From ba57feccc33efa5d9e444c321d621e5a1fcb675f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iago=20L=C3=B3pez=20Galeiras?= Date: Wed, 21 Sep 2016 16:38:33 +0200 Subject: [PATCH] fix PID handling --- docker/tcpv4tracer.py | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docker/tcpv4tracer.py b/docker/tcpv4tracer.py index 7cef18222..d2f9f5d6d 100755 --- a/docker/tcpv4tracer.py +++ b/docker/tcpv4tracer.py @@ -36,12 +36,12 @@ struct tcp_event_t { }; BPF_PERF_OUTPUT(tcp_event); -BPF_HASH(connectsock, u32, struct sock *); -BPF_HASH(closesock, u32, struct sock *); +BPF_HASH(connectsock, u64, struct sock *); +BPF_HASH(closesock, u64, struct sock *); int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk) { - u32 pid = bpf_get_current_pid_tgid(); + u64 pid = bpf_get_current_pid_tgid(); ##FILTER_PID## @@ -54,7 +54,7 @@ int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk) int kretprobe__tcp_v4_connect(struct pt_regs *ctx) { int ret = PT_REGS_RC(ctx); - u32 pid = bpf_get_current_pid_tgid(); + u64 pid = bpf_get_current_pid_tgid(); struct sock **skpp; skpp = connectsock.lookup(&pid); @@ -83,7 +83,7 @@ int kretprobe__tcp_v4_connect(struct pt_regs *ctx) // output struct tcp_event_t evt = { .type = "connect", - .pid = pid, + .pid = pid >> 32, .saddr = saddr, .daddr = daddr, .sport = ntohs(sport), @@ -102,7 +102,7 @@ int kretprobe__tcp_v4_connect(struct pt_regs *ctx) int kprobe__tcp_close(struct pt_regs *ctx, struct sock *sk) { - u32 pid = bpf_get_current_pid_tgid(); + u64 pid = bpf_get_current_pid_tgid(); ##FILTER_PID## @@ -114,7 +114,7 @@ int kprobe__tcp_close(struct pt_regs *ctx, struct sock *sk) int kretprobe__tcp_close(struct pt_regs *ctx) { - u32 pid = bpf_get_current_pid_tgid(); + u64 pid = bpf_get_current_pid_tgid(); struct sock **skpp; skpp = closesock.lookup(&pid); @@ -134,7 +134,7 @@ int kretprobe__tcp_close(struct pt_regs *ctx) // output struct tcp_event_t evt = { .type = "close", - .pid = pid, + .pid = pid >> 32, .saddr = saddr, .daddr = daddr, .sport = ntohs(sport), @@ -154,7 +154,7 @@ int kretprobe__tcp_close(struct pt_regs *ctx) int kretprobe__inet_csk_accept(struct pt_regs *ctx) { struct sock *newsk = (struct sock *)PT_REGS_RC(ctx); - u32 pid = bpf_get_current_pid_tgid(); + u64 pid = bpf_get_current_pid_tgid(); ##FILTER_PID## @@ -174,7 +174,7 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx) bpf_probe_read(&lport, sizeof(lport), &newsk->__sk_common.skc_num); if (family == AF_INET) { - struct tcp_event_t evt = {.type = "accept", .pid = pid}; + struct tcp_event_t evt = {.type = "accept", .pid = pid >> 32}; bpf_probe_read(&evt.saddr, sizeof(u32), &newsk->__sk_common.skc_rcv_saddr); bpf_probe_read(&evt.daddr, sizeof(u32),