1# 2# Taken from /usr/share/systemtap/tapset/linux/tcp.stp 3# 4// TCP tapset 5// Copyright (C) 2006 IBM Corp. 6// Copyright (C) 2006 Intel Corporation. 7// Copyright (C) 2007, 2010, 2012-2018 Red Hat, Inc. 8// 9// This file is part of systemtap, and is free software. You can 10// redistribute it and/or modify it under the terms of the GNU General 11// Public License (GPL); either version 2, or (at your option) any 12// later version. 13// <tapsetdescription> 14// This family of probe points is used to probe events that occur in the TCP layer, 15// </tapsetdescription> 16 17// See the BZ1546179 block comment in tapset/linux/networking.stp for 18// an explanation of the try/catch statements around sk_buff structure 19// accesses. 20 21%{ 22#include <linux/version.h> 23#include <net/sock.h> 24#include <net/tcp.h> 25#include <net/ip.h> 26#include <linux/skbuff.h> 27%} 28 29// Get retransmission timeout in usecs. RTO is initialized from default 30// retransmission time, but can be adjusted (increased) each time we 31// retransmit. It should always be less than the max value of TCP retransmission 32// timeout (TCP_RTO_MAX) 33function tcp_get_info_rto:long(sock:long) 34%{ /* pure */ 35 struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock; 36#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10) 37 struct tcp_opt *tp = tcp_sk(sk); 38 STAP_RETVALUE = (int64_t) jiffies_to_usecs(kread(&(tp->rto))); 39#else 40 const struct inet_connection_sock *icsk = inet_csk(sk); 41 STAP_RETVALUE = (int64_t) jiffies_to_usecs(kread(&(icsk->icsk_rto))); 42#endif 43 CATCH_DEREF_FAULT(); 44%} 45 46//Get congestion window segment size. Initial value of congestion window size 47//typically set to one segment (i.e., slow start algorithm, each segment can be 512 bytes). 48//This congestion window size can be dynamically increased based on whether TCP 49//is performing slow start or congestion avoidance. 50function tcp_get_info_snd_cwnd:long(sock:long) 51%{ /* pure */ 52 struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock; 53#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10) 54 struct tcp_opt *tp = tcp_sk(sk); 55#else 56 struct tcp_sock *tp = tcp_sk(sk); 57#endif 58 STAP_RETVALUE = (int64_t) kread(&(tp->snd_cwnd)); 59 CATCH_DEREF_FAULT(); 60%} 61 62// 63//Definitions of the TCP protocol sk_state field listed below. 64// 65// TCP_ESTABLISHED = 1, Normal data transfer 66// TCP_SYN_SENT = 2, App. has started to open a connection 67// TCP_SYN_RECV = 3, A connection request has arrived; wait for ACK 68// TCP_FIN_WAIT1 = 4, App. has said it is finished 69// TCP_FIN_WAIT2 = 5, The other side has agreed to close 70// TCP_TIME_WAIT = 6, Wait for all packets to die off 71// TCP_CLOSE = 7, No connection is active or pending 72// TCP_CLOSE_WAIT = 8, The other side has initiated a release 73// TCP_LAST_ACK = 9, Last ACK, wait for all packets to die off 74// TCP_LISTEN = 10, Waiting for incoming call 75// TCP_CLOSING = 11, Both sides have tried to close simultaneously 76// TCP_MAX_STATES = 12 Max states number 77// 78function tcp_ts_get_info_state:long(sock:long) 79%{ /* pure */ 80 struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock; 81 STAP_RETVALUE = (int64_t) kread(&(sk->sk_state)); 82 CATCH_DEREF_FAULT(); 83%} 84 85/* return the TCP destination port for a given sock */ 86function __tcp_sock_dport:long (sock:long) 87{ 88 port = @choose_defined(@inet_sock_cast(sock)->sk->__sk_common->skc_dport, # kernel >= 3.8 89 @choose_defined(@inet_sock_cast(sock)->inet_dport, # kernel >= 2.6.33 90 @choose_defined(@inet_sock_cast(sock)->dport, # kernel >= 2.6.11 91 @inet_sock_cast(sock)->inet->dport))) 92 return ntohs(port) 93} 94 95/* returns the TCP header for recent (<2.6.21) kernel */ 96@__private30 function __get_skb_tcphdr_new:long(skb:long) 97%{ /* pure */ 98 struct sk_buff *skb; 99 skb = (struct sk_buff *)(uintptr_t)STAP_ARG_skb; 100 /* as done by skb_transport_header() */ 101 #ifdef NET_SKBUFF_DATA_USES_OFFSET 102 STAP_RETVALUE = (long)(kread(&(skb->head)) + kread(&(skb->transport_header))); 103 #else 104 STAP_RETVALUE = (long)kread(&(skb->transport_header)); 105 #endif 106 CATCH_DEREF_FAULT(); 107%} 108 109/* returns the TCP header for a given sk_buff structure */ 110function __get_skb_tcphdr:long(skb:long) 111{ 112%( kernel_v < "2.6.21" %? 113 tcphdr = @cast(skb, "sk_buff")->h->raw 114 return tcphdr 115%: 116 return __get_skb_tcphdr_new(skb) 117%) 118} 119 120/* returns TCP URG flag for a given sk_buff structure */ 121function __tcp_skb_urg:long (tcphdr:long) 122{ 123 return @cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->urg 124} 125 126/* returns TCP ACK flag for a given sk_buff structure */ 127function __tcp_skb_ack:long (tcphdr:long) 128{ 129 return @cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->ack 130} 131 132/* returns TCP PSH flag for a given sk_buff structure */ 133function __tcp_skb_psh:long (tcphdr:long) 134{ 135 return @cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->psh 136} 137 138/* returns TCP RST flag for a given sk_buff structure */ 139function __tcp_skb_rst:long (tcphdr:long) 140{ 141 return @cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->rst 142} 143 144/* returns TCP SYN flag for a given sk_buff structure */ 145function __tcp_skb_syn:long (tcphdr:long) 146{ 147 return @cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->syn 148} 149 150/* returns TCP FIN flag for a given sk_buff structure */ 151function __tcp_skb_fin:long (tcphdr:long) 152{ 153 return @cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->fin 154} 155 156/* returns TCP source port for a given sk_buff structure */ 157function __tcp_skb_sport:long (tcphdr:long) 158{ 159 return ntohs(@cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->source) 160} 161 162/* returns TCP destination port for a given sk_buff structure */ 163function __tcp_skb_dport:long (tcphdr:long){ 164 return ntohs(@cast(tcphdr, "tcphdr", "kernel<linux/tcp.h>")->dest) 165} 166 167/* return the TCP source port for a given sock */ 168function __tcp_sock_sport:long (sock:long) 169{ 170 port = @choose_defined(@inet_sock_cast(sock)->inet_sport, # kernel >= 2.6.33 171 @choose_defined(@inet_sock_cast(sock)->sport, # kernel >= 2.6.11 172 @inet_sock_cast(sock)->inet->sport)) 173 return ntohs(port) 174} 175 176@__private30 global sockstate[12] 177probe init { 178 sockstate[1] = "TCP_ESTABLISHED" 179 sockstate[2] = "TCP_SYN_SENT" 180 sockstate[3] = "TCP_SYN_RECV" 181 sockstate[4] = "TCP_FIN_WAIT1" 182 sockstate[5] = "TCP_FIN_WAIT2" 183 sockstate[6] = "TCP_TIME_WAIT" 184 sockstate[7] = "TCP_CLOSE" 185 sockstate[8] = "TCP_CLOSE_WAIT" 186 sockstate[9] = "TCP_LAST_ACK" 187 sockstate[10] = "TCP_LISTEN" 188 sockstate[11] = "TCP_CLOSING" 189 sockstate[12] = "TCP_MAX_STATES" 190} 191 192function tcp_sockstate_str:string (state:long) { 193 return (state in sockstate ? sockstate[state] : "UNDEF") 194} 195 196// Get slow start threshold size. If cwnd size is less than or equal to 197// threshold size, then TCP is in slow start; otherwise TCP is in congestion 198// avoidance. 199function tcp_ts_get_info_snd_ssthresh:long(sock:long) 200%{ /* pure */ 201 struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock; 202#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10) 203 struct tcp_opt *tp = tcp_sk(sk); 204#else 205 struct tcp_sock *tp = tcp_sk(sk); 206#endif 207 STAP_RETVALUE = (int64_t) kread(&(tp->snd_ssthresh)); 208 CATCH_DEREF_FAULT(); 209%} 210 211// Get receiver's advertised segment size. TCP typically never sends more 212// than what receiver can accept. 213function tcp_ts_get_info_rcv_mss:long(sock:long) 214%{ /* pure */ 215 struct sock *sk = (struct sock *)(uintptr_t) STAP_ARG_sock; 216#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10) 217 struct tcp_opt *tp = tcp_sk(sk); 218 STAP_RETVALUE = (int64_t) kread(&(tp->ack.rcv_mss)); 219#else 220 const struct inet_connection_sock *icsk = inet_csk(sk); 221 STAP_RETVALUE = (int64_t) kread(&(icsk->icsk_ack.rcv_mss)); 222#endif 223 CATCH_DEREF_FAULT(); 224%} 225 226%{ 227// Define newer IPv4 sockopt constants for older kernels. 228#ifndef TCP_CONGESTION 229#define TCP_CONGESTION 0 230#endif 231#ifndef TCP_MD5SIG 232#define TCP_MD5SIG 0 233#endif 234#ifndef TCP_COOKIE_TRANSACTIONS 235#define TCP_COOKIE_TRANSACTIONS 0 236#endif 237#ifndef TCP_THIN_LINEAR_TIMEOUTS 238#define TCP_THIN_LINEAR_TIMEOUTS 0 239#endif 240#ifndef TCP_THIN_DUPACK 241#define TCP_THIN_DUPACK 0 242#endif 243#ifndef TCP_USER_TIMEOUT 244#define TCP_USER_TIMEOUT 0 245#endif 246%} 247 248@__private30 global __sockopt[18] 249probe init { 250 __sockopt[@const("TCP_NODELAY")] = "TCP_NODELAY" 251 __sockopt[@const("TCP_MAXSEG")] = "TCP_MAXSEG" 252 __sockopt[@const("TCP_CORK")] = "TCP_CORK" 253 __sockopt[@const("TCP_KEEPIDLE")] = "TCP_KEEPIDLE" 254 __sockopt[@const("TCP_KEEPINTVL")] = "TCP_KEEPINTVL" 255 __sockopt[@const("TCP_KEEPCNT")] = "TCP_KEEPCNT" 256 __sockopt[@const("TCP_SYNCNT")] = "TCP_SYNCNT" 257 __sockopt[@const("TCP_LINGER2")] = "TCP_LINGER2" 258 __sockopt[@const("TCP_DEFER_ACCEPT")] = "TCP_DEFER_ACCEPT" 259 __sockopt[@const("TCP_WINDOW_CLAMP")] = "TCP_WINDOW_CLAMP" 260 __sockopt[@const("TCP_INFO")] = "TCP_INFO" 261 __sockopt[@const("TCP_QUICKACK")] = "TCP_QUICKACK" 262 if (@const("TCP_CONGESTION") > 0) 263 __sockopt[@const("TCP_CONGESTION")] 264 = "TCP_CONGESTION" 265 if (@const("TCP_MD5SIG") > 0) 266 __sockopt[@const("TCP_MD5SIG")] = "TCP_MD5SIG" 267 if (@const("TCP_COOKIE_TRANSACTIONS") > 0) 268 __sockopt[@const("TCP_COOKIE_TRANSACTIONS")] 269 = "TCP_COOKIE_TRANSACTIONS" 270 if (@const("TCP_THIN_LINEAR_TIMEOUTS") > 0) 271 __sockopt[@const("TCP_THIN_LINEAR_TIMEOUTS")] 272 = "TCP_THIN_LINEAR_TIMEOUTS" 273 if (@const("TCP_THIN_DUPACK") > 0) 274 __sockopt[@const("TCP_THIN_DUPACK")] 275 = "TCP_THIN_DUPACK" 276 if (@const("TCP_USER_TIMEOUT") > 0) 277 __sockopt[@const("TCP_USER_TIMEOUT")] 278 = "TCP_USER_TIMEOUT" 279} 280 281function tcp_sockopt_str:string (optname:long) 282{ 283 return (optname in __sockopt ? __sockopt[optname] 284 : sprintf("UNDEF_SOCKOPT(%d)", optname)) 285} 286 287%{ 288// Define newer IPv6 sockopt constants for older kernels. 289#include <linux/in6.h> 290#ifndef IPV6_2292PKTINFO 291#define IPV6_2292PKTINFO 0 292#endif 293#ifndef IPV6_2292HOPOPTS 294#define IPV6_2292HOPOPTS 0 295#endif 296#ifndef IPV6_2292DSTOPTS 297#define IPV6_2292DSTOPTS 0 298#endif 299#ifndef IPV6_2292RTHDR 300#define IPV6_2292RTHDR 0 301#endif 302#ifndef IPV6_2292PKTOPTIONS 303#define IPV6_2292PKTOPTIONS 0 304#endif 305#ifndef IPV6_2292HOPLIMIT 306#define IPV6_2292HOPLIMIT 0 307#endif 308#ifndef IPV6_RECVPKTINFO 309#define IPV6_RECVPKTINFO 0 310#endif 311#ifndef IPV6_RECVHOPLIMIT 312#define IPV6_RECVHOPLIMIT 0 313#endif 314#ifndef IPV6_RECVHOPOPTS 315#define IPV6_RECVHOPOPTS 0 316#endif 317#ifndef IPV6_RTHDRDSTOPTS 318#define IPV6_RTHDRDSTOPTS 0 319#endif 320#ifndef IPV6_RECVRTHDR 321#define IPV6_RECVRTHDR 0 322#endif 323#ifndef IPV6_RECVDSTOPTS 324#define IPV6_RECVDSTOPTS 0 325#endif 326#ifndef IPV6_RECVPATHMTU 327#define IPV6_RECVPATHMTU 0 328#endif 329#ifndef IPV6_PATHMTU 330#define IPV6_PATHMTU 0 331#endif 332#ifndef IPV6_DONTFRAG 333#define IPV6_DONTFRAG 0 334#endif 335#ifndef IPV6_ADDR_PREFERENCES 336#define IPV6_ADDR_PREFERENCES 0 337#endif 338#ifndef IPV6_MINHOPCOUNT 339#define IPV6_MINHOPCOUNT 0 340#endif 341#ifndef IPV6_RECVORIGDSTADDR 342#define IPV6_RECVORIGDSTADDR 0 343#endif 344#ifndef IPV6_TRANSPARENT 345#define IPV6_TRANSPARENT 0 346#endif 347%} 348 349@__private30 global __ipv6_sockopt[55] 350probe init { 351 __ipv6_sockopt[@const("IPV6_ADDRFORM")] = "IPV6_ADDRFORM" 352 if (@const("IPV6_2292PKTINFO") > 0) 353 __ipv6_sockopt[@const("IPV6_2292PKTINFO")] 354 = "IPV6_2292PKTINFO" 355 if (@const("IPV6_2292HOPOPTS") > 0) 356 __ipv6_sockopt[@const("IPV6_2292HOPOPTS")] 357 = "IPV6_2292HOPOPTS" 358 if (@const("IPV6_2292DSTOPTS") > 0) 359 __ipv6_sockopt[@const("IPV6_2292DSTOPTS")] 360 = "IPV6_2292DSTOPTS" 361 if (@const("IPV6_2292RTHDR") > 0) 362 __ipv6_sockopt[@const("IPV6_2292RTHDR")] 363 = "IPV6_2292RTHDR" 364 if (@const("IPV6_2292PKTOPTIONS") > 0) 365 __ipv6_sockopt[@const("IPV6_2292PKTOPTIONS")] 366 = "IPV6_2292PKTOPTIONS" 367 __ipv6_sockopt[@const("IPV6_CHECKSUM")] = "IPV6_CHECKSUM" 368 if (@const("IPV6_2292HOPLIMIT") > 0) 369 __ipv6_sockopt[@const("IPV6_2292HOPLIMIT")] 370 = "IPV6_2292HOPLIMIT" 371 __ipv6_sockopt[@const("IPV6_NEXTHOP")] = "IPV6_NEXTHOP" 372 __ipv6_sockopt[@const("IPV6_AUTHHDR")] = "IPV6_AUTHHDR" 373 __ipv6_sockopt[@const("IPV6_FLOWINFO")] = "IPV6_FLOWINFO" 374 __ipv6_sockopt[@const("IPV6_UNICAST_HOPS")] 375 = "IPV6_UNICAST_HOPS" 376 __ipv6_sockopt[@const("IPV6_MULTICAST_IF")] 377 = "IPV6_MULTICAST_IF" 378 __ipv6_sockopt[@const("IPV6_MULTICAST_HOPS")] 379 = "IPV6_MULTICAST_HOPS" 380 __ipv6_sockopt[@const("IPV6_MULTICAST_LOOP")] 381 = "IPV6_MULTICAST_LOOP" 382 __ipv6_sockopt[@const("IPV6_ADD_MEMBERSHIP")] 383 = "IPV6_ADD_MEMBERSHIP" 384 __ipv6_sockopt[@const("IPV6_DROP_MEMBERSHIP")] 385 = "IPV6_DROP_MEMBERSHIP" 386 __ipv6_sockopt[@const("IPV6_ROUTER_ALERT")] 387 = "IPV6_ROUTER_ALERT" 388 __ipv6_sockopt[@const("IPV6_MTU_DISCOVER")] 389 = "IPV6_MTU_DISCOVER" 390 __ipv6_sockopt[@const("IPV6_MTU")] = "IPV6_MTU" 391 __ipv6_sockopt[@const("IPV6_RECVERR")] = "IPV6_RECVERR" 392 __ipv6_sockopt[@const("IPV6_V6ONLY")] = "IPV6_V6ONLY" 393 __ipv6_sockopt[@const("IPV6_JOIN_ANYCAST")] 394 = "IPV6_JOIN_ANYCAST" 395 __ipv6_sockopt[@const("IPV6_LEAVE_ANYCAST")] 396 = "IPV6_LEAVE_ANYCAST" 397 __ipv6_sockopt[@const("IPV6_FLOWLABEL_MGR")] 398 = "IPV6_FLOWLABEL_MGR" 399 __ipv6_sockopt[@const("IPV6_FLOWINFO_SEND")] 400 = "IPV6_FLOWINFO_SEND" 401 __ipv6_sockopt[@const("IPV6_IPSEC_POLICY")] 402 = "IPV6_IPSEC_POLICY" 403 __ipv6_sockopt[@const("IPV6_XFRM_POLICY")] 404 = "IPV6_XFRM_POLICY" 405 __ipv6_sockopt[@const("MCAST_JOIN_GROUP")] 406 = "MCAST_JOIN_GROUP" 407 __ipv6_sockopt[@const("MCAST_BLOCK_SOURCE")] 408 = "MCAST_BLOCK_SOURCE" 409 __ipv6_sockopt[@const("MCAST_UNBLOCK_SOURCE")] 410 = "MCAST_UNBLOCK_SOURCE" 411 __ipv6_sockopt[@const("MCAST_LEAVE_GROUP")] 412 = "MCAST_LEAVE_GROUP" 413 __ipv6_sockopt[@const("MCAST_JOIN_SOURCE_GROUP")] 414 = "MCAST_JOIN_SOURCE_GROUP" 415 __ipv6_sockopt[@const("MCAST_LEAVE_SOURCE_GROUP")] 416 = "MCAST_LEAVE_SOURCE_GROUP" 417 __ipv6_sockopt[@const("MCAST_MSFILTER")] = "MCAST_MSFILTER" 418 if (@const("IPV6_RECVPKTINFO") > 0) 419 __ipv6_sockopt[@const("IPV6_RECVPKTINFO")] 420 = "IPV6_RECVPKTINFO" 421 __ipv6_sockopt[@const("IPV6_PKTINFO")] = "IPV6_PKTINFO" 422 if (@const("IPV6_RECVHOPLIMIT") > 0) 423 __ipv6_sockopt[@const("IPV6_RECVHOPLIMIT")] 424 = "IPV6_RECVHOPLIMIT" 425 __ipv6_sockopt[@const("IPV6_HOPLIMIT")] = "IPV6_HOPLIMIT" 426 if (@const("IPV6_RECVHOPOPTS") > 0) 427 __ipv6_sockopt[@const("IPV6_RECVHOPOPTS")] 428 = "IPV6_RECVHOPOPTS" 429 __ipv6_sockopt[@const("IPV6_HOPOPTS")] = "IPV6_HOPOPTS" 430 if (@const("IPV6_RTHDRDSTOPTS") > 0) 431 __ipv6_sockopt[@const("IPV6_RTHDRDSTOPTS")] 432 = "IPV6_RTHDRDSTOPTS" 433 if (@const("IPV6_RECVRTHDR") > 0) 434 __ipv6_sockopt[@const("IPV6_RECVRTHDR")] 435 = "IPV6_RECVRTHDR" 436 __ipv6_sockopt[@const("IPV6_RTHDR")] = "IPV6_RTHDR" 437 if (@const("IPV6_RECVDSTOPTS") > 0) 438 __ipv6_sockopt[@const("IPV6_RECVDSTOPTS")] 439 = "IPV6_RECVDSTOPTS" 440 __ipv6_sockopt[@const("IPV6_DSTOPTS")] = "IPV6_DSTOPTS" 441 if (@const("IPV6_RECVPATHMTU") > 0) 442 __ipv6_sockopt[@const("IPV6_RECVPATHMTU")] 443 = "IPV6_RECVPATHMTU" 444 if (@const("IPV6_PATHMTU") > 0) 445 __ipv6_sockopt[@const("IPV6_PATHMTU")] 446 = "IPV6_PATHMTU" 447 if (@const("IPV6_DONTFRAG") > 0) 448 __ipv6_sockopt[@const("IPV6_DONTFRAG")] 449 = "IPV6_DONTFRAG" 450 __ipv6_sockopt[@const("IPV6_RECVTCLASS")] 451 = "IPV6_RECVTCLASS" 452 __ipv6_sockopt[@const("IPV6_TCLASS")] = "IPV6_TCLASS" 453 if (@const("IPV6_ADDR_PREFERENCES") > 0) 454 __ipv6_sockopt[@const("IPV6_ADDR_PREFERENCES")] 455 = "IPV6_ADDR_PREFERENCES" 456 if (@const("IPV6_MINHOPCOUNT") > 0) 457 __ipv6_sockopt[@const("IPV6_MINHOPCOUNT")] 458 = "IPV6_MINHOPCOUNT" 459 if (@const("IPV6_RECVORIGDSTADDR") > 0) 460 __ipv6_sockopt[@const("IPV6_RECVORIGDSTADDR")] 461 = "IPV6_RECVORIGDSTADDR" 462 if (@const("IPV6_TRANSPARENT") > 0) 463 __ipv6_sockopt[@const("IPV6_TRANSPARENT")] 464 = "IPV6_TRANSPARENT" 465} 466 467function tcp_ipv6_sockopt_str:string (optname:long) 468{ 469 return (optname in __ipv6_sockopt ? __ipv6_sockopt[optname] 470 : sprintf("UNDEF_SOCKOPT(%d)", optname)) 471} 472 473/** 474 * probe tcp.sendmsg - Sending a tcp message 475 * @name: Name of this probe 476 * @sock: Network socket 477 * @family: IP address family 478 * @size: Number of bytes to send 479 * 480 * Context: 481 * The process which sends a tcp message 482 */ 483probe tcp.sendmsg = kernel.function("tcp_sendmsg") { 484 name = "tcp.sendmsg" 485 sock = (@defined($sock) ? $sock->sk : $sk) 486 family = __ip_sock_family(@defined($sock) ? $sock->sk : $sk) 487 size = $size 488} 489 490/** 491 * probe tcp.sendmsg.return - Sending TCP message is done 492 * @name: Name of this probe 493 * @size: Number of bytes sent or error code if an error occurred. 494 * 495 * Context: 496 * The process which sends a tcp message 497 */ 498probe tcp.sendmsg.return = kernel.function("tcp_sendmsg").return { 499 name = "tcp.sendmsg" 500 size = $return 501} 502 503/** 504 * probe tcp.recvmsg - Receiving TCP message 505 * @name: Name of this probe 506 * @sock: Network socket 507 * @size: Number of bytes to be received 508 * @family: IP address family 509 * @saddr: A string representing the source IP address 510 * @daddr: A string representing the destination IP address 511 * @sport: TCP source port 512 * @dport: TCP destination port 513 * Context: 514 * The process which receives a tcp message 515 */ 516probe tcp.recvmsg = kernel.function("tcp_recvmsg") { 517 name = "tcp.recvmsg" 518 sock = $sk 519 size = $len 520 family = __ip_sock_family($sk) 521 saddr = format_ipaddr(__ip_sock_saddr($sk), __ip_sock_family($sk)) 522 daddr = format_ipaddr(__ip_sock_daddr($sk), __ip_sock_family($sk)) 523 sport = __tcp_sock_sport($sk) 524 dport = __tcp_sock_dport($sk) 525} 526 527/** 528 * probe tcp.recvmsg.return - Receiving TCP message complete 529 * @name: Name of this probe 530 * @size: Number of bytes received or error code if an error occurred. 531 * @family: IP address family 532 * @saddr: A string representing the source IP address 533 * @daddr: A string representing the destination IP address 534 * @sport: TCP source port 535 * @dport: TCP destination port 536 * 537 * Context: 538 * The process which receives a tcp message 539 */ 540probe tcp.recvmsg.return = kernel.function("tcp_recvmsg").return { 541 name = "tcp.recvmsg" 542 size = $return 543 family = __ip_sock_family(@entry($sk)) 544 saddr = format_ipaddr(__ip_sock_saddr(@entry($sk)), __ip_sock_family(@entry($sk))) 545 daddr = format_ipaddr(__ip_sock_daddr(@entry($sk)), __ip_sock_family(@entry($sk))) 546 sport = __tcp_sock_sport(@entry($sk)) 547 dport = __tcp_sock_dport(@entry($sk)) 548} 549 550/** 551 * probe tcp.disconnect - TCP socket disconnection 552 * @name: Name of this probe 553 * @sock: Network socket 554 * @family: IP address family 555 * @flags: TCP flags (e.g. FIN, etc) 556 * @saddr: A string representing the source IP address 557 * @daddr: A string representing the destination IP address 558 * @sport: TCP source port 559 * @dport: TCP destination port 560 * 561 * Context: 562 * The process which disconnects tcp 563 */ 564probe tcp.disconnect = kernel.function("tcp_disconnect") { 565 name = "tcp.disconnect" 566 sock = $sk 567 family = __ip_sock_family($sk) 568 flags = $flags 569 saddr = format_ipaddr(__ip_sock_saddr($sk), __ip_sock_family($sk)) 570 daddr = format_ipaddr(__ip_sock_daddr($sk), __ip_sock_family($sk)) 571 sport = __tcp_sock_sport($sk) 572 dport = __tcp_sock_dport($sk) 573} 574 575/** 576 * probe tcp.disconnect.return - TCP socket disconnection complete 577 * @name: Name of this probe 578 * @ret: Error code (0: no error) 579 * 580 * Context: 581 * The process which disconnects tcp 582 */ 583probe tcp.disconnect.return = kernel.function("tcp_disconnect").return { 584 name = "tcp.disconnect" 585 ret = $return 586} 587 588/** 589 * probe tcp.setsockopt - Call to setsockopt() 590 * @name: Name of this probe 591 * @sock: Network socket 592 * @family: IP address family 593 * @level: The level at which the socket options will be manipulated 594 * @optname: TCP socket options (e.g. TCP_NODELAY, TCP_MAXSEG, etc) 595 * @optstr: Resolves optname to a human-readable format 596 * @optlen: Used to access values for setsockopt() 597 * 598 * Context: 599 * The process which calls setsockopt 600 */ 601probe tcp.setsockopt = tcp.ipv4.setsockopt, tcp.ipv6.setsockopt 602{ 603} 604probe tcp.ipv4.setsockopt = kernel.function("tcp_setsockopt") 605{ 606 name = "tcp.ipv4.setsockopt" 607 sock = $sk 608 family = __ip_sock_family($sk) 609 level = $level 610 optname = $optname 611 optstr = tcp_sockopt_str($optname) 612 optlen = $optlen 613} 614probe tcp.ipv6.setsockopt = kernel.function("ipv6_setsockopt")!, 615 module("ipv6").function("ipv6_setsockopt") 616{ 617 name = "tcp.ipv6.setsockopt" 618 sock = $sk 619 family = __ip_sock_family($sk) 620 level = $level 621 optname = $optname 622 optstr = tcp_ipv6_sockopt_str($optname) 623 optlen = $optlen 624} 625 626/** 627 * probe tcp.setsockopt.return - Return from setsockopt() 628 * @name: Name of this probe 629 * @ret: Error code (0: no error) 630 * 631 * Context: 632 * The process which calls setsockopt 633 */ 634probe tcp.setsockopt.return = tcp.ipv4.setsockopt.return, 635 tcp.ipv6.setsockopt.return 636{ 637} 638probe tcp.ipv4.setsockopt.return = kernel.function("tcp_setsockopt").return 639{ 640 name = "tcp.ipv4.setsockopt" 641 ret = $return 642} 643probe tcp.ipv6.setsockopt.return = kernel.function("ipv6_setsockopt").return!, 644 module("ipv6").function("ipv6_setsockopt").return 645{ 646 name = "tcp.ipv6.setsockopt" 647 ret = $return 648} 649 650/** 651 * probe tcp.receive - Called when a TCP packet is received 652 * @name: Name of the probe point 653 * @iphdr: IP header address 654 * @protocol: Packet protocol from driver 655 * @family: IP address family 656 * @saddr: A string representing the source IP address 657 * @daddr: A string representing the destination IP address 658 * @sport: TCP source port 659 * @dport: TCP destination port 660 * @urg: TCP URG flag 661 * @ack: TCP ACK flag 662 * @psh: TCP PSH flag 663 * @rst: TCP RST flag 664 * @syn: TCP SYN flag 665 * @fin: TCP FIN flag 666 */ 667probe tcp.receive = tcp.ipv4.receive, tcp.ipv6.receive 668{ 669} 670 671probe tcp.ipv4.receive = kernel.function("tcp_v4_rcv") 672{ 673 name = "tcp.ipv4.receive" 674 # If we're here, by definition we're doing AF_INET, not AF_INET6. 675 family = @const("AF_INET") 676 try { 677 iphdr = __get_skb_iphdr($skb) 678 saddr = format_ipaddr(__ip_skb_saddr(iphdr), @const("AF_INET")) 679 daddr = format_ipaddr(__ip_skb_daddr(iphdr), @const("AF_INET")) 680 protocol = __ip_skb_proto(iphdr) 681 } catch { } 682 683 try { 684 tcphdr = __get_skb_tcphdr($skb) 685 dport = __tcp_skb_dport(tcphdr) 686 sport = __tcp_skb_sport(tcphdr) 687 urg = __tcp_skb_urg(tcphdr) 688 ack = __tcp_skb_ack(tcphdr) 689 psh = __tcp_skb_psh(tcphdr) 690 rst = __tcp_skb_rst(tcphdr) 691 syn = __tcp_skb_syn(tcphdr) 692 fin = __tcp_skb_fin(tcphdr) 693 } catch { } 694} 695 696probe tcp.ipv6.receive = kernel.function("tcp_v6_rcv")!, 697 module("ipv6").function("tcp_v6_rcv") 698{ 699 name = "tcp.ipv6.receive" 700 # If we're here, by definition we're doing AF_INET6, not AF_INET. 701 family = @const("AF_INET6") 702 try { 703 iphdr = __get_skb_iphdr(@choose_defined($skb, kernel_pointer($pskb))) 704 saddr = format_ipaddr(&@cast(iphdr, "ipv6hdr", 705 "kernel<linux/ipv6.h>")->saddr, 706 @const("AF_INET6")) 707 daddr = format_ipaddr(&@cast(iphdr, "ipv6hdr", 708 "kernel<linux/ipv6.h>")->daddr, 709 @const("AF_INET6")) 710 } catch { } 711 712 # If we're here, by definition we're doing IPPROTO_TCP. There 713 # isn't a protocol field in 'struct ipv6hdr'. There is one in 714 # 'struct sk_buff', but that protocol field is an Ethernet 715 # Procol ID (ETH_P_*), not an IP protocol ID (IPPROTO_*). 716 protocol = @const("IPPROTO_TCP") 717 718 try { 719 tcphdr = __get_skb_tcphdr(@choose_defined($skb, 720 kernel_pointer($pskb))) 721 dport = __tcp_skb_dport(tcphdr) 722 sport = __tcp_skb_sport(tcphdr) 723 urg = __tcp_skb_urg(tcphdr) 724 ack = __tcp_skb_ack(tcphdr) 725 psh = __tcp_skb_psh(tcphdr) 726 rst = __tcp_skb_rst(tcphdr) 727 syn = __tcp_skb_syn(tcphdr) 728 fin = __tcp_skb_fin(tcphdr) 729 } catch { } 730} 731