How to print skb data

[liuhangbin]

When I read blog printing sk_buff data. I'm wondering if bpftrace could do that. So I tried with

#!/usr/bin/bpftrace

kprobe:kfree_skb
{
        $skb = (struct sk_buff*)arg0;
        $data = $skb->head + $skb->mac_header;

        $line = 0;
        unroll(10) {
                printf("%06d\t", $line);

                unroll(16) {
                        $c = *(uint8 *)$data;
                        printf("%02x ", $c);
                        $data += 1;
                }
                printf("\n");

                $line += 10;
        }
}

As bpf do not support while loop with uncertain value, I just try to print the first 10 lines. But I only got values like

000000  02 02 03 04 05 06 07 00 09 00 0b 0c 0d 0e 0f ff
000010  13 ff 15 16 17 18 19 1a 1b 1c 1d 00 1f 20 21 22
000020  25 26 27 11 29 2a 2b 2c 2d 2e 2f 30 31 ff 33 34
000030  37 38 39 3a 3b b7 3d 3e 3f 40 41 42 43 44 45 8a
000040  49 4a 4b 4c 4d 4e 4f 67 51 52 53 54 55 56 57 58
...

Is there anything I did wrong?

Thanks
Hangbin

[fbs]

The nice way would be #1272 as it handles the magic for you but this code should work too.

On master this works, so at least the offset is calculated ok:

sudo ./src/bpftrace -e '
kfunc:tcp_v4_rcv {
  $data = args->skb->head + args->skb->mac_header;
  print(macaddr($data));
  print(macaddr($data + 6));
  exit(); 
}'
Attaching 1 probe...
02:10:F9:86:D4:BA
52:54:00:12:35:02

$ ip link sh enp0s3
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 02:10:f9:86:d4:ba brd ff:ff:ff:ff:ff:ff
$ ip neigh show $(ip route get 8.8.8.8 |cut -d ' ' -f3)
10.0.2.2 dev enp0s3 lladdr 52:54:00:12:35:02 REACHABLE

Note that its better to use the buf builtin:

$ sudo ./src/bpftrace -e '
kfunc:tcp_v4_rcv {
  $data = args->skb->head + args->skb->mac_header; 
  print(buf($data, 64));
  exit();
}'


Attaching 1 probe...
\x02\x10\xf9\x86\xd4\xbaRT\x00\x125\x02\x08\x00E\x00\x00Ly\xda\x00\x00@\x06\xe8\xc1\x0a\x00\x02\x02\x0a\x00\x02\x0f\xf6\xdc\x00\x16\xb6oT\x1b\xd7tu9P\x18\xff\xff\xdd\x14\x00\x00\xd1\x18\x95\xf1k7\x9b@@\x09

[liuhangbin]

The nice way would be #1272 as it handles the magic for you but this code should work too.

Ah, yes, that's exactly what I want.

Note that its better to use the buf builtin:

The buf building will convert values less than 256 to characters. This will corrupt the final output.

[fbs]

You can convert the output:

import sys

def chunks(lst, n):
    """Yield successive n-sized chunks from lst."""
    for i in range(0, len(lst), n):
        yield lst[i:i + n]

def hexy(d):
    def gen():
        for c in chunks(d, 2):
            yield "{:02x}{:02x}".format(ord(c[0]), ord(c[1]))
    return ' '.join(gen())

data = sys.stdin.buffer.read().decode('unicode-escape')

for i, d in enumerate(chunks(data, 16)):
    print("{:06x}: {}".format(i*16, hexy(d)))

sudo ./src/bpftrace -q -e 'kfunc:tcp_v4_rcv { $data = args->skb->head + args->skb->mac_header; print(buf($data, 64)); exit(); }' | tee | python3 ./hexdump.py
000000: 0210 f986 d4ba 5254 0012 3502 0800 4500
000010: 004c b9b1 0000 4006 a8ea 0a00 0202 0a00
000020: 020f f6dc 0016 b670 d363 d776 f99d 5018
000030: ffff 043e 0000 4b34 2a4e 68eb 4522 fb03
Traceback (most recent call last):

(yes it has an issue, but you can see the mac addr in there)

[liuhangbin]

Thanks for the workaround. Hope #1272 could be merged soon.