eBPF bcctools get contents from tracepipe

Question

This is small program that traces communication in tracepipe. My question is how do I access the contents of tracepipe using bcctools. I tried manually reading the file using fopen but that does not work, is there any function I am not aware of?

Modified  #define KBUILD_MODNAME "filter"
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <linux/udp.h>

#include <linux/if_packet.h>
#include <linux/if_vlan.h>


int udpfilter(struct xdp_md *ctx) {
  bpf_trace_printk("got a packet\n");
  void *data = (void *)(long)ctx->data;
  void *data_end = (void *)(long)ctx->data_end;
  struct ethhdr *eth = data;
  if ((void*)eth + sizeof(*eth) <= data_end) {
    struct iphdr *ip = data + sizeof(*eth);
    if ((void*)ip + sizeof(*ip) <= data_end) {
      if (ip->protocol == IPPROTO_UDP) {
        struct udphdr *udp = (void*)ip + sizeof(*ip);
        if ((void*)udp + sizeof(*udp) <= data_end) {
          if (udp->dest == ntohs(7999)) {
            bpf_trace_printk("udp port 7999\n");
            udp->dest = ntohs(7998);
          }
        }
      }
    }
  }
  return XDP_PASS;
}

score 0 · Answer 1 · answered Nov 27 '21 at 19:05

To display the output from the trace pipe, you can simply use:

bpftool prog tracelog

Note however that the trace pipe is only meant for debugging. If you check your system logs, you'll notice a big warning whenever you use bpf_trace_printk. Instead you should use the perf ring buffer.

eBPF bcctools get contents from tracepipe

1 Answers1