search

iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.36k stars 3.86k forks source link

libbpf-tools: Fix bindsnoop for kernel v6.6+ #4846

Closed chenhengqi closed 9 months ago

chenhengqi commented 9 months ago

The freebind field in struct inet_sock gone in recent kernel versions due to some kernel refactor works (0). The change breaks the bindsnoop tool. Fix it in a CO-RE way.

This should close #4838.

chenhengqi commented 9 months ago

@akanksha216 Could you help testing this PR ? Thanks.

akanksha216 commented 9 months ago

@chenhengqi Thanks for the fix. I have tested on powerpc platform with kernel 6.7.0-rc6. The patch seems to be resolving the earlier 18 make errors. But seeing the below make error now.

bindsnoop.bpf.c:90:37: error: call to undeclared function 'get_inet_sock_freebind'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 90 | opts.fields.freebind = get_inet_sock_freebind(inet_sock); | ^ bindsnoop.bpf.c:91:37: error: call to undeclared function 'get_inet_sock_transparent'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 91 | opts.fields.transparent = get_inet_sock_transparent(inet_sock); | ^ bindsnoop.bpf.c:92:37: error: call to undeclared function 'get_inet_sock_bind_address_no_port'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 92 | opts.fields.bind_address_no_port = get_inet_sock_bind_address_no_port(inet_sock); | ^ 3 errors generated. make: *** [Makefile:202: /root/bcc/libbpf-tools/.output/bindsnoop.bpf.o] Error 1 make.txt

chenhengqi commented 9 months ago

@akanksha216 Did you include core_fixes.bpf.h ?

akanksha216 commented 9 months ago

Somehow the core_fixes.bpf.h change wasn't applied earlier. Tested again with both the file changes and its working now. Thanks for the fix.

make_output.txt