mirror of
https://github.com/weaveworks/scope.git
synced 2026-07-22 14:56:56 +00:00
fix PID handling
This commit is contained in:
@@ -36,12 +36,12 @@ struct tcp_event_t {
|
||||
};
|
||||
|
||||
BPF_PERF_OUTPUT(tcp_event);
|
||||
BPF_HASH(connectsock, u32, struct sock *);
|
||||
BPF_HASH(closesock, u32, struct sock *);
|
||||
BPF_HASH(connectsock, u64, struct sock *);
|
||||
BPF_HASH(closesock, u64, struct sock *);
|
||||
|
||||
int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk)
|
||||
{
|
||||
u32 pid = bpf_get_current_pid_tgid();
|
||||
u64 pid = bpf_get_current_pid_tgid();
|
||||
|
||||
##FILTER_PID##
|
||||
|
||||
@@ -54,7 +54,7 @@ int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk)
|
||||
int kretprobe__tcp_v4_connect(struct pt_regs *ctx)
|
||||
{
|
||||
int ret = PT_REGS_RC(ctx);
|
||||
u32 pid = bpf_get_current_pid_tgid();
|
||||
u64 pid = bpf_get_current_pid_tgid();
|
||||
|
||||
struct sock **skpp;
|
||||
skpp = connectsock.lookup(&pid);
|
||||
@@ -83,7 +83,7 @@ int kretprobe__tcp_v4_connect(struct pt_regs *ctx)
|
||||
// output
|
||||
struct tcp_event_t evt = {
|
||||
.type = "connect",
|
||||
.pid = pid,
|
||||
.pid = pid >> 32,
|
||||
.saddr = saddr,
|
||||
.daddr = daddr,
|
||||
.sport = ntohs(sport),
|
||||
@@ -102,7 +102,7 @@ int kretprobe__tcp_v4_connect(struct pt_regs *ctx)
|
||||
|
||||
int kprobe__tcp_close(struct pt_regs *ctx, struct sock *sk)
|
||||
{
|
||||
u32 pid = bpf_get_current_pid_tgid();
|
||||
u64 pid = bpf_get_current_pid_tgid();
|
||||
|
||||
##FILTER_PID##
|
||||
|
||||
@@ -114,7 +114,7 @@ int kprobe__tcp_close(struct pt_regs *ctx, struct sock *sk)
|
||||
|
||||
int kretprobe__tcp_close(struct pt_regs *ctx)
|
||||
{
|
||||
u32 pid = bpf_get_current_pid_tgid();
|
||||
u64 pid = bpf_get_current_pid_tgid();
|
||||
|
||||
struct sock **skpp;
|
||||
skpp = closesock.lookup(&pid);
|
||||
@@ -134,7 +134,7 @@ int kretprobe__tcp_close(struct pt_regs *ctx)
|
||||
// output
|
||||
struct tcp_event_t evt = {
|
||||
.type = "close",
|
||||
.pid = pid,
|
||||
.pid = pid >> 32,
|
||||
.saddr = saddr,
|
||||
.daddr = daddr,
|
||||
.sport = ntohs(sport),
|
||||
@@ -154,7 +154,7 @@ int kretprobe__tcp_close(struct pt_regs *ctx)
|
||||
int kretprobe__inet_csk_accept(struct pt_regs *ctx)
|
||||
{
|
||||
struct sock *newsk = (struct sock *)PT_REGS_RC(ctx);
|
||||
u32 pid = bpf_get_current_pid_tgid();
|
||||
u64 pid = bpf_get_current_pid_tgid();
|
||||
|
||||
##FILTER_PID##
|
||||
|
||||
@@ -174,7 +174,7 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx)
|
||||
bpf_probe_read(&lport, sizeof(lport), &newsk->__sk_common.skc_num);
|
||||
|
||||
if (family == AF_INET) {
|
||||
struct tcp_event_t evt = {.type = "accept", .pid = pid};
|
||||
struct tcp_event_t evt = {.type = "accept", .pid = pid >> 32};
|
||||
bpf_probe_read(&evt.saddr, sizeof(u32),
|
||||
&newsk->__sk_common.skc_rcv_saddr);
|
||||
bpf_probe_read(&evt.daddr, sizeof(u32),
|
||||
|
||||
Reference in New Issue
Block a user