cilium / pwru Goto Github PK
View Code? Open in Web Editor NEWPacket, where are you? -- eBPF-based Linux kernel networking debugger
License: Apache License 2.0
Packet, where are you? -- eBPF-based Linux kernel networking debugger
License: Apache License 2.0
Details are in the lwn article - https://lwn.net/Articles/885729/.
This information is not actually useful to the kernel, but it has been added to the existing kfree_skb tracepoint, making it available to any program that connects to that tracepoint.
It looks like the drop reasons are available with the existing trace point.
The Dockerfile ends up generating the 1.47GB image. This can be reduced by:
base
image instead of ubuntu
.pwru
binary to a new image.As title, I establish a pwru tracing for a packet in a server.
However, due to some other problems, my ssh connection to the server is disconnected.
Now I find that packets processing speed is seriously reduced...
I think injected probes were not removed when ssh is disconnected. Is there any way to verify this? bpftool prog show?
Same as cilium/cilium@28f376b.
Currently, users are required to specify source/destination pod IP addresses as filters. Allow users to pass pod identifiers such as name or label along with the namespace as filters. The mapping from pod identifiers to their IPs can potentially be retrieved from Hubble.
Would be great to track the pointer itself after the initial pkt classification match, and then keep following based on pointer value. Example was filtering on specific port:
[...]
0xffff8882262bf600 [ksoftirqd/1] tcf_classify 4840296765444
0xffff8882262bf600 [ksoftirqd/1] skb_ensure_writable 4840296788712
0xffff8882262bf600 [ksoftirqd/1] inet_proto_csum_replace4 4840296792231
0xffff8882262bf600 [ksoftirqd/1] skb_ensure_writable 4840296794062 <--- last occurrence before out of sight
0xffff8882262bf900 [<empty>] ip_local_out 4856424668947
0xffff8882262bf900 [<empty>] __ip_local_out 4856424679151
0xffff8882262bf900 [<empty>] nf_hook_slow 4856424682172
[...]
What can be seen, we lost track of pointer 0xffff8882262bf600 after skb_ensure_writable because in the tc BPF program we did NAT'ing of the packet.
We can do this today with
--kmods $(ls /sys/kernel/btf/ | grep -v vmlinux | tr '\n' , | sed 's/.$//')
A --all-kmods
flag would be nice
> sudo ./pwru --filter-dst-ip="::4:dead:beef:cafe" --output-tuple
2022/12/05 09:25:46 Per cpu buffer size: 4096 bytes
2022/12/05 09:25:46 Attaching kprobes (via kprobe-multi)...
1433 / 1433 [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
2022/12/05 09:25:46 Attached (ignored 0)
2022/12/05 09:25:46 Listening for events..
SKB CPU PROCESS FUNC
0xffff9befbef5bc00 4 [WebExtensions] skb_queue_tail 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] unix_stream_read_actor 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] consume_skb 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] skb_unlink 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] consume_skb 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] skb_release_head_state 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] unix_destruct_scm 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] sock_wfree 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] skb_release_data 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] skb_free_head 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9befbef5bc00 1 [IPC I/O Parent] kfree_skbmem 1.0.0.0:0->0.0.0.0:0(icmp)
0xffff9bef83152c00 1 [IPC I/O Parent] unix_stream_read_actor 1.0.0.0:0->0.0.0.0:0()
0xffff9bef83152c00 1 [IPC I/O Parent] consume_skb 1.0.0.0:0->0.0.0.0:0()
0xffff9bef83152c00 1 [IPC I/O Parent] skb_unlink 1.0.0.0:0->0.0.0.0:0()
0xffff9bef83152c00 1 [IPC I/O Parent] consume_skb 1.0.0.0:0->0.0.0.0:0()
0xffff9bef83152c00 1 [IPC I/O Parent] skb_release_head_state 1.0.0.0:0->0.0.0.0:0()
0xffff9bef83152c00 1 [IPC I/O Parent] unix_destruct_scm 1.0.0.0:0->0.0.0.0:0()
...
We should also add IPv6 integration tests to the .github/workflows/test.yaml
.
root@bpf2:~# ./pwru --filter-proto icmp --output-tuple
2022/01/21 04:44:15 Attaching kprobes...
577 / 577 [---------------------------------------------------------------------------------------------------------------------------------] 100.00% 34 p/s
2022/01/21 04:44:32 Attached (ignored 13)
2022/01/21 04:44:32 Listening for events..
SKB PROCESS FUNC TIMESTAMP
0xffff96f353734300 [ping] __ip_local_out 52052971636335 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] ip_output 52052971655120 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] nf_hook_slow 52052971658827 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] __cgroup_bpf_run_filter_skb 52052971662013 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] neigh_resolve_output 52052971666902 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] __neigh_event_send 52052971669217 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] eth_header 52052971673094 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_push 52052971676681 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] dev_queue_xmit 52052971678785 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] netdev_core_pick_tx 52052971681881 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] netif_skb_features 52052971684686 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] passthru_features_check 52052971686700 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_network_protocol 52052971689855 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] validate_xmit_xfrm 52052971693733 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] dev_hard_start_xmit 52052971695646 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_clone_tx_timestamp 52052971699343 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] __dev_forward_skb 52052971701788 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_scrub_packet 52052971704002 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] eth_type_trans 52052971706256 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] netif_rx 52052971708560 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] tcf_classify_ingress 52052971727115 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_ensure_writable 52052971788730 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_ensure_writable 52052971790414 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_ensure_writable 52052971791676 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_ensure_writable 52052971792948 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] skb_do_redirect 52052971820830 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] ip_rcv 52052971825740 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] sock_wfree 52052971829246 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] ip_route_input_noref 52052971832592 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] ip_route_input_rcu 52052971834256 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] fib_validate_source 52052971839766 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] ip_local_deliver 52052971843844 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] ip_protocol_deliver_rcu 52052971846338 10.0.1.30:0->10.0.1.23:0(icmp)
0xffff96f353734300 [ping] raw_local_deliver 52052971848362 10.0.1.30:0->10.0.1.23:0(icmp)
2022/01/21 04:44:35 Perf event ring buffer full, dropped 3 samples
0xffff96f353734300 [ping] fib_compute_spec_dst 52052971858761 10.0.1.30:0->10.0.1.23:0(icmp)
2022/01/21 04:44:35 Perf event ring buffer full, dropped 5 samples
0xffff96f353734b00 [ping] neigh_resolve_output 52052971871024 10.0.1.23:0->10.0.1.30:0(icmp)
### 2022/01/21 04:44:35 Perf event ring buffer full, dropped 16 samples
0xffff96f353734300 [<empty>] skb_release_head_state 52052971885111 10.0.1.30:0->10.0.1.23:0(icmp)
2022/01/21 04:44:35 Perf event ring buffer full, dropped 1 samples
0xffff96f353734b00 [<empty>] skb_ensure_writable 52052971919565 10.0.1.23:0->10.0.1.30:0(icmp)
0xffff96f353734b00 [<empty>] skb_ensure_writable 52052971921188 10.0.1.23:0->10.0.1.30:0(icmp)
2022/01/21 04:44:35 Perf event ring buffer full, dropped 2 samples
0xffff96f353734b00 [<empty>] skb_do_redirect 52052971938721 10.0.1.23:0->10.0.1.30:0(icmp)
2022/01/21 04:44:35 Perf event ring buffer full, dropped 13 samples
0xffff96f353734300 [<empty>] sk_filter_trim_cap 52052971953108 10.0.1.23:0->10.0.1.30:0(icmp)
2022/01/21 04:44:35 Perf event ring buffer full, dropped 9 samples
0xffff96f353734300 [<empty>] skb_free_datagram 52052971971122 10.0.1.23:0->10.0.1.30:0(icmp)
^C2022/01/21 04:44:43 Received signal, exiting program..
root@bpf2:~#
root@bpf1:~# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
cni-bpz2q 1/1 Running 0 14h 10.0.1.23 bpf2 <none> <none>
cni-hx8gz 1/1 Running 0 14h 10.0.0.159 bpf1 <none> <none>
same 1/1 Running 0 79s 10.0.1.30 bpf2 <none> <none>
root@bpf1:~# kubectl exec -it same -- ping -c 1 10.0.1.23
PING 10.0.1.23 (10.0.1.23): 56 data bytes
64 bytes from 10.0.1.23: seq=0 ttl=63 time=0.269 ms
--- 10.0.1.23 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.269/0.269/0.269 ms
How about the issue when monitor the two pods communicate to each other on the same node.
which is it means that the ring buffer is full?
ENV:
root@bpf2:~# uname -a
Linux bpf2 5.10.0-051000-generic #202012132330 SMP Sun Dec 13 23:33:36 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
root@bpf2:~#
Currently, --filter-{src,dst}-ip
supports only v4. Same goes for IP addrs shown by --output-tuple
.
This requires the following in cilium/ebpf:
internal/btf
package.See https://github.com/brb/ebpf/tree/pwru for the diff.
When I want to submit a PR, what's the preferred code style format?
clang-format for linux ?
Network addresses may overlap between multiple net namespaces, which can interfere with our filtering.
Once cilium/ebpf#716 has been merged, we can start using the multi-link kprobes. This should significantly reduce the startup time.
Each pwru release published in https://github.com/cilium/pwru/releases is statically linked, and it doesn't have any runtime dependencies. So, it should be trivial to package for major distros (Archlinux, Ubuntu, Debian, Fedora, etc).
Hi,
I installed Ubuntu 20.04 and installed the Ubuntu PPA mainline kernel https://kernel.ubuntu.com/~kernel-ppa/mainline/v6.1.10/, when start pwru v0.0.8, it seems took a few minutes to complete the attachment
./pwru --filter-src-ip 10.169.72.114 --output-tuple --backend kprobe-multi
nothing output, wait for a few minutes, then finally got output like below
2023/02/09 04:15:42 Per cpu buffer size: 4096 bytes
2023/02/09 04:15:42 Attaching kprobes (via kprobe-multi)...
1517 / 1517 [-----------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
2023/02/09 04:15:42 Attached (ignored 0)
2023/02/09 04:15:42 Listening for events..
SKB CPU PROCESS FUNC
I run custom built 6.2 kernel on Centos 8 and same pwru, no such long delay attachment, looked the kernel config between Ubuntu PPA mainline 6.1.10 and Centos 8 custom 6.2 kernel, no difference in regard to FPROBE, KPROBE, FTRACE config. maybe Ubuntu PPA mainline 6.1.10 got more functions to attach?
To show a return value and its BTF.
Right now pwru only supports:
--filter-dst-ip string filter destination IP addr
--filter-dst-port uint16 filter destination port
[...]
--filter-src-ip string filter source IP addr
--filter-src-port uint16 filter source port
But when tracing packets through the stack, they can get DNAT'ed or SNAT'ed or both.
Maybe libpcap-like expression could even be used here, and converted to eBPF insns (e.g. inline asm blob), at least basic primitives to define an expression with ips & ports combined with logical and/or.
When I specify IPv6 addr in --filter-{src,dst}-ip
, the filter seems to catch all packets instead of filtering ones which match the specified IP addr. For example:
# ./pwru --filter-src-ip=fc00:f853:ccd:e793::6 --per-cpu-buffer=100000 --output-tuple --output-meta
2023/02/24 09:39:25 Per cpu buffer size: 100000 bytes
2023/02/24 09:39:25 Attaching kprobes (via kprobe-multi)...
1437 / 1437 [------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
2023/02/24 09:39:25 Attached (ignored 0)
2023/02/24 09:39:25 Listening for events..
SKB CPU PROCESS FUNC
0x0 3 [alacritty] security_socket_getpeersec_dgram netns=0 mark=0x0 ifindex=0 proto=0 mtu=0 len=0 :0->:0()
0x0 3 [alacritty] bpf_lsm_socket_getpeersec_dgram netns=0 mark=0x0 ifindex=0 proto=0 mtu=0 len=0 :0->:0()
0xffff98b4f59dfd00 3 [alacritty] __build_skb_around netns=0 mark=0x0 ifindex=0 proto=0 mtu=0 len=0 :0->:0()
When to run on Ubuntu 23.04, it fails.
# ./pwru --output-tuple --output-meta --filter-track-skb --output-skb --output-limit-lines 10
2023/06/28 12:49:56 Failed to load objects: field KprobeSkb1: program kprobe_skb_1: apply CO-RE relocations: relocate Struct:"sk_buff": target_type_id: multiple types match: ambiguous relocation
Here is env info:
# uname -a
Linux xxx 6.2.0-20-generic #20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 6 07:48:48 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 23.04
Release: 23.04
Codename: lunar
# llc --version
Ubuntu LLVM version 15.0.7
Optimized build.
Default target: x86_64-pc-linux-gnu
Host CPU: skylake
Registered Targets:
aarch64 - AArch64 (little endian)
aarch64_32 - AArch64 (little endian ILP32)
aarch64_be - AArch64 (big endian)
amdgcn - AMD GCN GPUs
arm - ARM
arm64 - ARM64 (little endian)
arm64_32 - ARM64 (little endian ILP32)
armeb - ARM (big endian)
avr - Atmel AVR Microcontroller
bpf - BPF (host endian)
bpfeb - BPF (big endian)
bpfel - BPF (little endian)
hexagon - Hexagon
lanai - Lanai
m68k - Motorola 68000 family
mips - MIPS (32-bit big endian)
mips64 - MIPS (64-bit big endian)
mips64el - MIPS (64-bit little endian)
mipsel - MIPS (32-bit little endian)
msp430 - MSP430 [experimental]
nvptx - NVIDIA PTX 32-bit
nvptx64 - NVIDIA PTX 64-bit
ppc32 - PowerPC 32
ppc32le - PowerPC 32 LE
ppc64 - PowerPC 64
ppc64le - PowerPC 64 LE
r600 - AMD GPUs HD2XXX-HD6XXX
riscv32 - 32-bit RISC-V
riscv64 - 64-bit RISC-V
sparc - Sparc
sparcel - Sparc LE
sparcv9 - Sparc V9
systemz - SystemZ
thumb - Thumb
thumbeb - Thumb (big endian)
ve - VE
wasm32 - WebAssembly 32-bit
wasm64 - WebAssembly 64-bit
x86 - 32-bit X86: Pentium-Pro and above
x86-64 - 64-bit X86: EM64T and AMD64
xcore - XCore
Meanwhile, it slow starts like #189 .
Hi,
I am trying to use pwru to trouble shoot issue cilium/cilium#17528. this is on 5.4 kernel, I got error
[root@centos-dev pwru]# ./pwru --filter-dst-ip=10.169.72.236 --filter-dst-port=8472 --filter-proto=udp --output-stack
2021/10/20 13:24:35 Loading objects: field KprobeSkb1: program kprobe_skb_1: load program: invalid argument: ; int kprobe_skb_1(struct pt_regs *ctx) {
0: (bf) r6 = r1
; struct sk_buff *skb = (struct sk_buff *) PT_REGS_PARM1(ctx);
1: (79) r9 = *(u64 *)(r6 +112)
2: (b7) r1 = 0
; struct event_t event = {};
3: (7b) *(u64 *)(r10 -56) = r1
last_idx 3 first_idx 0
regs=2 stack=0 before 2: (b7) r1 = 0
4: (7b) *(u64 *)(r10 -64) = r1
5: (7b) *(u64 *)(r10 -72) = r1
6: (7b) *(u64 *)(r10 -80) = r1
7: (7b) *(u64 *)(r10 -88) = r1
8: (7b) *(u64 *)(r10 -96) = r1
9: (7b) *(u64 *)(r10 -104) = r1
10: (7b) *(u64 *)(r10 -112) = r1
11: (7b) *(u64 *)(r10 -120) = r1
12: (7b) *(u64 *)(r10 -128) = r1
13: (7b) *(u64 *)(r10 -136) = r1
; u32 index = 0;
14: (63) *(u32 *)(r10 -140) = r1
15: (bf) r2 = r10
;
16: (07) r2 += -140
; struct config *cfg = bpf_map_lookup_elem(&cfg_map, &index);
17: (18) r1 = 0xffff9c67d9e55400
19: (85) call bpf_map_lookup_elem#1
20: (bf) r7 = r0
; if (cfg) {
21: (15) if r7 == 0x0 goto pc+430
R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R6_w=ctx(id=0,off=0,imm=0) R7_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R9_w=inv(id=0) R10=fp0 fp-56_w=00000000 fp-64_w=00000000 fp-72_w=00000000 fp-80_w=00000000 fp-88_w=00000000 fp-96_w=00000000 fp-104_w=00000000 fp-112_w=00000000 fp-120_w=00000000 fp-128_w=00000000 fp-136_w=00000000 fp-144=mmmm????
; if (cfg->mark) {
22: (71) r1 = *(u8 *)(r7 +1)
R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R6_w=ctx(id=0,off=0,imm=0) R7_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R9_w=inv(id=0) R10=fp0 fp-56_w=00000000 fp-64_w=00000000 fp-72_w=00000000 fp-80_w=00000000 fp-88_w=00000000 fp-96_w=00000000 fp-104_w=00000000 fp-112_w=00000000 fp-120_w=00000000 fp-128_w=00000000 fp-136_w=00000000 fp-144=mmmm????
23: (67) r1 <<= 8
24: (71) r2 = *(u8 *)(r7 +0)
R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R1_w=inv(id=0,umax_value=65280,var_off=(0x0; 0xff00)) R6_w=ctx(id=0,off=0,imm=0) R7_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R9_w=inv(id=0) R10=fp0 fp-56_w=00000000 fp-64_w=00000000 fp-72_w=00000000 fp-80_w=00000000 fp-88_w=00000000 fp-96_w=00000000 fp-104_w=00000000 fp-112_w=00000000 fp-120_w=00000000 fp-128_w=00000000 fp-136_w=00000000 fp-144=mmmm????
25: (4f) r1 |= r2
26: (71) r2 = *(u8 *)(r7 +2)
R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R1_w=inv(id=0) R2_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R6_w=ctx(id=0,off=0,imm=0) R7_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R9_w=inv(id=0) R10=fp0 fp-56_w=00000000 fp-64_w=00000000 fp-72_w=00000000 fp-80_w=00000000 fp-88_w=00000000 fp-96_w=00000000 fp-104_w=00000000 fp-112_w=00000000 fp-120_w=00000000 fp-128_w=00000000 fp-136_w=00000000 fp-144=mmmm????
27: (71) r3 = *(u8 *)(r7 +3)
R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R1_w=inv(id=0) R2_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R6_w=ctx(id=0,off=0,imm=0) R7_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R9_w=inv(id=0) R10=fp0 fp-56_w=00000000 fp-64_w=00000000 fp-72_w=00000000 fp-80_w=00000000 fp-88_w=00000000 fp-96_w=00000000 fp-104_w=00000000 fp-112_w=00000000 fp-120_w=00000000 fp-128_w=00000000 fp-136_w=00000000 fp-144=mmmm????
28: (67) r3 <<= 8
29: (4f) r3 |= r2
30: (67) r3 <<= 16
31: (4f) r3 |= r1
; if (cfg->mark) {
32: (15) if r3 == 0x0 goto pc+19
R0=map_value(id=0,off=0,ks=4,vs=48,imm=0) R1=inv(id=0) R2=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R3=inv(id=0) R6=ctx(id=0,off=0,imm=0) R7=map_value(id=0,off=0,ks=4,vs=48,imm=0) R9=inv(id=0) R10=fp0 fp-56=00000000 fp-64=00000000 fp-72=00000000 fp-80=00000000 fp-88=00000000 fp-96=00000000 fp-104=00000000 fp-112=00000000 fp-120=00000000 fp-128=00000000 fp-136=00000000 fp-144=mmmm????
33: (b7) r1 = 164
34: (bf) r3 = r9
35: (0f) r3 += r1
36: (bf) r1 = r10
;
37: (07) r1 += -24
; mark = BPF_CORE_READ(skb, mark);
38: (b7) r2 = 4
39: (85) call unknown#113
invalid func unknown#113
processed 39 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1```
I noticed in the section of the code below, that there are 5 kprobe programs and each of them are reading the sk_buff for the intercepted data from different params 1-5 respectively.
The question is, what is the significance of PT_REG_PARMx
and also why do we need 5 kprobe programs?
https://github.com/cilium/pwru/blob/master/bpf/kprobe_pwru.c#L359-L392
@aanm Could you add ubuntu-latest-4cores-16gb
to this repo too?
[vagrant@fedora ~]$ sudo ./pwru --filter-dst-port=11211
2022/01/07 03:50:20 Attaching kprobes...
473 / 1333 [----------------------------------------------- 35.48% 17 p/s
Killed
i am able to run pwru just like sudo ./pwru
but not able to apply any filters
Can this watch arp request and response?
# ./pwru --output-skb
2021/11/25 16:47:00 Loading objects: field KprobeSkb1: program kprobe_skb_1: load program: invalid argument: BPF_STX uses reserved fields
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
The running OS:
# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.04
Release: 21.04
Codename: hirsute
# uname -a
Linux pagani 5.11.0-31-generic #33-Ubuntu SMP Wed Aug 11 13:19:04 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
bpf:
# cat /boot/config-$(uname -r) | grep BPF
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_LSM=y
CONFIG_BPF_SYSCALL=y
CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_BPF_JIT_DEFAULT_ON=y
# CONFIG_BPF_PRELOAD is not set
CONFIG_IPV6_SEG6_BPF=y
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_BPFILTER=y
CONFIG_BPFILTER_UMH=m
CONFIG_NET_CLS_BPF=m
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_LWTUNNEL_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
CONFIG_BPF_KPROBE_OVERRIDE=y
CONFIG_TEST_BPF=m
# cat /boot/config-$(uname -r) | grep BTF
CONFIG_VIDEO_SONY_BTF_MPX=m
CONFIG_DEBUG_INFO_BTF=y
CONFIG_PAHOLE_HAS_SPLIT_BTF=y
CONFIG_DEBUG_INFO_BTF_MODULES=y
llvm:
# llc --version
LLVM (http://llvm.org/):
LLVM version 12.0.0
Optimized build.
Default target: x86_64-pc-linux-gnu
Host CPU: skylake
Registered Targets:
bpf - BPF (host endian)
bpfeb - BPF (big endian)
bpfel - BPF (little endian)
I run Ubuntu 21.04 as a VirtualBox VM. go generate
, go build
and ./pwru --output-skb
, then the error comes.
check the kprobe_pwru.c:
static __always_inline void
set_skb_btf(struct sk_buff *skb, typeof(print_skb_id) *event_id) {
#ifdef OUTPUT_SKB
static struct btf_ptr p = {};
typeof(print_skb_id) id;
char *str;
p.type_id = bpf_core_type_id_kernel(struct sk_buff);
p.ptr = skb;
id = __sync_fetch_and_add(&print_skb_id, 1) % 256;
str = bpf_map_lookup_elem(&print_skb_map, (u32 *) &id);
if (!str)
return;
if (bpf_snprintf_btf(str, PRINT_SKB_STR_SIZE, &p, sizeof(p), 0) < 0)
return;
*event_id = id;
#endif
}
check the kernel bpf verifier.c:
if (BPF_CLASS(insn->code) == BPF_STX &&
((BPF_MODE(insn->code) != BPF_MEM &&
BPF_MODE(insn->code) != BPF_XADD) || insn->imm != 0)) {
verbose(env, "BPF_STX uses reserved fields\n");
return -EINVAL;
}
and learn BPF and XDP Reference Guide:
BPF_ST, BPF_STX: Both classes are for store operations. Similar to BPF_LDX the BPF_STX is the store counterpart and is used to
store the data from a register into memory, which, again, can be stack memory, map value, packet data, etc. BPF_STX also holds
special instructions for performing word and double-word based atomic add operations, which can be used for counters, for
example. The BPF_ST class is similar to BPF_STX by providing instructions for storing data into memory only that the source
operand is an immediate value.
also to check its assembly code:
# clang -I./bpf/headers -O2 -target bpf -c bpf/kprobe_pwru.c -o kprobe_pwru.elf -g -DOUTPUT_SKB
# llvm-objdump -S ./kprobe_pwru.elf > kprobe_pwru.elf.txt
But at the end, I don't know how to fix it.
The kernel calls kfree_skb when the packet is finally dropped, and most of the time this is the first thing we look at, so we can print out the kernel stack and get a general idea of the problem. However, the current default is to probe all functions that contain skb, which is a bit time consuming.
[Sun Oct 17 21:42:38][#94# ] (master)$go build main.go
./main.go:68:15: undefined: signal.NotifyContext
./main.go:85:11: undefined: KProbePWRUObjects
./main.go:86:13: undefined: LoadKProbePWRUObjects
./main.go:99:11: undefined: KProbePWRUWithoutOutputSKBObjects
./main.go:100:13: undefined: LoadKProbePWRUWithoutOutputSKBObjects
note: module requires Go 1.17
When writing bpf programs, you may need to use some basic memory operations, such as memcmp, etc.
https://github.com/cilium/cilium/blob/master/bpf/include/bpf/builtins.h
Would be awesome to add, as optional, the current datetime for each event line that pwru emits, instead of
0xffff8d36e2d97000 11 [agent] skb_release_data 1616 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=120
0xffff8d36e2d97000 11 [agent] kfree_skbmem 1634 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=120
0xffff8d36e2d96200 11 [agent] skb_consume_udp 10517284 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=116
0xffff8d36e2d96200 11 [agent] __consume_stateless_skb 1194 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=116
0xffff8d36e2d96200 11 [agent] skb_release_data 1203 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=116
we would have
18:03:00 0xffff8d36e2d97000 11 [agent] skb_release_data 1616 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=120
18:03:00 0xffff8d36e2d97000 11 [agent] kfree_skbmem 1634 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=120
18:03:00 0xffff8d36e2d96200 11 [agent] skb_consume_udp 10517284 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=116
18:03:00 0xffff8d36e2d96200 11 [agent] __consume_stateless_skb 1194 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=116
18:03:00 0xffff8d36e2d96200 11 [agent] skb_release_data 1203 netns=0 mark=0x0 ifindex=0 proto=8 mtu=0 len=116
wdyt @brb?
From https://github.com/cilium/pwru/actions/runs/3692407386/jobs/6252237529:
docker run \
--rm \
--workdir /pwru \
--volume `pwd`:/pwru docker.io/library/golang:1.18.3-alpine3.16 \
sh -c "apk add --no-cache make git clang llvm && \
addgroup -g 123 release && \
adduser -u 1001 -D -G release release && \
su release -c 'make local-release VERSION=v0.0.7'"
...
addgroup: gid '123' in use
Current set_tuple()
reads l4_off
from skb->transport_header
and then get struct tcphdr *tcp
based on that:
Lines 205 to 208 in f470db0
Lines 227 to 228 in f470db0
But on some kprobes such as xfrm_rcv_cb
and xfrm6_rcv_cb
, skb->head + skb->transport_header
points to the same position as skb->head + skb->network_header
, causing wrong L4 tuple settings therefore.
I was observing cilium with IPsec using pwru, while keeping curling from pod1@host1 to pod2@host2 using IPv6.
The pwru command below filters tcp syn traffic on host2 (receiving host):
$ s pwru --output-tuple --output-meta --filter-dst-port 80 --filter-dst-ip fd00:10:244:1::cf33 --filter-pcap 'ip6[40+13] & 0x3f = 0x2' --filter-netns 4026533408
2023/07/01 12:43:37 Per cpu buffer size: 4096 bytes
2023/07/01 12:43:37 Attaching kprobes (via kprobe-multi)...
1498 / 1498 [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
2023/07/01 12:43:37 Attached (ignored 0)
2023/07/01 12:43:37 Listening for events..
SKB CPU PROCESS FUNC
0xffff98ae4743eae8 0 [curl] xfrm_rcv_cb netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:24589->[fd00:10:244:1::cf33]:62723(tcp)
0xffff98ae4743eae8 0 [curl] xfrm6_rcv_cb netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:24589->[fd00:10:244:1::cf33]:62723(tcp)
0xffff98ae4743eae8 0 [curl] gro_cells_receive netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:24589->[fd00:10:244:1::cf33]:62723(tcp)
0xffff98ae4743eae8 0 [curl] napi_gro_receive netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:24589->[fd00:10:244:1::cf33]:62723(tcp)
0xffff98ae4743eae8 0 [curl] dev_gro_receive netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:24589->[fd00:10:244:1::cf33]:62723(tcp)
0xffff98ae4743eae8 0 [curl] ipv6_gro_receive netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:24589->[fd00:10:244:1::cf33]:62723(tcp)
0xffff98ae4743eae8 0 [curl] tcp6_gro_receive netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] __skb_gro_checksum_complete netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] tcp_gro_receive netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_defer_rx_timestamp netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] tcf_classify netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_ensure_writable netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_ensure_writable netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_ensure_writable netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_ensure_writable netns=4026533408 mark=0x0 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_ensure_writable netns=4026533408 mark=0x0 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_ensure_writable netns=4026533408 mark=0x0 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_do_redirect netns=4026533408 mark=0x0 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] __bpf_redirect netns=4026533408 mark=0x0 ifindex=4 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] __dev_queue_xmit netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] qdisc_pkt_len_init netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] netdev_core_pick_tx netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] validate_xmit_skb netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] netif_skb_features netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] passthru_features_check netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_network_protocol netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] validate_xmit_xfrm netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] dev_hard_start_xmit netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_clone_tx_timestamp netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] __dev_forward_skb netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] __dev_forward_skb2 netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] skb_scrub_packet netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
0xffff98ae4743eae8 0 [curl] eth_type_trans netns=4026533408 mark=0x0 ifindex=11 proto=dd86 mtu=1500 len=94 [fd00:10:244::834b]:37360->[fd00:10:244:1::cf33]:80(tcp)
Please notice the first 6 lines of output, which printed skb with dst port 62723, this is not what we want as we specified --filter-dst-port 80
.
Let's run that pwru command again but with output-skb
:
0xffff98ae4743dae8 0 [curl] xfrm_rcv_cb netns=4026533408 mark=0xd00 ifindex=4 proto=dd86 mtu=1500 len=80 [fd00:10:244::834b]:24584->[fd00:10:244:1::cf33]:55600(tcp)
(struct sk_buff){
(union){
(struct){
.prev = (struct sk_buff *)0x00000000cd64749d,
(union){
.dev = (struct net_device *)0x000000008db904fc,
.dev_scratch = (long unsigned int)18446630474028769280,
},
},
.rbnode = (struct rb_node){
.rb_right = (struct rb_node *)0x00000000cd64749d,
.rb_left = (struct rb_node *)0x000000008db904fc,
},
.list = (struct list_head){
.prev = (struct list_head *)0x00000000cd64749d,
},
},
.cb = (char[])[
4,
],
(union){
(struct){
._skb_refdst = (long unsigned int)18446630476639842048,
},
.tcp_tsorted_anchor = (struct list_head){
.next = (struct list_head *)0x000000003ed00c73,
},
._sk_redir = (long unsigned int)18446630476639842048,
},
._nfct = (long unsigned int)7,
.len = (unsigned int)80,
.mac_len = (__u16)14,
.fclone = (__u8)0x2,
.active_extensions = (__u8)2,
(union){
(struct){
.ooo_okay = (__u8)0x1,
.l4_hash = (__u8)0x1,
.csum_valid = (__u8)0x1,
.tc_at_ingress = (__u8)0x1,
.slow_gro = (__u8)0x1,
(union){
.csum = (__wsum)1048856,
(struct){
.csum_start = (__u16)280,
.csum_offset = (__u16)16,
},
},
.skb_iif = (int)4,
.hash = (__u32)4162138329,
(union){
.mark = (__u32)3328,
.reserved_tailroom = (__u32)3328,
},
(union){
.inner_protocol = (__be16)22629,
.inner_ipproto = (__u8)101,
},
.inner_transport_header = (__u16)224,
.inner_network_header = (__u16)184,
.inner_mac_header = (__u16)170,
.protocol = (__be16)56710,
.transport_header = (__u16)240,
.network_header = (__u16)240,
.mac_header = (__u16)226,
},
.headers = (struct){
.ooo_okay = (__u8)0x1,
.l4_hash = (__u8)0x1,
.csum_valid = (__u8)0x1,
.tc_at_ingress = (__u8)0x1,
.slow_gro = (__u8)0x1,
(union){
.csum = (__wsum)1048856,
(struct){
.csum_start = (__u16)280,
.csum_offset = (__u16)16,
},
},
.skb_iif = (int)4,
.hash = (__u32)4162138329,
(union){
.mark = (__u32)3328,
.reserved_tailroom = (__u32)3328,
},
The transport_header
and network_header
have the same value 240
!
That explains everything: the filter_pcap()
works as expected because it calculates L4 using L3 header pointer, which is accurate; set_output()
on the other hand relies on skb->transport_header
, which isn't set properly for those kprobes.
To explain how we get a strange dest port 62723, let's inspect the packet:
In output_tuple(), struct tcphdr *tcp
points to L3 header wrongly, as I highlighted in the picture above. Then tcp->dport
would get the 3rd and 4th bytes: f5 03
, which is exactly 62723 in hex:
>>> 0xf503
62723
In conclusion, pcap filter counts on the L3 header only and works perfect to filter the packet, but tuple output setting doesn't make it right.
On 5.18, both PT_REGS_IP(ctx)
and bpf_get_func_ip(ctx)
return addrs which are +4 compared to 5.17. This breaks IP => func name resolution via /proc/kallsyms
.
@YutaroHayakawa found this commit torvalds/linux@7f0059b which might explain the +4.
To apply the same fix we might need to teach https://github.com/cilium/ebpf how to load the kernel config.
Hi 👋
On ArchLinux running Kernel 6.0.8
I'm running into the following problem:
$ sudo pwru
2022/11/18 10:46:19 Failed to load BTF spec: can't read types: type id 2036: unknown kind: Unknown (19)
I've verified that I meet all the requirements from the README.md
.
How to reproduce:
cd $GOPATH/src/github.com/cilium
git clone https://github.com/cilium/little-vm-helper
cd little-vm-helper && make && sudo make install && cd -
mkdir images/
IMAGE_DIR=./images ./little-vm-helper/scripts/pull_image.sh quay.io/lvh-images/kind:bpf-next-20230531.165437
lvh run --image ./images/kind_bpf-next.qcow2 --host-mount $GOPATH/src/github.com/cilium/ --daemonize -p 2222:22 --cpu=3 --mem=6G
ssh -p 2222 -o "StrictHostKeyChecking=no" root@localhost
cd /host/pwru
./pwru --filter-dst-ip=1.1.1.1
... takes ages until attach kprobes appear
For the BPF code compilation we already use clang. Let's use the same compiler for the libpcap.a and CGO compilations.
The skb
search should not be limited to the compiled kernel, and it should include kernel modules (either specified by user or all available in /sys/kernel/btf/*
).
This requires cilium/ebpf to implement an equivalent of the libbpf's btf__parse_split()
.
Mainly to catch possible discrepancies between different verifier versions.
The Cilium's alignchecker should be extended to support BTF instead of DWARF. AFAIK, @ti-mo is planning to do so.
If the machine that compiled pwru has more CPUs than the machine that runs it I get the following error, along with an exit code 1:
Creating perf event reader: failed to create perf ring for CPU 1: can't create perf event: Invalid argument
I've attached the full strace, but the main syscall that failed is installing the perf_event to the (non-existent) second CPU:
[pid 1994] perf_event_open({type=PERF_TYPE_SOFTWARE, size=PERF_ATTR_SIZE_VER7, config=PERF_COUNT_SW_BPF_OUTPUT, sample_period=0, sample_type=PERF_SAMPLE_RAW, read_format=0, watermark=1, precise_ip=0 /* arbitrary skid */, ...}, -1, 1, -1, PERF_FLAG_FD_CLOEXEC) = -1 EINVAL (Invalid argument)
Previously discussed in #89 (comment)
Now each field in each filter rule corresponds to a key, so the bpf program will call bpf_map_lookup_elem several times to query, and it is not very convenient when adding fields
To include cilium/ebpf#1084.
/*
* TODO: ipv6 l4 protocol
* According to https://www.rfc-editor.org/rfc/rfc2460, in ipv6 header, the
* transport layer protocol is represented by the Next Header field. However
* ipv6 supports extension headers and recommends to place the transport layer
* protocol at last. So if we want to parse out the transport layer protocol,
* we have to identify all the extension headers, which is quite troublesome.
* Currently it is assumed that there are no ipv6 extension headers.
*/
Full log:
$~/sandbox/gopath/src/github.com/cilium/pwru [09:54:20] @ main
> make release
docker run \
--rm \
--workdir /pwru \
--volume `pwd`:/pwru docker.io/library/golang:1.18.3 \
sh -c "apt update && apt install -y make git clang-13 llvm && \
ln -s /usr/bin/clang && \
git config --global --add safe.directory /pwru && \
make libpcap.a && \
make local-release VERSION=v0.0.9-38-gf7f9bdb"
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]
Get:2 http://security.debian.org/debian-security bullseye-security InRelease [48.4 kB]
Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]
Get:4 http://security.debian.org/debian-security bullseye-security/main amd64 Packages [252 kB]
Get:5 http://deb.debian.org/debian bullseye/main amd64 Packages [8183 kB]
Get:6 http://deb.debian.org/debian bullseye-updates/main amd64 Packages [14.8 kB]
Fetched 8658 kB in 4s (2095 kB/s)
Reading package lists...
Building dependency tree...
Reading state information...
53 packages can be upgraded. Run 'apt list --upgradable' to see them.
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
Reading package lists...
Building dependency tree...
Reading state information...
make is already the newest version (4.3-4.1).
The following additional packages will be installed:
binfmt-support icu-devtools lib32gcc-s1 lib32stdc++6 libc-dev-bin libc6
libc6-dev libc6-i386 libclang-common-13-dev libclang-cpp11 libclang-cpp13
libclang1-13 libffi-dev libgc1 libicu-dev libicu67 libllvm11 libllvm13
libncurses-dev libncurses6 libncursesw6 libobjc-10-dev libobjc4 libpfm4
libpipeline1 libtinfo-dev libtinfo6 libxml2 libxml2-dev libyaml-0-2 libz3-4
libz3-dev llvm-11 llvm-11-dev llvm-11-runtime llvm-11-tools llvm-13
llvm-13-dev llvm-13-linker-tools llvm-13-runtime llvm-13-tools llvm-runtime
python3-pkg-resources python3-pygments python3-yaml
Suggested packages:
clang-13-doc gettext-base git-daemon-run | git-daemon-sysvinit git-doc
git-el git-email git-gui gitk gitweb git-cvs git-mediawiki git-svn glibc-doc
libc-l10n locales manpages-dev icu-doc ncurses-doc llvm-11-doc llvm-13-doc
python3-setuptools python-pygments-doc ttf-bitstream-vera
Recommended packages:
patch less manpages manpages-dev libc-devtools libnss-nis libnss-nisplus
libgpm2
The following NEW packages will be installed:
binfmt-support clang-13 icu-devtools lib32gcc-s1 lib32stdc++6 libc6-i386
libclang-common-13-dev libclang-cpp11 libclang-cpp13 libclang1-13 libffi-dev
libgc1 libicu-dev libicu67 libllvm11 libllvm13 libncurses-dev libobjc-10-dev
libobjc4 libpfm4 libpipeline1 libtinfo-dev libxml2 libxml2-dev libyaml-0-2
libz3-4 libz3-dev llvm llvm-11 llvm-11-dev llvm-11-runtime llvm-11-tools
llvm-13 llvm-13-dev llvm-13-linker-tools llvm-13-runtime llvm-13-tools
llvm-runtime python3-pkg-resources python3-pygments python3-yaml
The following packages will be upgraded:
git libc-dev-bin libc6 libc6-dev libncurses6 libncursesw6 libtinfo6
7 upgraded, 41 newly installed, 0 to remove and 46 not upgraded.
Need to get 196 MB of archives.
After this operation, 1110 MB of additional disk space will be used.
Get:1 http://deb.debian.org/debian bullseye/main amd64 libc6-dev amd64 2.31-13+deb11u6 [2360 kB]
Get:2 http://deb.debian.org/debian bullseye/main amd64 libc-dev-bin amd64 2.31-13+deb11u6 [276 kB]
Get:3 http://deb.debian.org/debian bullseye/main amd64 libc6 amd64 2.31-13+deb11u6 [2827 kB]
Get:4 http://deb.debian.org/debian bullseye/main amd64 libncurses6 amd64 6.2+20201114-2+deb11u1 [102 kB]
Get:5 http://deb.debian.org/debian bullseye/main amd64 libncursesw6 amd64 6.2+20201114-2+deb11u1 [132 kB]
Get:6 http://deb.debian.org/debian bullseye/main amd64 libtinfo6 amd64 6.2+20201114-2+deb11u1 [341 kB]
Get:7 http://deb.debian.org/debian bullseye/main amd64 libpipeline1 amd64 1.5.3-1 [34.3 kB]
Get:8 http://deb.debian.org/debian bullseye/main amd64 binfmt-support amd64 2.2.1-1+deb11u1 [66.8 kB]
Get:9 http://deb.debian.org/debian bullseye/main amd64 libicu67 amd64 67.1-7 [8622 kB]
Get:10 http://deb.debian.org/debian bullseye/main amd64 libxml2 amd64 2.9.10+dfsg-6.7+deb11u4 [693 kB]
Get:11 http://deb.debian.org/debian bullseye/main amd64 libz3-4 amd64 4.8.10-1 [6949 kB]
Get:12 http://deb.debian.org/debian bullseye/main amd64 libllvm13 amd64 1:13.0.1-6~deb11u1 [20.1 MB]
Get:13 http://deb.debian.org/debian bullseye/main amd64 libclang-cpp13 amd64 1:13.0.1-6~deb11u1 [10.7 MB]
Get:14 http://deb.debian.org/debian bullseye/main amd64 libgc1 amd64 1:8.0.4-3 [239 kB]
Get:15 http://deb.debian.org/debian bullseye/main amd64 libobjc4 amd64 10.2.1-6 [41.8 kB]
Get:16 http://deb.debian.org/debian bullseye/main amd64 libobjc-10-dev amd64 10.2.1-6 [170 kB]
Get:17 http://deb.debian.org/debian bullseye/main amd64 libc6-i386 amd64 2.31-13+deb11u6 [2615 kB]
Get:18 http://deb.debian.org/debian bullseye/main amd64 lib32gcc-s1 amd64 10.2.1-6 [49.4 kB]
Get:19 http://deb.debian.org/debian bullseye/main amd64 lib32stdc++6 amd64 10.2.1-6 [510 kB]
Get:20 http://deb.debian.org/debian bullseye/main amd64 libclang-common-13-dev amd64 1:13.0.1-6~deb11u1 [5602 kB]
Get:21 http://deb.debian.org/debian bullseye/main amd64 llvm-13-linker-tools amd64 1:13.0.1-6~deb11u1 [1253 kB]
Get:22 http://deb.debian.org/debian bullseye/main amd64 libclang1-13 amd64 1:13.0.1-6~deb11u1 [6187 kB]
Get:23 http://deb.debian.org/debian bullseye/main amd64 clang-13 amd64 1:13.0.1-6~deb11u1 [123 kB]
Get:24 http://deb.debian.org/debian bullseye/main amd64 git amd64 1:2.30.2-1+deb11u2 [5518 kB]
Get:25 http://deb.debian.org/debian bullseye/main amd64 icu-devtools amd64 67.1-7 [201 kB]
Get:26 http://deb.debian.org/debian bullseye/main amd64 libllvm11 amd64 1:11.0.1-2 [17.9 MB]
Get:27 http://deb.debian.org/debian bullseye/main amd64 libclang-cpp11 amd64 1:11.0.1-2 [9632 kB]
Get:28 http://deb.debian.org/debian bullseye/main amd64 libffi-dev amd64 3.3-6 [56.5 kB]
Get:29 http://deb.debian.org/debian bullseye/main amd64 libicu-dev amd64 67.1-7 [9597 kB]
Get:30 http://deb.debian.org/debian bullseye/main amd64 libncurses-dev amd64 6.2+20201114-2+deb11u1 [344 kB]
Get:31 http://deb.debian.org/debian bullseye/main amd64 libpfm4 amd64 4.11.1+git32-gd0b85fb-1 [286 kB]
Get:32 http://deb.debian.org/debian bullseye/main amd64 libtinfo-dev amd64 6.2+20201114-2+deb11u1 [940 B]
Get:33 http://deb.debian.org/debian bullseye/main amd64 libxml2-dev amd64 2.9.10+dfsg-6.7+deb11u4 [790 kB]
Get:34 http://deb.debian.org/debian bullseye/main amd64 libyaml-0-2 amd64 0.2.2-1 [49.6 kB]
Get:35 http://deb.debian.org/debian bullseye/main amd64 libz3-dev amd64 4.8.10-1 [90.8 kB]
Get:36 http://deb.debian.org/debian bullseye/main amd64 llvm-11-runtime amd64 1:11.0.1-2 [212 kB]
Get:37 http://deb.debian.org/debian bullseye/main amd64 llvm-runtime amd64 1:11.0-51+nmu5 [8532 B]
Get:38 http://deb.debian.org/debian bullseye/main amd64 llvm-11 amd64 1:11.0.1-2 [8463 kB]
Get:39 http://deb.debian.org/debian bullseye/main amd64 llvm amd64 1:11.0-51+nmu5 [10.7 kB]
Get:40 http://deb.debian.org/debian bullseye/main amd64 python3-pkg-resources all 52.0.0-4 [190 kB]
Get:41 http://deb.debian.org/debian bullseye/main amd64 python3-pygments all 2.7.1+dfsg-2.1 [657 kB]
Get:42 http://deb.debian.org/debian bullseye/main amd64 python3-yaml amd64 5.3.1-5 [138 kB]
Get:43 http://deb.debian.org/debian bullseye/main amd64 llvm-11-tools amd64 1:11.0.1-2 [373 kB]
Get:44 http://deb.debian.org/debian bullseye/main amd64 llvm-11-dev amd64 1:11.0.1-2 [28.0 MB]
Get:45 http://deb.debian.org/debian bullseye/main amd64 llvm-13-runtime amd64 1:13.0.1-6~deb11u1 [265 kB]
Get:46 http://deb.debian.org/debian bullseye/main amd64 llvm-13 amd64 1:13.0.1-6~deb11u1 [11.0 MB]
Get:47 http://deb.debian.org/debian bullseye/main amd64 llvm-13-tools amd64 1:13.0.1-6~deb11u1 [421 kB]
Get:48 http://deb.debian.org/debian bullseye/main amd64 llvm-13-dev amd64 1:13.0.1-6~deb11u1 [31.9 MB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 196 MB in 2min 33s (1281 kB/s)
(Reading database ... 15718 files and directories currently installed.)
Preparing to unpack .../libc6-dev_2.31-13+deb11u6_amd64.deb ...
Unpacking libc6-dev:amd64 (2.31-13+deb11u6) over (2.31-13+deb11u3) ...
Preparing to unpack .../libc-dev-bin_2.31-13+deb11u6_amd64.deb ...
Unpacking libc-dev-bin (2.31-13+deb11u6) over (2.31-13+deb11u3) ...
Preparing to unpack .../libc6_2.31-13+deb11u6_amd64.deb ...
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
Unpacking libc6:amd64 (2.31-13+deb11u6) over (2.31-13+deb11u3) ...
Setting up libc6:amd64 (2.31-13+deb11u6) ...
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
(Reading database ... 15719 files and directories currently installed.)
Preparing to unpack .../libncurses6_6.2+20201114-2+deb11u1_amd64.deb ...
Unpacking libncurses6:amd64 (6.2+20201114-2+deb11u1) over (6.2+20201114-2) ...
Preparing to unpack .../libncursesw6_6.2+20201114-2+deb11u1_amd64.deb ...
Unpacking libncursesw6:amd64 (6.2+20201114-2+deb11u1) over (6.2+20201114-2) ...
Preparing to unpack .../libtinfo6_6.2+20201114-2+deb11u1_amd64.deb ...
Unpacking libtinfo6:amd64 (6.2+20201114-2+deb11u1) over (6.2+20201114-2) ...
Setting up libtinfo6:amd64 (6.2+20201114-2+deb11u1) ...
Selecting previously unselected package libpipeline1:amd64.
(Reading database ... 15719 files and directories currently installed.)
Preparing to unpack .../00-libpipeline1_1.5.3-1_amd64.deb ...
Unpacking libpipeline1:amd64 (1.5.3-1) ...
Selecting previously unselected package binfmt-support.
Preparing to unpack .../01-binfmt-support_2.2.1-1+deb11u1_amd64.deb ...
Unpacking binfmt-support (2.2.1-1+deb11u1) ...
Selecting previously unselected package libicu67:amd64.
Preparing to unpack .../02-libicu67_67.1-7_amd64.deb ...
Unpacking libicu67:amd64 (67.1-7) ...
Selecting previously unselected package libxml2:amd64.
Preparing to unpack .../03-libxml2_2.9.10+dfsg-6.7+deb11u4_amd64.deb ...
Unpacking libxml2:amd64 (2.9.10+dfsg-6.7+deb11u4) ...
Selecting previously unselected package libz3-4:amd64.
Preparing to unpack .../04-libz3-4_4.8.10-1_amd64.deb ...
Unpacking libz3-4:amd64 (4.8.10-1) ...
Selecting previously unselected package libllvm13:amd64.
Preparing to unpack .../05-libllvm13_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking libllvm13:amd64 (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package libclang-cpp13.
Preparing to unpack .../06-libclang-cpp13_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking libclang-cpp13 (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package libgc1:amd64.
Preparing to unpack .../07-libgc1_1%3a8.0.4-3_amd64.deb ...
Unpacking libgc1:amd64 (1:8.0.4-3) ...
Selecting previously unselected package libobjc4:amd64.
Preparing to unpack .../08-libobjc4_10.2.1-6_amd64.deb ...
Unpacking libobjc4:amd64 (10.2.1-6) ...
Selecting previously unselected package libobjc-10-dev:amd64.
Preparing to unpack .../09-libobjc-10-dev_10.2.1-6_amd64.deb ...
Unpacking libobjc-10-dev:amd64 (10.2.1-6) ...
Selecting previously unselected package libc6-i386.
Preparing to unpack .../10-libc6-i386_2.31-13+deb11u6_amd64.deb ...
Unpacking libc6-i386 (2.31-13+deb11u6) ...
Selecting previously unselected package lib32gcc-s1.
Preparing to unpack .../11-lib32gcc-s1_10.2.1-6_amd64.deb ...
Unpacking lib32gcc-s1 (10.2.1-6) ...
Selecting previously unselected package lib32stdc++6.
Preparing to unpack .../12-lib32stdc++6_10.2.1-6_amd64.deb ...
Unpacking lib32stdc++6 (10.2.1-6) ...
Selecting previously unselected package libclang-common-13-dev.
Preparing to unpack .../13-libclang-common-13-dev_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking libclang-common-13-dev (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package llvm-13-linker-tools.
Preparing to unpack .../14-llvm-13-linker-tools_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking llvm-13-linker-tools (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package libclang1-13.
Preparing to unpack .../15-libclang1-13_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking libclang1-13 (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package clang-13.
Preparing to unpack .../16-clang-13_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking clang-13 (1:13.0.1-6~deb11u1) ...
Preparing to unpack .../17-git_1%3a2.30.2-1+deb11u2_amd64.deb ...
Unpacking git (1:2.30.2-1+deb11u2) over (1:2.30.2-1) ...
Selecting previously unselected package icu-devtools.
Preparing to unpack .../18-icu-devtools_67.1-7_amd64.deb ...
Unpacking icu-devtools (67.1-7) ...
Selecting previously unselected package libllvm11:amd64.
Preparing to unpack .../19-libllvm11_1%3a11.0.1-2_amd64.deb ...
Unpacking libllvm11:amd64 (1:11.0.1-2) ...
Selecting previously unselected package libclang-cpp11.
Preparing to unpack .../20-libclang-cpp11_1%3a11.0.1-2_amd64.deb ...
Unpacking libclang-cpp11 (1:11.0.1-2) ...
Selecting previously unselected package libffi-dev:amd64.
Preparing to unpack .../21-libffi-dev_3.3-6_amd64.deb ...
Unpacking libffi-dev:amd64 (3.3-6) ...
Selecting previously unselected package libicu-dev:amd64.
Preparing to unpack .../22-libicu-dev_67.1-7_amd64.deb ...
Unpacking libicu-dev:amd64 (67.1-7) ...
Selecting previously unselected package libncurses-dev:amd64.
Preparing to unpack .../23-libncurses-dev_6.2+20201114-2+deb11u1_amd64.deb ...
Unpacking libncurses-dev:amd64 (6.2+20201114-2+deb11u1) ...
Selecting previously unselected package libpfm4:amd64.
Preparing to unpack .../24-libpfm4_4.11.1+git32-gd0b85fb-1_amd64.deb ...
Unpacking libpfm4:amd64 (4.11.1+git32-gd0b85fb-1) ...
Selecting previously unselected package libtinfo-dev:amd64.
Preparing to unpack .../25-libtinfo-dev_6.2+20201114-2+deb11u1_amd64.deb ...
Unpacking libtinfo-dev:amd64 (6.2+20201114-2+deb11u1) ...
Selecting previously unselected package libxml2-dev:amd64.
Preparing to unpack .../26-libxml2-dev_2.9.10+dfsg-6.7+deb11u4_amd64.deb ...
Unpacking libxml2-dev:amd64 (2.9.10+dfsg-6.7+deb11u4) ...
Selecting previously unselected package libyaml-0-2:amd64.
Preparing to unpack .../27-libyaml-0-2_0.2.2-1_amd64.deb ...
Unpacking libyaml-0-2:amd64 (0.2.2-1) ...
Selecting previously unselected package libz3-dev:amd64.
Preparing to unpack .../28-libz3-dev_4.8.10-1_amd64.deb ...
Unpacking libz3-dev:amd64 (4.8.10-1) ...
Selecting previously unselected package llvm-11-runtime.
Preparing to unpack .../29-llvm-11-runtime_1%3a11.0.1-2_amd64.deb ...
Unpacking llvm-11-runtime (1:11.0.1-2) ...
Selecting previously unselected package llvm-runtime.
Preparing to unpack .../30-llvm-runtime_1%3a11.0-51+nmu5_amd64.deb ...
Unpacking llvm-runtime (1:11.0-51+nmu5) ...
Selecting previously unselected package llvm-11.
Preparing to unpack .../31-llvm-11_1%3a11.0.1-2_amd64.deb ...
Unpacking llvm-11 (1:11.0.1-2) ...
Selecting previously unselected package llvm.
Preparing to unpack .../32-llvm_1%3a11.0-51+nmu5_amd64.deb ...
Unpacking llvm (1:11.0-51+nmu5) ...
Selecting previously unselected package python3-pkg-resources.
Preparing to unpack .../33-python3-pkg-resources_52.0.0-4_all.deb ...
Unpacking python3-pkg-resources (52.0.0-4) ...
Selecting previously unselected package python3-pygments.
Preparing to unpack .../34-python3-pygments_2.7.1+dfsg-2.1_all.deb ...
Unpacking python3-pygments (2.7.1+dfsg-2.1) ...
Selecting previously unselected package python3-yaml.
Preparing to unpack .../35-python3-yaml_5.3.1-5_amd64.deb ...
Unpacking python3-yaml (5.3.1-5) ...
Selecting previously unselected package llvm-11-tools.
Preparing to unpack .../36-llvm-11-tools_1%3a11.0.1-2_amd64.deb ...
Unpacking llvm-11-tools (1:11.0.1-2) ...
Selecting previously unselected package llvm-11-dev.
Preparing to unpack .../37-llvm-11-dev_1%3a11.0.1-2_amd64.deb ...
Unpacking llvm-11-dev (1:11.0.1-2) ...
Selecting previously unselected package llvm-13-runtime.
Preparing to unpack .../38-llvm-13-runtime_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking llvm-13-runtime (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package llvm-13.
Preparing to unpack .../39-llvm-13_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking llvm-13 (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package llvm-13-tools.
Preparing to unpack .../40-llvm-13-tools_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking llvm-13-tools (1:13.0.1-6~deb11u1) ...
Selecting previously unselected package llvm-13-dev.
Preparing to unpack .../41-llvm-13-dev_1%3a13.0.1-6~deb11u1_amd64.deb ...
Unpacking llvm-13-dev (1:13.0.1-6~deb11u1) ...
Setting up python3-pkg-resources (52.0.0-4) ...
Setting up libpipeline1:amd64 (1.5.3-1) ...
Setting up libicu67:amd64 (67.1-7) ...
Setting up libyaml-0-2:amd64 (0.2.2-1) ...
Setting up python3-yaml (5.3.1-5) ...
Setting up libffi-dev:amd64 (3.3-6) ...
Setting up python3-pygments (2.7.1+dfsg-2.1) ...
Setting up libz3-4:amd64 (4.8.10-1) ...
Setting up libpfm4:amd64 (4.11.1+git32-gd0b85fb-1) ...
Setting up libllvm11:amd64 (1:11.0.1-2) ...
Setting up libncurses6:amd64 (6.2+20201114-2+deb11u1) ...
Setting up binfmt-support (2.2.1-1+deb11u1) ...
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of start.
Setting up icu-devtools (67.1-7) ...
Setting up git (1:2.30.2-1+deb11u2) ...
Setting up libncursesw6:amd64 (6.2+20201114-2+deb11u1) ...
Setting up libgc1:amd64 (1:8.0.4-3) ...
Setting up libc6-i386 (2.31-13+deb11u6) ...
Setting up libc-dev-bin (2.31-13+deb11u6) ...
Setting up libxml2:amd64 (2.9.10+dfsg-6.7+deb11u4) ...
Setting up libz3-dev:amd64 (4.8.10-1) ...
Setting up llvm-11-runtime (1:11.0.1-2) ...
Setting up llvm-11-tools (1:11.0.1-2) ...
Setting up llvm-11 (1:11.0.1-2) ...
Setting up libobjc4:amd64 (10.2.1-6) ...
Setting up libclang-cpp11 (1:11.0.1-2) ...
Setting up lib32gcc-s1 (10.2.1-6) ...
Setting up lib32stdc++6 (10.2.1-6) ...
Setting up llvm-runtime (1:11.0-51+nmu5) ...
Setting up llvm (1:11.0-51+nmu5) ...
Setting up libllvm13:amd64 (1:13.0.1-6~deb11u1) ...
Setting up libobjc-10-dev:amd64 (10.2.1-6) ...
Setting up llvm-13-runtime (1:13.0.1-6~deb11u1) ...
Setting up libc6-dev:amd64 (2.31-13+deb11u6) ...
Setting up libicu-dev:amd64 (67.1-7) ...
Setting up libclang-common-13-dev (1:13.0.1-6~deb11u1) ...
Setting up libncurses-dev:amd64 (6.2+20201114-2+deb11u1) ...
Setting up llvm-11-dev (1:11.0.1-2) ...
Setting up llvm-13-linker-tools (1:13.0.1-6~deb11u1) ...
Setting up llvm-13-tools (1:13.0.1-6~deb11u1) ...
Setting up libclang1-13 (1:13.0.1-6~deb11u1) ...
Setting up libxml2-dev:amd64 (2.9.10+dfsg-6.7+deb11u4) ...
Setting up libclang-cpp13 (1:13.0.1-6~deb11u1) ...
Setting up libtinfo-dev:amd64 (6.2+20201114-2+deb11u1) ...
Setting up clang-13 (1:13.0.1-6~deb11u1) ...
Setting up llvm-13 (1:13.0.1-6~deb11u1) ...
Setting up llvm-13-dev (1:13.0.1-6~deb11u1) ...
Processing triggers for libc-bin (2.31-13+deb11u3) ...
ln: failed to create symbolic link './clang': File exists
make: *** [Makefile:29: release] Error 1
when i run command pwru --filter-src-ip 10.17.8.21
i got the error bellow
2023/03/03 10:11:59 Failed to load BTF spec: no BTF found for kernel version 6.2.1-1.el7.elrepo.x86_64: not supported
TBD.
Hi Team,
I have a very basic question. As I've seen everywhere people are using different terms while using ebpf for packets journey.
Can someone please explain the difference b/w below terms when we write ebpf code :
Packet rerouting,
Packet forwarding,
Packet switching,
Packet redirecting
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.