probes/net-extended-trace.c

   1 /*
   2  * ltt/probes/net-extended-trace.c
   3  *
   4  * Net tracepoint extended probes.
   5  *
   6  * These probes record many header fields from TCP and UDP messages. Here are
   7  * the consequences of this:
   8  * 1) it allows analyzing network traffic to provide some pcap-like
   9  *    functionality within LTTng
  10  * 2) it allows offline synchronization of a group of concurrent traces
  11  *    recorded on different nodes
  12  * 3) it increases tracing overhead
  13  *
  14  * You can leave out these probes or not activate them if you are not
  15  * especially interested in the details of network traffic and do not wish to
  16  * synchronize distributed traces.
  17  *
  18  * Dual LGPL v2.1/GPL v2 license.
  19  */
  20
  21 #include <linux/in_route.h>
  22 #include <linux/ip.h>
  23 #include <linux/module.h>
  24 #include <linux/tcp.h>
  25 #include <linux/udp.h>
  26 #include <net/route.h>
  27 #include <trace/net.h>
  28
  29 #include "../ltt-type-serializer.h"
  30
  31 void probe_net_dev_xmit_extended(void *_data, struct sk_buff *skb);
  32
  33 DEFINE_MARKER_TP(net, dev_xmit_extended, net_dev_xmit,
  34         probe_net_dev_xmit_extended, "skb 0x%lX network_protocol #n2u%hu "
  35         "transport_protocol #1u%u saddr #n4u%lu daddr #n4u%lu "
  36         "tot_len #n2u%hu ihl #1u%u source #n2u%hu dest #n2u%hu seq #n4u%lu "
  37         "ack_seq #n4u%lu doff #1u%u ack #1u%u rst #1u%u syn #1u%u fin #1u%u");
  38
  39 notrace void probe_net_dev_xmit_extended(void *_data, struct sk_buff *skb)
  40 {
  41         struct marker *marker;
  42         struct serialize_l214421224411111 data;
  43         struct iphdr *iph = ip_hdr(skb);
  44         struct tcphdr *th = tcp_hdr(skb);
  45
  46         data.f1 = (unsigned long)skb;
  47         data.f2 = skb->protocol;
  48
  49         if (ntohs(skb->protocol) == ETH_P_IP) {
  50                 data.f3 = ip_hdr(skb)->protocol;
  51                 data.f4 = iph->saddr;
  52                 data.f5 = iph->daddr;
  53                 data.f6 = iph->tot_len;
  54                 data.f7 = iph->ihl;
  55
  56                 if (data.f3 == IPPROTO_TCP) {
  57                         data.f8 = th->source;
  58                         data.f9 = th->dest;
  59                         data.f10 = th->seq;
  60                         data.f11 = th->ack_seq;
  61                         data.f12 = th->doff;
  62                         data.f13 = th->ack;
  63                         data.f14 = th->rst;
  64                         data.f15 = th->syn;
  65                         data.f16 = th->fin;
  66                 }
  67         }
  68
  69         marker = &GET_MARKER(net, dev_xmit_extended);
  70         ltt_specialized_trace(marker, marker->single.probe_private,
  71                 &data, serialize_sizeof(data), sizeof(long));
  72 }
  73
  74 void probe_tcpv4_rcv_extended(void *_data, struct sk_buff *skb);
  75
  76 DEFINE_MARKER_TP(net, tcpv4_rcv_extended, net_tcpv4_rcv,
  77         probe_tcpv4_rcv_extended, "skb 0x%lX saddr #n4u%lu daddr #n4u%lu "
  78         "tot_len #n2u%hu ihl #1u%u source #n2u%hu dest #n2u%hu seq #n4u%lu "
  79         "ack_seq #n4u%lu doff #1u%u ack #1u%u rst #1u%u syn #1u%u fin #1u%u");
  80
  81 notrace void probe_tcpv4_rcv_extended(void *_data, struct sk_buff *skb)
  82 {
  83         struct marker *marker;
  84         struct serialize_l4421224411111 data;
  85         struct iphdr *iph = ip_hdr(skb);
  86         struct tcphdr *th = tcp_hdr(skb);
  87
  88         data.f1 = (unsigned long)skb;
  89         data.f2 = iph->saddr;
  90         data.f3 = iph->daddr;
  91         data.f4 = iph->tot_len;
  92         data.f5 = iph->ihl;
  93         data.f6 = th->source;
  94         data.f7 = th->dest;
  95         data.f8 = th->seq;
  96         data.f9 = th->ack_seq;
  97         data.f10 = th->doff;
  98         data.f11 = th->ack;
  99         data.f12 = th->rst;
 100         data.f13 = th->syn;
 101         data.f14 = th->fin;
 102
 103         marker = &GET_MARKER(net, tcpv4_rcv_extended);
 104         ltt_specialized_trace(marker, marker->single.probe_private,
 105                 &data, serialize_sizeof(data), sizeof(long));
 106 }
 107
 108 void probe_udpv4_rcv_extended(void *_data, struct sk_buff *skb);
 109
 110 DEFINE_MARKER_TP(net, udpv4_rcv_extended, net_udpv4_rcv,
 111         probe_udpv4_rcv_extended, "skb 0x%lX saddr #n4u%lu daddr #n4u%lu "
 112         "unicast #1u%u ulen #n2u%hu source #n2u%hu dest #n2u%hu "
 113         "data_start #8u%lx");
 114
 115 notrace void probe_udpv4_rcv_extended(void *_data, struct sk_buff *skb)
 116 {
 117         struct marker *marker;
 118         struct serialize_l4412228 data;
 119         struct iphdr *iph = ip_hdr(skb);
 120         struct rtable *rt = skb_rtable(skb);
 121         struct udphdr *uh = udp_hdr(skb);
 122
 123         data.f1 = (unsigned long)skb;
 124         data.f2 = iph->saddr;
 125         data.f3 = iph->daddr;
 126         data.f4 = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST) ? 0 : 1;
 127         data.f5 = uh->len;
 128         data.f6 = uh->source;
 129         data.f7 = uh->dest;
 130         /* UDP header has not been pulled from skb->data, read the first 8
 131          * bytes of UDP data if they are not in a fragment*/
 132         data.f8 = 0;
 133         if (skb_headlen(skb) >= sizeof(struct udphdr) + 8)
 134                 data.f8 = *(unsigned long long *)(skb->data + sizeof(*uh));
 135         else if (skb_headlen(skb) >= sizeof(struct udphdr))
 136                 memcpy(&data.f8, skb->data + sizeof(struct udphdr),
 137                         skb_headlen(skb) - sizeof(struct udphdr));
 138
 139         marker = &GET_MARKER(net, udpv4_rcv_extended);
 140         ltt_specialized_trace(marker, marker->single.probe_private,
 141                 &data, serialize_sizeof(data), sizeof(unsigned long long));
 142 }
 143
 144 MODULE_LICENSE("GPL and additional rights");
 145 MODULE_AUTHOR("Benjamin Poirier");
 146 MODULE_DESCRIPTION("Net Tracepoint Extended Probes");