fix PID handling

This commit is contained in:
Iago López Galeiras
2016-09-21 16:38:33 +02:00
parent 5bb2a5c735
commit ba57feccc3

View File

@@ -36,12 +36,12 @@ struct tcp_event_t {
};
BPF_PERF_OUTPUT(tcp_event);
BPF_HASH(connectsock, u32, struct sock *);
BPF_HASH(closesock, u32, struct sock *);
BPF_HASH(connectsock, u64, struct sock *);
BPF_HASH(closesock, u64, struct sock *);
int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk)
{
u32 pid = bpf_get_current_pid_tgid();
u64 pid = bpf_get_current_pid_tgid();
##FILTER_PID##
@@ -54,7 +54,7 @@ int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk)
int kretprobe__tcp_v4_connect(struct pt_regs *ctx)
{
int ret = PT_REGS_RC(ctx);
u32 pid = bpf_get_current_pid_tgid();
u64 pid = bpf_get_current_pid_tgid();
struct sock **skpp;
skpp = connectsock.lookup(&pid);
@@ -83,7 +83,7 @@ int kretprobe__tcp_v4_connect(struct pt_regs *ctx)
// output
struct tcp_event_t evt = {
.type = "connect",
.pid = pid,
.pid = pid >> 32,
.saddr = saddr,
.daddr = daddr,
.sport = ntohs(sport),
@@ -102,7 +102,7 @@ int kretprobe__tcp_v4_connect(struct pt_regs *ctx)
int kprobe__tcp_close(struct pt_regs *ctx, struct sock *sk)
{
u32 pid = bpf_get_current_pid_tgid();
u64 pid = bpf_get_current_pid_tgid();
##FILTER_PID##
@@ -114,7 +114,7 @@ int kprobe__tcp_close(struct pt_regs *ctx, struct sock *sk)
int kretprobe__tcp_close(struct pt_regs *ctx)
{
u32 pid = bpf_get_current_pid_tgid();
u64 pid = bpf_get_current_pid_tgid();
struct sock **skpp;
skpp = closesock.lookup(&pid);
@@ -134,7 +134,7 @@ int kretprobe__tcp_close(struct pt_regs *ctx)
// output
struct tcp_event_t evt = {
.type = "close",
.pid = pid,
.pid = pid >> 32,
.saddr = saddr,
.daddr = daddr,
.sport = ntohs(sport),
@@ -154,7 +154,7 @@ int kretprobe__tcp_close(struct pt_regs *ctx)
int kretprobe__inet_csk_accept(struct pt_regs *ctx)
{
struct sock *newsk = (struct sock *)PT_REGS_RC(ctx);
u32 pid = bpf_get_current_pid_tgid();
u64 pid = bpf_get_current_pid_tgid();
##FILTER_PID##
@@ -174,7 +174,7 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx)
bpf_probe_read(&lport, sizeof(lport), &newsk->__sk_common.skc_num);
if (family == AF_INET) {
struct tcp_event_t evt = {.type = "accept", .pid = pid};
struct tcp_event_t evt = {.type = "accept", .pid = pid >> 32};
bpf_probe_read(&evt.saddr, sizeof(u32),
&newsk->__sk_common.skc_rcv_saddr);
bpf_probe_read(&evt.daddr, sizeof(u32),