Skip to content

Commit

Permalink
feat: support return args
Browse files Browse the repository at this point in the history
  • Loading branch information
jim3ma committed Dec 6, 2024
1 parent 7835657 commit afbb698
Show file tree
Hide file tree
Showing 2 changed files with 40 additions and 24 deletions.
23 changes: 19 additions & 4 deletions main.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ package main
import (
"embed"
"fmt"
"io/ioutil"
"io"
"log"
"os"
"path/filepath"
Expand Down Expand Up @@ -72,7 +72,22 @@ func (t Target) Arg(i int) string {
return fmt.Sprintf("reg(\"%s\")", regs[i])
}

return fmt.Sprintf("sarg%d", i)
// FIX: WARNING: sarg* is deprecated and will be removed in the future. Use *(reg("sp") + <stack_offset>) instead.
return fmt.Sprintf(`*(reg("sp") + %d)`, 8*(i+1))
}

// RetArg maps return argument indices to bpftrace built-ins taking into account which ABI
// is in use
func (t Target) RetArg(i, offset int) string {
if t.RegsABI {
// rax, rbx, rcx, rdi, rsi, r8, r9, r10, r11 should do
if i < 0 || i >= len(regs) {
panic("argument out of bounds. roll your own")
}
return fmt.Sprintf("reg(\"%s\")", regs[i])
}

return fmt.Sprintf(`*(reg("sp") + %d)`, 8*(i+1+offset))
}

func NewTarget(exe string, arguments func(string) []string) (*Target, error) {
Expand Down Expand Up @@ -128,14 +143,14 @@ func main() {
log.Fatal(err)
}

scriptTemplate, err := ioutil.ReadFile(scriptFile)
scriptTemplate, err := os.ReadFile(scriptFile)
if err != nil {
// try embedded files
f, err1 := templates.Open(scriptFile)
if err1 != nil {
log.Fatalf("failed to open %s on filesystem: (%s), tried embedded files got %s", scriptFile, err, err1)
}
scriptTemplate, err = ioutil.ReadAll(f)
scriptTemplate, err = io.ReadAll(f)
if err != nil {
panic(err)
}
Expand Down
41 changes: 21 additions & 20 deletions templates/httpsnoop.bt
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@ struct url {
};

struct request {
uint8_t pad[16];
uint8_t *method;
int methodlen;
struct url *url;
};

Expand All @@ -28,45 +29,45 @@ uprobe:{{ .ExePath }}:runtime.execute {
}

tracepoint:sched:sched_process_exit {
delete(@rmethod[@gids[tid], pid]);
delete(@rscheme[@gids[tid], pid]);
delete(@rhost[@gids[tid], pid]);
delete(@rpath[@gids[tid], pid]);
{{ if not .RegsABI }}
delete(@addr[@gids[tid], pid]);
{{ end }}
delete(@gids[tid]);
}


uprobe:{{ .ExePath }}:"net/http.(*Client).do" {
$url = ((struct request *){{ .Arg 1 }})->url;
$request = ((struct request *){{ .Arg 1 }});
$url = $request->url;
$method = str($request->method, $request->methodlen);
$scheme = str($url->scheme, $url->schemelen);
$host = str($url->host, $url->hostlen);
$path = str($url->path, $url->pathlen);

@rmethod[@gids[tid], pid] = $method;
@rscheme[@gids[tid], pid] = $scheme;
@rhost[@gids[tid], pid] = $host;
@rpath[@gids[tid], pid] = $path;
}

{{ range $index, $r := $.SymbolReturns "net/http.(*Client).do" -}}
{{range $index, $r := $.SymbolReturns "net/http.(*Client).do" -}}
{{ if $index }}, {{ end }}
uprobe:{{ $.ExePath }}:"net/http.(*Client).do" + {{ $r -}}
{{ end }} {
{{ if $.RegsABI }}
$resp = (struct response *)reg("ax");
{{ else }}
@addr[@gids[tid], pid] = *(reg("sp") + 24);
$resp = (struct response *)@addr[@gids[tid], pid];
{{ end }}
$resp = (struct response *){{ .RetArg 0 2 }};

if ($resp == 0) {
printf("error %s://%s%s\n", @rscheme[@gids[tid], pid], @rhost[@gids[tid], pid], @rpath[@gids[tid], pid]);
printf("error %s %s://%s%s\n",
@rmethod[@gids[tid], pid],
@rscheme[@gids[tid], pid],
@rhost[@gids[tid], pid],
@rpath[@gids[tid], pid]);
} else {
printf("%d: %s://%s%s\n", $resp->statuscode, @rscheme[@gids[tid], pid], @rhost[@gids[tid], pid], @rpath[@gids[tid], pid]);
printf("%d: %s %s://%s%s\n",
$resp->statuscode,
@rmethod[@gids[tid], pid],
@rscheme[@gids[tid], pid],
@rhost[@gids[tid], pid],
@rpath[@gids[tid], pid]);
}
print(ustack());
}




0 comments on commit afbb698

Please sign in to comment.