Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pwru fails to parse helper symbols when --filter-track-bpf-helpers #462

Open
jschwinger233 opened this issue Dec 4, 2024 · 2 comments · May be fixed by #477
Open

pwru fails to parse helper symbols when --filter-track-bpf-helpers #462

jschwinger233 opened this issue Dec 4, 2024 · 2 comments · May be fixed by #477
Labels
bug Something isn't working

Comments

@jschwinger233
Copy link
Member 

$ s pwru --filter-mark 0x78540a00  --filter-track-bpf-helpers        'dst host 10.244.1.136 and dst port 8080 and tcp[tcpflags]=tcp-syn' 
2024/12/05 02:12:02 Attaching kprobes (via kprobe-multi)...
1641 / 1641 [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
2024/12/05 02:12:02 Attached (ignored 0)
2024/12/05 02:12:02 Listening for events..
SKB                CPU PROCESS          NETNS      MARK/x        IFACE       PROTO  MTU   LEN   TUPLE FUNC
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00        0         0x0000 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) ip_local_out
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00        0         0x0000 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) __ip_local_out
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00        0         0x0800 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) nf_hook_slow
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00        0         0x0800 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) ip_output
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00  cilium_host:3   0x0800 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) nf_hook_slow
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00  cilium_host:3   0x0800 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) apparmor_ip_postroute
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00  cilium_host:3   0x0800 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) ip_finish_output
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00  cilium_host:3   0x0800 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) __ip_finish_output
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00  cilium_host:3   0x0800 1500  60    10.244.1.95:42104->10.244.1.136:8080(tcp) ip_finish_output2
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00  cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) __dev_queue_xmit
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c504061
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c50b871
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) skb_ensure_writable
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c50b871
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) skb_ensure_writable
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c50f791
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) skb_ensure_writable
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8b949921
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c50e041
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) skb_ensure_writable
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c50f791
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) skb_ensure_writable
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c50f791
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) skb_ensure_writable
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 0         cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8b94b981
0xffff9296e13e3ce8 5   ~um-envoy:491632 4026533895 78540a00  cilium_host:3   0x0800 1500  74    10.244.1.95:42104->10.244.1.136:8080(tcp) 0xffffffff8c502c21

The raw addresses are not expected.

git-bisect points to #455

It’s neither contributor’s nor reviewer's mistake; I’ll blame the missing CI test for not covering all scenarios.
@jschwinger233 jschwinger233 added the bug Something isn't working label Dec 4, 2024
@brb
Copy link
Member

brb commented Dec 5, 2024

missing CI test for not covering all scenarios.

Yeah, it's been in my head for quite a while 😬 Basically creating a netns, attaching some dummy BPF progs to one end, and then running pwru.

@jschwinger233
Copy link
Member Author

Or we can run a cilium 1.17 in lvh, pick several scenarios that most pwru features can be tested, such as l7-ipsec-pod-to-pod, bpf-nodeport, ...

@jschwinger233 jschwinger233 mentioned this issue Dec 14, 2024
Open
1 task
jschwinger233 added a commit to jschwinger233/pwru that referenced this issue Jan 3, 2025
@jschwinger233
Events from kprobe.multi have eventTypeKprobeMulti set in .type
51435e8 
Even with --backend kprobe-multi, pwru still uses kprobe for
--filter-track-bpf-helpers. This patch makes pwru capable of
distinguishing event types in order to adjust addressres for symbol
resolution.

Fixes: cilium#462

Signed-off-by: gray <[email protected]>
jschwinger233 added a commit to jschwinger233/pwru that referenced this issue Jan 3, 2025
@jschwinger233
Events from kprobe.multi have eventTypeKprobeMulti set in .type
1fee058 
Even with --backend kprobe-multi, pwru still uses kprobe for
--filter-track-bpf-helpers. This patch makes pwru capable of
distinguishing event types in order to adjust addressres for symbol
resolution.

Fixes: cilium#462

Signed-off-by: gray <[email protected]>
@jschwinger233 jschwinger233 linked a pull request Jan 3, 2025 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Events from kprobe.multi have eventTypeKprobeMulti set in .type jschwinger233/pwru
2 participants
@brb @jschwinger233