ebpf_exporter

1
#include <vmlinux.h>
2
#include <bpf/bpf_tracing.h>
3
#include "maps.bpf.h"
4

5
#define MAX_ENTRIES 8192
6

7
// Type of tcp retransmits
8
#define RETRANSMIT 1
9
#define TLP 2
10

11
#define AF_INET 2
12
#define AF_INET6 10
13

14
#define UPPER_PORT_BOUND 32768
15

16
struct ipv4_key_t {
17
    u32 saddr;
18
    u32 daddr;
19
    u16 main_port;
20
    u8 type;
21
};
22

23
struct ipv6_key_t {
24
    u8 saddr[16];
25
    u8 daddr[16];
26
    u16 main_port;
27
    u8 type;
28
};
29

30
struct {
31
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
32
    __uint(max_entries, MAX_ENTRIES);
33
    __type(key, struct ipv4_key_t);
34
    __type(value, u64);
35
} tcp_retransmit_ipv4_packets_total SEC(".maps");
36

37
struct {
38
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
39
    __uint(max_entries, MAX_ENTRIES);
40
    __type(key, struct ipv6_key_t);
41
    __type(value, u64);
42
} tcp_retransmit_ipv6_packets_total SEC(".maps");
43

44
static int extract_main_port(const struct sock *sk)
45
{
46
    u16 sport = sk->__sk_common.skc_num;
47
    u16 dport = __builtin_bswap16(sk->__sk_common.skc_dport);
48

49
    if (sport > UPPER_PORT_BOUND && dport > UPPER_PORT_BOUND) {
50
        return 0;
51
    }
52

53
    if (sport < dport) {
54
        return sport;
55
    }
56

57
    return dport;
58
}
59

60
#define TRACE_PROTOCOL(key_type, map, ip_extractor)                                                                    \
61
    key_type key = {};                                                                                                 \
62
                                                                                                                       \
63
    key.type = type;                                                                                                   \
64
    key.main_port = extract_main_port(sk);                                                                             \
65
                                                                                                                       \
66
    ip_extractor;                                                                                                      \
67
                                                                                                                       \
68
    increment_map(map, &key, 1);                                                                                       \
69
                                                                                                                       \
70
    return 0;
71

72
static int trace_ipv4(const struct sock *sk, u8 type)
73
{
74
    TRACE_PROTOCOL(struct ipv4_key_t, &tcp_retransmit_ipv4_packets_total, {
75
        key.saddr = sk->__sk_common.skc_rcv_saddr;
76
        key.daddr = sk->__sk_common.skc_daddr;
77
    });
78
}
79

80
static int trace_ipv6(const struct sock *sk, u8 type)
81
{
82
    TRACE_PROTOCOL(struct ipv6_key_t, &tcp_retransmit_ipv6_packets_total, {
83
        bpf_probe_read_kernel(&key.saddr, sizeof(key.saddr), sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
84
        bpf_probe_read_kernel(&key.daddr, sizeof(key.daddr), sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32);
85
    });
86
}
87

88
static int trace_event(const struct sock *sk, u8 type)
89
{
90
    switch (sk->__sk_common.skc_family) {
91
    case AF_INET:
92
        return trace_ipv4(sk, type);
93
    case AF_INET6:
94
        return trace_ipv6(sk, type);
95
    }
96

97
    return 0;
98
}
99

100
SEC("fentry/tcp_send_loss_probe")
101
int BPF_PROG(tcp_send_loss_probe, struct sock *sk)
102
{
103
    return trace_event(sk, TLP);
104
}
105

106
SEC("fentry/tcp_retransmit_skb")
107
int BPF_PROG(tcp_retransmit_skb, struct sock *sk)
108
{
109
    return trace_event(sk, RETRANSMIT);
110
}
111

112
char LICENSE[] SEC("license") = "GPL";
113