
#define IPV6_RECVPATHMTU 0
#endif
#ifndef IPV6_PATHMTU
#define IPV6_PATHMTU 0
#endif
#ifndef IPV6_DONTFRAG
#define IPV6_DONTFRAG 0
#endif
#ifndef IPV6_ADDR_PREFERENCES
#define IPV6_ADDR_PREFERENCES 0
#endif
#ifndef IPV6_MINHOPCOUNT
#define IPV6_MINHOPCOUNT 0
#endif
#ifndef IPV6_RECVORIGDSTADDR
#define IPV6_RECVORIGDSTADDR 0
#endif
#ifndef IPV6_TRANSPARENT
#define IPV6_TRANSPARENT 0
#endif
%}
@__private30 global __ipv6_sockopt[55]
probe init {
__ipv6_sockopt[@const("IPV6_ADDRFORM")] = "IPV6_ADDRFORM"
if (@const("IPV6_2292PKTINFO") > 0)
__ipv6_sockopt[@const("IPV6_2292PKTINFO")]
= "IPV6_2292PKTINFO"
if (@const("IPV6_2292HOPOPTS") > 0)
__ipv6_sockopt[@const("IPV6_2292HOPOPTS")]
= "IPV6_2292HOPOPTS"
if (@const("IPV6_2292DSTOPTS") > 0)
__ipv6_sockopt[@const("IPV6_2292DSTOPTS")]
= "IPV6_2292DSTOPTS"
if (@const("IPV6_2292RTHDR") > 0)
__ipv6_sockopt[@const("IPV6_2292RTHDR")]
= "IPV6_2292RTHDR"
if (@const("IPV6_2292PKTOPTIONS") > 0)
__ipv6_sockopt[@const("IPV6_2292PKTOPTIONS")]
= "IPV6_2292PKTOPTIONS"
__ipv6_sockopt[@const("IPV6_CHECKSUM")] = "IPV6_CHECKSUM"
if (@const("IPV6_2292HOPLIMIT") > 0)
__ipv6_sockopt[@const("IPV6_2292HOPLIMIT")]
= "IPV6_2292HOPLIMIT"
__ipv6_sockopt[@const("IPV6_NEXTHOP")] = "IPV6_NEXTHOP"
__ipv6_sockopt[@const("IPV6_AUTHHDR")] = "IPV6_AUTHHDR"
__ipv6_sockopt[@const("IPV6_FLOWINFO")] = "IPV6_FLOWINFO"
__ipv6_sockopt[@const("IPV6_UNICAST_HOPS")]
= "IPV6_UNICAST_HOPS"
__ipv6_sockopt[@const("IPV6_MULTICAST_IF")]
= "IPV6_MULTICAST_IF"
__ipv6_sockopt[@const("IPV6_MULTICAST_HOPS")]
= "IPV6_MULTICAST_HOPS"
__ipv6_sockopt[@const("IPV6_MULTICAST_LOOP")]
= "IPV6_MULTICAST_LOOP"
__ipv6_sockopt[@const("IPV6_ADD_MEMBERSHIP")]
= "IPV6_ADD_MEMBERSHIP"
__ipv6_sockopt[@const("IPV6_DROP_MEMBERSHIP")]
= "IPV6_DROP_MEMBERSHIP"
__ipv6_sockopt[@const("IPV6_ROUTER_ALERT")]
= "IPV6_ROUTER_ALERT"
__ipv6_sockopt[@const("IPV6_MTU_DISCOVER")]
= "IPV6_MTU_DISCOVER"
__ipv6_sockopt[@const("IPV6_MTU")] = "IPV6_MTU"
__ipv6_sockopt[@const("IPV6_RECVERR")] = "IPV6_RECVERR"
__ipv6_sockopt[@const("IPV6_V6ONLY")] = "IPV6_V6ONLY"
__ipv6_sockopt[@const("IPV6_JOIN_ANYCAST")]
= "IPV6_JOIN_ANYCAST"
__ipv6_sockopt[@const("IPV6_LEAVE_ANYCAST")]
= "IPV6_LEAVE_ANYCAST"
__ipv6_sockopt[@const("IPV6_FLOWLABEL_MGR")]
= "IPV6_FLOWLABEL_MGR"
__ipv6_sockopt[@const("IPV6_FLOWINFO_SEND")]
= "IPV6_FLOWINFO_SEND"
__ipv6_sockopt[@const("IPV6_IPSEC_POLICY")]
= "IPV6_IPSEC_POLICY"
__ipv6_sockopt[@const("IPV6_XFRM_POLICY")]
= "IPV6_XFRM_POLICY"
__ipv6_sockopt[@const("MCAST_JOIN_GROUP")]
= "MCAST_JOIN_GROUP"
__ipv6_sockopt[@const("MCAST_BLOCK_SOURCE")]
= "MCAST_BLOCK_SOURCE"
__ipv6_sockopt[@const("MCAST_UNBLOCK_SOURCE")]
= "MCAST_UNBLOCK_SOURCE"
__ipv6_sockopt[@const("MCAST_LEAVE_GROUP")]
= "MCAST_LEAVE_GROUP"
__ipv6_sockopt[@const("MCAST_JOIN_SOURCE_GROUP")]
= "MCAST_JOIN_SOURCE_GROUP"
__ipv6_sockopt[@const("MCAST_LEAVE_SOURCE_GROUP")]
= "MCAST_LEAVE_SOURCE_GROUP"
__ipv6_sockopt[@const("MCAST_MSFILTER")] = "MCAST_MSFILTER"
if (@const("IPV6_RECVPKTINFO") > 0)
__ipv6_sockopt[@const("IPV6_RECVPKTINFO")]
= "IPV6_RECVPKTINFO"
__ipv6_sockopt[@const("IPV6_PKTINFO")] = "IPV6_PKTINFO"
if (@const("IPV6_RECVHOPLIMIT") > 0)
__ipv6_sockopt[@const("IPV6_RECVHOPLIMIT")]
= "IPV6_RECVHOPLIMIT"
__ipv6_sockopt[@const("IPV6_HOPLIMIT")] = "IPV6_HOPLIMIT"
if (@const("IPV6_RECVHOPOPTS") > 0)
__ipv6_sockopt[@const("IPV6_RECVHOPOPTS")]
= "IPV6_RECVHOPOPTS"
__ipv6_sockopt[@const("IPV6_HOPOPTS")] = "IPV6_HOPOPTS"
if (@const("IPV6_RTHDRDSTOPTS") > 0)
__ipv6_sockopt[@const("IPV6_RTHDRDSTOPTS")]
= "IPV6_RTHDRDSTOPTS"
if (@const("IPV6_RECVRTHDR") > 0)
__ipv6_sockopt[@const("IPV6_RECVRTHDR")]
= "IPV6_RECVRTHDR"
__ipv6_sockopt[@const("IPV6_RTHDR")] = "IPV6_RTHDR"
if (@const("IPV6_RECVDSTOPTS") > 0)
__ipv6_sockopt[@const("IPV6_RECVDSTOPTS")]
= "IPV6_RECVDSTOPTS"
__ipv6_sockopt[@const("IPV6_DSTOPTS")] = "IPV6_DSTOPTS"
if (@const("IPV6_RECVPATHMTU") > 0)
__ipv6_sockopt[@const("IPV6_RECVPATHMTU")]
= "IPV6_RECVPATHMTU"
if (@const("IPV6_PATHMTU") > 0)
__ipv6_sockopt[@const("IPV6_PATHMTU")]
= "IPV6_PATHMTU"
if (@const("IPV6_DONTFRAG") > 0)
__ipv6_sockopt[@const("IPV6_DONTFRAG")]
= "IPV6_DONTFRAG"
__ipv6_sockopt[@const("IPV6_RECVTCLASS")]
= "IPV6_RECVTCLASS"
__ipv6_sockopt[@const("IPV6_TCLASS")] = "IPV6_TCLASS"
if (@const("IPV6_ADDR_PREFERENCES") > 0)
__ipv6_sockopt[@const("IPV6_ADDR_PREFERENCES")]
= "IPV6_ADDR_PREFERENCES"
if (@const("IPV6_MINHOPCOUNT") > 0)
__ipv6_sockopt[@const("IPV6_MINHOPCOUNT")]
= "IPV6_MINHOPCOUNT"
if (@const("IPV6_RECVORIGDSTADDR") > 0)
__ipv6_sockopt[@const("IPV6_RECVORIGDSTADDR")]
= "IPV6_RECVORIGDSTADDR"
if (@const("IPV6_TRANSPARENT") > 0)
__ipv6_sockopt[@const("IPV6_TRANSPARENT")]
= "IPV6_TRANSPARENT"
}
function tcp_ipv6_sockopt_str:string (optname:long)
{
return (optname in __ipv6_sockopt ? __ipv6_sockopt[optname]
: sprintf("UNDEF_SOCKOPT(%d)", optname))
}
/**
* probe tcp.sendmsg - Sending a tcp message
* @name: Name of this probe
* @sock: Network socket
* @family: IP address family
* @size: Number of bytes to send
*
* Context:
* The process which sends a tcp message
*/
probe tcp.sendmsg = kernel.function("tcp_sendmsg") {
name = "tcp.sendmsg"
sock = (@defined($sock) ? $sock->sk : $sk)
family = __ip_sock_family(@defined($sock) ? $sock->sk : $sk)
size = $size
}
/**
* probe tcp.sendmsg.return - Sending TCP message is done
* @name: Name of this probe
* @size: Number of bytes sent or error code if an error occurred.
*
* Context:
* The process which sends a tcp message
*/
probe tcp.sendmsg.return = kernel.function("tcp_sendmsg").return {
name = "tcp.sendmsg"
size = $return
}
/**
* probe tcp.recvmsg - Receiving TCP message
* @name: Name of this probe
* @sock: Network socket
* @size: Number of bytes to be received
* @family: IP address family
* @saddr: A string representing the source IP address
* @daddr: A string representing the destination IP address
* @sport: TCP source port
* @dport: TCP destination port
* Context:
* The process which receives a tcp message
*/
probe tcp.recvmsg = kernel.function("tcp_recvmsg") {
name = "tcp.recvmsg"
sock = $sk
size = $len
family = __ip_sock_family($sk)
saddr = format_ipaddr(__ip_sock_saddr($sk), __ip_sock_family($sk))
daddr = format_ipaddr(__ip_sock_daddr($sk), __ip_sock_family($sk))
sport = __tcp_sock_sport($sk)
dport = __tcp_sock_dport($sk)
}
/**
* probe tcp.recvmsg.return - Receiving TCP message complete
* @name: Name of this probe
* @size: Number of bytes received or error code if an error occurred.
* @family: IP address family
* @saddr: A string representing the source IP address
* @daddr: A string representing the destination IP address
* @sport: TCP source port
* @dport: TCP destination port
*
* Context:
* The process which receives a tcp message
*/
probe tcp.recvmsg.return = kernel.function("tcp_recvmsg").return {
name = "tcp.recvmsg"
size = $return
family = __ip_sock_family(@entry($sk))
saddr = format_ipaddr(__ip_sock_saddr(@entry($sk)), __ip_sock_family(@entry($sk)))
daddr = format_ipaddr(__ip_sock_daddr(@entry($sk)), __ip_sock_family(@entry($sk)))
sport = __tcp_sock_sport(@entry($sk))
dport = __tcp_sock_dport(@entry($sk))
}
/**
* probe tcp.disconnect - TCP socket disconnection
* @name: Name of this probe
* @sock: Network socket
* @family: IP address family
* @flags: TCP flags (e.g. FIN, etc)
* @saddr: A string representing the source IP address
* @daddr: A string representing the destination IP address
* @sport: TCP source port
* @dport: TCP destination port
*
* Context:
* The process which disconnects tcp
*/
probe tcp.disconnect = kernel.function("tcp_disconnect") {
name = "tcp.disconnect"
sock = $sk
family = __ip_sock_family($sk)
flags = $flags
saddr = format_ipaddr(__ip_sock_saddr($sk), __ip_sock_family($sk))
daddr = format_ipaddr(__ip_sock_daddr($sk), __ip_sock_family($sk))
sport = __tcp_sock_sport($sk)
dport = __tcp_sock_dport($sk)
}
/**
* probe tcp.disconnect.return - TCP socket disconnection complete
* @name: Name of this probe
* @ret: Error code (0: no error)
*
* Context:
* The process which disconnects tcp
*/
probe tcp.disconnect.return = kernel.function("tcp_disconnect").return {
name = "tcp.disconnect"
ret = $return
}
/**
* probe tcp.setsockopt - Call to setsockopt()
* @name: Name of this probe
* @sock: Network socket
* @family: IP address family
* @level: The level at which the socket options will be manipulated
* @optname: TCP socket options (e.g. TCP_NODELAY, TCP_MAXSEG, etc)
* @optstr: Resolves optname to a human-readable format
* @optlen: Used to access values for setsockopt()
*
* Context:
* The process which calls setsockopt
*/
probe tcp.setsockopt = tcp.ipv4.setsockopt, tcp.ipv6.setsockopt
{
}
probe tcp.ipv4.setsockopt = kernel.function("tcp_setsockopt")
{
name = "tcp.ipv4.setsockopt"
sock = $sk
family = __ip_sock_family($sk)
level = $level
optname = $optname
optstr = tcp_sockopt_str($optname)
optlen = $optlen
}
probe tcp.ipv6.setsockopt = kernel.function("ipv6_setsockopt")!,
module("ipv6").function("ipv6_setsockopt")
{
name = "tcp.ipv6.setsockopt"
sock = $sk
family = __ip_sock_family($sk)
level = $level
optname = $optname
optstr = tcp_ipv6_sockopt_str($optname)
optlen = $optlen
}
/**
* probe tcp.setsockopt.return - Return from setsockopt()
* @name: Name of this probe
* @ret: Error code (0: no error)
*
* Context:
* The process which calls setsockopt
*/
probe tcp.setsockopt.return = tcp.ipv4.setsockopt.return,
tcp.ipv6.setsockopt.return
{
}
probe tcp.ipv4.setsockopt.return = kernel.function("tcp_setsockopt").return
{
name = "tcp.ipv4.setsockopt"
ret = $return
}
probe tcp.ipv6.setsockopt.return = kernel.function("ipv6_setsockopt").return!,
module("ipv6").function("ipv6_setsockopt").return
{
name = "tcp.ipv6.setsockopt"
ret = $return
}
/**
* probe tcp.receive - Called when a TCP packet is received
* @name: Name of the probe point
* @iphdr: IP header address
* @protocol: Packet protocol from driver
* @family: IP address family
* @saddr: A string representing the source IP address
* @daddr: A string representing the destination IP address
* @sport: TCP source port
* @dport: TCP destination port
* @urg: TCP URG flag
* @ack: TCP ACK flag
* @psh: TCP PSH flag
* @rst: TCP RST flag
* @syn: TCP SYN flag
* @fin: TCP FIN flag
*/
probe tcp.receive = tcp.ipv4.receive, tcp.ipv6.receive
{
}
probe tcp.ipv4.receive = kernel.function("tcp_v4_rcv")
{
name = "tcp.ipv4.receive"
# If we're here, by definition we're doing AF_INET, not AF_INET6.
family = @const("AF_INET")
try {
iphdr = __get_skb_iphdr($skb)
saddr = format_ipaddr(__ip_skb_saddr(iphdr), @const("AF_INET"))
daddr = format_ipaddr(__ip_skb_daddr(iphdr), @const("AF_INET"))
protocol = __ip_skb_proto(iphdr)
} catch { }
try {
tcphdr = __get_skb_tcphdr($skb)
dport = __tcp_skb_dport(tcphdr)
sport = __tcp_skb_sport(tcphdr)
urg = __tcp_skb_urg(tcphdr)
ack = __tcp_skb_ack(tcphdr)
psh = __tcp_skb_psh(tcphdr)
rst = __tcp_skb_rst(tcphdr)
syn = __tcp_skb_syn(tcphdr)
fin = __tcp_skb_fin(tcphdr)
} catch { }
}
probe tcp.ipv6.receive = kernel.function("tcp_v6_rcv")!,
module("ipv6").function("tcp_v6_rcv")
{
name = "tcp.ipv6.receive"
# If we're here, by definition we're doing AF_INET6, not AF_INET.
family = @const("AF_INET6")
try {
iphdr = __get_skb_iphdr(@choose_defined($skb, kernel_pointer($pskb)))
saddr = format_ipaddr(&@cast(iphdr, "ipv6hdr",
"kernel")->saddr,
@const("AF_INET6"))
daddr = format_ipaddr(&@cast(iphdr, "ipv6hdr",
"kernel")->daddr,
@const("AF_INET6"))
} catch { }
# If we're here, by definition we're doing IPPROTO_TCP. There
# isn't a protocol field in 'struct ipv6hdr'. There is one in
# 'struct sk_buff', but that protocol field is an Ethernet
# Procol ID (ETH_P_*), not an IP protocol ID (IPPROTO_*).
protocol = @const("IPPROTO_TCP")
try {
tcphdr = __get_skb_tcphdr(@choose_defined($skb,
kernel_pointer($pskb)))
dport = __tcp_skb_dport(tcphdr)
sport = __tcp_skb_sport(tcphdr)
urg = __tcp_skb_urg(tcphdr)
ack = __tcp_skb_ack(tcphdr)
psh = __tcp_skb_psh(tcphdr)
rst = __tcp_skb_rst(tcphdr)
syn = __tcp_skb_syn(tcphdr)
fin = __tcp_skb_fin(tcphdr)
} catch { }
}