Re: How to get socket information for the socket tapset ?

[David Smith <dsmith at redhat dot com>]

On 01/23/2014 02:31 AM, Gregory Hosler wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I found the API documentation:
> 
> 	file:///usr/share/doc/systemtap-client-2.4/index.html
> 
> to be quite useful.
> 
> I have a question, however.
> 
> Chapter 14. Socket Tapset --> within the socket.routines() how do I access the
> socket ?
> 
> Specifically, within socket.receive() and socket.send() I want to know the
> source and destination addresses. If I can know the socket variable name, then
> I can get the addresses out of the socket header (ipmib_remote_addr /
> ipmib_local_addr, etc.)
> 
> Specifically, I am looking for the following:
> 
> 	for each incoming / outgoing packet:
> 
> 		source address
> 		destination address
> 		size
> 		local executable name
> 
> - From the examples directory:
> 
> 	/usr/share/doc/systemtap-client-2.4/examples/network/socktop
> 
> provides what I am looking for, minus the source/destination addresses (and uses
> the socket tapset library.
> 
> I have looked at the socket tapset code:
> 
> 	/usr/share/systemtap/tapset/linux/socket.stp
> 
> which lays on top of the 3 read/write routines, with the unfortunate situation
> that the socket variable is not the same for all 3 of the read (and
> similarily, write) routines.
> 
> Might there be an easy way around this ?

It depends on your definition of "easy". Here's a 'socket.send' probe
that figures out the source and destination addresses:

====
probe socket.send
{
    sock_addr = @choose_defined($sock, _get_sock_addr($iocb->ki_filp))
    saddr = format_ipaddr(__ip_sock_saddr(@cast(sock_addr, "socket",
"kernel")->sk),
			  __ip_sock_family(@cast(sock_addr, "socket", "kernel")->sk))
    daddr = format_ipaddr(__ip_sock_daddr(@cast(sock_addr, "socket",
"kernel")->sk),
			  __ip_sock_family(@cast(sock_addr, "socket", "kernel")->sk))
    printf("source: %s, dest: %s\n", saddr, daddr)
}
====

Basically, if $sock is defined, use it directly. Otherwise for
sock_aio_write, dig it out of the iocb.

Let me know if that isn't enough to get you going.

-- 
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)