vendor: update tcptracer-bpf

This includes https://github.com/weaveworks/tcptracer-bpf/pull/39

vendor/github.com/weaveworks/tcptracer-bpf/pkg/tracer/event.go

@@ -32,6 +32,7 @@ func tcpV4ToGo(data *[]byte) (ret TcpV4) {
 	ret.SPort = uint16(eventC.sport)
 	ret.DPort = uint16(eventC.dport)
 	ret.NetNS = uint32(eventC.netns)
+	ret.Fd = uint32(eventC.fd)
 
 	return
 }
@@ -64,6 +65,7 @@ func tcpV6ToGo(data *[]byte) (ret TcpV6) {
 	ret.SPort = uint16(eventC.sport)
 	ret.DPort = uint16(eventC.dport)
 	ret.NetNS = uint32(eventC.netns)
+	ret.Fd = uint32(eventC.fd)
 
 	return
 }

vendor/github.com/weaveworks/tcptracer-bpf/pkg/tracer/event_common.go

@@ -8,9 +8,10 @@ type EventType uint32
 
 // These constants should be in sync with the equivalent definitions in the ebpf program.
 const (
-	EventConnect EventType = 1
-	EventAccept            = 2
-	EventClose             = 3
+	EventConnect   EventType = 1
+	EventAccept              = 2
+	EventClose               = 3
+	EventFdInstall           = 4
 )
 
 func (e EventType) String() string {
@@ -21,6 +22,8 @@ func (e EventType) String() string {
 		return "accept"
 	case EventClose:
 		return "close"
+	case EventFdInstall:
+		return "fdinstall"
 	default:
 		return "unknown"
 	}
@@ -38,6 +41,7 @@ type TcpV4 struct {
 	SPort     uint16    // Local TCP port
 	DPort     uint16    // Remote TCP port
 	NetNS     uint32    // Network namespace ID (as in /proc/$pid/ns/net)
+	Fd        uint32    // File descriptor for fd_install events
 }
 
 // TcpV6 represents a TCP event (connect, accept or close) on IPv6
@@ -52,4 +56,5 @@ type TcpV6 struct {
 	SPort     uint16    // Local TCP port
 	DPort     uint16    // Remote TCP port
 	NetNS     uint32    // Network namespace ID (as in /proc/$pid/ns/net)
+	Fd        uint32    // File descriptor for fd_install events
 }

vendor/github.com/weaveworks/tcptracer-bpf/pkg/tracer/tracer.go

@@ -5,6 +5,7 @@ package tracer
 import (
 	"bytes"
 	"fmt"
+	"unsafe"
 
 	bpflib "github.com/iovisor/gobpf/elf"
 )
@@ -111,6 +112,19 @@ func NewTracer(tcpEventCbV4 func(TcpV4), tcpEventCbV6 func(TcpV6), lostCb func(l
 	}, nil
 }
 
+func (t *Tracer) AddFdInstallWatcher(pid uint32) (err error) {
+	var one uint32 = 1
+	mapFdInstall := t.m.Map("fdinstall_pids")
+	err = t.m.UpdateElement(mapFdInstall, unsafe.Pointer(&pid), unsafe.Pointer(&one), 0)
+	return err
+}
+
+func (t *Tracer) RemoveFdInstallWatcher(pid uint32) (err error) {
+	mapFdInstall := t.m.Map("fdinstall_pids")
+	err = t.m.DeleteElement(mapFdInstall, unsafe.Pointer(&pid))
+	return err
+}
+
 func (t *Tracer) Stop() {
 	close(t.stopChan)
 	t.perfMapIPV4.PollStop()

vendor/github.com/weaveworks/tcptracer-bpf/pkg/tracer/tracer_unsupported.go

@@ -15,6 +15,12 @@ func TracerAsset() ([]byte, error) {
 func NewTracer(tcpEventCbV4 func(TcpV4), tcpEventCbV6 func(TcpV6), lostCb func(lost uint64)) (*Tracer, error) {
 	return nil, fmt.Errorf("not supported on non-Linux systems")
 }
+func (t *Tracer) AddFdInstallWatcher(pid uint32) (err error) {
+	return fmt.Errorf("not supported on non-Linux systems")
+}
+func (t *Tracer) RemoveFdInstallWatcher(pid uint32) (err error) {
+	return fmt.Errorf("not supported on non-Linux systems")
+}
 
 func (t *Tracer) Stop() {
 }

vendor/github.com/weaveworks/tcptracer-bpf/tcptracer-bpf.c

@@ -78,6 +78,26 @@ struct bpf_map_def SEC("maps/tuplepid_ipv6") tuplepid_ipv6 = {
 	.max_entries = 1024,
 };
 
+/* This is a key/value store with the keys being a pid
+ * and the values being a fd unsigned int.
+ */
+struct bpf_map_def SEC("maps/fdinstall_ret") fdinstall_ret = {
+	.type = BPF_MAP_TYPE_HASH,
+	.key_size = sizeof(__u64),
+	.value_size = sizeof(unsigned int),
+	.max_entries = 1024,
+};
+
+/* This is a key/value store with the keys being a pid (tgid)
+ * and the values being a boolean.
+ */
+struct bpf_map_def SEC("maps/fdinstall_pids") fdinstall_pids = {
+	.type = BPF_MAP_TYPE_HASH,
+	.key_size = sizeof(__u32),
+	.value_size = sizeof(__u32),
+	.max_entries = 1024,
+};
+
 /* http://stackoverflow.com/questions/1001307/detecting-endianness-programmatically-in-a-c-program */
 __attribute__((always_inline))
 static bool is_big_endian(void)
@@ -821,6 +841,48 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx)
 	return 0;
 }
 
+SEC("kprobe/fd_install")
+int kprobe__fd_install(struct pt_regs *ctx)
+{
+	u64 pid = bpf_get_current_pid_tgid();
+	u32 tgid = pid >> 32;
+	unsigned long fd = (unsigned long) PT_REGS_PARM1(ctx);
+	u32 *exists = NULL;
+
+	exists = bpf_map_lookup_elem(&fdinstall_pids, &tgid);
+	if (exists == NULL || !*exists)
+		return 0;
+
+	bpf_map_update_elem(&fdinstall_ret, &pid, &fd, BPF_ANY);
+
+	return 0;
+}
+
+SEC("kretprobe/fd_install")
+int kretprobe__fd_install(struct pt_regs *ctx)
+{
+	u64 pid = bpf_get_current_pid_tgid();
+	unsigned long *fd;
+	fd = bpf_map_lookup_elem(&fdinstall_ret, &pid);
+	if (fd == NULL) {
+		return 0;	// missed entry
+	}
+	bpf_map_delete_elem(&fdinstall_ret, &pid);
+
+	u32 cpu = bpf_get_smp_processor_id();
+	struct tcp_ipv4_event_t evt = {
+		.timestamp = bpf_ktime_get_ns(),
+		.cpu = cpu,
+		.type = TCP_EVENT_TYPE_FD_INSTALL,
+	};
+	evt.pid = pid >> 32;
+	evt.fd = *(__u32*)fd;
+	bpf_get_current_comm(&evt.comm, sizeof(evt.comm));
+	bpf_perf_event_output(ctx, &tcp_event_ipv4, cpu, &evt, sizeof(evt));
+
+	return 0;
+}
+
 char _license[] SEC("license") = "GPL";
 // this number will be interpreted by gobpf-elf-loader to set the current
 // running kernel version

vendor/github.com/weaveworks/tcptracer-bpf/tcptracer-bpf.h

@@ -3,9 +3,10 @@
 
 #include <linux/types.h>
 
-#define TCP_EVENT_TYPE_CONNECT 1
-#define TCP_EVENT_TYPE_ACCEPT  2
-#define TCP_EVENT_TYPE_CLOSE   3
+#define TCP_EVENT_TYPE_CONNECT          1
+#define TCP_EVENT_TYPE_ACCEPT           2
+#define TCP_EVENT_TYPE_CLOSE            3
+#define TCP_EVENT_TYPE_FD_INSTALL       4
 
 #define GUESS_SADDR      0
 #define GUESS_DADDR      1
@@ -30,6 +31,8 @@ struct tcp_ipv4_event_t {
 	__u16 sport;
 	__u16 dport;
 	__u32 netns;
+	__u32 fd;
+	__u32 dummy;
 };
 
 struct tcp_ipv6_event_t {
@@ -46,6 +49,8 @@ struct tcp_ipv6_event_t {
 	__u16 sport;
 	__u16 dport;
 	__u32 netns;
+	__u32 fd;
+	__u32 dummy;
 };
 
 // tcp_set_state doesn't run in the context of the process that initiated the

vendor/github.com/weaveworks/tcptracer-bpf/tests/tracer.go

@@ -1,19 +1,28 @@
 package main
 
 import (
+	"flag"
 	"fmt"
 	"os"
 	"os/signal"
+	"strconv"
+	"strings"
 
 	"github.com/weaveworks/tcptracer-bpf/pkg/tracer"
 )
 
+var watchFdInstallPids string
 var lastTimestampV4 uint64
 var lastTimestampV6 uint64
 
 func tcpEventCbV4(e tracer.TcpV4) {
-	fmt.Printf("%v cpu#%d %s %v %s %v:%v %v:%v %v\n",
-		e.Timestamp, e.CPU, e.Type, e.Pid, e.Comm, e.SAddr, e.SPort, e.DAddr, e.DPort, e.NetNS)
+	if e.Type == tracer.EventFdInstall {
+		fmt.Printf("%v cpu#%d %s %v %s %v\n",
+			e.Timestamp, e.CPU, e.Type, e.Pid, e.Comm, e.Fd)
+	} else {
+		fmt.Printf("%v cpu#%d %s %v %s %v:%v %v:%v %v\n",
+			e.Timestamp, e.CPU, e.Type, e.Pid, e.Comm, e.SAddr, e.SPort, e.DAddr, e.DPort, e.NetNS)
+	}
 
 	if lastTimestampV4 > e.Timestamp {
 		fmt.Printf("ERROR: late event!\n")
@@ -40,9 +49,15 @@ func lostCb(count uint64) {
 	os.Exit(1)
 }
 
+func init() {
+	flag.StringVar(&watchFdInstallPids, "monitor-fdinstall-pids", "", "a comma-separated list of pids that need to be monitored for fdinstall events")
+
+	flag.Parse()
+}
+
 func main() {
-	if len(os.Args) != 1 {
-		fmt.Fprintf(os.Stderr, "Usage: %s\n", os.Args[0])
+	if flag.NArg() > 1 {
+		flag.Usage()
 		os.Exit(1)
 	}
 
@@ -52,6 +67,20 @@ func main() {
 		os.Exit(1)
 	}
 
+	for _, p := range strings.Split(watchFdInstallPids, ",") {
+		if p == "" {
+			continue
+		}
+
+		pid, err := strconv.ParseUint(p, 10, 32)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Invalid pid: %v\n", err)
+			os.Exit(1)
+		}
+		fmt.Printf("Monitor fdinstall events for pid %d\n", pid)
+		t.AddFdInstallWatcher(uint32(pid))
+	}
+
 	fmt.Printf("Ready\n")
 
 	sig := make(chan os.Signal, 1)

vendor/manifest

@@ -1462,7 +1462,7 @@
 			"importpath": "github.com/weaveworks/tcptracer-bpf",
 			"repository": "https://github.com/weaveworks/tcptracer-bpf",
 			"vcs": "git",
-			"revision": "a82fffdbfee2ffe2c469279dbfeb3734cf7de1f2",
+			"revision": "783f088bbe3e91d4d23cf2f48072f80de2fd03fc",
 			"branch": "master",
 			"notests": true
 		},