linux-kernel - Re: [PATCH v2 net-next] net: tracepoint: exposing sk_faimily in tracepoint inet_sock_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <075DF50A-F4CD-4475-B393-1293BDF8E038@fb.com>
Date:   Sun, 7 Jan 2018 20:55:26 +0000
From:   Song Liu <songliubraving@...com>
To:     Yafang Shao <laoar.shao@...il.com>
CC:     David Miller <davem@...emloft.net>,
        "brendan.d.gregg@...il.com" <brendan.d.gregg@...il.com>,
        "marcelo.leitner@...il.com" <marcelo.leitner@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 net-next] net: tracepoint:  exposing sk_faimily in
 tracepoint inet_sock_set_state


> On Jan 6, 2018, at 10:31 PM, Yafang Shao <laoar.shao@...il.com> wrote:
> 
> As of now, there're two sk_family are traced with sock:inet_sock_set_state,
> which are AF_INET and AF_INET6.
> So the sk_family are exposed as well.
> Then we can conveniently use it to do the filter.
> 
> Both sk_family and sk_protocol are showed in the printk message, so we need
> not expose them as tracepoint arguments.
> 
> Suggested-by: Brendan Gregg <brendan.d.gregg@...il.com>
> Suggested-by: Song Liu <songliubraving@...com>
> Signed-off-by: Yafang Shao <laoar.shao@...il.com>
> ---
> include/trace/events/sock.h | 15 +++++++++++++--
> 1 file changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/include/trace/events/sock.h b/include/trace/events/sock.h
> index 3537c5f..3176a39 100644
> --- a/include/trace/events/sock.h
> +++ b/include/trace/events/sock.h
> @@ -11,7 +11,11 @@
> #include <linux/ipv6.h>
> #include <linux/tcp.h>
> 
> -/* The protocol traced by sock_set_state */
> +#define family_names			\
> +		EM(AF_INET)				\
> +		EMe(AF_INET6)
> +
> +/* The protocol traced by inet_sock_set_state */
> #define inet_protocol_names		\
> 		EM(IPPROTO_TCP)			\
> 		EM(IPPROTO_DCCP)		\
> @@ -37,6 +41,7 @@
> #define EM(a)       TRACE_DEFINE_ENUM(a);
> #define EMe(a)      TRACE_DEFINE_ENUM(a);
> 
> +family_names
> inet_protocol_names
> tcp_state_names
> 
> @@ -45,6 +50,9 @@
> #define EM(a)       { a, #a },
> #define EMe(a)      { a, #a }
> 
> +#define show_family_name(val)			\
> +	__print_symbolic(val, family_names)
> +
> #define show_inet_protocol_name(val)    \
> 	__print_symbolic(val, inet_protocol_names)
> 
> @@ -118,6 +126,7 @@
> 		__field(int, newstate)
> 		__field(__u16, sport)
> 		__field(__u16, dport)
> +		__field(__u16, family)
> 		__field(__u8, protocol)
> 		__array(__u8, saddr, 4)
> 		__array(__u8, daddr, 4)
> @@ -134,6 +143,7 @@
> 		__entry->oldstate = oldstate;
> 		__entry->newstate = newstate;
> 
> +		__entry->family = sk->sk_family;
> 		__entry->protocol = sk->sk_protocol;
> 		__entry->sport = ntohs(inet->inet_sport);
> 		__entry->dport = ntohs(inet->inet_dport);
> @@ -160,7 +170,8 @@
> 		}
> 	),
> 
> -	TP_printk("protocol=%s sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c oldstate=%s newstate=%s",
> +	TP_printk("family=%s protocol=%s sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c oldstate=%s newstate=%s",
> +			show_family_name(__entry->family),
> 			show_inet_protocol_name(__entry->protocol),
> 			__entry->sport, __entry->dport,
> 			__entry->saddr, __entry->daddr,
> --
> 1.8.3.1
> 

Reviewed-by: Song Liu <songliubraving@...com>