snowroll
commented
2 months ago +1
Open tongyuanww opened 3 months ago
snowroll
commented
2 months ago +1
drzraf
commented
2 weeks ago Same error (no Docker involved), Linux 6.8.0, Python bcc 0.29.1 (python3-bpfcc)
2024-10-18 16:48:32,131 MainProcess network.py:__init__ INFO Traffic dumps will be saved to dumps/
/virtual/main.c:84:145: error: expected expression
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:84:627: error: expected '}'
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:84:143: note: to match this '{'
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:84:21: error: initializing 'struct inet_sock *' with an expression of incompatible type 'typeof(struct sock)' (aka 'struct sock')
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/virtual/main.c:84:638: error: extraneous ')' before ';'
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:84:641: error: use of undeclared identifier '_val'
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:84:648: error: expected identifier or '('
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:84:652: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
| int
/virtual/main.c:84:658: error: extraneous closing brace ('}')
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:84:659: error: expected identifier or '('
84 | struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
| ^
/virtual/main.c:85:25: error: statement expression not allowed at file scope
85 | u32 daddr = bpf_ntohl(({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&sa_in->sin_addr.s_addr); _val; }));
| ^
/virtual/main.c:86:25: error: statement expression not allowed at file scope
86 | u32 saddr = bpf_ntohl(({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&inet->inet_saddr); _val; })); // FIXME: equal to 0?
| ^
/virtual/main.c:87:25: error: statement expression not allowed at file scope
87 | u16 sport = bpf_ntohs(({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&inet->inet_sport); _val; }));
| ^
/virtual/main.c:90:3: error: unknown type name 'tuple'
90 | tuple.saddr = saddr;
| ^
/virtual/main.c:90:8: error: expected identifier or '('
90 | tuple.saddr = saddr;
| ^
/virtual/main.c:91:3: error: unknown type name 'tuple'
91 | tuple.sport = sport;
| ^
/virtual/main.c:91:8: error: expected identifier or '('
91 | tuple.sport = sport;
| ^
/virtual/main.c:92:3: error: unknown type name 'tuple'
92 | tuple.daddr = daddr;
| ^
/virtual/main.c:92:8: error: expected identifier or '('
92 | tuple.daddr = daddr;
| ^
/virtual/main.c:93:3: error: unknown type name 'tuple'
93 | tuple.dport = dport;
| ^
fatal error: too many errors emitted, stopping now [-ferror-limit=]
20 errors generated.
Process MemoryDumper:
Traceback (most recent call last):
File "/usr/lib/python3.12/multiprocessing/process.py", line 314, in _bootstrap
self.run()
File "/usr/lib/python3.12/multiprocessing/process.py", line 108, in run
self._target(*self._args, **self._kwargs)
File "/x-ray-tls/src/dumper/handshake_detector.py", line 75, in run
bpf = setup_bpf(self.interface)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/x-ray-tls/src/dumper/bpf.py", line 40, in setup_bpf
bpf = BPF(src_file="src/dumper/handshake_detector.c", debug=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 479, in __init__
raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module b'src/dumper/handshake_detector.c'
fl42
commented
1 week ago Hello, Is your OS ubuntu 20.04? As of now, only Ubuntu 20.04 is supported as host OS.
drzraf
commented
1 week ago 24.04
What is actually distribution-specific? Kernel or specific user-space version?
The Docker image has been successfully created. The following is the information displayed：docker images REPOSITORY TAG IMAGE ID CREATED SIZE tls-traffic-analyzer latest 0e79c8df13a6 10 days ago 3.05GB I encountered an error while running the container. The following is the error message. I hope someone can answer it for me /virtual/main.c:84:145: error: expected expression struct inet_sock inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void ){ typeof(struct sock) _val; builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void ){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void ){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void )net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp); ^ /virtual/main.c:84:627: error: expected '}' struct inet_sock inet = ({ typeof(struct sock) _val; builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void ){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void ){ typeof(struct sock) _val; builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void )net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp); It appears to be a syntax error, but the file/virtual/main. c cannot be found Traceback (most recent call last): File "/usr/lib/python3.10/multiprocessing/process.py", line 314, in _bootstrap self.run() File "/usr/lib/python3.10/multiprocessing/process.py", line 108, in run self._target(self._args, **self._kwargs) File "/app/src/dumper/handshake_detector.py", line 75, in run bpf = setup_bpf(self.interface) File "/app/src/dumper/bpf.py", line 40, in setup_bpf bpf = BPF(src_file="src/dumper/handshake_detector.c", debug=False) File "/usr/lib/python3/dist-packages/bcc/init.py", line 479, in init raise Exception("Failed to compile BPF module %s" % (src_file or ""))
Exception: Failed to compile BPF module b'src/dumper/handshake_detector.c'
This is the final error message