Skip to contentSkip to conversation

Network packet tracer module using kprobes interface.

PATCH In review Prasanna S Panchamukhi 2 participants 4 messages Aug 11, 2004 – Aug 16, 2004

Subsystems (3)
Networking Network drivers netfilter
lore
Share & tools
lore

Prasanna S Panchamukhi

author
#0 lore raw

PATCH 4/4 Network packet tracer module using kprobes interface.

Hi,

Below is [4/4]kprobes-netptk-tracer-268-rc4.patch

This patch provides network packet tracing feature using kernel space probes mechanism, which is efficient for dynamic tracing. Network packet traceing allows you to see the network packets while moving up and down the stack.
Network packet tracing was suggested by Andi Kleen.
To trace the network packets based on source and target ports, insert the module with source and target ports.
Example insmod netpktlog.ko netpktlog=@62333,254
To trace the network packets based on only source port, insert module with source port.
Example insmod netpktlog.ko netpktlog=@62333,
To trace network packets based on target port, insert module with target port.
Example insmod netpktlog.ko netpktlog=@,254

Your comments are welcome!

Thanks
Prasanna

Signature · 5 lines
Prasanna S Panchamukhi
Linux Technology Center
India Software Labs, IBM Bangalore
Ph: 91-80-25044636
<[email protected]>

This patch provides network packet tracing feature using kernel
space probes mechanism, which is efficient for dynamic tracing. Network packet traceing allows you to see the network packets while moving up and down the stack.
To trace the network packets based on source and target ports, insert the module with source and target ports.
Example insmod netpktlog.ko netpktlog=@62333,254
To trace the network packets based on only source port, insert module with source port.
Example insmod netpktlog.ko netpktlog=@62333,
To trace network packets based on target port, insert module with target port.
Example insmod netpktlog.ko netpktlog=@,254

---

---

---

---

 linux-2.6.8-rc4-prasanna/drivers/net/Kconfig                    |   12 
 linux-2.6.8-rc4-prasanna/drivers/net/Makefile                   |    3 
 linux-2.6.8-rc4-prasanna/include/linux/netfilter_ipv4/ipt_LOG.h |    2 
 linux-2.6.8-rc4-prasanna/kernel/kallsyms.c                      |    1 
 linux-2.6.8-rc4-prasanna/net/ipv4/netfilter/ipt_LOG.c           |    3

---

 linux-2.6.8-rc4-prasanna/drivers/net/Kconfig                    |   12 
 linux-2.6.8-rc4-prasanna/drivers/net/Makefile                   |    3 
 linux-2.6.8-rc4-prasanna/drivers/net/netpktlog.c                |  216 ++++++++++
 linux-2.6.8-rc4-prasanna/include/linux/netfilter_ipv4/ipt_LOG.h |    2 
 linux-2.6.8-rc4-prasanna/include/linux/netpktlog.h              |  114 +++++
 linux-2.6.8-rc4-prasanna/kernel/kallsyms.c                      |    1 
 linux-2.6.8-rc4-prasanna/net/ipv4/netfilter/ipt_LOG.c           |    3 
 7 files changed, 350 insertions(+), 1 deletion(-)
drivers/net/Kconfig renamed from drivers/net/Kconfig~kprobes-netptk-tracer-268-rc4 +12 -0
diff -puN drivers/net/Kconfig~kprobes-netptk-tracer-268-rc4 drivers/net/Kconfig
@@ -2598,3 +2598,15 @@ config NETCONSOLE
 	If you want to log kernel messages over the network, enable this.
 	See Documentation/networking/netconsole.txt for details.
 
+config NETPKTLOG
+	tristate "Network packet Tracer using kernel probes(EXPERIMENTAL)"
+	depends on KPROBES && IP_NF_TARGET_LOG
+	---help---
+	Network packet tracering is achived using kernel probes allowing you
+	to see the network packets while moving up and down the stack. This
+	module uses kprobes mechanism which is highly efficient for dynamic
+	tracing.
+
+	See driver/net/netpktlog.c for details.
+	To compile this driver as a module, choose M.If unsure, say N.
+
drivers/net/Makefile renamed from drivers/net/Makefile~kprobes-netptk-tracer-268-rc4 +3 -0
diff -puN drivers/net/Makefile~kprobes-netptk-tracer-268-rc4 drivers/net/Makefile
@@ -191,3 +191,6 @@ obj-$(CONFIG_HAMRADIO) += hamradio/
 obj-$(CONFIG_IRDA) += irda/
 
 obj-$(CONFIG_NETCONSOLE) += netconsole.o
+ifeq ($(CONFIG_NETPKTLOG),y)
+ obj-m += netpktlog.o
+endif
drivers/net/netpktlog.c new file +216 -0

216 lines not on this page · raw message

include/linux/netfilter_ipv4/ipt_LOG.h renamed from include/linux/netfilter_ipv4/ipt_LOG.h~kprobes-netptk-tracer-268-rc4 +2 -0
diff -puN include/linux/netfilter_ipv4/ipt_LOG.h~kprobes-netptk-tracer-268-rc4 include/linux/netfilter_ipv4/ipt_LOG.h
@@ -11,5 +11,7 @@ struct ipt_log_info {
 	unsigned char logflags;
 	char prefix[30];
 };
+void dump_packet(const struct ipt_log_info *info, const struct sk_buff *skb,
+			unsigned int iphoff);
 
 #endif /*_IPT_LOG_H*/
include/linux/netpktlog.h new file +114 -0

114 lines not on this page · raw message

kernel/kallsyms.c renamed from kernel/kallsyms.c~kprobes-netptk-tracer-268-rc4 +1 -0
diff -puN kernel/kallsyms.c~kprobes-netptk-tracer-268-rc4 kernel/kallsyms.c
@@ -310,3 +310,4 @@ int __init kallsyms_init(void)
 __initcall(kallsyms_init);
 
 EXPORT_SYMBOL(__print_symbol);
+EXPORT_SYMBOL(kallsyms_lookup_name);
net/ipv4/netfilter/ipt_LOG.c renamed from net/ipv4/netfilter/ipt_LOG.c~kprobes-netptk-tracer-268-rc4 +2 -1
diff -puN net/ipv4/netfilter/ipt_LOG.c~kprobes-netptk-tracer-268-rc4 net/ipv4/netfilter/ipt_LOG.c
@@ -41,7 +41,7 @@ MODULE_PARM_DESC(nflog, "register as int
 static spinlock_t log_lock = SPIN_LOCK_UNLOCKED;
 
 /* One level of recursion won't kill us */
-static void dump_packet(const struct ipt_log_info *info,
+void dump_packet(const struct ipt_log_info *info,
 			const struct sk_buff *skb,
 			unsigned int iphoff)
 {

@@ -461,5 +461,6 @@ static void __exit fini(void)
 	ipt_unregister_target(&ipt_log_reg);
 }
 
+EXPORT_SYMBOL_GPL(dump_packet);
 module_init(init);
 module_exit(fini);

_

author
#1 lore raw

Hi Andi,

Please find the updated Network packet tracer patch below.

Your comments are welcome!

Thanks
Prasanna

Signature · 5 lines
Prasanna S Panchamukhi
Linux Technology Center
India Software Labs, IBM Bangalore
Ph: 91-80-25044636
<[email protected]>

This patch provides network packet tracing feature using kernel
space probes mechanism, which is efficient for dynamic tracing. Network packet traceing allows you to see the network packets while moving up and down the stack.
To trace the network packets based on source and target ports, insert the module with source and target ports.
Example insmod netpktlog.ko netpktlog=@62333,254
To trace the network packets based on only source port, insert module with source port.
Example insmod netpktlog.ko netpktlog=@62333,
To trace network packets based on target port, insert module with target port.
Example insmod netpktlog.ko netpktlog=@,254

---

---

---

---

 linux-2.6.8-rc4-prasanna/drivers/net/Kconfig                    |   12 
 linux-2.6.8-rc4-prasanna/drivers/net/Makefile                   |    3 
 linux-2.6.8-rc4-prasanna/include/linux/netfilter_ipv4/ipt_LOG.h |    2 
 linux-2.6.8-rc4-prasanna/kernel/kallsyms.c                      |    1 
 linux-2.6.8-rc4-prasanna/net/ipv4/netfilter/ipt_LOG.c           |    3

---

 linux-2.6.8-rc4-prasanna/drivers/net/Kconfig                    |   12 
 linux-2.6.8-rc4-prasanna/drivers/net/Makefile                   |    3 
 linux-2.6.8-rc4-prasanna/drivers/net/netpktlog.c                |  204 ++++++++++
 linux-2.6.8-rc4-prasanna/include/linux/netfilter_ipv4/ipt_LOG.h |    2 
 linux-2.6.8-rc4-prasanna/include/linux/netpktlog.h              |  113 +++++
 linux-2.6.8-rc4-prasanna/kernel/kallsyms.c                      |    1 
 linux-2.6.8-rc4-prasanna/net/ipv4/netfilter/ipt_LOG.c           |    3 
 7 files changed, 337 insertions(+), 1 deletion(-)
drivers/net/Kconfig renamed from drivers/net/Kconfig~kprobes-netptk-tracer-268-rc4 +12 -0
diff -puN drivers/net/Kconfig~kprobes-netptk-tracer-268-rc4 drivers/net/Kconfig
@@ -2598,3 +2598,15 @@ config NETCONSOLE
 	If you want to log kernel messages over the network, enable this.
 	See Documentation/networking/netconsole.txt for details.
 
+config NETPKTLOG
+	tristate "Network packet Tracer using kernel probes(EXPERIMENTAL)"
+	depends on KPROBES && IP_NF_TARGET_LOG
+	---help---
+	Network packet tracering is achived using kernel probes allowing you
+	to see the network packets while moving up and down the stack. This
+	module uses kprobes mechanism which is highly efficient for dynamic
+	tracing.
+
+	See driver/net/netpktlog.c for details.
+	To compile this driver as a module, choose M.If unsure, say N.
+
drivers/net/Makefile renamed from drivers/net/Makefile~kprobes-netptk-tracer-268-rc4 +3 -0
diff -puN drivers/net/Makefile~kprobes-netptk-tracer-268-rc4 drivers/net/Makefile
@@ -191,3 +191,6 @@ obj-$(CONFIG_HAMRADIO) += hamradio/
 obj-$(CONFIG_IRDA) += irda/
 
 obj-$(CONFIG_NETCONSOLE) += netconsole.o
+ifeq ($(CONFIG_NETPKTLOG),y)
+ obj-m += netpktlog.o
+endif
drivers/net/netpktlog.c new file +204 -0

204 lines not on this page · raw message

include/linux/netfilter_ipv4/ipt_LOG.h renamed from include/linux/netfilter_ipv4/ipt_LOG.h~kprobes-netptk-tracer-268-rc4 +2 -0
diff -puN include/linux/netfilter_ipv4/ipt_LOG.h~kprobes-netptk-tracer-268-rc4 include/linux/netfilter_ipv4/ipt_LOG.h
@@ -11,5 +11,7 @@ struct ipt_log_info {
 	unsigned char logflags;
 	char prefix[30];
 };
+void dump_packet(const struct ipt_log_info *info, const struct sk_buff *skb,
+			unsigned int iphoff);
 
 #endif /*_IPT_LOG_H*/
include/linux/netpktlog.h new file +113 -0

113 lines not on this page · raw message

kernel/kallsyms.c renamed from kernel/kallsyms.c~kprobes-netptk-tracer-268-rc4 +1 -0
diff -puN kernel/kallsyms.c~kprobes-netptk-tracer-268-rc4 kernel/kallsyms.c
@@ -310,3 +310,4 @@ int __init kallsyms_init(void)
 __initcall(kallsyms_init);
 
 EXPORT_SYMBOL(__print_symbol);
+EXPORT_SYMBOL(kallsyms_lookup_name);
net/ipv4/netfilter/ipt_LOG.c renamed from net/ipv4/netfilter/ipt_LOG.c~kprobes-netptk-tracer-268-rc4 +2 -1
diff -puN net/ipv4/netfilter/ipt_LOG.c~kprobes-netptk-tracer-268-rc4 net/ipv4/netfilter/ipt_LOG.c
@@ -41,7 +41,7 @@ MODULE_PARM_DESC(nflog, "register as int
 static spinlock_t log_lock = SPIN_LOCK_UNLOCKED;
 
 /* One level of recursion won't kill us */
-static void dump_packet(const struct ipt_log_info *info,
+void dump_packet(const struct ipt_log_info *info,
 			const struct sk_buff *skb,
 			unsigned int iphoff)
 {

@@ -461,5 +461,6 @@ static void __exit fini(void)
 	ipt_unregister_target(&ipt_log_reg);
 }
 
+EXPORT_SYMBOL_GPL(dump_packet);
 module_init(init);
 module_exit(fini);

_

#2 lore raw

drivers/net/netpktlog.c line 33

Quoted 4 lines
drivers/net/netpktlog.c new file +4 -0
+static char config[256];
+static unsigned short src_port, tgt_port;
+module_param_string(netpktlog, config, 256, 0);
+MODULE_PARM_DESC(netpktlog, " netpktlog=@<source-port>,<target-port>\n");

It would be better to use the new style module_parm here, then it could be even modified from sysfs at runtime when you set suitable permissions.

drivers/net/netpktlog.c line 52

Quoted 8 lines

+ * with source port. Example insmod netpktlog.ko netpktlog=@62333,
+ * To trace network packets based on target port, insert module with
+ * target port. Example insmod netpktlog.ko netpktlog=@,254
+ */

drivers/net/netpktlog.c new file +4 -0
+
+static void jnetif_rx(struct sk_buff *skb)
+{
+	netfilter_ip(skb);

Are you sure this works? I'm not sure skb->nh.iph is initialized at this point. At this point you have to skip the ethernet header yourself.

drivers/net/netpktlog.c line 58

Quoted 3 lines
drivers/net/netpktlog.c new file +3 -0
+static void j__kfree_skb(struct sk_buff *skb)
+{
+	netfilter_ip(skb);

This may have the same problem depending on where it is called from. Should be unlikely enough though that it could be ignored.

drivers/net/netpktlog.c line 64

Quoted 6 lines
drivers/net/netpktlog.c new file +6 -0
+	jprobe_return();
+}
+
+static int jnetif_receive_skb(struct sk_buff *skb)
+{
+	netfilter_ip(skb);

This function only sets skb->nh.iph

include/linux/netpktlog.h line 33

Quoted 3 lines
include/linux/netpktlog.h new file +3 -0
+#include <net/udp.h>
+
+void tcp_send_dupack(struct sock *sk, struct sk_buff *skb);

This shouldn't be needed anymore, no?

Review

Quoted 2 lines
(quoted diff) +2 -0
+
+static inline void option_setup(char *opt)

[...] Not sure why you made these two functions inline?

-andi

author
#3 lore raw

Hi Andi,

Please find the updated patch below. The patch includes following updates as per your suggestions.

1. Module parameters can be modified at runtime using sysfs interface.
2. iph = (struct iphdr *)skb->data; is valid at few routines netif_rx, netif_receive_skb, ip_rcv, ip_local_deliver. Modified to dump packet header accordingly.
3. Other routines dump the network packet header from the skb->nh.iph, skb->h.th, skb->h.uh, skb->h.icmp.
4. IP/TCP header is not initialized at ip_queue_xmit() probe.

Please provide your comments.

Thanks
Prasanna

Signature · 12 lines
Prasanna S Panchamukhi
Linux Technology Center
India Software Labs, IBM Bangalore
Ph: 91-80-25044636
<[email protected]>

This patch  demonistrates network packet tracing for specific source and 
target ports.
Network packet tracing is achived using kernel probes allowing you
to see the network packets while moving up and down the stack. This
module uses kprobes mechanism which is highly efficient for dynamic
tracing.

---

 linux-2.6.8-rc4-prasanna/drivers/net/Kconfig                    |   12 
 linux-2.6.8-rc4-prasanna/drivers/net/Makefile                   |    3 
 linux-2.6.8-rc4-prasanna/include/linux/netfilter_ipv4/ipt_LOG.h |    2 
 linux-2.6.8-rc4-prasanna/kernel/kallsyms.c                      |    1 
 linux-2.6.8-rc4-prasanna/net/ipv4/netfilter/ipt_LOG.c           |    3

---

 linux-2.6.8-rc4-prasanna/drivers/net/Kconfig                    |   12 
 linux-2.6.8-rc4-prasanna/drivers/net/Makefile                   |    3 
 linux-2.6.8-rc4-prasanna/drivers/net/netpktlog.c                |  672 ++++++++++
 linux-2.6.8-rc4-prasanna/include/linux/netfilter_ipv4/ipt_LOG.h |    2 
 linux-2.6.8-rc4-prasanna/kernel/kallsyms.c                      |    1 
 linux-2.6.8-rc4-prasanna/net/ipv4/netfilter/ipt_LOG.c           |    3 
 6 files changed, 692 insertions(+), 1 deletion(-)
drivers/net/Kconfig renamed from drivers/net/Kconfig~kprobes-netpkt-tracer-268-rc4 +12 -0
diff -puN drivers/net/Kconfig~kprobes-netpkt-tracer-268-rc4 drivers/net/Kconfig
@@ -2598,3 +2598,15 @@ config NETCONSOLE
 	If you want to log kernel messages over the network, enable this.
 	See Documentation/networking/netconsole.txt for details.
 
+config NETPKTLOG
+	tristate "Network packet Tracer using kernel probes(EXPERIMENTAL)"
+	depends on KPROBES && IP_NF_TARGET_LOG
+	---help---
+	Network packet tracing is achived using kernel probes allowing you
+	to see the network packets while moving up and down the stack. This
+	module uses kprobes mechanism which is highly efficient for dynamic
+	tracing.
+
+	See driver/net/netpktlog.c for details.
+	To compile this driver as a module, choose M.If unsure, say N.
+
drivers/net/Makefile renamed from drivers/net/Makefile~kprobes-netpkt-tracer-268-rc4 +3 -0
diff -puN drivers/net/Makefile~kprobes-netpkt-tracer-268-rc4 drivers/net/Makefile
@@ -191,3 +191,6 @@ obj-$(CONFIG_HAMRADIO) += hamradio/
 obj-$(CONFIG_IRDA) += irda/
 
 obj-$(CONFIG_NETCONSOLE) += netconsole.o
+ifeq ($(CONFIG_NETPKTLOG),y)
+ obj-m += netpktlog.o
+endif
drivers/net/netpktlog.c new file +672 -0

672 lines not on this page · raw message

include/linux/netfilter_ipv4/ipt_LOG.h renamed from include/linux/netfilter_ipv4/ipt_LOG.h~kprobes-netpkt-tracer-268-rc4 +2 -0
diff -puN include/linux/netfilter_ipv4/ipt_LOG.h~kprobes-netpkt-tracer-268-rc4 include/linux/netfilter_ipv4/ipt_LOG.h
@@ -11,5 +11,7 @@ struct ipt_log_info {
 	unsigned char logflags;
 	char prefix[30];
 };
+void dump_packet(const struct ipt_log_info *info, const struct sk_buff *skb,
+			unsigned int iphoff);
 
 #endif /*_IPT_LOG_H*/
kernel/kallsyms.c renamed from kernel/kallsyms.c~kprobes-netpkt-tracer-268-rc4 +1 -0
diff -puN kernel/kallsyms.c~kprobes-netpkt-tracer-268-rc4 kernel/kallsyms.c
@@ -310,3 +310,4 @@ int __init kallsyms_init(void)
 __initcall(kallsyms_init);
 
 EXPORT_SYMBOL(__print_symbol);
+EXPORT_SYMBOL(kallsyms_lookup_name);
net/ipv4/netfilter/ipt_LOG.c renamed from net/ipv4/netfilter/ipt_LOG.c~kprobes-netpkt-tracer-268-rc4 +2 -1
diff -puN net/ipv4/netfilter/ipt_LOG.c~kprobes-netpkt-tracer-268-rc4 net/ipv4/netfilter/ipt_LOG.c
@@ -41,7 +41,7 @@ MODULE_PARM_DESC(nflog, "register as int
 static spinlock_t log_lock = SPIN_LOCK_UNLOCKED;
 
 /* One level of recursion won't kill us */
-static void dump_packet(const struct ipt_log_info *info,
+void dump_packet(const struct ipt_log_info *info,
 			const struct sk_buff *skb,
 			unsigned int iphoff)
 {

@@ -461,5 +461,6 @@ static void __exit fini(void)
 	ipt_unregister_target(&ipt_log_reg);
 }
 
+EXPORT_SYMBOL_GPL(dump_packet);
 module_init(init);
 module_exit(fini);

_