From 47d214b3d924c65b45ddf4851bef98f5949808fa Mon Sep 17 00:00:00 2001 From: yangyongguang Date: Tue, 24 Jun 2025 11:26:11 +0800 Subject: [PATCH] add for upd port metric --- .../ebpf.probe/src/endpointprobe/endpoint.c | 12 +++++++++--- .../ebpf.probe/src/endpointprobe/endpoint.meta | 10 ++++++++++ .../ebpf.probe/src/endpointprobe/udp.bpf.c | 17 +++++++++++++++++ 3 files changed, 36 insertions(+), 3 deletions(-) diff --git a/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.c b/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.c index fc27bb26..ac8144a2 100644 --- a/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.c +++ b/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.c @@ -133,7 +133,9 @@ struct udp_socket_s { struct udp_socket_id_s id; u64 stats[EP_STATS_MAX]; char *local_ip; + u16 local_port; char *remote_ip; + u16 remote_port; time_t last_rcv_data; }; @@ -405,12 +407,14 @@ static void output_tcp_socket(struct tcp_socket_s* tcp_sock) static void output_udp_socket(struct udp_socket_s* udp_sock) { (void)fprintf(stdout, - "|%s|%d|%s|%s|%u" + "|%s|%d|%s|%u|%s|%u|%u" "|%llu|%llu|%llu|\n", OO_UDP_SOCK, udp_sock->id.tgid, udp_sock->local_ip, + udp_sock->local_port, udp_sock->remote_ip, + udp_sock->remote_port, udp_sock->id.local_ipaddr.family, udp_sock->stats[EP_STATS_QUE_RCV_FAILED], @@ -650,8 +654,8 @@ static int add_udp_sock_evt(struct endpoint_probe_s * probe, struct udp_socket_e memcpy(&(id.local_ipaddr), &(evt->local_ipaddr), sizeof(id.local_ipaddr)); memcpy(&(id.remote_ipaddr), &(evt->remote_ipaddr), sizeof(id.remote_ipaddr)); id.tgid = evt->tgid; - id.local_ipaddr.port = 0; - id.remote_ipaddr.port = 0; + id.local_ipaddr.port = evt->local_ipaddr.port; + id.remote_ipaddr.port = evt->remote_ipaddr.port; udp = lkup_udp_socket(probe, (const struct udp_socket_id_s *)&id); if (udp) { @@ -677,6 +681,8 @@ static int add_udp_sock_evt(struct endpoint_probe_s * probe, struct udp_socket_e ip_str(new_udp->id.remote_ipaddr.family, (unsigned char *)&(new_udp->id.remote_ipaddr.ip), remote_ip_str, INET6_ADDRSTRLEN); new_udp->local_ip = strdup((const char *)local_ip_str); new_udp->remote_ip = strdup((const char *)remote_ip_str); + new_udp->local_port = new_udp->id.local_ipaddr.port; + new_udp->remote_port = new_udp->id.remote_ipaddr.port; if (new_udp->local_ip == NULL || new_udp->remote_ip == NULL) { goto err; diff --git a/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.meta b/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.meta index 2e848234..f316db55 100644 --- a/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.meta +++ b/src/probes/extends/ebpf.probe/src/endpointprobe/endpoint.meta @@ -134,11 +134,21 @@ measurements: type: "key", name: "local_ip", }, + { + description: "local port of udp socket.", + type: "key", + name: "local_port", + }, { description: "remote ip of udp socket.", type: "key", name: "remote_ip", }, + { + description: "remote port of udp socket.", + type: "key", + name: "remote_port", + }, { description: "protocol", type: "key", diff --git a/src/probes/extends/ebpf.probe/src/endpointprobe/udp.bpf.c b/src/probes/extends/ebpf.probe/src/endpointprobe/udp.bpf.c index aa957bcc..5c7c19bc 100644 --- a/src/probes/extends/ebpf.probe/src/endpointprobe/udp.bpf.c +++ b/src/probes/extends/ebpf.probe/src/endpointprobe/udp.bpf.c @@ -60,6 +60,16 @@ static __always_inline struct ipv6hdr *ipv6_hdr(const struct sk_buff *skb) return (struct ipv6hdr *)skb_network_header(skb); } +static __always_inline void get_udp_ports_from_skb(struct sk_buff *skb, struct udp_socket_event_s *evt) +{ + unsigned char *head = BPF_CORE_READ(skb, head); + u16 transport_header = BPF_CORE_READ(skb, transport_header); + struct udphdr *uh = (struct udphdr *)(head + transport_header); + + evt->local_ipaddr.port = bpf_ntohs(BPF_CORE_READ(uh, dest)); + evt->remote_ipaddr.port = bpf_ntohs(BPF_CORE_READ(uh, source)); +} + static __always_inline __maybe_unused void get_remote_addr(struct udp_socket_event_s* evt, const struct sockaddr* remote_addr) { const struct sockaddr_in *addr_in = (const struct sockaddr_in *)remote_addr; @@ -89,6 +99,7 @@ static __always_inline void get_local_sockaddr(struct udp_socket_event_s* evt, c } else { BPF_CORE_READ_INTO(&(evt->local_ipaddr.ip6), sk, __sk_common.skc_v6_rcv_saddr); } + evt->local_ipaddr.port = BPF_CORE_READ(sk, __sk_common.skc_num); return; } @@ -104,6 +115,8 @@ static __always_inline void get_remote_sockaddr(struct udp_socket_event_s* evt, } else { BPF_CORE_READ_INTO(&(evt->remote_ipaddr.ip6), sk, __sk_common.skc_v6_daddr); } + evt->remote_ipaddr.port = BPF_CORE_READ(sk, __sk_common.skc_dport); + evt->remote_ipaddr.port = bpf_ntohs(evt->remote_ipaddr.port); return; } @@ -168,6 +181,8 @@ KRETPROBE(__skb_recv_udp, pt_regs) evt.remote_ipaddr.family = AF_INET6; } + get_udp_ports_from_skb(skb, &evt); + unsigned int len = _(skb->len); evt.val = (u64)len; evt.tgid = (int)(bpf_get_current_pid_tgid() >> INT_LEN); @@ -252,6 +267,8 @@ KRETPROBE(__udp_enqueue_schedule_skb, pt_regs) evt.remote_ipaddr.family = AF_INET6; } + get_udp_ports_from_skb(skb, &evt); + unsigned int len = _(skb->len); evt.val = (u64)len; evt.evt = EP_STATS_QUE_RCV_FAILED; -- Gitee