xh4n3 · July 7, 2022 02:39 · xh4n3 · Jul 7, 2022
diff --git a/arp_announcement.bt b/arp_announcement.bt
 #!/usr/bin/env bpftrace
 /*
 * arp_announcement traces inetdev_event/br_handle_frame/br_set_state.
 * 
 * Background:
 * 1. This script addresses https://github.com/containernetworking/plugins/issues/756
 * 2. br state definitions at https://github.com/torvalds/linux/blob/v4.19/include/uapi/linux/if_bridge.h#L49-L53
 * 3. inetdev_event event type definitions at https://github.com/torvalds/linux/blob/v4.19/include/linux/netdevice.h#L2413-L2450
 * 
 * Usage:
 * arp_announcement.bt
 */

 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/ip.h>
 #include <uapi/linux/if_ether.h>

 struct net_bridge_port {
 	struct net_bridge		*br;
 	struct net_device		*dev;

 	struct list_head		list;
 	unsigned long			flags;
 	struct net_bridge_vlan_group	__rcu *vlgrp;
 	struct net_bridge_port		__rcu *backup_port;

 	u8				priority;
 	u8				state;
 }

 struct net_bridge {
 	spinlock_t			lock;
 	spinlock_t			hash_lock;
 	struct list_head		port_list;
 	struct net_device		*dev;
 }

 kprobe:inetdev_event {
 	time("%H:%M:%S ");
 	$event = (arg1);
 	$info = (struct netdev_notifier_info *)(arg2);
 	$dev = $info->dev;
 	printf("inetdev_event   triggered: ");
 	printf("dev_ifindex %d", $dev->ifindex);
 	printf("\t");
 	printf("event_type %d", $event);
 	printf("\n");
 }

 kprobe:br_handle_frame {
 	time("%H:%M:%S ");
 	$skb = (struct sk_buff *)(*arg0);
 	printf("br_handle_frame triggered: ");
 	printf("dev_ifindex %d", $skb->dev->ifindex);
 	printf("\t");
 	$hdr = (struct ethhdr *)($skb->head + $skb->mac_header);
 	printf("source_mac %r", buf($hdr->h_source));
 	printf("\t");
 	printf("dest_mac %r", buf($hdr->h_dest));
 	printf("\t");
 	$brp = (struct net_bridge_port *) ($skb->dev->rx_handler_data);
 	printf("bridge_port_state %d", $brp->state);
 	printf("\t");
 	$br = $brp->br;
 	printf("bridge_ifindex %d", $br->dev->ifindex);
 	printf("\n");
 }

 kprobe:br_set_state {
 	time("%H:%M:%S ");
 	$port = (struct net_bridge_port *)(arg0);
 	$state = (arg1);
 	printf("br_set_state    triggered: ");
 	printf("dev_ifindex %d", $port->dev->ifindex);
 	printf("\t");
 	printf("new_state %d", $state);
 	printf("\n");
 }
	#!/usr/bin/env bpftrace
	/*
	* arp_announcement traces inetdev_event/br_handle_frame/br_set_state.
	*
	* Background:
	* 1. This script addresses https://github.com/containernetworking/plugins/issues/756
	* 2. br state definitions at https://github.com/torvalds/linux/blob/v4.19/include/uapi/linux/if_bridge.h#L49-L53
	* 3. inetdev_event event type definitions at https://github.com/torvalds/linux/blob/v4.19/include/linux/netdevice.h#L2413-L2450
	*
	* Usage:
	* arp_announcement.bt
	*/

	#include <linux/skbuff.h>
	#include <linux/netdevice.h>
	#include <linux/ip.h>
	#include <uapi/linux/if_ether.h>

	struct net_bridge_port {
	struct net_bridge *br;
	struct net_device *dev;

	struct list_head list;
	unsigned long flags;
	struct net_bridge_vlan_group __rcu *vlgrp;
	struct net_bridge_port __rcu *backup_port;

	u8 priority;
	u8 state;
	}

	struct net_bridge {
	spinlock_t lock;
	spinlock_t hash_lock;
	struct list_head port_list;
	struct net_device *dev;
	}

	kprobe:inetdev_event {
	time("%H:%M:%S ");
	$event = (arg1);
	$info = (struct netdev_notifier_info *)(arg2);
	$dev = $info->dev;
	printf("inetdev_event triggered: ");
	printf("dev_ifindex %d", $dev->ifindex);
	printf("\t");
	printf("event_type %d", $event);
	printf("\n");
	}

	kprobe:br_handle_frame {
	time("%H:%M:%S ");
	$skb = (struct sk_buff )(arg0);
	printf("br_handle_frame triggered: ");
	printf("dev_ifindex %d", $skb->dev->ifindex);
	printf("\t");
	$hdr = (struct ethhdr *)($skb->head + $skb->mac_header);
	printf("source_mac %r", buf($hdr->h_source));
	printf("\t");
	printf("dest_mac %r", buf($hdr->h_dest));
	printf("\t");
	$brp = (struct net_bridge_port *) ($skb->dev->rx_handler_data);
	printf("bridge_port_state %d", $brp->state);
	printf("\t");
	$br = $brp->br;
	printf("bridge_ifindex %d", $br->dev->ifindex);
	printf("\n");
	}

	kprobe:br_set_state {
	time("%H:%M:%S ");
	$port = (struct net_bridge_port *)(arg0);
	$state = (arg1);
	printf("br_set_state triggered: ");
	printf("dev_ifindex %d", $port->dev->ifindex);
	printf("\t");
	printf("new_state %d", $state);
	printf("\n");
	}