feat: dae trace

[jschwinger233]

Background

This PR adds new subcommand dae trace to observe skb on the system.

dae $ ./dae trace -h
To trace traffic

Usage:
  dae trace [flags]

Flags:
  -h, --help              help for trace
  -4, --ipv4              Capture IPv4 traffic
  -6, --ipv6              Capture IPv6 traffic
  -p, --l4-proto string   Layer 4 protocol (default "tcp")
  -o, --output string     Output file (default "/dev/stdout")
  -P, --port int          Port (default 80)

For example, running dae trace -4 -p tcp -P 233 gives:

dae $ sudo ./dae trace -4 -p tcp -P 80
attaching kprobes: 1704/1704
start tracing
ffff92132a71d8e8 mark=0 netns=4026531840 if=0() proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=65476 ip_local_out
ffff92132a71d8e8 mark=0 netns=4026531840 if=0() proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=65476 __ip_local_out
ffff92132a71d8e8 mark=0 netns=4026531840 if=0() proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 nf_hook_slow
ffff92132a71d8e8 mark=0 netns=4026531840 if=0() proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 ip_output
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 nf_hook_slow
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 apparmor_ip_postroute
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 ip_finish_output
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 __ip_finish_output
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 ip_finish_output2
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 __dev_queue_xmit
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 qdisc_pkt_len_init
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 netdev_core_pick_tx
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 sch_direct_xmit
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 validate_xmit_skb_list
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 validate_xmit_skb
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 netif_skb_features
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 passthru_features_check
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 skb_network_protocol
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 skb_csum_hwoffload_help
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 validate_xmit_xfrm
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 dev_hard_start_xmit
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=141081(curl) 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 skb_clone_tx_timestamp
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=0() 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 dev_kfree_skb_any_reason
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=0() 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 kfree_skb_reason(SKB_CONSUMED)
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=0() 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 skb_release_head_state
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=0() 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 tcp_wfree
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=0() 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 skb_release_data
ffff92132a71d8e8 mark=0 netns=4026531840 if=2(enp0s31f6) proc=0() 10.0.0.6:47812 > 1.1.1.1:80 tcp_flags=S payload_len=0 kfree_skbmem

Notes:

1. The binary size has increased less than 1M, so I presume it's acceptable.
2. trace.c has to be compiled with specific arch instead of general bpf, so dae trace only supports some arch:

Supported targets:
	386
	amd64
	arm
	arm64
	arm64be
	armbe
	ppc64
	ppc64le
	riscv64
	s390
	s390x
	sparc
	sparc64

Outstanding issues:

• Output to a file
• Add new bpf header to https://github.com/daeuniverse/dae_bpf_headers: Bump libbpf version: v1.3.0 dae_bpf_headers#1

Checklist

• The Pull Request has been fully tested
• There's an entry in the CHANGELOGS
• There is a user-facing docs PR against https://github.com/daeuniverse/dae

Full Changelogs

• [Implement ...]

Issue Reference

Closes #[issue number]

Test Result

[mzz2017]

-v is confusing (verbose/version). Can we use -4 and -6?

[jschwinger233]

Mark "Ready for review" to trigger PR build.

[mzz2017]

This work is owesome!

[sumire88]

@jschwinger233 thanks for your amazing work. Has this new feature been tested yet?

[dae-prow]

🧪 Since the PR has been fully tested, please consider merging it.

[sumire88]

All good, let's proceed.

[douglarek]

A very interesting feature! Regarding the Go environment variable GOARCH, is that it is not automatically injected for the 'make' command. Would it be better to default to 'go env GOARCH' in 'make' if the user has not set it explicitly?