SOCKETLAT_SENDSLOW 源端口大小端转换问题

static always_inline void set_tuple_sock(struct sock sk, struct tuple tpl) { short unsigned int skc_family; skc_family = BPF_CORE_READ(sk, __sk_common.skc_family); if (skc_family == PF_INET6) { // TODO: add v6 sock support tpl->l3_proto = ETH_P_IPV6; } else { bpf_probe_read(&tpl->saddr, sizeof(tpl->saddr.v4addr), &sk->sk_common.skc_rcv_saddr); bpf_probe_read(&tpl->daddr, sizeof(tpl->daddr.v4addr), &sk->__sk_common.skc_daddr); tpl->l3_proto = ETH_P_IP; }

tpl->sport = BPF_CORE_READ(sk, sk_common.skc_num); tpl->dport = BPF_CORE_READ(sk, sk_common.skc_dport); tpl->l4_proto = get_sock_protocol(sk); ; } 源目的端口的字段类型是 struct { __be16 skc_dport; __u16 skc_num; }; 用户态程序对源目的端口都进行了 bits.ReverseBytes16 转换 tuple := fmt.Sprintf("protocol=%s saddr=%s sport=%d daddr=%s dport=%d ", bpfutil.GetProtoStr(event.Tuple.L4Proto), bpfutil.GetAddrStr(event.Tuple.L3Proto, ([16]byte)(unsafe.Pointer(&event.Tuple.Saddr))), bits.ReverseBytes16(event.Tuple.Sport), bpfutil.GetAddrStr(event.Tuple.L3Proto, ([16]byte)(unsafe.Pointer(&event.Tuple.Daddr))), bits.ReverseBytes16(event.Tuple.Dport))

从而导致event日志事件，获取的目的端口是正确的，源端口是错误的

alibaba / kubeskoop

SOCKETLAT_SENDSLOW 源端口大小端转换问题 #306