eBPF 概述，第 5 部分：跟踪用户进程

$ tplist -l /usr/lib/libpython3.7m.so
b'/usr/lib/libpython3.7m.so' b'python':b'import__find__load__start'
b'/usr/lib/libpython3.7m.so' b'python':b'import__find__load__done'
b'/usr/lib/libpython3.7m.so' b'python':b'gc__start'
b'/usr/lib/libpython3.7m.so' b'python':b'gc__done'
b'/usr/lib/libpython3.7m.so' b'python':b'line'
b'/usr/lib/libpython3.7m.so' b'python':b'function__return'
b'/usr/lib/libpython3.7m.so' b'python':b'function__entry'

$ python -m http.server >/dev/null & sudo ./uflow -l python $!
[4] 11727
Tracing method calls in python process 11727... Ctrl-C to quit.
CPU PID    TID    TIME(us) METHOD
3   11740  11757  7.034           /usr/lib/python3.7/_weakrefset.py._remove
3   11740  11757  7.034     /usr/lib/python3.7/threading.py._acquire_restore
0   11740  11740  7.034               /usr/lib/python3.7/threading.py.__exit__
0   11740  11740  7.034             /usr/lib/python3.7/socketserver.py.service_actions
0   11740  11740  7.034     /usr/lib/python3.7/selectors.py.select
0   11740  11740  7.532     /usr/lib/python3.7/socketserver.py.service_actions
0   11740  11740  7.532

#!/usr/bin/env python
from bcc import BPF, USDT
import sys

bpf = """
#include <uapi/linux/ptrace.h>

static int strncmp(char *s1, char *s2, int size) {for (int i = 0; i < size; ++i)
        if (s1[i] != s2[i])
            return 1;
    return 0;
}

int trace_file_transfers(struct pt_regs *ctx) {
    uint64_t fnameptr;
    char fname[128]={0}, searchname[9]="copyfile";

    bpf_usdt_readarg(2, ctx, &fnameptr);
    bpf_probe_read(&fname, sizeof(fname), (void *)fnameptr);

    if (!strncmp(fname, searchname, sizeof(searchname)))
        bpf_trace_printk("Someone is transferring a file!\\n");
    return 0;
};
"""

u = USDT(pid=int(sys.argv[1]))
u.enable_probe(probe="function__entry", fn_name="trace_file_transfers")
b = BPF(text=bpf, usdt_contexts=[u])
while 1:
    try:
        (_, _, _, _, ts, msg) = b.trace_fields()
    except ValueError:
        continue
    print("%-18.9f %s" % (ts, msg))

$ python -m http.server >/dev/null & sudo ./trace_simplehttp.py $!
[14] 28682
34677.450520000    b'Someone is transferring a file!'

diff --git a/usr/lib/python3.7/http/server.py b/usr/lib/python3.7/http/server.py
index ca2dd50..af08e10 100644
--- a/usr/lib/python3.7/http/server.py
+++ b/usr/lib/python3.7/http/server.py
@@ -107,6 +107,13 @@ from functools import partial
 
 from http import HTTPStatus
 
+import stapsdt
+provider = stapsdt.Provider("simplehttp")
+probe = provider.add_probe("file_transfer",
+                           stapsdt.ArgTypes.uint64,
+                           stapsdt.ArgTypes.uint64,
+                           stapsdt.ArgTypes.uint32)+provider.load()
 
 # Default error message template
 DEFAULT_ERROR_MESSAGE = """\
@@ -650,6 +657,8 @@ class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
         f = self.send_head()
         if f:
             try:
+                path = self.translate_path(self.path)
+                probe.fire(self.address_string(), path, os.path.getsize(path))
                 self.copyfile(f, self.wfile)
             finally:
                 f.close()

$ python -m http.server >/dev/null 2>&1 & tplist -p $!
[1] 13297
b'/tmp/simplehttp-Q6SJDX.so' b'simplehttp':b'file_transfer'
b'/usr/lib/libpython3.7m.so.1.0' b'python':b'import__find__load__start'
b'/usr/lib/libpython3.7m.so.1.0' b'python':b'import__find__load__done'

 #!/usr/bin/env python2
 from bcc import BPF, USDT
 import sys

 bpf = """
 #include <uapi/linux/ptrace.h>

 BPF_PERF_OUTPUT(events);

 struct file_transf {char client_ip_str[20];
     char file_path[300];
     u32 file_size;
     u64 timestamp;
 };

 int trace_file_transfers(struct pt_regs *ctx, char *ipstrptr, char *pathptr, u32 file_size) {struct file_transf ft = {0};

     ft.file_size = file_size;
     ft.timestamp = bpf_ktime_get_ns();
     bpf_probe_read(&ft.client_ip_str, sizeof(ft.client_ip_str), (void *)ipstrptr);
     bpf_probe_read(&ft.file_path, sizeof(ft.file_path), (void *)pathptr);

     events.perf_submit(ctx, &ft, sizeof(ft));
     return 0;
 };
 """

 def print_event(cpu, data, size):
     event = b["events"].event(data)
     print("{0}: {1} is downloding file {2} ({3} bytes)".format(event.timestamp, event.client_ip_str, event.file_path, event.file_size))

 u = USDT(pid=int(sys.argv[1]))
 u.enable_probe(probe="file_transfer", fn_name="trace_file_transfers")
 b = BPF(text=bpf, usdt_contexts=[u])
 b["events"].open_perf_buffer(print_event)

 while 1:
     try:
         b.perf_buffer_poll()
     except KeyboardInterrupt:
         exit()

$ python -m http.server >/dev/null 2>&1 & sudo ./trace_stapsdt.py $!
[1] 5613
325540469950102: 127.0.0.1 is downloading file /home/adi/ (4096 bytes)
325543319100447: 127.0.0.1 is downloading file /home/adi/.bashrc (827 bytes)
325552448306918: 127.0.0.1 is downloading file /home/adi/workspace/ (4096 bytes)
325563646387008: 127.0.0.1 is downloading file /home/adi/workspace/work.tar (112640 bytes)
(...)

$ file /usr/lib/libc-2.28.so
/usr/lib/libc-2.28.so: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, (...), not stripped
$ nm -na /usr/lib/libc-2.28.so | grep -i -e getaddrinfo
0000000000000000 a getaddrinfo.c

b.attach_uprobe(name="c", sym="getaddrinfo", fn_name="do_entry", pid=args.pid)
b.attach_uretprobe(name="c", sym="getaddrinfo", fn_name="do_return", pid=args.pid)