ebpf: tcp retransmits tracing - kernel versions 5.12+ support

Author: apetruhin

ebpftracer/Dockerfile

@@ -8,8 +8,10 @@ WORKDIR /tmp
 RUN clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -D__KERNEL=416 -c ebpf.c -o ebpf416.o && llvm-strip --strip-debug ebpf416.o
 RUN clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -D__KERNEL=420 -c ebpf.c -o ebpf420.o && llvm-strip --strip-debug ebpf420.o
 RUN clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -D__KERNEL=506 -c ebpf.c -o ebpf506.o && llvm-strip --strip-debug ebpf506.o
+RUN clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -D__KERNEL=512 -c ebpf.c -o ebpf512.o && llvm-strip --strip-debug ebpf512.o
 
 RUN echo -en '// generated - do not edit\npackage ebpftracer\nvar ebpfProg = []struct{v string; p []byte}{\n' > ebpf.go \
+	&& echo -en '\t{"v5.12", []byte("' >> ebpf.go && hexdump -v -e '"\x" 1/1 "%02x"' ebpf512.o >> ebpf.go && echo '")},' >> ebpf.go \
 	&& echo -en '\t{"v5.6", []byte("' >> ebpf.go && hexdump -v -e '"\x" 1/1 "%02x"' ebpf506.o >> ebpf.go && echo '")},' >> ebpf.go \
 	&& echo -en '\t{"v4.20", []byte("' >> ebpf.go && hexdump -v -e '"\x" 1/1 "%02x"' ebpf420.o >> ebpf.go && echo '")},' >> ebpf.go \
 	&& echo -en '\t{"v4.16", []byte("' >> ebpf.go && hexdump -v -e '"\x" 1/1 "%02x"' ebpf416.o >> ebpf.go && echo '")},' >> ebpf.go \

ebpftracer/Makefile

@@ -4,7 +4,7 @@ build:
 	docker cp $(shell docker create --rm ebpftracer):/tmp/ebpf.go ./ebpf.go
 	@echo
 
-test: test_vm1 test_vm2 test_vm3
+test: test_vm1 test_vm2 test_vm3 test_vm4
 
 define test_in_vm
 	@echo ===TESTING IN $(1)===
@@ -21,6 +21,9 @@ test_vm2: build
 test_vm3: build
 	$(call test_in_vm,ubuntu2010)
 
+test_vm4: build
+	$(call test_in_vm,ubuntu2110)
+
 vms_start:
 	vagrant up
 

ebpftracer/Vagrantfile

@@ -28,4 +28,7 @@ Vagrant.configure("2") do |config|
 	config.vm.define "ubuntu2010" do |ubuntu2010|
 		ubuntu2010.vm.box = "generic/ubuntu2010"
     end
+    config.vm.define "ubuntu2110" do |ubuntu2110|
+        ubuntu2110.vm.box = "generic/ubuntu2110"
+    end
 end

ebpftracer/ebpf.go

@@ -13,6 +13,9 @@ struct trace_event_raw_tcp_event_sk_skb__stub {
 #endif
 	__u16 sport;
 	__u16 dport;
+#if __KERNEL >= 512
+	__u16 family;
+#endif
 	__u8 saddr[4];
 	__u8 daddr[4];
 	__u8 saddr_v6[16];

ebpftracer/ebpf/tcp_retransmit.c

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"github.com/containerd/cgroups"
+	cgroupsV2 "github.com/containerd/cgroups/v2"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -71,14 +72,24 @@ func TestProcessEvents(t *testing.T) {
 	assert.Equal(t, Event{Type: EventTypeProcessExit, Pid: uint32(p2.Process.Pid)}, *getEvent())
 
 	var limit int64 = 200 * 1024 * 1024
-	control, err := cgroups.New(cgroups.V1, cgroups.StaticPath("/program"), &specs.LinuxResources{
-		Memory: &specs.LinuxMemory{Limit: &limit},
-	})
-	require.NoError(t, err)
-	defer control.Delete()
 	// p3 should be killed by the OOM killer, because 300 MB > 200 MB cgroup limit
-	p3 := exec.Command("cgexec", "-g", "memory:program", program, "300", "1s")
-	require.Error(t, p3.Run())
+	p3 := exec.Command(program, "300", "3s")
+	require.NoError(t, p3.Start())
+	switch cgroups.Mode() {
+	case cgroups.Legacy, cgroups.Hybrid:
+		control, err := cgroups.New(cgroups.V1, cgroups.StaticPath("/program"), &specs.LinuxResources{
+			Memory: &specs.LinuxMemory{Limit: &limit},
+		})
+		require.NoError(t, err)
+		defer control.Delete()
+		require.NoError(t, control.Add(cgroups.Process{Pid: p3.Process.Pid}))
+	case cgroups.Unified:
+		control, err := cgroupsV2.NewManager("/sys/fs/cgroup", "/program", &cgroupsV2.Resources{Memory: &cgroupsV2.Memory{Max: &limit}})
+		require.NoError(t, err)
+		defer control.Delete()
+		require.NoError(t, control.AddProc(uint64(p3.Process.Pid)))
+	}
+	require.Error(t, p3.Wait())
 	assert.Equal(t, Event{Type: EventTypeProcessStart, Pid: uint32(p3.Process.Pid)}, *getEvent())
 	assert.Equal(t, Event{Type: EventTypeProcessExit, Reason: EventReasonOOMKill, Pid: uint32(p3.Process.Pid)}, *getEvent())