File manager

File manager - Edit - /snap/lxd/40115/share/openvswitch/scripts/usdt/dpif_nl_exec_monitor.py

Back
#!/usr/bin/env python3 # # Copyright (c) 2022 Red Hat, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # Script information: # ------------------- # dpif_nl_exec_monitor.py uses the dpif_netlink_operate__:op_flow_execute USDT # probe to receive all DPIF_OP_EXECUTE operations that are queued for # transmission over the netlink socket. It will do some basic decoding, and if # requested a packet dump. # # Here is an example: # # # ./dpif_nl_exec_monitor.py --packet-decode decode # Display DPIF_OP_EXECUTE operations being queued for transmission... # TIME CPU COMM PID NL_SIZE # 3124.516679897 1 ovs-vswitchd 8219 180 # nlmsghdr : len = 0, type = 36, flags = 1, seq = 0, pid = 0 # genlmsghdr: cmd = 3, version = 1, reserver = 0 # ovs_header: dp_ifindex = 21 # > Decode OVS_PACKET_ATTR_* TLVs: # nla_len 46, nla_type OVS_PACKET_ATTR_PACKET[1], data: 00 00 00... # nla_len 20, nla_type OVS_PACKET_ATTR_KEY[2], data: 08 00 02 00... # > Decode OVS_KEY_ATTR_* TLVs: # nla_len 8, nla_type OVS_KEY_ATTR_PRIORITY[2], data: 00 00... # nla_len 8, nla_type OVS_KEY_ATTR_SKB_MARK[15], data: 00 00... # nla_len 88, nla_type OVS_PACKET_ATTR_ACTIONS[3], data: 4c 00 03... # > Decode OVS_ACTION_ATTR_* TLVs: # nla_len 76, nla_type OVS_ACTION_ATTR_SET[3], data: 48 00... # > Decode OVS_TUNNEL_KEY_ATTR_* TLVs: # nla_len 12, nla_type OVS_TUNNEL_KEY_ATTR_ID[0], data:... # nla_len 20, nla_type OVS_TUNNEL_KEY_ATTR_IPV6_DST[13], ... # nla_len 5, nla_type OVS_TUNNEL_KEY_ATTR_TTL[4], data: 40 # nla_len 4, nla_type OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT... # nla_len 4, nla_type OVS_TUNNEL_KEY_ATTR_CSUM[6], data: # nla_len 6, nla_type OVS_TUNNEL_KEY_ATTR_TP_DST[10],... # nla_len 12, nla_type OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS... # nla_len 8, nla_type OVS_ACTION_ATTR_OUTPUT[1], data: 02 00 00 00 # - Dumping OVS_PACKET_ATR_PACKET data: # ###[ Ethernet ]### # dst = 00:00:00:00:ec:01 # src = 04:f4:bc:28:57:00 # type = IPv4 # ###[ IP ]### # version = 4 # ihl = 5 # tos = 0x0 # len = 50 # id = 0 # flags = # frag = 0 # ttl = 127 # proto = icmp # chksum = 0x2767 # src = 10.0.0.1 # dst = 10.0.0.100 # \options \ # ###[ ICMP ]### # type = echo-request # code = 0 # chksum = 0xf7f3 # id = 0x0 # seq = 0xc # # The example above dumps the full netlink and packet decode. However options # exist to disable this. Here is the full list of supported options: # # usage: dpif_nl_exec_monitor.py [-h] [--buffer-page-count NUMBER] [-D [DEBUG]] # [-d {none,hex,decode}] [-n {none,hex,nlraw}] # [-p VSWITCHD_PID] [-s [64-2048]] # [-w PCAP_FILE] # # optional arguments: # -h, --help show this help message and exit # --buffer-page-count NUMBER # Number of BPF ring buffer pages, default 1024 # -D [DEBUG], --debug [DEBUG] # Enable eBPF debugging # -d {none,hex,decode}, --packet-decode {none,hex,decode} # Display packet content in selected mode, default none # -n {none,hex,nlraw}, --nlmsg-decode {none,hex,nlraw} # Display netlink message content in selected mode, # default nlraw # -p VSWITCHD_PID, --pid VSWITCHD_PID # ovs-vswitch's PID # -s [64-2048], --nlmsg-size [64-2048] # Set maximum netlink message size to capture, default # 512 # -w PCAP_FILE, --pcap PCAP_FILE # Write upcall packets to specified pcap file from bcc import BPF, USDT, USDTException from os.path import exists from scapy.all import hexdump, wrpcap from scapy.layers.l2 import Ether import argparse import psutil import re import struct import sys import time # # Actual eBPF source code # ebpf_source = """ #include <linux/sched.h> #define MAX_NLMSG <MAX_NLMSG_VAL> struct event_t { u32 cpu; u32 pid; u64 ts; u32 nl_size; char comm[TASK_COMM_LEN]; u8 nl_msg[MAX_NLMSG]; }; struct ofpbuf { void base; void data; uint32_t size; /* The actual structure is longer, but we are only interested in the * first couple of entries. / }; BPF_RINGBUF_OUTPUT(events, <BUFFER_PAGE_CNT>); BPF_TABLE("percpu_array", uint32_t, uint64_t, dropcnt, 1); int trace__op_flow_execute(struct pt_regs ctx) { struct ofpbuf nlbuf; uint32_t size; bpf_usdt_readarg_p(5, ctx, &nlbuf, sizeof(nlbuf)); struct event_t event = events.ringbuf_reserve(sizeof(struct event_t)); if (!event) { uint32_t type = 0; uint64_t value = dropcnt.lookup(&type); if (value) __sync_fetch_and_add(value, 1); return 1; } event->ts = bpf_ktime_get_ns(); event->cpu = bpf_get_smp_processor_id(); event->pid = bpf_get_current_pid_tgid(); bpf_get_current_comm(&event->comm, sizeof(event->comm)); event->nl_size = nlbuf.size; if (event->nl_size > MAX_NLMSG) size = MAX_NLMSG; else size = event->nl_size; bpf_probe_read(&event->nl_msg, size, nlbuf.data); events.ringbuf_submit(event, 0); return 0; }; """ # # print_event() # def print_event(ctx, data, size): event = b["events"].event(data) print("{:<18.9f} {:<4} {:<16} {:<10} {:<10}". format(event.ts / 1000000000, event.cpu, event.comm.decode("utf-8"), event.pid, event.nl_size)) # # Dumping the netlink message data if requested. # if event.nl_size < options.nlmsg_size: nl_size = event.nl_size else: nl_size = options.nlmsg_size if options.nlmsg_decode == "hex": # # Abuse scapy's hex dump to dump flow key # print(re.sub("^", " " * 4, hexdump(Ether(bytes(event.nl_msg)[:nl_size]), dump=True), flags=re.MULTILINE)) if options.nlmsg_decode == "nlraw": decode_result = decode_nlm(bytes(event.nl_msg)[:nl_size], dump=True) else: decode_result = decode_nlm(bytes(event.nl_msg)[:nl_size], dump=False) # # Decode packet only if there is data # if "OVS_PACKET_ATTR_PACKET" not in decode_result: return pkt_data = decode_result["OVS_PACKET_ATTR_PACKET"] indent = 4 if options.nlmsg_decode != "nlraw" else 6 if options.packet_decode != "none": print("{}- Dumping OVS_PACKET_ATR_PACKET data:".format(" " * indent)) if options.packet_decode == "hex": print(re.sub("^", " " * indent, hexdump(pkt_data, dump=True), flags=re.MULTILINE)) packet = Ether(pkt_data) if options.packet_decode == "decode": print(re.sub("^", " " * indent, packet.show(dump=True), flags=re.MULTILINE)) if options.pcap is not None: wrpcap(options.pcap, packet, append=True) # # decode_nlm_tlvs() # def decode_nlm_tlvs(tlvs, header=None, indent=4, dump=True, attr_to_str_func=None, decode_tree=None): bytes_left = len(tlvs) result = {} if dump: print("{}{}".format(" " * indent, header)) while bytes_left: if bytes_left < 4: if dump: print("{}WARN: decode truncated; can't read header".format( " " * indent)) break nla_len, nla_type = struct.unpack("=HH", tlvs[:4]) if nla_len < 4: if dump: print("{}WARN: decode truncated; nla_len < 4".format( " " * indent)) break nla_data = tlvs[4:nla_len] trunc = "" if attr_to_str_func is None: nla_type_name = "type_{}".format(nla_type) else: nla_type_name = attr_to_str_func(nla_type) if nla_len > bytes_left: trunc = "..." nla_data = nla_data[:(bytes_left - 4)] else: result[nla_type_name] = nla_data if dump: print("{}nla_len {}, nla_type {}[{}], data: {}{}".format( " " * indent, nla_len, nla_type_name, nla_type, "".join("{:02x} ".format(b) for b in nla_data), trunc)) # # If we have the full data, try to decode further # if trunc == "" and decode_tree is not None \ and nla_type_name in decode_tree: node = decode_tree[nla_type_name] decode_nlm_tlvs(nla_data, header=node["header"], indent=indent + node["indent"], dump=True, attr_to_str_func=node["attr_str_func"], decode_tree=node["decode_tree"]) if trunc != "": if dump: print("{}WARN: decode truncated; nla_len > msg_len[{}] ". format(" " * indent, bytes_left)) break # update next offset, but make sure it's aligned correctly next_offset = (nla_len + 3) & ~(3) tlvs = tlvs[next_offset:] bytes_left -= next_offset return result # # decode_nlm() # def decode_nlm(msg, indent=4, dump=True): result = {} # # Decode 'struct nlmsghdr' # if dump: print("{}nlmsghdr : len = {}, type = {}, flags = {}, seq = {}, " "pid = {}".format(" " * indent, struct.unpack("=IHHII", msg[:16]))) msg = msg[16:] # # Decode 'struct genlmsghdr' # if dump: print("{}genlmsghdr: cmd = {}, version = {}, reserver = {}".format( " " indent, struct.unpack("=BBH", msg[:4]))) msg = msg[4:] # # Decode 'struct ovs_header' # if dump: print("{}ovs_header: dp_ifindex = {}".format( " " indent, struct.unpack("=I", msg[:4]))) msg = msg[4:] # # Decode TLVs # nl_attr_tree = { "OVS_PACKET_ATTR_KEY": { "header": "> Decode OVS_KEY_ATTR_ TLVs:", "indent": 4, "attr_str_func": get_ovs_key_attr_str, "decode_tree": None, }, "OVS_PACKET_ATTR_ACTIONS": { "header": "> Decode OVS_ACTION_ATTR_* TLVs:", "indent": 4, "attr_str_func": get_ovs_action_attr_str, "decode_tree": { "OVS_ACTION_ATTR_SET": { "header": "> Decode OVS_KEY_ATTR_* TLVs:", "indent": 4, "attr_str_func": get_ovs_key_attr_str, "decode_tree": { "OVS_KEY_ATTR_TUNNEL": { "header": "> Decode OVS_TUNNEL_KEY_ATTR_* TLVs:", "indent": 4, "attr_str_func": get_ovs_tunnel_key_attr_str, "decode_tree": None, }, }, }, }, }, } result = decode_nlm_tlvs(msg, indent=indent + 2, dump=dump, header="> Decode OVS_PACKET_ATTR_* TLVs:", attr_to_str_func=get_ovs_pkt_attr_str, decode_tree=nl_attr_tree) return result # # get_ovs_pkt_attr_str() # def get_ovs_pkt_attr_str(attr): ovs_pkt_attr = ["OVS_PACKET_ATTR_UNSPEC", "OVS_PACKET_ATTR_PACKET", "OVS_PACKET_ATTR_KEY", "OVS_PACKET_ATTR_ACTIONS", "OVS_PACKET_ATTR_USERDATA", "OVS_PACKET_ATTR_EGRESS_TUN_KEY", "OVS_PACKET_ATTR_UNUSED1", "OVS_PACKET_ATTR_UNUSED2", "OVS_PACKET_ATTR_PROBE", "OVS_PACKET_ATTR_MRU", "OVS_PACKET_ATTR_LEN", "OVS_PACKET_ATTR_HASH"] if attr < 0 or attr >= len(ovs_pkt_attr): return "<UNKNOWN:{}>".format(attr) return ovs_pkt_attr[attr] # # get_ovs_key_attr_str() # def get_ovs_key_attr_str(attr): ovs_key_attr = ["OVS_KEY_ATTR_UNSPEC", "OVS_KEY_ATTR_ENCAP", "OVS_KEY_ATTR_PRIORITY", "OVS_KEY_ATTR_IN_PORT", "OVS_KEY_ATTR_ETHERNET", "OVS_KEY_ATTR_VLAN", "OVS_KEY_ATTR_ETHERTYPE", "OVS_KEY_ATTR_IPV4", "OVS_KEY_ATTR_IPV6", "OVS_KEY_ATTR_TCP", "OVS_KEY_ATTR_UDP", "OVS_KEY_ATTR_ICMP", "OVS_KEY_ATTR_ICMPV6", "OVS_KEY_ATTR_ARP", "OVS_KEY_ATTR_ND", "OVS_KEY_ATTR_SKB_MARK", "OVS_KEY_ATTR_TUNNEL", "OVS_KEY_ATTR_SCTP", "OVS_KEY_ATTR_TCP_FLAGS", "OVS_KEY_ATTR_DP_HASH", "OVS_KEY_ATTR_RECIRC_ID", "OVS_KEY_ATTR_MPLS", "OVS_KEY_ATTR_CT_STATE", "OVS_KEY_ATTR_CT_ZONE", "OVS_KEY_ATTR_CT_MARK", "OVS_KEY_ATTR_CT_LABELS", "OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4", "OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6", "OVS_KEY_ATTR_NSH"] if attr < 0 or attr >= len(ovs_key_attr): return "<UNKNOWN:{}>".format(attr) return ovs_key_attr[attr] # # get_ovs_action_attr_str() # def get_ovs_action_attr_str(attr): ovs_action_attr = ["OVS_ACTION_ATTR_UNSPEC", "OVS_ACTION_ATTR_OUTPUT", "OVS_ACTION_ATTR_USERSPACE", "OVS_ACTION_ATTR_SET", "OVS_ACTION_ATTR_PUSH_VLAN", "OVS_ACTION_ATTR_POP_VLAN", "OVS_ACTION_ATTR_SAMPLE", "OVS_ACTION_ATTR_RECIRC", "OVS_ACTION_ATTR_HASH", "OVS_ACTION_ATTR_PUSH_MPLS", "OVS_ACTION_ATTR_POP_MPLS", "OVS_ACTION_ATTR_SET_MASKED", "OVS_ACTION_ATTR_CT", "OVS_ACTION_ATTR_TRUNC", "OVS_ACTION_ATTR_PUSH_ETH", "OVS_ACTION_ATTR_POP_ETH", "OVS_ACTION_ATTR_CT_CLEAR", "OVS_ACTION_ATTR_PUSH_NSH", "OVS_ACTION_ATTR_POP_NSH", "OVS_ACTION_ATTR_METER", "OVS_ACTION_ATTR_CLONE", "OVS_ACTION_ATTR_CHECK_PKT_LEN", "OVS_ACTION_ATTR_ADD_MPLS", "OVS_ACTION_ATTR_TUNNEL_PUSH", "OVS_ACTION_ATTR_TUNNEL_POP", "OVS_ACTION_ATTR_DROP", "OVS_ACTION_ATTR_LB_OUTPUT"] if attr < 0 or attr >= len(ovs_action_attr): return "<UNKNOWN:{}>".format(attr) return ovs_action_attr[attr] # # get_ovs_tunnel_key_attr_str() # def get_ovs_tunnel_key_attr_str(attr): ovs_tunnel_key_attr = ["OVS_TUNNEL_KEY_ATTR_ID", "OVS_TUNNEL_KEY_ATTR_IPV4_SRC", "OVS_TUNNEL_KEY_ATTR_IPV4_DST", "OVS_TUNNEL_KEY_ATTR_TOS", "OVS_TUNNEL_KEY_ATTR_TTL", "OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT", "OVS_TUNNEL_KEY_ATTR_CSUM", "OVS_TUNNEL_KEY_ATTR_OAM", "OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS", "OVS_TUNNEL_KEY_ATTR_TP_SRC", "OVS_TUNNEL_KEY_ATTR_TP_DST", "OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS", "OVS_TUNNEL_KEY_ATTR_IPV6_SRC", "OVS_TUNNEL_KEY_ATTR_IPV6_DST", "OVS_TUNNEL_KEY_ATTR_PAD", "OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS", "OVS_TUNNEL_KEY_ATTR_GTPU_OPTS"] if attr < 0 or attr >= len(ovs_tunnel_key_attr): return "<UNKNOWN:{}>".format(attr) return ovs_tunnel_key_attr[attr] # # buffer_size_type() # def buffer_size_type(astr, min=64, max=2048): value = int(astr) if min <= value <= max: return value else: raise argparse.ArgumentTypeError( "value not in range {}-{}".format(min, max)) # # next_power_of_two() # def next_power_of_two(val): np = 1 while np < val: np = 2 return np # # main() # def main(): # # Don't like these globals, but ctx passing does not seem to work with the # existing open_ring_buffer() API :( # global b global options # # Argument parsing # parser = argparse.ArgumentParser() parser.add_argument("--buffer-page-count", help="Number of BPF ring buffer pages, default 1024", type=int, default=1024, metavar="NUMBER") parser.add_argument("-D", "--debug", help="Enable eBPF debugging", type=int, const=0x3f, default=0, nargs="?") parser.add_argument("-d", "--packet-decode", help="Display packet content in selected mode, " "default none", choices=["none", "hex", "decode"], default="none") parser.add_argument("-n", "--nlmsg-decode", help="Display netlink message content in selected mode" ", default nlraw", choices=["none", "hex", "nlraw"], default="nlraw") parser.add_argument("-p", "--pid", metavar="VSWITCHD_PID", help="ovs-vswitch's PID", type=int, default=None) parser.add_argument("-s", "--nlmsg-size", help="Set maximum netlink message size to capture, " "default 512", type=buffer_size_type, default=512, metavar="[64-2048]") parser.add_argument("-w", "--pcap", metavar="PCAP_FILE", help="Write upcall packets to specified pcap file", type=str, default=None) options = parser.parse_args() # # Find the PID of the ovs-vswitchd daemon if not specified. # if options.pid is None: for proc in psutil.process_iter(): if "ovs-vswitchd" in proc.name(): if options.pid is not None: print("ERROR: Multiple ovs-vswitchd daemons running, " "use the -p option!") sys.exit(-1) options.pid = proc.pid # # Error checking on input parameters # if options.pid is None: print("ERROR: Failed to find ovs-vswitchd's PID!") sys.exit(-1) if options.pcap is not None: if exists(options.pcap): print("ERROR: Destination capture file \"{}\" already exists!". format(options.pcap)) sys.exit(-1) options.buffer_page_count = next_power_of_two(options.buffer_page_count) # # Attach the usdt probe # u = USDT(pid=int(options.pid)) try: u.enable_probe(probe="dpif_netlink_operate__:op_flow_execute", fn_name="trace__op_flow_execute") except USDTException as e: print("ERROR: {}" "ovs-vswitchd!".format( (re.sub("^", " " 7, str(e), flags=re.MULTILINE)).strip(). replace("--with-dtrace or --enable-dtrace", "--enable-usdt-probes"))) sys.exit(-1) # # Uncomment to see how arguments are decoded. # print(u.get_text()) # # # Attach probe to running process # source = ebpf_source.replace("<MAX_NLMSG_VAL>", str(options.nlmsg_size)) source = source.replace("<BUFFER_PAGE_CNT>", str(options.buffer_page_count)) b = BPF(text=source, usdt_contexts=[u], debug=options.debug) # # Print header # print("Display DPIF_OP_EXECUTE operations being queued for transmission " "onto the netlink socket.") print("{:<18} {:<4} {:<16} {:<10} {:<10}".format( "TIME", "CPU", "COMM", "PID", "NL_SIZE")) # # Dump out all events # b["events"].open_ring_buffer(print_event) while 1: try: b.ring_buffer_poll() time.sleep(0.5) except KeyboardInterrupt: break dropcnt = b.get_table("dropcnt") for k in dropcnt.keys(): count = dropcnt.sum(k).value if k.value == 0 and count > 0: print("\nWARNING: Not all upcalls were captured, {} were dropped!" "\n Increase the BPF ring buffer size with the " "--buffer-page-count option.".format(count)) # # Start main() as the default entry point... # if __name__ == "__main__": main()

| ver. 1.4 | Github | . | PHP 8.2.9 | Generation time: 0.07 | proxy | phpinfo | Settings